The Veronte Autopilot 4x from systems developer Embention is a high-reliability control system designed to withstand basic failures, ensuring a ‘fail-operational’ performance even if an issue arises with the referee.
Power Redundancy
Power redundancy is critical for maintaining system reliability. The Veronte Autopilot 4x features four power inputs: one for each of the three cores and an additional one for the referees. Each core is independently powered and includes fuse protections to ensure that a failure in one core’s power supply does not impact the others.
The referees also benefit from power redundancy, with duplicated feed pins for each core. Independent power domains are established for internal peripherals, distributing power to various components in a reliable and fault-tolerant manner.
Redundancy 3+1
The Veronte Autopilot 4x comprises three internal cores (Veronte Autopilot 1x) and allows for the connection of a fourth external autopilot, either from Embention or another manufacturer.
All autopilots have the capability to control the vehicle, with the arbitration stage determining which core should take control based on a redundancy strategy. In the event of a core failure, the referees will detect it and select the appropriate core to maintain vehicle control.
Redundancy Management
The referees receive data from the various autopilot cores, each of which conducts built-in self-diagnosis tests (BITs) and communicates its status through a watchdog signal, helping to identify malfunctions. The cores send status updates and voting data to the referees via two redundant communication buses, which the referees use to decide which core should control the vehicle.
Robustness to Referee Faults
In the unlikely event of a failure in one of the referees, there are safeguards in place to ensure that one autopilot will always remain in control. If the referee fails to generate an output signal, Core 1 is selected by default. Since the referee has failed, no further core failures are anticipated.
Learn more about the Veronte Autopilot 4x >>
I/O Robustness
Redundancy in the system is designed to complement overall vehicle redundancy. To avoid critical failure points, redundant actuators and other critical components should be employed. These devices can connect through multiple ports on the autopilot, with internal management of communication redundancy.
The overall redundant system design should consider autopilot outputs and power banks to minimize single points of failure. For communication buses like RS232 or RS485, the output (Tx) is managed by the core selected by the referee, while input data (Rx) is received by all cores via individual buffers, reducing single points of failure.
Signals such as PWM and GPIO are managed by independent multiplexer banks, and in the event of a multiplexer failure, secondary I/O options are used.
Integrated FTS
The Veronte Autopilot 4x also features a completely hardware-independent referee voting system that can function as a Flight Termination System (FTS) in the event of a catastrophic failure involving all three autopilot cores.
These features make the Veronte Autopilot 4x one of the most robust redundant control systems in its category. Its compact and lightweight design makes it ideal for controlling autonomous vehicles, and is ideal for manufacturers of drones and eVTOLs.
