AP-Manager switches between two Pixhawks for safety, redunancy

AP-Manager is a board available now that allows switching between two Pixhawks or APM autopilots:

Product Description

The requirements for the operation of unmanned aircrafts in commercial and semi-professional purposes have changed fundamentally in the past years in Europe and worldwide. ( FAA ) The regulations will get even more strictly in the future.

Depending on the application, the weight, the purpose, the situation, the flight area, spectators and some more reasons, SAFETY is becoming increasingly important.

Single point of failure and redundancy became the keywords for permissions and certifications from authorities and insurances.

Among other parts inside a system, redundancy of the autopilot system is meanwhile mandatory to follow the rules. Especially multicopters are very instable in their flight characteristics when it comes to malfunction of the stabilization system.

We therefore developed a redundancy circuit board which is an automatic monitoring and controlling bridge between two independent running autopilot systems, a mutual protection in case of malfunction in an autopilot system. Even if both autopilots fail (power supply, freezing controller…), the forwarding of the control signals for a manual flight of the aircraft, Delta or Helicopter is guaranteed.

This system also offers the possibility to switch manually between two different autopilot systems to test different software and sensor setups. Another benefit of the AP-Manager is that only one telemetry module is needed to monitor data of both autopilot systems (except for DJI autopilots, here you need two downlinks, from each autopilot seperate).

AP-Manager is a safe attendant for flying and testing of your unmanned aircraft.

Views: 2200

Comment by Andrew Rabbitt on June 21, 2016 at 7:02pm

Is this second post for redundancy too...? ;)

3D Robotics
Comment by Chris Anderson on June 21, 2016 at 7:44pm

LOL. Fixed!

Comment by Billy B on June 21, 2016 at 10:10pm

So who switches the switcher in case the switcher goes bad?

Comment by RM Aviation on June 21, 2016 at 10:14pm
It's a nice piece of equipment and very useful, I'm just wondering what makes it so expensive to buy? At around twice the cost of a pixhawk it just seems too highly priced.

Comment by Hugues on June 21, 2016 at 11:32pm

I do not want to pee on the parade but this board does not bring a redundancy solution to the needed real encountered redundancy problems of Ardupilot hardware and software, because it is unable to define which ardupilot provides the correct outputs. It only detects the presence or the absence of an output or in other words if an ardupilot is alive. This is a never encountered issue. 

To make it useful, a more sophisticated board is required which will compare different signals logically ( not only at hardware level) between a minimum of three ardupilot boards. In aviation rules redundancy even requires a comparison between 5 boards to allow for two failures to be detected.

Comment by Rob_Lefebvre on June 22, 2016 at 1:49am

@Billy, you could use it in combination with the Millswood failsafe.  They you have Diversity Diversification. 

Comment by Holger S on June 22, 2016 at 1:52am

As far as I understand the device, the AP Manager itself is can be considered as a single point of failure. It adds another PCB, plus lots of additional cables, all of them can fail. So where is the improvement in redundancy or reliability?

Comment by Martin Rüedi on June 22, 2016 at 6:14am

Is not the idea fundamentally flawed? Because the flight controller is just one element in a fully closed control loop. I see problems having a controller running idle, fed with feedback that comes from the action of the other controller. The I-characteristic could cause the passive controller to runaway as soon as the processing does not happen completely in sync (also time wise). Which is not given exactly in those moments when one would want to take a defective controller out of the loop...

Have ever transitions from a failed to a running controller been succesfully demonstrated usign this system architecture? Even if manually switched?

Comment by Patrick Poirier on June 22, 2016 at 12:17pm

I have a feeling of déjà-vu on these solution... seem that there is one every few month ?

In commercial aviation, half of all plane crashes are caused by pilot errors. We are talking here of highly trained professionals, so it is easy to extrapolate that in the drone business, the pilot/operator induced error should be a much higher rate. The next common cause is mechanical/electrical systems that accounts for 22% of the crashes. Considering that the autopilot is a subset of electrical systems, and based on what we can read as probable causes : Battery - Connectors - ESC  , the autopilot malfunction must be way back in the failure list.

So you end-up adding additional weight and complexity to address a very small percentage of risk.

Comment by wrostek on June 22, 2016 at 12:25pm

We should all be interested to go step by step into the direction

of certification. That will be a long road.

Thanks Chris for bringing this in.


You need to be a member of DIY Drones to add comments!

Join DIY Drones


Season Two of the Trust Time Trial (T3) Contest 
A list of all T3 contests is here. The current round, the Vertical Horizontal one, is here

© 2020   Created by Chris Anderson.   Powered by

Badges  |  Report an Issue  |  Terms of Service