The 2 two components making up ZeroPilot’s firmware system are the safety firmware and the autopilot firmware. The Safety firmware runs on an STM32F0 microcontroller and actuates and is responsible for running attitude management and actuating the servos and electronic electric speed controllers. It also reads ppm input from a hobby receiver. It is purposefully designed to be as simple and thus, as reliable as possible. Figure 3.1 illustrates the inputs and outputs of the safety firmware.
...
The Attitude Manager is a new addition to the Safety controller for the 2022 UAS competition as a result of the requirements to run math models on remote-controller inputs when flying a hexacopter.
...
During regular flight, where both Autopilot and ground data are being received by safety, the Decision Module is responsible for selecting the correct commands to send into the Attitude Manager. For example, if we want to fly the plane in autonomous mode, the Decision Module will ignore the data sent in via PPM so the drone can be flown autonomously. Likewise, if we want to fly the plane in manual mode, the Decision Module will ignore the data sent by Autopilot and only send the PPM input commands through the Attitude Manager.
The decision to have the autopilot and safety firmware run on separate microcontrollers was made in order to ensure that there was a layer of redundancy. In this way, even the hardest failure in the complex autopilot firmware cannot crash the Safety firmware, which defaults to being human controlled in times of emergencies. The Safety and Autopilot microcontrollers communicate using Serial-Peripheral Interface (SPI) as a result of the low complexity of the system and high data transfer speed. Figure 3.2 shows the safety firmware’s state logic.
Figure 3.2 Safety State Machine
The safety chip’s code was written with simplicity in mind - its role is intended to be a simple fallback rather than a complicated actuator.
PWM Manager
The PWM manager is responsible for setting the compare value on the dedicated timer channels for PWM outputs.
...
Setup is to be called once in order to set the prescaler and start PWM generation.
...
Sensors
The Safety controller has an IMU (BMX160) connected via I2C that feeds accelerometer, gyroscope, and magnetometer data to the Attitude Manager. This is needed to run the math models that allow for stable flight when generating the PWM values.
Attitude Manager
The Attitude Manager was previously on the Autopilot chip pre-2022 UAS competition. It’s main purpose is to convert commands sent via the PPM controller and Autopilot chip into PWM values for all actuators. In the context of a hexacopter, the PWM values will determine the power output of the motors while for a fixed winged aircraft it will also include the position of the elevators, rudder, etc.
More information on the composition of Attitude Manager can be found in the Attitude Manager documentation on the ZeroPilot Confluence page.
FreeRTOS
FreeRTOS is leveraged by Safety for the IMU, PPM control receiver, and Decision Module/Attitude Manager. With our current design, the IMU will run at 150 Hz, the PPM control receiver will run at 150 Hz, and the Decision Module/Attitude Manager will run at 100 Hz.
Interchip will run on an interrupt-based system.
Interchip Communication
The autopilot and safety chip communicate with SPI. @Aadi Aaditya Chaudhary to write more here.