...
/ Document Center / By

Initial Setup of a Multi-Rotor Aircraft -Ⅱ

Fail-safe

ArduPilot firmware includes built-in safety mechanisms designed to reduce the risk of incidents such as aircraft loss or crashes.

Proper configuration of failsafe settings is crucial; incorrect settings can lead to various operational anomalies.

Protection mechanisms include the following:

  • Remote control signal loss protection
  • Battery protection
  • Ground station failure protection
  • EKF/DCM hardware failure protection
  • Simple geofence
  • Polygon geofence
  • Impact protection

Remote Control Failsafe (Signal Loss Protection)

Copter supports several configurable failsafe options in the event that the connection between the pilot’s transmitter and the autopilot’s receiver is lost. This page explains how to set up and test this failsafe. Please note that “Radio Failsafe” was formerly known as “Throttle Failsafe,” as some receivers use the throttle channel to signal a loss of connection.

Copter also supports other failsafes, including battery, ground station, and EKF/DCM failsafes. For more details, please refer to Failsafe.

The principle behind RC receiver throttle failsafe:

Most remote control receivers feature a throttle failsafe function: when the receiver stops receiving signals from the transmitter, the throttle channel (Channel 3) automatically switches to a value below 1000 PWM (e.g., 950). When the flight controller detects this value of 950 on Channel 3, it identifies a loss of RC signal and activates the corresponding failsafe mode—such as RTL (Return to Launch/Home) or AUTO (continuing the mission autonomously).

When is the fail-safe triggered?

If enabled and correctly configured, the radio failsafe will trigger in the following situations:

  • The pilot turns off the remote control transmitter
  • The drone moves beyond the remote control’s communication range
  • The pilot manually moves the throttle channel on the transmitter below the `FS_THR_VALUE`
  • The receiver loses power (unlikely)
  • The wiring connecting the receiver to the autopilot becomes disconnected (unlikely).

what happens

Upon triggering the radio failsafe, the drone will execute a pre-configured action—such as taking no action, landing immediately, or performing RTL (Return to Launch) or SmartRTL. It can also be configured to bypass the failsafe during an automated mission and continue the flight path, or to proceed with landing if the landing phase has already begun.

  • If the multicopter is already disarmed, the failsafe will not trigger.
  • If the multicopter is armed but has already landed, it will disarm immediately.
  • If the multicopter is armed in Stabilize or Acro mode and the throttle input is at the minimum level, it will disarm.
  • Otherwise, the multicopter will behave according to the following parameter configurations.

If the failsafe condition clears (i.e., communication between the transmitter and receiver is re-established), the multicopter will remain in its failsafe mode. It will not automatically revert to the flight mode that was active prior to the failsafe trigger. For example, if the drone was in Loiter mode when the failsafe occurred and automatically switched to RTL, it will remain in RTL even after communication is restored. If the pilot wishes to regain control in Loiter mode, they must manually switch modes using the transmitter and then select Loiter again.

Receiver Configuration

By default, most newly purchased receivers simply stop outputting pulses if contact with the transmitter is lost. However, some low-end receivers are configured to hold all channels at their last known positions. This is problematic because the autopilot cannot detect that the pilot has lost control of the drone. Instead, the receiver must be configured to signal the autopilot that contact has been lost; there are two ways to achieve this, depending on the specific receiver. Transmitter and receiver systems vary by brand, so please consult your transmitter’s user manual to determine the available options and how to configure them.

The receiver outputs low throttle after a configuration loss-of-control event

“Low throttle” refers to a state where, upon loss of connection between the receiver and the transmitter, the receiver outputs a throttle value lower than the standard minimum throttle setting.
Configuration procedure:

  • Before configuring, please record the minimum throttle value so it can be restored later.
  • Open the transmitter’s failsafe settings interface; connect the flight controller to the ground station and open the radio calibration interface.
  • Use the trim buttons to adjust the minimum throttle value to the specific throttle output level you desire for the failsafe state.
  • Enable throttle failsafe; the transmitter will record this throttle value for the failsafe condition.
  • Use the trim buttons to return the minimum throttle value to its original setting.
  • Finally, set FS_THR_VALUE to the recorded failsafe throttle value (which is lower than the normal minimum).

No signal output from the receiver after configuration loss of control

“No Signal Output” – the receiver stops sending signals to the flight controller. This is the preferred method and how most modern FrSky receivers operate. Below is the setup procedure for a FlySky 9-channel transmitter paired with an FrSky D4R-II receiver using the “No Signal Output” method to trigger failsafe.

Specifications and Configuration

The FS_THR_ENABLE (Throttle Failsafe Enable) parameter can be configured via the full parameter list or full parameter tree in Mission Planner, or through the Mission Planner interface under **Initial Setup > Mandatory Hardware > Failsafe**.

  • Disabled (Value 0): Completely disables the radio failsafe.
  • Always RTL (Value 1): Switches to RTL mode upon triggering. If a GPS position is unavailable, the vehicle will switch to Land mode instead.
  • Continue Mission in Auto Mode (Deprecated in 4.0+) (Value 2): Ignores the failsafe during Auto mode missions; otherwise, behavior is identical to “Always RTL.” This option no longer exists in ArduCopter 4.0; please refer to the FS_OPTIONS parameter for this functionality. In Copter 4.0 and later, setting this value automatically converts it to Value 1 and modifies FS_OPTIONS to include bit 0 in the bitmask, indicating “Continue if in Auto mode during Radio Failsafe.”
  • Always Land (Value 3): Switches the vehicle to Land mode.
  • SmartRTL or RTL (Value 4): Switches the vehicle to SmartRTL mode. If SmartRTL is unavailable, it switches to RTL mode instead. If a GPS position is unavailable, it switches to Land mode instead.
  • SmartRTL or Land (Value 5): Switches the vehicle to SmartRTL mode. If SmartRTL is unavailable, it switches to Land mode instead.
  • Any invalid value (e.g., accidentally entering 99) results in the same behavior as “Always Land.”

The FS_THR_VALUE parameter can be configured via the full parameter list or full parameter tree in Mission Planner, or through the “Failsafe” screen under **Initial Setup > Mandatory Hardware**.
It must be set to a value at least 10 points higher than the minimum PWM value for Channel 3.

The FS_OPTIONS parameter (introduced in Copter 4.0 and later versions) is a bitmask parameter used to select one or more options that modify the standard failsafe actions for radio, GCS, and battery. In Mission Planner’s Full Parameter List or Full Parameter Tree, a convenient checkbox pop-up makes it easy to configure this (and any other bitmask) parameter. Please upgrade your ground station to version 1.3.69 or higher to ensure you have the latest parameter definitions.

The FS_OPTIONS bitmask is defined as follows:
Bit 1: Continue if in AUTO mode during a radio failsafe.
Bit 2: Continue if in AUTO mode during a GCS failsafe.
Bit 3: Continue if a radio failsafe occurs while in Guided mode.
Bit 4: Continue if any failsafe is triggered.
Bit 5: Continue guided control from the GCS.
If none of the above are set, the FS_THR_ENABLE option is executed according to configuration.

Only bitmask bits 0, 2, and 3 affect the actions taken during a radio failsafe event. This parameter can also be used in conjunction with battery and GCS failsafes, so ensure you consider all options when configuring it.
Below is a screenshot of the Mission Planner “Initial Setup” >> “Mandatory Hardware” >> “Failsafe” menu.

Test Failsafe Protection

You can perform these tests with the battery connected; however, if you do connect the battery, you should remove the propellers first.

Test #1: Failsafe Trigger Mechanism

  • If using the “low-throttle trigger” method, ensure that after turning off the transmitter, the receiver outputs a value lower than the minimum throttle (i.e., the failsafe value output by the receiver upon signal loss).
  • Ensure the transmitter is powered on and the signal is visible in the radio calibration interface (to verify the signal is functioning correctly), then switch to Stabilize mode.
  • The PWM value for the throttle (Channel 3) should be roughly the same as shown in the first image below. The value may be higher or lower, but it must be at least 10 units above `FS_THR_VALUE`.
  • Turn off the transmitter; the throttle PWM value should drop to at least 10 units below `FS_THR_VALUE` (as shown in the second image below).

You can select one or more of the test scenarios below to verify functionality.

Test #2: With the throttle at zero and the flight mode set to Stabilize or Acro, the system should immediately auto-arm/disarm to lock the motors.

  • Switch to Stabilize mode and arm the motors using the remote control while keeping the throttle at the minimum position.
  • Turn off the remote control; the motors should immediately lock (stop spinning).
  • The red indicator light will start flashing, and “Disarmed” (or “Locked”) will be displayed on the “Flight Data” screen in Mission Planner.

Test #3: Change flight mode to RTL or LAND while throttle is above zero

  • Switch to Stabilize mode, arm the motors using the transmitter, and raise the throttle to the midpoint.
  • Turn off the transmitter. If the drone has a valid GPS lock, the flight mode should switch to RTL; if the drone lacks a GPS lock or the lock quality is poor, the flight mode should switch to LAND (flight mode and GPS lock status are visible on the Flight Data screen in Mission Planner).

Test #4: Regaining control after remote control communication is restored

  • Continuing from Test 3, turn the transmitter back on.
  • While the flight mode is still set to RTL or LAND and the system is armed, move the flight mode switch to a different position (switch modes) and then back to Stabilize mode.
  • The flight mode displayed on the Failsafe page updates in real time.

Test 5 (Optional): Disconnect power to the receiver

  • Switch to Stabilize mode, arm the motors using the remote controller, and keep the throttle above zero.
  • Carefully disconnect the power cable connecting the receiver to the autopilot.
  • As described in Test #3, the flight mode should switch to RTL or LAND.

Upon detecting a loss-of-control condition, the receiver directly outputs a mode-switching command.

General users are strictly prohibited from using this method; additionally, ensure that the flight controller’s remote control failsafe is disabled when using it.

  • Configure the receiver’s failsafe setting for Channel 5 (the flight mode channel);
  • If the signal is lost, the receiver outputs the PWM value corresponding to RTL mode on Channel 5. The flight controller then switches to RTL mode (the flight controller is unaware that a signal loss has occurred; it simply switches modes based on the PWM signal, just as it would during a manual flight mode change).

Although this method is useful in certain scenarios, it is not recommended; the flight controller remains unaware that control has been lost during this process and thus will not alert you to the loss of control. Furthermore, this mechanism is not triggered if the receiver loses power or if the connection between the receiver and the autopilot is severed.

Battery Fault Protection

Overview:

For battery failsafe protection, a threshold—such as a specific voltage or remaining capacity level—can be set; when the battery voltage or capacity drops below this threshold, the drone will automatically execute RTL, SmartRTL, or Land mode.

To use the battery failsafe, a voltage and current sensor must be installed and configured for it to function.

NOTE: ArduPilot firmware version 4.0 and later supports up to 10 battery/power monitors. The following discussion applies to these optional batteries as well. Each can trigger a failsafe, and each can have distinct operational behaviors and settings. Additionally, a group of batteries can be treated as a single unit; please refer to `BATTx_MONITOR = 10`.

When is the fail-safe triggered?

Battery Failsafe Activation Conditions:

If enabled and correctly configured, the activation conditions are:

  • Voltage drops below the `BATT_LOW_VOLT` setting (or `FS_BATT_VOLT` in older versions) for more than 10 seconds; if set to zero, the voltage-based trigger is disabled.
  • Remaining capacity drops below the `BATT_LOW_MAH` parameter (or `FS_BATT_MAH` in older firmware versions); typically, this is set to approximately 20% of the battery capacity (e.g., “1000” for a 5000mAh battery); if set to zero, the capacity-based trigger is disabled (i.e., only voltage is used).

What happens if the protection is triggered:

When the failsafe is triggered:

  • The buzzer will sound a loud low-battery alarm.
  • The LED will flash yellow.
  • “Low Battery!” will be displayed on the ground station HUD (if a telemetry link is connected).

Then, one of the following will occur:

  • Nothing happens: If the vehicle is not armed.
  • Automatic disarm: If the vehicle is in Stabilize or Acro mode and the throttle is at the minimum value.
  • User-configurable actions are stored in the BATT_FS_LOW_ACT (Copter-3.6 or later) or FS_BATT_ENABLE (Copter-3.5 or earlier) parameters:

1. LAND – The drone will switch to Land mode.
2. RTL – If possible, the drone will switch to RTL (Return to Launch) mode; if not possible (due to poor positioning), it will switch to Land mode.
3. SmartRTL or RTL – If possible, the drone will switch to SmartRTL mode; if not possible (because the SmartRTL position buffer is full), it will switch to RTL. If RTL is also not possible (due to poor positioning), it will switch to Land mode.
4. SmartRTL or Land – If possible, the drone will switch to SmartRTL mode; if not possible (because the SmartRTL position buffer is full), it will switch to Land mode.
5. Stop – The drone will disarm, and there will be no motor output. This is a dangerous option and should not be used in the vast majority of cases.

As with all failsafes, the user can regain control of the drone by switching the flight mode to another mode. Unless a dual-layer failsafe is configured, the battery failsafe will not trigger again (see below).

Even if the failsafe action is set to “Disabled” (i.e., BATT_FS_LOW_ACT = 0), the buzzer will sound and the LED indicator will flash yellow. To completely disable the battery failsafe, set BATT_LOW_VOLT and BATT_LOW_MAH to zero. Once the battery failsafe has been triggered, it cannot be reset without restarting the flight controller.

Configure battery fail-safe:

Ground Station > Initial Setup > Mandatory Hardware > Failsafe Screen

  • If the battery parameter fields are greyed out, please configure the power module according to the instructions.
  • Set the “Low Battery” voltage threshold (configure based on battery voltage; typically, the nominal voltage per cell is 3.7V/3.5V—for example, a 3S battery could be set to 10.5V–10.8V).
  • Reserved Capacity (mAh): Use of this feature is not recommended due to potential inaccuracy; if not used, set the value to 0.
  • Select the desired action from the drop-down list (Land, RTL, SmartRTL, etc.).

Newly introduced parameter

The FS_OPTIONS parameter (available in Copter firmware version 4.0 and later) uses a bitmask to select one or more options that modify the standard actions for radio, GCS, and battery failsafes. In Mission Planner’s Full Parameter List or Full Parameter Tree, a convenient checkbox pop-up makes it easy to configure this (and any other) bitmask parameter. Please update your ground station to version 1.3.69 or higher to ensure you have the latest parameter definitions.

The FS_OPTIONS bits are defined as follows:

Bit 0 set: Continue mission if in Auto mode during a radio failsafe.
Bit 1 set: Continue mission if in Auto mode during a GCS failsafe.
Bit 2 set: Continue mission if in Guided mode during a radio failsafe.
Bit 3 set: Continue mission if any failsafe is triggered.
Bit 4 set: Continue manual control during a GCS failsafe.
If none of the above are set, the actions defined by BATT_FS_LOW_ACT or BATT_FS_CRT_ACT will be executed.

The FS_OPTIONS bitmask is defined as follows:

Bit 1: Continue if in AUTO mode during a radio failsafe.
Bit 2: Continue if in AUTO mode during a GCS failsafe.
Bit 3: Continue if a radio failsafe occurs while in Guided mode.
Bit 4: Continue if any failsafe is triggered.
Bit 5: Continue guided control from the GCS.
If none of the above are set, the action specified by BATT_FS_LOW_ACT or BATT_FS_CRT_ACT is executed based on configuration.

Only bitmask bit 3 affects the action taken during a battery failsafe event. This parameter can also be used in conjunction with GCS and radio failsafe functions, so ensure all options are considered when configuring it.

Dual-layer fail-safe protection

Copter-3.6 (and later versions) includes a two-stage battery failsafe. It allows you to configure a secondary action to be taken if the battery voltage or remaining capacity drops below a lower threshold. BATT_CRT_VOLT holds the secondary (lower) voltage threshold; set to zero to disable. BATT_CRT_MAH holds the secondary (lower) capacity threshold; set to zero to disable. BATT_FS_CRT_ACT specifies the secondary action to be performed. A sensible configuration is BATT_FS_LOW_ACT = 2 (RTL) and BATT_FS_CRT_ACT = 1 (Land).

Advanced Settings

BATT_FS_VOLTSRC allows configuration of whether to use the raw battery voltage or the corrected voltage. BATT_LOW_TIMER: Configures the duration for which the voltage must remain below the failsafe trigger threshold. BATTx_: Triggers the failsafe for the corresponding battery.

Ground Station Fail-Safe

Significant improvements have been made to the Ground Control Station (GCS) failsafe in Copter-4.0 and later versions.

If the drone loses contact with the GCS, it will take action (provided the feature is enabled). GCS failsafe monitoring begins after the last MAVLink heartbeat is sent from the GCS; if no heartbeat packet is received within 5 seconds, the GCS failsafe will trigger based on your parameter settings.

If no GCS (Ground Control Station) is connected, the GCS failsafe will remain inactive, regardless of the parameter settings.

When is fail-safe protection triggered?

The following situations will result in the loss of the GCS MAVLink heartbeat and trigger a GCS failsafe event after 5 seconds:

  • The operator turns off or disconnects the GCS.
  • The helicopter moves beyond the range of the GCS telemetry radio.
  • Power is lost to the GCS telemetry radio at either end.
  • The cable connecting the GCS telemetry radio to the autopilot or ground equipment becomes disconnected.

The following actions will take place:

Upon triggering the radio failsafe, the drone will execute a pre-configured action—such as doing nothing, landing immediately, or initiating RTL (Return to Launch) or SmartRTL. It can also be configured to ignore the failsafe during an automated mission and continue the flight path, or to proceed with landing if it has already entered the landing phase.

  • If the drone is disarmed, the failsafe will not trigger.
  • If the drone is armed but still on the ground, it will disarm immediately.
  • If the drone is armed in Stabilize or Acro mode with minimum throttle input, it will disarm immediately; otherwise, it will behave according to the configured parameters.
  • If the GCS reconnects after a GCS failsafe has been triggered, the drone will remain in the failsafe mode (e.g., RTL); to regain control of the aircraft, you must manually switch to your desired mode.

Configure GCS signal loss protection:

In the Ground Station—under Configuration/Tuning > Full Parameter List—locate the `FS_GCS_ENABLE` parameter:

  • 0. Disable GCS Failsafe.
  • 1. Always RTL (Return to Launch); if a valid GPS lock is unavailable, Land mode is used instead.
  • 2. If the current mode is AUTO, the mission continues (deprecated in version 4.0+); otherwise, RTL is executed. (Note: This option no longer exists in ArduCopter 4.0; refer to the `FS_OPTIONS` parameter for this functionality. In Copter 4.0 and later, setting this value automatically converts it to value 1 (Always RTL) and modifies the `FS_OPTIONS` bitmask to include the bit (1) for “Continue Auto Mission on GCS Failsafe”.)
  • 3. SmartRTL or RTL; switches the vehicle to SmartRTL mode. If SmartRTL is unavailable, it switches to RTL mode instead. If GPS positioning is unavailable, it switches to Land mode.
  • 4. Always Land.
  • 5. Any invalid value (e.g., accidentally entering 99) is treated the same as “Enabled Always RTL.”

The FS_OPTIONS parameter (Copter 4.0 and later) is a bitmask used to select one or more options that modify the standard failsafe actions for radio, GCS, and battery failsafes.

  • Bit 0: Continue in Auto mode during a radio failsafe.
  • Bit 1: Continue in Auto mode during a GCS failsafe.
  • Bit 2: Continue in Guided mode during a radio failsafe.
  • Bit 3: Continue landing during any failsafe.
  • Bit 4: Allow pilot control during a GCS failsafe. If none of the above are set, the action follows the FS_GCS_ENABLE configuration.

All fail-safe parameters can be viewed or configured via the “Advanced Parameter List” in the Mission Planner.

EKF Failsafe

The EKF failsafe monitors the health of the EKF (Position and Attitude Estimation System) to detect issues with the drone’s position estimation—typically caused by GPS failures or compass errors—and prevent “flyaways.”

Starting with Copter 3.3, the EKF failsafe replaced the GPS failsafe.

When is it triggered?

The EKF failsafe is triggered when the EKF “variance” for any two of the following—compass, position, or velocity—exceeds the `FS_EKF_THRESH` parameter value for one second.

These “variances” originate from the EKF itself and indicate the reliability of the EKF’s estimates. Values ​​range from 0 to 1, where 0 indicates a highly reliable estimate and 1.0 indicates very low reliability.

The EKF calculates these “variances” by comparing data from multiple sensors. For instance, if the GPS position suddenly jumps while the accelerometer shows no corresponding sudden acceleration, the EKF variance for position will increase (meaning the estimate has become less reliable).

These variations can be monitored in real-time via the ground station. If using Mission Planner, click the “EKF” label on the HUD.

What happens when the fail-safe is triggered?

  • The autopilot’s LED will flash red-yellow or blue-yellow, and an audible alarm will sound.
  • If a telemetry link is connected, “EKF variance” will appear on the ground station’s HUD.
  • In manual flight modes (e.g., Stabilize, Acro, AltHold), the flight controller will not take corrective action; however, the pilot will be unable to switch to autonomous flight modes (Loiter, PosHold, RTL, Guided, Auto) until the fault is cleared.
  • When in an autonomous mode (i.e., Loiter, PosHold, RTL, Guided, Auto, etc.), the `FS_EKF_ACTION` parameter determines the behavior. By default, this value is set to “1,” meaning the drone will switch to Land mode. This is a “pilot-controlled” landing, meaning the pilot retains control over roll and pitch, while the drone descends at the rate specified by `LAND_SPEED`. It will land and automatically disarm.
  • The EKF failsafe error will be recorded in the dataflash logs.
  • After an EKF failsafe event occurs, the pilot can regain control by switching to a manual flight mode (e.g., AltHold) to fly the drone back.

Adjust the fail-safe sensitivity

The FS_EKF_THRESH parameter adjusts the sensitivity of EKF failsafe detection.

  • Setting it to 0 disables the failsafe.
  • Setting it to a value between 0.8 and 1.0 reduces the likelihood of triggering the EKF failsafe; higher values ​​make the EKF requirements less strict, though this may result in a delayed response to compass or GPS failures, causing the aircraft to drift further off course.
  • Setting it to 0.6 increases the strictness of EKF monitoring. Lowering this value may cause the EKF failsafe to trigger a landing during aggressive maneuvers.

Dataflash Log Example

You can examine EKF innovations by plotting the NKF4.SP (position innovation), NKF4.SV (velocity innovation), and NKF4.SM (compass innovation) values ​​from the dataflash logs.

The figure below shows the EKF innovations for position (green), velocity (red), and compass (yellow) during an actual EKF failsafe event. During this event, external interference—possibly from a nearby high-power radio tower—caused the GPS to report inaccurate position and velocity data. The vehicle immediately switched to Land mode after both the velocity and position innovations exceeded the FS_EKF_THRESH value of 0.8.

Simple Electronic Fence

APM:Copter version 3.0 and later introduces a simple geofence protection system. This feature creates a “tin can”-shaped geofence centered on the Home point, preventing the aircraft from exceeding a specified radius or altitude; doing so triggers a designated protection mode, such as RTL (Return to Launch) or LAND. Settings can be configured via the ground station.

Type:

Circle: Radius range limit
Altitude: Altitude limit
Altitude OR Circle: Altitude and distance limits

Action:

Report only:
When the aircraft exceeds the set geofence boundaries, the ground station will issue an alert indicating the breach.

Suitable for users operating via a mobile app.

RTL or LAND:
If the aircraft exceeds the set geofence boundaries, it will execute an RTL (Return to Launch) or LAND operation.

If the vehicle strays outside these borders, it will switch into RTL or LAND mode. At the moment the fence is breached, a backup fence is established 20m further out (or higher up). If the copter breaches this backup fence (for example, if the vehicle is not configured correctly or the operator takes control but fails to bring the copter back to the home point), the copter will switch to RTL mode again (and another backup fence will be created an additional 20m further out).

You can set up a simple geofence in the following way:

  • Connect the Pixhawk flight controller to Mission Planner via USB or a telemetry radio.
  • Go to Setup/Tuning > > > GeoFence.
  • Check the “Enable” box.
  • Set the desired restriction type: Circle (radius limit) or Altitude (height limit).
  • Action: The action to be performed when the limit is exceeded.
  • Max Alt: Set the maximum altitude limit.
  • Max Radius: Set the maximum radius distance.
  • Return-to-Launch (RTL) Minimum Altitude: Set an ideal return altitude based on the flight environment.

Enable the geofence function via Channel 7 or Channel 8:

If you wish to enable or disable the geofence using a transmitter switch, you can do so as follows (note: this is not recommended for beginners, as it can easily lead to confusion or errors):

  • Ensure that a CH7 or CH8 switch on your transmitter has already been set up and calibrated.
  • Navigate to Mission Planner >> Config/Tuning >> Extended Tuning.
  • Configure CH7 or CH8 to control the Fence function (i.e., a PWM value above 1800 enables the fence, while a value below 1800 disables it).

Warn:

  • The minimum recommended fence radius is 30 meters.
  • The geofence relies on proper GPS operation; therefore, do not disable GPS arming checks or EKF failsafe mechanisms when the fence is enabled. Conversely, if you disable these checks, you must also disable the geofence.
  • For optimal results, ensure that the RTL (Return to Launch) function is working correctly.
  • When the geofence is enabled, the flight controller checks for a GPS lock before arming; if no lock is found, arming is prevented, and an error is reported.
  • If the geofence is enabled but the GPS failsafe is not, the geofence will be automatically disabled if the GPS signal is lost or a GPS malfunction occurs during flight.
  • If both the GPS failsafe and the geofence are enabled and GPS lock is lost during flight, the aircraft will switch to LAND mode, regardless of the current flight mode. If the LAND sequence is not desired, the pilot can regain control by toggling the flight mode switch.
  • To reset or replace the existing fence, be prepared to toggle the flight mode or use a dedicated switch to enable/disable the fence.

Polygonal Fence

Overview

Copter 3.4 (and later versions) includes support for polygonal fences with up to 84 points. The purpose of this fence is to prevent your vehicle from flying outside the defined polygonal area by triggering an RTL; if flying in Loiter mode, the vehicle will typically stop before breaching the fence. This feature is an extension of the simple circular fence.

Enable the fence in Mission Planner

  • Connect your flight controller to Mission Planner.
  • Go to the Config/Tuning | GeoFence screen.
  • Click “Enable” and set the type to “polygon”.
  • Set the action to “RTL or Land”
  • Go to the Flight Plan screen
  • Right-click on the map and select “Draw Polygon” >> “Add Polygon Point”
  • Click other points on the map to define the polygon
  • After defining the polygon, you must right-click and select “Limit Range” >> “Set Return Position.” This position is not actually used by the helicopter, but it must be set because the same underlying library is used as for fixed-wing aircraft.

Right-click and select “Upload Polygon Fence to Aircraft” >> “Upload”.

Collision/Impact Protection

Copter currently includes a built-in collision detection feature; if the aircraft loses control and impacts the ground, the system automatically locks the motors. This minimizes damage to the aircraft and reduces the risk of secondary injury to nearby people or damage to property. The logic for collision detection is similar to that of parachute deployment, with the key difference being that a parachute typically deploys during a fall, whereas collision detection triggers after the aircraft has struck the ground.

When does the collision check lock the motor?

When all of the following conditions persist for more than 2 seconds:

  1. The aircraft is armed
  2. The aircraft has not landed (as determined by the flight controller)
  3. The current flight mode is not ACRO or FLIP
  4. The aircraft is not moving at a speed exceeding 3 cm/s
  5. The actual tilt angle deviates from the target tilt angle by more than 30 degrees

What happens when collision checking is activated:

  1. The flight controller will automatically disarm the motors.
  2. A “Crash: Disarming” message will appear in the ground station.
  3. A crash event (EV 12, red error) will be recorded in the log.

Situations requiring it to be turned off:

Generally speaking, it is not recommended for users to disable collision checking.

However, for users with specialized applications:

such as drones used for towing lines or drone skiing.

In scenarios where the aircraft frequently maintains a tilt angle exceeding 30 degrees for more than one second, it is recommended to disable collision checking to prevent a crash caused by the motors automatically shutting down.

How to disable collision checking:

In Ground Station >> Configuration/Tuning >> Full Parameter List

Find FS_CRASH_CHECK and change it to 0 to disable it.

Vibration Protection

This feature is available only in Copter firmware version 4.0 and later.

Vibration failsafe differs from most other failsafes in ArduPilot because it does not trigger a flight mode switch. Instead, it alters the algorithms controlling climb rate and acceleration during altitude-controlled flight modes. It is enabled by default but can be disabled by setting FS_VIBE_ENABLE = 0.

Impact of high vibration

Multirotors can experience high levels of horizontal vibration (exceeding 60 m/s²), which may cause accelerometer saturation (i.e., exceeding the sensor’s measurable range). This results in “clipping,” meaning the EKF cannot accurately calculate the climb rate or vertical acceleration. Consequently, the drone may fail to accurately control its climb rate, or in extreme cases, even ascend at full speed.

Trigger

When the EKF’s vertical velocity and position innovations become negative, and the velocity variance is less than 1 for a duration of 1 second or longer.

Innovation is the difference between the predicted value and the latest (non-IMU) value. Variance represents the confidence the EKF has in its estimate; 0 is good, while a value greater than 1 is not.

Algorithm Changes

  • “Vibration compensation ON” will appear on the ground station HUD. The EKF climb rate will be calculated using a third-order complementary filter tuned for higher vibration tolerance (though with reduced accuracy). The altitude controller switches to a more vibration-resistant two-stage controller (position → velocity) instead of the standard three-stage controller (position → velocity → acceleration). The vehicle will not change flight modes, but altitude hold performance will be less precise than normal; the vehicle may overshoot its target altitude and/or respond more sluggishly to pilot inputs.

Disable

  • Vibration compensation will remain active for at least 15 seconds.
  • If the EKF recovers, “Vibrational OFF” will be displayed on the HUD, and the climb rate and altitude controllers will revert to normal operation.

Parachute

This section explains how to set up manual and automatic parachute deployment.

There may be a risk of danger. Please use this feature with caution.

Connect to Pixhawk

The parachute mechanism can be triggered via a relay or a PWM signal (e.g., a servo); however, because relay pins are pulled high during startup, we recommend using PWM—specifically, the AUX1-AUX4 pins on the Pixhawk.

Plan using Mission Planner

To configure the parachute release, first connect to Mission Planner, then open the **Config/Tuning > Full Parameter List** page and set the following parameters:

  • CHUTE_ENABLED = 1
  • CHUTE_TYPE = 10 (set to PWM control)
  • CHUTE_SERVO_ON should be set to the PWM value required to release the parachute
  • CHUTE_SERVO_OFF should be the PWM value before release

If using AC3.5 (or higher), set SERVO9_FUNCTION = “27”. SERVO9 corresponds to the Pixhawk’s AUX OUT 1. To use AUX OUT 2, set SERVO10_FUNCTION to 27, and so on.

If using AC3.4.6 (or lower), set RC9_FUNCTION = “27”. RC9 corresponds to the Pixhawk’s AUX OUT 1. To use AUX OUT 2, set RC9 to 27, and so on.

  • Manually configure the parachute for Channel 7 via the Extended Tuning page in Mission Planner.

When will the parachute deploy?

When the “crash check” function detects that the aircraft has lost attitude control and is falling, the motors stop, and the parachute deploys automatically. For the crash checker to trigger parachute deployment, the following conditions must be met continuously for 2 seconds:

  • Motors are armed
  • The aircraft is not “landing” (the system considers a landing to be in progress if the throttle output is below 25%, the motors are at their minimum limit, the aircraft is rotating at more than 20 degrees/second, and the pilot has not commanded a landing—provided this state persists for at least one second)
  • The aircraft is not in FLIP or ACRO flight mode
  • The deviation of the aircraft’s roll and/or pitch angle from the target tilt angle exceeds 20 degrees
  • The barometer indicates that the aircraft is not climbing
  • The aircraft is above the CHUTE_ALT_MIN altitude

Test Parachute

Parachute deployment can be hazardous depending on the release mechanism; please exercise caution when performing these tests and ensure the parachute and vehicle propellers are safely removed or disabled.

To test manual deployment:

  • Set the `CHUTE_ALT_MIN` parameter to zero to disable the minimum altitude check.
  • Arm the motors in Stabilize mode and raise the throttle to the minimum level.
  • Move the Ch7 switch to the high position.
  • You should observe the motors stop, the parachute servo actuate, and—if telemetry is connected—the message “Parachute: Released!” appear on the HUD of the “Flight Data” screen.

To test the automatic deployment:

  • Set the `CHUTE_ALT_MIN` parameter to zero to disable the minimum altitude check.
  • Arm the motors in Stabilize mode and raise the throttle to the minimum level.
  • Tilt the drone by at least 20 degrees.
  • After 2 seconds, the motors should stop, the parachute servo should actuate, and—if telemetry is installed—”Parachute: Released!” should appear on the HUD of the “Flight Data” screen.
  • Once testing is complete, revert `CHUTE_ALT_MIN` to the desired altitude (default is 10m).

The above content covers the tutorial on configuring the failsafe mechanism for a multi-rotor aircraft for the first time.
Please stay tuned for the next article:
《Multi-Rotor Aircraft: First Flight Tutorial》

Purchase Channels

CUAV Downloads

Products Brochure

Product Usage Scope and Limitations

Seraphinite AcceleratorOptimized by Seraphinite Accelerator
Turns on site high speed to be attractive for people and search engines.