Shoplink Okto XL V3 - Combi - Redundanz

Shoplink Doppel Quadro V3 - Cool Redundanz

Download

Here you can download the latest redundant firmware: Download

Redundant system

In some countries copter are allowed only with redundant configuration.
Since 01.01.2014 Austria has a law that requiring more stringent requirements about the reliability of a copter.
We developed and tested a concept, that allows a redundant MikroKopter's.

With this concept the Austro Control gave a the MikroKopter the highest approval "D" !

Redundancy means, that important components have to be replaced in case of a fault and the MK should not crash if there is a failure of a (single) component (eg, motor, receiver, Flight Control, etc.).
The MikroKopter have been continuously developed and improved in terms of safety and reliability,<BR>> A significant contribution to safety brought the introduction of the OktoKopter with 8 motors.

Video

Here you can see how the redundant system work:

Installation of a redundant FlightCtrl

You need

• Redundant BL-Regler V3.5

  • Okto XL V3 - Combi - Redundanz or

  • Doppel Quadro V3 - Cool Redundanz

• a second FlightControl (FC 2.1 or higher)

• Redundant connector set
  • (include the Set "Double Quadro V3 - Cool Redundanz" or "Okto XL V3 - Combi - Redundance")

Redundant configuration

The system is extended with a redundant FlightCtrl. The second FlightCtrl (Slave) is connected via the 10-pol connector with the UART of the BL-Ctrl V3.5. To power up the second FlightCtrl you connect it directly with the BL-Ctrl V3.5 (See pictures).

Connect with Okto-BL-V3.5

Connect with DoubleQuadro-Cool V3.5

Principle of operation:

• The second FlightCtrl is connected with the serial interface (UART) of the BL-Ctrl V3 - Redundancy.

• The new data bus (UART) is decoupled at each regulator by resistance and / or diode. So in case of a fault a single regulator of the BL-Ctrl V3.5 can not shut down the whole PCB.
  • INFO: Since the distribution version 3.5 of the redundant data bus is already integrated.

• During flight, the slave FlightCtrl continuously sends data to the BL-controller.

• The BL-controller reports to the Master-FlightCtrl that that they receive additional data. In the HoTT or Jeti Display you see this with an "R".

• If there is a fault on the I2C bus or if they get no data from the Master FlightCtrl, the second FlightCtrl will immediately turn on and controll the function.

• Normally you will not note that the second FlightCtrl takes over the controlling.

• The second FlightCtrl will also automatically control the copter if e.g. the Master FlightCtrl resets lost the supply.

• The second FlightCtrl can also be equipped with the Set Navigation.

Note:
If you have an older BL-Ctrl V3 you can see here how to install the resistors / diodes yourself: Redundanz

Wiring diagram

Note: the circuit of the redundant UART data bus is integrated with V3.5 distributors already in the PCB

Firmware

If you use the redundant System you need a special software for the second FlightCtrl (Slave).
Here you can download the redundant Software: Download

Settings

IMPORTANT: Both FlightCtrl needs the same settings.

• The Mixer must be the same.
• The channel assignment of both FCs must be the same.

• The second FlightCtrl use the same stick positions.

Settings

• Set the Master-FlightCtrl complete (Channels, Mixer etc.).

• Save this in all 5 Parameterset's (Settings).
• Save this setting on your PC / Laptop.

• connect now the MK-USB directly with the 10-pin connector of the Slave-FlightCtrl.

• install the same settings of the Master FlightCtrl (you have saved before on your PC / Laptop) on all 5 Parameterset's of the Slave-FlightCtrl.

• Remove the MK-USB and connect the UART connector on the Slave-FlightCtrl.

• Calibrate the ACC with your transmitter (Throttle up + Yaw right).

  • Here the copter must be absolutly horizontal. In this step you calibrate both FlightCtrl together!

• Calibrate the compass (Link).

Ready. If you use a Graupner HoTT or Jeti transmitter you should see now an "R" in the display if you start the motors.

Function test

Test the redundant FC

• If both FlightCtrl's are connected, the green LED on the Slave-FlightCtrl is flashing fast.

• If you disconnect the Master-FlightCtrl (remove the Molex cable) the green LED on the Slave-FlightCtrl is still flashing and also the red LED is on.

• If you remove the Master-FlightCtrl the (disconnect the Molex cable) the red LED on each BL-Ctrl will NOT light on!

Test the main FC

• After you start the motors you see an "R" in the telemetry display of your Graupner HoTT or Jeti transmitter -> Redundancy is active.

• Jeti Display:

In the virtual display in the KopterTool you can also see an "R" (if you have a connection between copter and your PC/Laptop).

Redundancy display in the log file

See also: SimpleGpxViewer

Fault simulation

Two errors can be simulated:

• I2C error => Bus failure of the Master FlightCtrl

• motor failure

I2C error

To simulate an error you need a free channel on your transmitter (for each error one channel). This free channel you can program on a free switch on your transmitter.
To simulate the I2C error we set the first channel in the settings under "User" to Parameter 7: Link.

• If you now use the switch on your transmitter (value > 150), the Master-FlightCtrl simulate an I2C error.

• Important: The FC will only do this if the motors are ON and you see the "R" in the display.

To test it let the MikroKopter on the ground with motors ON. Then use the switch. The Master FlightCtrl will now beep fast and the motors must turn further nonstop. Now you can also start, fly and land the copter. If this is OK you can fly the copter and use then this function.

Please Note
If you use a Set Navigation, this is only working with the Master FlightCtrl. During an error when the second FlightCtrl works you will not have the functions PositionHold, ComingHome etc. Only if you also use a second Set Navigation for the Slave FlightCtrl you will also have this functions during a fault of the master FC.

Motor failure

The second free channel we can set to Parameter 6: Link.

• If you now use the switch on your transmitter (value > 150), Motor 1 will stop.

• Important: The FC will only do this if the motors are ON and you see the "R" in the display.

Note:

• If you did not use the test function set a "0" for Parameter 6!

• Test it only with an OktoKopter. A QuadroKopter or HexaKopter will crash if a motor fails!

Covered fail-cases and reqirements

Point 1: Failure RC Transmitter

• Failure Transmitter - Out of range, disturbances or other reasons
• Result: The Kopter doesn't react to the RC-Commands

MikroKopter-Solution

• If the RC connection is lost, the MikroKopter immediately notices that and activates the Failsafe feature.

• It waits 5 seconds to check if the signal comes back.
• Then it goes to a predefined altitude and flies back
• At Home Position, the Kopter descends and lands automatically
• It the RC-Connection comes back, the MK is back under RC control

• Here a video from 2011: https://vimeo.com/32788915 (the landing procedure is much better since 2013)

Point 2: Failure RC Receiver

Same like above

Point 3: Disturbed RC connection

Same like above

Point 4: Motor failure

• for example: Motor, BL-Ctrl or Propeller broken

MikroKopter-Solution

• In case of a defective propeller or defective motor, the OktoKopter can still remain safe in the air (See Video).

• The loss of thrust will be noticed by the FlightControl and immediately compensated

• Overload of a BL-Ctrl will be detected (Overtemperature or Overcurrent), and the BL-Ctrl will reduce the prower. The BL-Ctrl will not switch off!
• The Poilot will be informed by a speech message "Error Motor" and a Text on the LCD of his transmitter
• In the logfile is recorded which motor caused a problem - this one could be replaced to prevent further problems

Point 5: Shortcut

• for example in Camera or sensors.
• Operation under rainy conditions

MikroKopter-Solution

• protection by a closed cover
• Automatic selftest after switching on the MK: Sensors, Voltage, GPS and Motor Shortcut
• Shortcut on a motor: The BL-Ctrl detects that and switchs off

• Shortcut inside the avionic system: The avionic system (FlightControl + !NAviControl) is redundant (See point 7)

• Scortcut in Camera and gimbals: the supply is seperate and doesn't effect the flight safety

Point 6: Failure in Battery

• for example: defective Lipo cells or connection cables

MikroKopter-Solution

• Two Lipos are connected by seperate power cables
• The voltage is permanently monitored and auto landing and coming home will be initiated in case of undervoltage

Different levels of undervoltage:

First Level (i.e. 30% remaining capacity):

• The pilot gets a warning message on the transmitter (speech and LCD)

• The MikroKopter's buzzer is beeping

• The LEDs of the MK are blinking
• usually there is 1-2 minutes left for landing

Second Level (i.e. 20% remaining capacity):

• The MK switches automatically to Coming Home and flies back to starting point

Third Level (i.e. 10% remaining capacity):

• The MK descends, even if the HomePosition is still not reached. That prevents for crashes from high altitudes

Point 7: Disturbance/Blackout of the avionic system

• for example: Shortcut in the FlightControl or Shortcut on I2C-Bus

MikroKopter-Solution

If the FlightControl stopps operation, the redundant backup FlightControl immediately takes over the control (See video)

Function principle of the redundant avionic system:

• A second FC (FlightControl) is connected 'from behind' to the serial port of each motor controller (BL-Ctrl).

• The redundant data bus is decoupled at each regulator by resistors, so that a single faulty BL-controller can't disable or shortcut the Bus signal
• The BL-controller report to the main FC that they receive additional (redundant) data. The transmitter display will show "redundancy ready"
• If the BL controllers have a fault on the main I2C bus, or looses the setpoint from the main FC, they immediately turn over to the data of the second FC.
• Switching over works so smoothly that the MK will not tilt or drop over
• This also works when the Main-FC would make a reset in flight or the power of the FC was briefly interrupted.

Point 8: Disturbance in global navigation system (GPS)

• for example: Loss of Satefix or defective GPS-Reveiver

MikroKopter-Solution

• The number of satellites the GPS receiver is monitored and displayed via telemetry.
• The strength and inclination of the earth's magnetic field is measured and used to descide if the compass signal is vaild or not.

• A stand-alone unit (NaviControl) is responsible for GPS navigation

• A total failure of this unit is recognized by the FlightControl, who then switches to manual control and informs the pilot via telemetry.

Before starting:

The pilot is informed about disturbed geomagnetic field or GPS signal loss and can not start the MikroKopter in that case.

During Flight:

If the navigation system, GPS or compass are disturbed (solar storms, GPS-shadowing, etc.), the MikroKopter switches to manual mode and the pilot gets informed via the telemetry. For example, by voice message: "Error GPS"

In addition, the pilot can always turn off the GPS mode on the transmitter and use manually control.

Point 9: Fault / failure in the telemetry

• for example: Transmission error

MikroKopter solution

• The telemetry transmission is not relevant to the flight of the copter.

• If the telemetry fails, this does not affect the flight characteristics of the MikroKopter.

Point 10: Thermal overload the battery

• for Example: internal LiPo battery fault or overload due to high current / imbalance

MikroKopter solution

• Two sepearate Lipos are connected to the MikroKopter with seperate connection cables

• The second lipo will do the power supply if the first one looses power
• Overloading of the Batteries will result in undervoltage - that is covered in point 6

Point 11: Flight recorder/Blackbox

• Investigation of faults or crashes

MikroKopter solution

• In the MikroKopter all flight-relevant data are logged onto SD-Card (up to 5Hz)

• In the event of a crash, the Micro-SD card can be removed from the navigation board. The data can then be evaluated on the PC.

• We restored flight data from a MikroKopter that was found under water.

• Recorded are e.g.:
  • Flight height
  • GPS location
  • voltages
  • temperatures
  • Control movements and switch positions
  • Error messages as Motor error (restarted motor)
  • Motor Currents (individual Currents)
  • Magnetic values of compass sensor
  • Number of GPS satellites

Point 12: flight limits

• Limitation of the flight altitude and distance
• Incorrect operation of the pilot. For example, Flight out of sight
• Drifting away in a storm

MikroKopter solution

MikroKopter flight limits can be set:

• Maximum altitude (for example 100m)
• Maximum distance (for example 250m)
• Maximum radius for waypoint flight (for example 250m)
• Security radius for automatic landing (eg. 300m)

The pilot can't exceed either the maximum height or distance.

If the MikroKopter would still leave the safety radius, the copter goes automatically into descend mode (fixed velocity 3m/s) and automatically switches to the Coming Home mode. Then the descent is only canceled if the MK comes back within the safety radius. This function prevents a copter from flying too far away in a storm.

The maximum limit for the Waypoint flight prevents using too far distant points. For example, if by mistake the wrong waypoint list is loaded, which would be 100km away.