Page 1 of 2 12 LastLast
Results 1 to 10 of 12

Thread: FCSwitch4: Adding redundancy to the Flight Controller, the ultimate safety increase

  1. #1
    Pilot sircana's Avatar
    Join Date
    Mar 2011
    Posts
    1,163

    FCSwitch4: Adding redundancy to the Flight Controller, the ultimate safety increase

    Some months ago I introduced Astraeus Technologies, and the AT4-Switch, the first product of a whole new range of products aimed to increase the safety of UAS operations:
    http://fpvlab.com/forums/showthread....s-Technologies

    Now we are introducing the Astraeus Technologies FCSwitch4, a device that provides an ultimate level of safety to the operation of quadcopters, allowing redundancy in the most critical component: the Flight Controller.




    Being the first US company to get an FAA exemption, at Astraeus Aerial we focused on making our operation as safe as possible. As in full-size aircrafts, undoubtedly one of the best ways to increase safety is adding redundancy to the critical systems.

    Clearly, the most critical component in any multicopter is the Flight Controller. The technology used in these amazing devices was only military just a few years ago. Any Flight Controller has an incredible level of complexity, both at hardware and firmware levels. And the reality is that due to this complexity and the lack of maturity of such new technology, sometimes they fail. From the most simple ones up to others very expensive intended for professional use, you can find many reports (and some funny videos) in the web about fly-aways, flip-of-death and other malfunctions.

    While some fly-away videos can be quite funny to watch (especially when it happens over the ocean… ) this was a big concern for us when developing our UAS fleet at Astraeus Aerial, and we decided to use a second Flight Controller. But the problem was how to give the control at any time to this second flight controller, as when switching between both Flight Controllers you get all kind of wobbles and high speed oscillations, unacceptable for medium sized heavy UAS, and ultimately total loss of control and crashes. (Yes, we crashed quite a few times while developing the FCSwitch… ).

    The FCSwitch4 switches the motor outputs from two redundant Flight Controllers in a soft and controllable way. By using a PWM signal from any free RC channel, the pilot can at any time switch between two Flight Controllers. The proprietary algorithm allows for a smooth and safe transition, while responding to pilot inputs at any time.

    As the FCSwitch4 is totally independent from the two Flight Controllers, it’s not affected by firmware errors, GPS locks or sensors malfunction. In case of fly-away or any odd behavior from the active Flight Controller, the pilot switches to the second Flight Controller, recovering immediately the control of the quadcopter.

    We have been using it at Astraeus Aerial after extensive testing for the last 18 months, and several partners all around the globe have been impressed with its reliability after performing all kinds of crazy tests.

    You can find all the details about it in the Astraeus Technologies website:
    http://astraeustechnologies.com/inde...roller=product
    Last edited by sircana; 30th October 2015 at 04:59 AM.

  2. #2
    Co-Pilot doobie's Avatar
    Join Date
    Jan 2015
    Location
    ontario canada
    Posts
    1,525
    VERY INTERESTING
    flyin HIGH

  3. #3
    Pilot sircana's Avatar
    Join Date
    Mar 2011
    Posts
    1,163
    Just to show one application of the FCSwitch4, together with the AT 4-Switch (see details here: http://fpvlab.com/forums/showthread....dant-RC-system ) the below video demonstrates the two pilots operation we use at Astraeus Aerial, or what we call the Double Redundancy Command and Control System.

    Our flight safety protocol states that if the First Pilot at any time detects loss of control, he calls for “override” to the Second Pilot. Also, the Second Pilot can override the First Pilot if the aircraft looks out of control.

    In order to do this test, the First pilot is flying in manual mode, using Flight Controller 1. He could switch to Flight Controller 2 at any moment, but the purpose of this test was simulate a Flight Controller failure, so he keeps the Flight Controller Switch in position 1, and starts flying with odd attitudes.

    The Second Pilot has his transmitter with the Flight Controller Switch in position 2, and the Flight Mode switch in GPS position. He is observing the Aircraft, with the sticks centered, and the left finger in the switch that controls the AT 4-Switch. When he is asked to “override”, he flips the switch, and the AT 4-Switch installed on board gives the command to the RC receiver linked to his transmitter. As its transmitter is in Flight Controller 2 – GPS mode, the FC2 takes the control in GPS mode, stabilizing the aircraft.





    This is the most complex scenario, combining the FCSwitch4 (for switching between two Flight Controllers) and the AT 4-Switch (for switching between two independent RC links), in order to provide double redundancy.

    Obviously, in a single pilot scenario, the same pilot will switch to Flight Controller 2 if he detects any odd behavior from Flight Controller 1.

    I hope it makes sense… easier to show than to explain in writing…
    Last edited by sircana; 3rd November 2015 at 05:11 PM. Reason: syntax

  4. #4
    Navigator Beerwiser's Avatar
    Join Date
    Oct 2011
    Location
    Locked in then trunk of a car.
    Posts
    681
    So if your switch is the failure point then what? I assume it goes between the FC and ESC's.

  5. #5
    Pilot sircana's Avatar
    Join Date
    Mar 2011
    Posts
    1,163
    Quote Originally Posted by Beerwiser View Post
    So if your switch is the failure point then what? I assume it goes between the FC and ESC's.
    Yes, it goes between the FCs and the ESCs.

    The Flight Controller being the most critical component of any multicopter, and being proved that all of them can fail from time to time, we considered absolutely necessary making it redundant for our own professional use.

    I'm a firm believer in the KISS principle, but when you are talking about safety, the compromise between reducing the points of potential failure and adding redundancy wherever you can it's clear in my mind (Just as full size aircrafts do...).

    From this point, it's up to the engineers to develop systems that add safety while minimizing the chances of becoming an additional point of failure.

    In the case of the FCSwitch4, it only modifies the PWM signals to the ESCs during the change from one Flight Controller to the other. During normal operation (which is the standard as you should desire to never have to use it) the active Flight Controller PWM outputs are basically hardwired to the ESCs inputs.

  6. #6
    Navigator epic4me's Avatar
    Join Date
    Aug 2013
    Posts
    250
    Sistemas Paralelos...

  7. #7
    Pilot
    Join Date
    Mar 2011
    Location
    Battleground, WA
    Posts
    1,440
    What would be interesting would be a switch that monitors the model inside each FC and verifies it hasn't drifted too far from reality, comparing both sets of GPS/INS data and choosing the most accurate one possible.

    Not sure how many here have any experience with how most FCs/autopilots work, but basically there is a "perfect" model, or simulation, that is running on the autopilot. Then, as you make inputs, it reacts appropriately and the control loop tries to issue commands to make the actual model follow that simulation. This gives the PID loop something to compare against, or the "perfect answer" to the math problem.

    Soo...a software monitoring FC switch would be capable of detecting if a FC has drifted far away from reality and can choose the most accurate FC to fly the aircraft instead. There are lots of ways the simulation inside of a FC and reality can drift away, or apart. Excessive vibrations, excessive temperature changes, RF/EMI, and voltage fluctuations in general. In fact, this confusion between the simulation and the reality is what most often downs a multi-rotor, and I would venture to say a large amount of those crashes are due to excessive vibrations.

    Just my .02.
    Regarding "some" peoples thoughts about Trappy and the FAA and "the sky is falling":

    "Perspective. Time to recognize the root cause and not focus exclusively on a single case."


  8. #8
    Pilot sircana's Avatar
    Join Date
    Mar 2011
    Posts
    1,163
    Quote Originally Posted by philthyy View Post
    What would be interesting would be a switch that monitors the model inside each FC and verifies it hasn't drifted too far from reality, comparing both sets of GPS/INS data and choosing the most accurate one possible.

    Not sure how many here have any experience with how most FCs/autopilots work, but basically there is a "perfect" model, or simulation, that is running on the autopilot. Then, as you make inputs, it reacts appropriately and the control loop tries to issue commands to make the actual model follow that simulation. This gives the PID loop something to compare against, or the "perfect answer" to the math problem.

    Soo...a software monitoring FC switch would be capable of detecting if a FC has drifted far away from reality and can choose the most accurate FC to fly the aircraft instead. There are lots of ways the simulation inside of a FC and reality can drift away, or apart. Excessive vibrations, excessive temperature changes, RF/EMI, and voltage fluctuations in general. In fact, this confusion between the simulation and the reality is what most often downs a multi-rotor, and I would venture to say a large amount of those crashes are due to excessive vibrations.

    Just my .02.
    Good points. I would say this already exists in the market, the Gemini from Zero UAV works more or less as you explained:

    http://www.zerouav.com/en/products/hpjzyt/GEMINI/

    The only problem is that you are forced to use the Gemini f you want redundancy, and at the end of the day both Master and Slave are working on the same firmware and interconnected, which IMHO increases the chances of the full system failing at the same time.

    When we developed the FCSwitch, we wanted to make it totally independent from the FCs, and we wanted to use two totally independent FCs (or even two different models). Also, it was a key target to make it 100% plug&play: no setup, no messing with software, no calibration.

    As I answered to Beerwiser, there is a compromise between keeping things as simple as possible to reduce the points of potential failure, and adding redundancy and/or safety features. The solution you describe, while could have the advantage of "anticipating" the failure of one of the FCs, I believe would add too much complexity to the system. On the other hand, while automatic switching between FCs could be seen as very interesting for some pilots, in our case keeping the pilot(s) in command at any time and taking the decisions was mandatory.

  9. #9
    Team Blacksheep FPVflyer's Avatar
    Join Date
    Jan 2012
    Location
    Central Europe
    Posts
    644
    Quote Originally Posted by sircana View Post
    Good points. I would say this already exists in the market, the Gemini from Zero UAV works more or less as you explained:

    http://www.zerouav.com/en/products/hpjzyt/GEMINI/

    The only problem is that you are forced to use the Gemini f you want redundancy, and at the end of the day both Master and Slave are working on the same firmware and interconnected, which IMHO increases the chances of the full system failing at the same time.

    When we developed the FCSwitch, we wanted to make it totally independent from the FCs, and we wanted to use two totally independent FCs (or even two different models). Also, it was a key target to make it 100% plug&play: no setup, no messing with software, no calibration.

    As I answered to Beerwiser, there is a compromise between keeping things as simple as possible to reduce the points of potential failure, and adding redundancy and/or safety features. The solution you describe, while could have the advantage of "anticipating" the failure of one of the FCs, I believe would add too much complexity to the system. On the other hand, while automatic switching between FCs could be seen as very interesting for some pilots, in our case keeping the pilot(s) in command at any time and taking the decisions was mandatory.
    And don't forget about the price, the Gemini cost around 1500$! More than this look the place the hardware take, 2 big FCs, 2 GPS, IMO a redundant system doesn't mean totally redundant in every function, but only to have a secondary FC as a backup, if the first FC is gone, you can't think to keep flying your mission with only 1 FC working, you have anyway to come back, land and fix the problem. To just come back and land you don't need a 2nd GPS or a 2nd big size FC. Ex in a medium size drone for aerial video, you can use (just an example) a DJI WKM or A2 as primary FC, and a NAZA without GPS for backup, if something goes wrong, you'll self detect it immediately (flyaway, dead flip, or whatever else), so just switch to the NAZA and fly back safely. Imagine how much space (and weight) you can save using a NAZA instead of a secondary A2 (or Gemini's size FC), wiring super simple, programming inexisting (so less time to install and set).
    To this add the money save, 1'000$ of difference between the 2 systems, and on your-choice-FC you don't have to think to buy 2x expensive WKM or A2, but just 1 with a cheap NAZA.

    And another thing, in a system which self-detect a problem and automatically switch to the 2nd FC, how will it tell you he made this change? Through OSD (which maybe you're not looking while flying LOS or just because our OSD today are so full of informations that you don't see it immediately)? If yes, are you forced to use the Gemini's OSD and can't use your favorite one?
    Any other way to alert the pilot the system has switched the FC is anyway another alert system added to a drone which is already full of them (for weak signal, for GPS loss, for magnetometer uncalibrated, for gyro uncalibrated, for low battery, for bad attitude status, and more more more more....), so what is better? I think I just see it has a problem, and I switch, and I come back to land.

    Imagine if you're flying and the system self switch, and you never know this! This can happen just for 1 flight, or more than 1, or even continuosly due a problem onboard or external conditions...

    Redundant is important for safety, but keep things simple and easy is like the "prevention" (hope this way to write is correct) of the need of a redundant system, and the FCSwitch4 is so simple that it avoid problem into the switch himself (yes, why not make a redundant switch? LOL).
    "RSSI on the OSD? No, it just make me nervous..."

    Correction: No more nervous with TBS Crossfire!

  10. #10
    Team Blacksheep FPVflyer's Avatar
    Join Date
    Jan 2012
    Location
    Central Europe
    Posts
    644

    Demo flight test

    Aaaand finally!
    Did some flights on a "crappy" frame, crappy because assembled bad, bad geometry, non efficienct X8 configuration, china motors, more china props, hacked NAZA LITE and who can make worse, will do.
    The reason of all theses bad points? Load the work of the FCSwitch as much as possible, to really push his limits (actually, I've never been able to reach his limit) and see how performant is this switch.

    The Judgement? I never had a device so simple, so efficient, so easy to install, which do a so complicated and delicate work so well! It handle every situation very easy, even when you make it work when it's not needed and creating useless stress on the whole system (continuos switching just to see what happen ).
    I was very impressed on how smooth is the transition from the primary FC to the backup one. Think also this point: When passing from one FC to the other, just hard switch, the sudden feedback coming to the controls emitted by the second FC will translate into a very violent movement of the multirotor. Smaller and lighter it is, more aggressive and violent (and crash dependent) it is. In this X8 the size is small, 8 motors, which mean very overpowered octo --> very violent transition between Flight Controllers.

    EXACTLY! But.... not with the Astraeus FCSwitch! In this video you'll see well how smooth is the transition between the flight controllers, the FCS8 (used in the video) make a soft change, giving you all the time to correct the attitude and position before the bad happen.

    After all the positive point discussed in this thread, I want to add a new one:
    Since the crash on the drones still occur, or almost happen, the FCS become also a diagnostic device. How? Simple, if you're in flight and the drone start being unstable or anything else, you can immediately switch to the other FC, problem solved? You can land and replace the "defected" FC, problem not solved? You know it's not related to the FC!
    For someone this can maybe sound like an odd positive point, but in my experience I remember crashes where I spent days to understand what happened on the drone, and not everytime I have been 100% sure about what the issue was.

    So, stop talking, enjoy the video!

    PS: This system will be installed on my next SAR drone (20'000$ of value in the air).
    Last edited by FPVflyer; 7th December 2015 at 06:31 AM.
    "RSSI on the OSD? No, it just make me nervous..."

    Correction: No more nervous with TBS Crossfire!

Similar Threads

  1. Replies: 5
    Last Post: 26th September 2016, 03:02 PM
  2. PID HELP....increase shakiness w throttle increase
    By Hernan in forum OSDs & Flight Controllers
    Replies: 7
    Last Post: 2nd April 2015, 11:02 AM
  3. Replies: 8
    Last Post: 17th February 2015, 07:54 AM
  4. Ultimate prop+motor combo for longest flight time?
    By slaffe in forum Team-Black Sheep
    Replies: 5
    Last Post: 8th February 2014, 06:26 PM
  5. Rx Redundancy
    By Scotttu in forum IFR - Video Link Discussion
    Replies: 0
    Last Post: 8th January 2012, 03:21 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •