Redundancy: dual IMUs and dual magnetometers (compasses).
Nice. Hopefully the next Inspire has redundant everything.
Nice. Hopefully the next Inspire has redundant everything.
P4 has redundancy
- Thread starter damoncooper
- Start date
Except, its not really redundancy. Having two data sources is just as bad as having one, its why airplanes have three of every key data point. If one appears bad, how do you know the other is right? You need to have at least three for it to be meaningful.
- Joined
- Feb 3, 2015
- Messages
- 1,882
- Reaction score
- 734
Yup, there are ways to estimate the quality of the data an IMU provides, but if anything we've had first hand experience of how unreliable it can be on the Inspire in the early days.
Sounds a lot more like it's a feature that was added for marketing to be able to tick a box rather than for actual safety improvements.
Sounds a lot more like it's a feature that was added for marketing to be able to tick a box rather than for actual safety improvements.
Having two data sources is not just as bad as having one. It is actually twice as bad as having one because now there is twice the chance of any IMU throwing a fit and downing the craft. Precisely like Ian mentioned about a RAID 0 setup. If either drive fails, you lose all your data. Also why commercial jetliners have 3 so they can resolve the bad one and ignore it.
I'm not sure how DJI's implementation of dual IMUs is going to make it safer. Perhaps they aggregate the result of both IMUs?
- Joined
- Aug 7, 2013
- Messages
- 10,851
- Reaction score
- 5,717
I have already asked this question and from the reply I got back it appears that the IMU's actually run independently from each other.
There are some jiggery Pokery algorithms that take into account the received stick positions data coming from the RX in the aircraft as well as the attitude of the aircraft.
The FC then looks at outputs of all IMU mems units and if an accelerometer on one axis is showing a 'runaway scenario' or non altering data stream the P4 will assume that IMU is faulty/giving erroneous data and switch it out of the control loop. There will be a corresponding error message displayed in the app and most people will bring their aircraft back pretty sharpish. However, utilising the above logic means that if an IMU goes down at no point will an operator loose control of their aircraft.
It's a similar story on the compass but I really can't see a compass throwing a fit and causing problems. Also, if you were to fly over an object influential enough to alter the magnetic flux on the P4 it would throw both compass's out at the same time.
Yes, I agree, as I have mentioned on here previously, three units is needed for true redundancy but I can see the logic behind two and the 'lock out' condition if one is considered bad.
There are some jiggery Pokery algorithms that take into account the received stick positions data coming from the RX in the aircraft as well as the attitude of the aircraft.
The FC then looks at outputs of all IMU mems units and if an accelerometer on one axis is showing a 'runaway scenario' or non altering data stream the P4 will assume that IMU is faulty/giving erroneous data and switch it out of the control loop. There will be a corresponding error message displayed in the app and most people will bring their aircraft back pretty sharpish. However, utilising the above logic means that if an IMU goes down at no point will an operator loose control of their aircraft.
It's a similar story on the compass but I really can't see a compass throwing a fit and causing problems. Also, if you were to fly over an object influential enough to alter the magnetic flux on the P4 it would throw both compass's out at the same time.
Yes, I agree, as I have mentioned on here previously, three units is needed for true redundancy but I can see the logic behind two and the 'lock out' condition if one is considered bad.
Thanks Ed for checking and sharing that info on the IMU. I was guessing DJI can't be THAT stupid to introduce dual IMU and dual Compass without proper redundancy 'lock out' algorithms, but I've been wrong many times before. Even commercial jetliners' version of IMUs have gone wonky before and done some weird stuff to the aircraft so I wouldn't trust a $1,399 piece of tech with 100% confidence 100% of the time.
- Joined
- Feb 3, 2015
- Messages
- 1,882
- Reaction score
- 734
Of course if there are 2 IMUs and they are touted as redundant there will be some mechanisms to detect a problem with one and isolate it.
But the thing is that with only 2 you can only detect extremely obvious problems, e.g. a sensor failing to provide data at all, or being completely out of whack/off scale. Anything more subtle and while you might be able to see one is wrong you can't know which.
Oh well, better than nothing I guess. Like having proximity detection sensors only on the front of a machine of which half of the promo shots were taken going backwards or orbiting sideways
But the thing is that with only 2 you can only detect extremely obvious problems, e.g. a sensor failing to provide data at all, or being completely out of whack/off scale. Anything more subtle and while you might be able to see one is wrong you can't know which.
Oh well, better than nothing I guess. Like having proximity detection sensors only on the front of a machine of which half of the promo shots were taken going backwards or orbiting sideways
Side/back proximity sensors are reserved for the P4P that will be launched once the P4 sales taper off..Oh well, better than nothing I guess. Like having proximity detection sensors only on the front of a machine of which half of the promo shots were taken going backwards or orbiting sideways
Using two IMUs for redundancy purposes depends entirely on detecting implausible values and handling them appropriately. I guess when you smell something fishy with one, you could compare it to the other to determine if it is real or erroneous.
My question is why stop at two. Three gives you unequivocal verification with less effort. MEMs are cheap. Even good ones.
My question is why stop at two. Three gives you unequivocal verification with less effort. MEMs are cheap. Even good ones.
- Joined
- Aug 7, 2013
- Messages
- 10,851
- Reaction score
- 5,717
I agree. Why the hell they didn't just go for three is beyond me. I wouldn't mind betting that by utilising three the coding overhead would be less complex as well since you are simply comparing three data streams and if one goes out of whack the faulty unit is identified.
We already KNOW they can't design and build cameras, I sometimes wonder about some of the UAV design desicions as well.
Dual IMUs and compass have long been used in Ardupilot and it is better than having one. For starters you can check for consistency by comparing both IMUs, if their readings don't match you don't start the aircraft.
Sean McLean makes a good point for using three sensors, but still 2 is better than one IMO
Sean McLean makes a good point for using three sensors, but still 2 is better than one IMO
So you lets say you have A IMU reporting 10 and B IMU report 9 - which one is correct? We are talking more about smaller variances and 2 really doesn't help (even extreme conditions say if IMU A reports 10 and IMU B reports 5 - which is it?? there is nothing to tell if A is correct or B is correct).
I you had A reporting 10, B reporting 9, and C reporting 10 you could clearly see that 10 is correct.
or A 10, B9, C11 you could get the medium value between all 3, which would be 10 which would show that IMU A is reporting more correct than others and an algorithm could be to put more logical weight on IMU A as being correct.
This is just a crude example, but 3 gives much more clearer picture.
Expect to see triple redundancy in the Phantom 5D....
The more crashes they have the more money they make. Like the inspire you could not get parts for a long time had to send it to L.A.
I think it's more for in the case of wildly incorrect data from one instrument. A buffer overflow error could produce this for example if a software bug made it through.
Ian Wood documented a case where the sensor data suddenly went to -697,854,854,425,774,699 and the aircraft FC thought that was a great value and "why yes, I do need to head to the other side of the planet to correct my position."
Having another reference point from another instrument that presumably may not have gone insane would allow the first to be shunned.
Presumably.
But like in high availability mission critical services like I run in my day job, for true HA you should always do things in 3's.
Similar threads
