Sanctir L1
A small drone that flies a route loaded before launch, with no radio link. When its battery runs low it lands, recharges from its own solar panels, takes off again and continues. At the end of the route it flies home, and the operator picks it up and downloads the data.
Two designs, one flight system
The L1-Q quadcopter and the L1-W fixed-wing VTOL, plus the L1-H hexacopter for power-line inspection. Complete allied-sourced parts lists, energy budgets, compliance and the flight software. The L1-Q software has passed simulation; no L1 aircraft has been built or flown yet. CC BY 4.0 for documents and parts lists, Apache 2.0 for software.
L1 Charging Pod
A ground charging pod that lets a drone charge in about an hour instead of most of a day, plus a design for the drones’ own on-board solar charging. One radio-free pod serves every site, with plug-in solar and grid kits. Simulated and reviewed, not built. In simulation it charges both L1 aircraft safely at a new 9 A setting, but neither can use a pod as listed today: each needs a battery management board, a new landing camera and flight software that has not been written.
Two designs
There are two designs. The L1-Q is a quadcopter: compact, precise, short range. The L1-W is a fixed-wing VTOL (a "quadplane"): it takes off and lands like a helicopter but cruises on a wing, and covers about ten times the distance per day. Both use the same flight logic, the same electronics and the same allied-sourced supply chain. A third, heavier hexacopter, the L1-H, is included for utility power-line inspection.
| L1-Q: Quadcopter | L1-W: Fixed-wing VTOL | L1-H: Hexacopter (inspection) | |
|---|---|---|---|
| Best for | Small areas, tight landing spots | Long routes: lines, rivers, borders, ridgelines | Power-line and vegetation surveys |
| All-up weight | 3.7 kg | 5.0 kg | 5.2 kg |
| Size | 65 cm across | 2.2 m wingspan | 90 cm across |
| Cruise speed | 12 m/s (27 mph) | 18 m/s (40 mph) | 12 m/s (27 mph) |
| Cruise power | ~520 W | ~150 W | ~720 W |
| Flight per charge | ~12 min · ~9 km | ~34 min · ~36 km | ~13 min · ~9.5 km |
| Solar | 0.25 m², ~50 W | 0.45 m² on the wing, ~85 W | 0.20 m², ~40 W (optional) |
| Distance per day, real-world sun | ~6.5 km | ~68 km | ~3 km |
| Landing spot needed | ~1 m clear | ~3 m clear | ~1.5 m clear |
| Flight hardware cost (without optional items) | ~$4,700 | ~$6,100 | ~$5,200 |
| Flight software | Ready; passed simulation | Not yet written (port of L1-Q) | Ready (same as L1-Q) |
Figures are engineering estimates from each design's parts list and energy model, at 60% of nameplate solar yield. They will change with weather, terrain, payload and flight testing.
How it works
- Plan. The operator loads the route, a list of safe landing spots ("perches") along it, the recovery point, and the launch rules (daylight hours, temperature limits).
- Fly and collect. The drone flies the route and records imagery and sensor data to onboard storage. Nothing is transmitted.
- Decide to land. Every second it compares the energy left in the battery with the energy needed to reach the nearest perch, plus a safety margin. It lands while it can still make it, or at 30% battery regardless.
- Recharge. On the perch it shuts down everything but the flight controller and charges from its panels. Every 45 minutes it disconnects the panels briefly and reads the battery's resting voltage to keep its charge estimate honest. It will not charge below 0 °C or above 45 °C.
- Relaunch. When the battery is at 85% or more, it is daylight, the battery is warm enough, the aircraft is level and GPS is healthy, it takes off and resumes the route at the waypoint where it left off.
- Return. After the last waypoint it lands at the recovery point and stays down. The operator collects it and downloads the encrypted data.
The full design. The Sanctir L1 comes in two designs: a quadcopter for compact areas and tight landing spots, and a fixed-wing VTOL that takes off like a helicopter but cruises on a wing and covers about ten times the distance per day. The Design Reference explains how both work and why they differ, and includes complete allied-sourced parts lists with costs and weights, energy budgets, compliance, and downloads.
Downloads
- Design Reference (full design and parts lists)
- Charging Pod (design, L1 aircraft results, on-board solar, verification and downloads)
- Complete package (zip)
- Flight software v2.2.1 (zip)
- L1-Q parts list (xlsx)
- L1-W parts list (xlsx)
Flight software, verified in simulation
The L1’s flight logic runs on the flight controller as an ArduPilot Lua script, with a small program on the companion computer. Together they make the decision to land, run the charge cycle and relaunch. The L1-Q version has been run through the full cycle in ArduPilot’s software-in-the-loop simulator on Copter-4.5. The L1-W needs a port to ArduPilot’s QuadPlane firmware, which has not been written yet.
solar_hop.lua companion_agent.py README.md
How the software decides
The script runs on the flight controller as a state machine. In normal flight the autopilot flies its mission and the script watches the battery.
| State | What happens |
|---|---|
| FLY | The mission runs in AUTO. Each second the script estimates the energy needed to reach the nearest landing point with a margin. It diverts when that point is about to become unreachable, or at a fixed low charge regardless, and saves the waypoint index. |
| DIVERT | GUIDED flight at a set height above terrain to the nearest landing point the energy model says it can reach. If none is reachable it lands where it is. |
| LANDING | LAND until touchdown and automatic disarm. |
| CHARGING | Companion computer shut down; panel connected only while cell temperature is inside the charge window; a resting-voltage reading every 45 minutes resynchronises the state of charge. |
| CHECK | Before any take-off: temperature, tilt, daylight, launch window, GNSS fix, attitude health, pre-arm checks, mission audit, hop limits and the operator HOLD flag. |
| CLIMB | GUIDED take-off above the landing point, then AUTO from the saved waypoint. |
| PAUSED | A pilot or detect-and-avoid has the aircraft. The script waits and never fights the pilot; a manual landing sets HOLD. |
| DONE | Mission complete or operator stop. The pack is charge-managed and the aircraft never relaunches. |
Safety behaviour
No temperature reading, no charging and no launch. The charge relay stays open unless a cell temperature sensor reports a value inside the charge window. After a reboot the charge reading is treated as empty until a resting-voltage reading succeeds, because the flight controller’s counter resets to full at boot. Human intervention wins. Any mode change the script did not command pauses it, and a manual landing or a disarm during climb sets HOLD, which survives a power cycle until an operator clears it. The mission is audited at boot and before every launch: every navigation item must use an absolute or terrain altitude, and the last command must be a landing at the recovery point.
Flight-controller wiring
| FC output | Function | Hardware |
|---|---|---|
| AUX1 (RELAY1) | Companion power | Logic-level MOSFET load switch on the 5 V BEC output |
| AUX2 (RELAY2) | PV connect | DC solid-state relay in series with the panel positive lead, before the MPPT. ON = charging. RELAY2_DEFAULT 1 so the pack charges if the script is disabled |
| AUX3 (RELAY3) | Shutdown request | Direct to a companion GPIO (BCM 17 by default); FC AUX is 3.3 V logic |
| I2C | Pack monitor | INA228 with a shunt of at least 60 A, bidirectional (BATT_MONITOR 21) |
| I2C | PV monitor | INA226 on the panel side of the relay (BATT2_MONITOR 21) |
| I2C | Cell temperature | MCP9600 and thermocouple on the pack, TEMP1_SRC 3 (battery index), TEMP1_SRC_ID 1. In Copter-4.5 TEMP1_SRC 1 is ESC, not battery; with the wrong source every thermal protection is silently off |
| TELEM2 | Companion MAVLink | 921600 8N1, MAVLink2 |
The full parameter list, the operator flags (SCR_USER1–SCR_USER4) and the reasons behind each setting are in the README. Remote ID must be fitted and enabled as required by 14 CFR Part 89.
Mission rules
1. Every navigation item uses an absolute or terrain altitude, never a relative one. Copter re-sets HOME on every arm, so after a hop a relative altitude would be measured from the landing point. 2. The last command is a landing (NAV_LAND) at the recovery point, never RTL; the script detects mission completion from it. 3. Preplanned landing points go in LAND_PTS: flat, open sky, on ground or roofs you control, spaced so the nearest one is always well inside what a leg from the low-charge threshold can cover (about 1 km on the reference quad). 4. Launches happen only inside a daylight launch window, 08:00–13:00 local solar time by default.
Test sequence
Do not skip steps.
1. Simulation (SITL)
Run ArduPilot SITL on Copter-4.5 with the script in scripts/ and CFG.SITL_TEST = true, the README parameters, and a mission in absolute frame ending in NAV_LAND. Confirm the full cycle: divert, land, disarm, charge, resting-voltage read, take-off, resume at the saved waypoint, final landing, and “DONE: mission complete”. Reboot mid-charge and after completion, and confirm the behaviour the README describes.
2. Bench
Vehicle strapped down, propellers off, HOLD set. Confirm relay sequencing with a meter, that charging stops when the thermocouple is cooled or unplugged, and the HOP log message.
3. Tether, propellers on
Throttle failsafe on, a safety pilot, one hop. Take control once in each of DIVERT, LANDING and CLIMB: the script must pause and never fight the pilot. Land manually and confirm the script sets HOLD and does not relaunch, including after a power cycle.
4. Short mission
Two landing points, three legs, daylight, within visual line of sight, under 14 CFR Part 107 with a safety pilot. Only after that should operations beyond visual line of sight be planned, under the authorisation the regulations require.
Review record
Version 2 was reviewed against the Copter-4.5 sources and scripting bindings; ten findings were closed in v2.1. Version 2.1 was then run in ArduPilot SITL, which found three defects, closed in v2.2: the script exceeded ArduPilot’s 100-local-variable limit and never loaded; mission completion was never detected after the final landing; and the divert decision ignored distance. Version 2.2 passed in SITL on the unmodified file, with every divert reaching its landing point within 3–6 m on legs up to 737 m. The one remaining finding, that the no-progress guard did not survive a reboot, is closed in v2.2.1. The full record is in the README.
Known limits
The state-of-charge table is a generic NMC curve; replace it with a measured table for the actual cells. There is no wind check on the ground. A landing point under canopy, on a north slope or in dust may never reach the resume threshold. These and the rest are listed in the README.
It is not a flight-proven product. The flight software has been validated in simulation only, no L1 aircraft has been built or flown, and it comes with no warranty. The operator is responsible for airworthiness, for compliance with 14 CFR Parts 89 and 107 or the authorisation that applies, and for following the test sequence before any flight without a link. This is an open reference design, not affiliated with or endorsed by the ArduPilot project.
Discuss the design
Corrections, test results and questions about the design are welcome. Describe the situation in general terms first; use an encrypted channel for anything specific.