Copter: Stand-By mode for use with multiple flight controllers running in parallel

[lthall]

StandBy is the ability to have multiple flight controllers working together where only one of these is the controller in command (CIC). The "ride along" controllers can experience significant I-term build up as they may have different attitude solution compared to the CIC. The secondary controllers may also be placed in a more basic mode. For example, during an auto mission the secondary flight controller may be held in Loiter.

The functionality in this PR is designed to be a minimum impact standby functionality for ArduCopter.

The requirements of this capability are:

• Remove I term build up
• Remove integrated build up sources
• Not trigger crash checks, parachute, or landing detectors.
• Ensure the aircraft will still fly effectively in Stabilize, Alt Hold, Loiter and continue to stabilize the aircraft in other modes. This is to ensure the aircraft will continue to be controllable in the event that a secondary flight controller is made CIC without disabling the Standby state.

This will be the first introductory implementation of this functionality to facilitate development in this area.

[proficnc]

Love it!
Thank you Leonard! This is absolutely awesome!

[lukezhqin]

good! SO you guys want to add a redundand CPU architecture?

[amilcarlucas]

I guess this is more a redundant CUBE architecture. I like it. A lot !!!

[proficnc]

Not just Cube, but yes, multiple Autopilots allowing for true redundancy.

Leonard has done some awesome work in this area

[lthall]

@amilcarlucas There is no aspect of this that is hardware dependent. It will enable a variety of methods and approaches to be further developed. This patch provides the most basic functionality required to have an autopilot in an armed and flying state while not in control.

[rmackay9]

Generally looks pretty good. A few issues related to naming and formatting and then a couple of questions.

[lthall]

For some reason this failed:
CI_BUILD_TARGET="sitltest-rover sitltest-sub sitltest-balancebot"

[peterbarker]

On Tue, 8 Oct 2019, Leonard Hall wrote: For some reason this failed: CI_BUILD_TARGET="sitltest-rover sitltest-sub sitltest-balancebot"

Try rebasing on master and pushing up again, please.

[rmackay9]

Merged, thanks!

[proficnc]

Awesome!!! A new era in ardupilot begins!

[Kiwa21]

Can we have more info on this ? @proficnc @lthall
Should we expect a dual/tri cube architecture "soon" ?
Thanks

[GlidLov]

Hi all
I'm very interested in the StandBy mode, looking forward to create a fully rendundant FC.
First, i must say what "real rendundant FC" means to me: a cluster of FCs where you can take apart one (phisically removing it) and system would still able to fly.
Now, my doubt is about architecture and thus wiring. Culprit here is connection to ESCs: as today, escs (most of them, at least) are controller by one single wire (abstracting comm protocol here) which has to be connected to an FC. Now, this leads to only one kind of system: a primary FC which has ESC connected, and a secondary FC which shares data with first one via mavlink (to ensure attitude solution is good, to be aware if the primary FC is working ok, etc). Then, when the second one is triggered, first one must release PWM outputs control to the second one, which will drive ESCs using part of first's HW.
However, this solution is inherently weak, because first FC must be still used somehow while second kicks in, and this makes this architecture not fully rendundant. A real rendundant one, would have a second set of PWM wires directly connected to the same ESC as first. Then also ESC must have a two-input discrimination system.
Other solution, which is even weaker maybe, is to implement an "ethernet/IP style" comm protocol to ESCS and making wires to escs all in common just like an ethernet network, which supports seamless plugging and unplugging nodes. Problem here would be protocol which normally has to be a strict real time thing. Packet based can't guarantee sync, reliability etc

So, do a working (on paper, at least) architecture has been shared already, on top of standby mode?