Add External Flight Termination Feature to Autdupilot per ASTM F3322-18

ArduCopter
1

Hi Everyone, this is Gene Engelgau with Fruity Chutes. We manufacture parachute recovery systems for drones. In 2018 we were involved with the ASTM standards committee that created the specification for what it means to have a certified parachute recovery system for a drone for the purposes of flight over people, or for other high-risk use. The standard in the F.38 section is ASTM F3322-18 and is available here for purchase:

https://webstore.ansi.org/Standards/ASTM/ASTMF332218

A key requirement to meet the standard is there needs to be an Automatic Trigger System (ATS) that can detect the drone failure and eject the parachute and it must be independent of the autopilot (is can work in cooperation as well so both can initiate the parachute). It standard also specifies that the drone needs to support a Flight Termination feature that when asserted by the ATS will cause the rotors to immediately stop since the parachute is being ejected. This is missing in the Ardupilot code base as far as I know, at least via an auxiliary input that the ATS can asset into the Pixhawk.

What I would like to propose is the addition of a key feature needed to support an external automatic trigger system called “Flight Termination” for the Ardupilot code base. This was recently added to the PX4 code base. Here is the pull request:

Below is the F3322-18 clause that defines the operation:

3.1.4 autonomous triggering system, ATS, n—device or components independent from any flight critical system of the sUA that will detect and initiate parachute deployment upon detection of a critical failure of the sUA in flight.

The ATS has it’s own IMU and other sensors that can detect the drone falling or flipping (out of control motion that should otherwise never happen). In this case the ATS will trigger the parachute.
The ATS also will generate a PWM signal that is sent to the autopilot to stop the rotors from spinning. This is called the Flight Termination System. The best and most reliable way to do this is to have the autopilot accept a PWM pulse width (or other ways can be done as well like logic level) that when asserted will cause all the rotors to immediately stop. Here is the paragraph from the standard that refers to the flight termination (stop the rotors)

3.1.16 flight termination system, FTS, n—device or components that will disable the propulsion system of the sUA.

Below are several paragraphs that makes the assertions regarding these:

5.8.4 To prevent propellers from injuring people on the ground after a deployment the PRS shall also include a Flight Termination System (FTS).

5.8.4.1 The FTS shall activate at the time of or before parachute deployment is initiated.**

The FAA (and other similar government agencies in other countries) are now referring people to this standard who want waivers for flight over people. We make this device here that satisfies the ATS requirement here:

Get back to me your feedback. I can also be reached directly at gene@fruitychutes.com

Thanks for all of your time!!

-Gene - CEO Fruity Chutes

2

This actually just came up from one of your users yesterday here Motor shutdown on pwm input (parachute release).

ArduPilot can detect the condition (falling out of the sky) or take a manual RC input which will stop the motors and trigger an output to pop the chute.

What ArduPilot currently does not have is way for an external input other than the RC receiver to trigger the emergency stop. So if you have an external parachute device, that does the detection and chute popping, there is no way to tell ArduPilot to stop the motors right now.

3

Hi, Yes, they are a customer of ours. If we can’t get support for this into the Ardupilot they will need to look at the PX4 code base which just had this implemented. That is a tough choice to make, they like Ardupilot.

Gene
gene@fruitychutes.com

4

Good afternoon, colleagues! We use a parachute system with an external Fruity Chutes activation system. We are looking forward to solving the problem of turning off the Ardupilot motors when the system is triggered! Are there any progress along this path?

5

Hi, No progress. We posted a feature request to the Ardupilot community Jan 20th ;last year. Since then I can’t get any Ardupilot developers to take this up. The PX4 software stack does have this implemented. Until we get some effort into this for Ardupilot I would recommend for the time being to possibly use that.

To put a point on this, the new ASTM F3322-18 parachute standard requires a dedicated parachute safety device, like the SATS-MINI. It can not be part of the autopilot. It can however work with it and augment it’s operation. Having the autopilot software provide a feature to externally cause the rotors to stop is keeping Audupilot based drones from being able to comply with the standard.

6

We do not need feature requests. We need pull requests :slight_smile:

7

And/or sponsors.

In fact, I think I accidentally did implement this feature.

The Button function work I did for Aion Robotics allows you to put an
arbitrary function on a button (which can be attached to e.g. aux in 5 on
a Cube, for example). Those functions include “eStop” to stop all the
motors spinning.

So while the external device gives you PWM on a PIN, you continue to
output motors. When the extern device stops giving you PWM, you trigger.
You can also use presence-of-PWM to trigger or use logic high or low.

It’s not flight termination - but its pretty damned close.

1 Like
8

We do have other stuff for certification that you might want to try:

9

Hi all, The SATS-MINI can produce a PWM pulse no problem. Most common is a 1000us pulse (50 hz frame rate) when in standby. Then a 2000us PWM pulse that indicates the parachute is ejected. What we need the rotors to stop immediately when we assert the 2000us PWM pulse (or some other width). Both these are configurable on the SATS-MINI.

Currently the SATS-MINI does not have a feature to “stop” the PWM pulse meaning the parachute to eject. That is not as safe as supplying a specific PWM pulse width asserting the parachute willdeployment.

If someone can pick this up and possibly implement this as a Ardupilot parachute feature that would be awesome. For Px4 here code here is how they did it:

Thanks all!

-Gene -
CEO Fruity Chutes,
gene@fruitychutes.com

-Gene

10

As @peterbarker said earlier, we support pwm with eStop that is pretty much the same as flighttermination, so we are already compliant …