Our Cinestar 8 bites the hand that feeds it!

Id say the motor safety switch may actually be less safe than the standard startup and shutdown procedure. Its very hard to accidentally start the motors using the stander procedure.

 

You've watched my new DVD on MK Tool, haven't you Brad! <evil grin>
I agree with you!

Andy.

 

Ha.. Actually not yet. Out of town til the 4th.

 

Sebastian thanks. Will take a look as I am sure others will as well. By any chance do you have the flight timers activated on your MX-20? If you do then there will be a log file on the SD card in the battery compartment of the MX-20 that would help the analysis. The MX-20 only logs if the flight timers have been turned on in the Flight Timers menu.

 

Sebastian

Here is an analysis from myself and Andy. Andy and I reviewed the video and the GPX file and here’s what we found.

From the video standpoint I watched the video pretty closely and it looked like the motors never shut off. The ship lands and goes to what appears to be idle, you start walking in from camera left and then the copter takes off. During those few seconds of tape the props never stop spinning. Usually motor off spins the props down pretty quickly.

Andy even did some sound analysis in his edit suite and came to the same conclusion watching the sound waveform.

Then there is the GPX file. It was a short flight of only 53 seconds. Note that the GPX file does not start recording until the throttle hits about 40%. So if you start the copter but don’t immediately lift off anything that is happening control wise during that period is not recorded.

As the recording starts there is a Low battery warning for 1 second. Battery voltage was 14.1 volts on the first recorded data point. That is 3.52 volts per cell and a battery is considered totally depleted at 3.3 volts. Lowest voltage was 12.8 volts (which is 3.2 volts per cell).

The ship takes off, we don’t see that in the video, and begins to fly. At 16 seconds there is another Low Bat alarm that continues, with a couple of small 2-3 second gaps, until the end of the recording.

36 seconds: The throttle has been reduced to a -123 setting (the NC board uses a scale of -127 [minimum throttle] to +127 with zero as the mid-point) and remains there until the end of the recording. This is the landing we see. The throttle position does not change but since we lose the radio connection and don’t have the log from the Graupner we don’t know what other inputs might have occurred.

39 seconds: The log records a Fail Safe error. This is the indication that it has lost the signal with the transmitter. Since we don’t have a log file from the Graupner this could be triggered by one of two events. The power was turned off on the transmitter or the receiver failed. The copter goes into Fail Safe mode which is a sequence of going into Altitude Hold (AH) , then trying to increase/decrease altitude to match theCome Home (CH) altitude setting followed by Position Hold (PH) and then executing the Come Home (CH) command.

43 seconds: CH is activated. According to Andy's analysis of the source code the Emergency CH kicks in about 5 seconds into the event based on the coding in the software.

49 seconds: Vario switches from trying to climb to descending.

53 seconds: Recording stops

This is the Graphview from GPXTool and you can see the various events and when the occur.



While the ship was in the air it seems to be trying to dos what it’s logic says to do. As a narrative: I just lost signal to the controller. I need to turn on AH and PH and will pause to see if I get a signal back. I will wait 5 seconds. I don’t hear anything I need to fly home and if I get back to my GPS home position which I recorded when I did my motor start with a GPS fix and still don’t get a signal back I will reduce power to the Emergency Gas setting and land.

From all the indications that is what it was trying to do. It was simply executing the Emergency Come Home procedure even though it was on the ground and already home. We think that this is a fail-live error in the software of the NC board. It should be able to detect that it is on the ground and not flying even if the motors are still running. There is apparently no such logic in the NC software according Andy's preliminary analysis of the source code.

You might ask why did it fly in a circle if it was already home? The log file shows that the Target distance/bearing started at 0 and stayed there during the short flight duration before landing. There wasn’t much of a radius during the entire flight time. But at the 40 second point, one second after the loss of signal, the Target Bearing (TB) and Target Distance (TD) start to change. TD slowly increases during the remainder of the event. The last recorded distance is 1.3m and the furthest was 3.4m. The bearing is changing with every recording point. This correlates to what we see in the video. So it appears that the copter is trying to find home but since it is already there is processing that information before it starts the landing sequence.

There is also the possibility that the uncommanded flight path is a product of a combination of the GPS inaccuracy and the logic of the Emergency Come Home -- which Andy doubts has been designed and tested to deal with "Distance to Target already zero!"

Summary: The ship never had the motors turned off. They were at idle and either the transmitter was turned off or the receiver failed. Copter went into Fail Safe mode and attempted to come home.

Suggested operating procedures:

1. Never turn the transmitter off until you are done flying and the batteries in the copter have been disconnected.
2. If the props are still spinning, you must regard the copter as armed and dangerous. (You stop until the props stop!)
3. Do not walk around with the transmitter dangling from your neck. It is too easy to change switch/stick positions.
4. Always use a microSD card in Navigation Control board.
5. Always set your Graupner transmitter so that the throttle stick controls the flight timers so the transmitter records log information to the microSD card. These logs will also contain Lat/Lon information which could be useful in the situation of a fly away.
6. Check the setting of the Low Battery alarm. A suggested setting is for 14.4 volts to allow a safety margin and return to a safe landing.

 

If you're into Monty Python, you'll know that "it's all in a days work for Bicycle Repairmen." See .

I second Adam's sentiments that we really appreciate you sharing the details of this so that we can all learn from it.

I've been in contact with Miktrokopter and suggested some ways that they might wish to considering avoiding this "fail live" situation. I've not seen their response yet -- but it's basically a way of suppressing the Emergency Fail Safe procedure when the copter is on the ground. Until you reported this incident, I had no idea that the software on the MK Boards would fail live like this.

Andy

 

Mike I am working on a sticky note for the Graupner Flight Timer setup. Should be up by the weekend.

 

I'm happy to report that, in the next version of the MK Firmware, Holger and his team have added the logic to suppress the Emergency Come Home feature when (a) the copter is within 40 meters horizontal of home, (b) at or below 15 meters of altitude, and (c) the throttle has been at idle for more than 1.5 seconds.

This will prevent the kind of accident that Sebastian suffered (in every sense of the word "suffered").

Let me just add how impressed I am with the speed with which Holger reacted to my email, we exchanged a couple of ideas how best to determine "the copter has landed," and then Holger and his team implemented the feature to prevent this kind of accident in future.

I do not know the version numbers and the release date of the new firmware other than "real soon now."

Andy.