The 2 components making up ZeroPilot’s firmware system are the safety firmware and the autopilot firmware. The Safety firmware runs on an STM32F0 microcontroller and actuates the servos and electronic speed controllers. It also reads ppm input from a hobby receiver. It is purposefully designed to be as simple and thus, as reliable as possible. Figure 3.1 illustrates the inputs and outputs of the safety firmware.
Figure 3.1 Safety Firmware Inputs and Outputs
The decision to have the autopilot and safety firmware run on separate microcontrollers was made in order to ensure that there was a layer of redundancy. In this way, even the hardest failure in the complex autopilot firmware cannot crash the Safety firmware, which defaults to being human controlled in times of emergencies. The Safety and Autopilot microcontrollers communicate using Serial-Peripheral Interface as a result of the low complexity of the system and high data transfer speed. Figure 3.2 shows the safety firmware’s state logic.
Figure 3.2 Safety State Machine
The safety chip’s code was written with simplicity in mind - its role is intended to be a simple fallback rather than a complicated actuator.
PWM Manager
The PWM manager is responsible for setting the compare value on the dedicated timer channels for PWM outputs.
Setup is to be called once in order to set the prescaler and start PWM generation.
Set is to be called whenever the PWM value needs to be adjusted on a specific channel
Interchip Communication
The autopilot and safety chip communicate with SPI. @Aadi to write more here.
Add Comment