Failsafe and Signal Loss

Failsafe & Signal Loss

What NaviCore does when the radio link drops — important to understand for an animatronic, where unexpected motion on signal loss is the thing you most want to avoid.

---

The short version

On a failsafe frame, NaviCore freezes — it does not act. Servos and other outputs hold their last commanded state; no buttons, switches, or knobs are dispatched. When the link recovers, normal operation resumes, and a button you were physically holding across the dropout won't auto‑fire — it needs a fresh press.

---

Background: how SBUS signals a loss

Each SBUS frame carries two status flags:

• lostFrame — this one frame was missed/garbled. Transient; a single dropped frame is normal RF jitter.
• failsafe — the receiver has decided the link is gone and is now emitting failsafe frames, with the channels parked at whatever failsafe positions the receiver was configured for.

You can watch both live in the config tool monitor and via #L09 (see CLI Commands).

---

What NaviCore does

Condition	Behavior
Normal frames	Decode + dispatch as usual.
lostFrame set (a blip)	Telemetry notes it, but dispatch continues — gating on a single lost frame would make control feel laggy.
failsafe set (link gone)	Dispatch is skipped entirely. Mode decode, the button matrix, switches, and knobs are all bypassed. Telemetry keeps updating (so the tool shows the failsafe state), but no actions fire and no servo targets change — every output holds its last value.

When failsafe clears (link restored), the matrix is re‑armed from a clean state: it requires a confirmed neutral and then a fresh press before it will fire again. So if you were holding a button when the transmitter died, NaviCore won't replay that press on recovery.

Why hold instead of go‑to‑failsafe‑pose? Because the receiver's failsafe channel values would otherwise be decoded as real input — driving servos to the failsafe pose and tripping whatever switch/knob thresholds those parked values happen to cross. Freezing is the safe choice for a prop.

---

What this means for your build

• Set sensible failsafe on the receiver too. NaviCore freezing its outputs is the firmware half; your drive/throttle ESC or motor controller (if any) has its own failsafe and should be configured to stop on signal loss. NaviCore can't stop a motor it isn't directly commanding.
• Most outputs hold; a "release when idle" pass-through channel is the exception. An ordinary servo or switch output stays energized at its last target through a failsafe. But a Maestro pass-through channel with Release when idle enabled — the default for a new pass-through output — has its idle-release timer running in loop() independently of the failsafe gate. Once the channel has been idle its releaseIdleMs (default 1500 ms) it is sent Set Target 0, the Maestro stops pulsing it, and the servo goes limp. Because dispatch is frozen during failsafe, the stick can't "move" to re-energize it, so the channel stays relaxed for the whole dropout. If you want limbs to go limp on loss, this is what provides it; if you need them to hold, leave the option off. See Maestro Setup.
• Brief RF blips are fine. A single lostFrame doesn't interrupt anything; only a real failsafe state freezes dispatch.

⚠️ A released servo has no holding torque. Use Release-when-idle only where gravity, friction, or a magnet holds the mechanism at rest — never where a servo is bearing a load you need held through a signal loss.

---

Verifying it

1. Connect the config tool and watch the monitor's SBUS health.
2. Power off the transmitter.
3. You should see the state flip to FAILSAFE, the servos stay put (no jump), and no actions fire.
4. Power the transmitter back on → state returns to receiving, and control resumes. A button held during the outage does not fire on recovery until released and pressed again.

The monitor tells two loss cases apart. If your receiver keeps emitting frames with the failsafe bit set, the SBUS dot turns red and reads FAILSAFE. If frames stop arriving entirely — a receiver that goes silent, or a laptop that was asleep — the dot instead reads No data — link idle after about 4 s, and it re-checks the instant the tab regains focus. So a slept laptop no longer shows a false "receiving" green while the transmitter is off.

If servos do jump to a pose or actions fire on power‑off, your receiver may be sending hold‑last‑position failsafe frames that don't set the failsafe bit — check the receiver's failsafe configuration so it flags failsafe (or stops output) on loss.

---

Next: Troubleshooting · Config Tool Guide