Documentation
Short pages, written for the person holding the aircraft rather than the person who wrote the code. An aircraft we assemble arrives already set up; these are for changing it, keeping it current, and knowing what the board is doing.
Radio, motor order, battery, modes and rates: every setting, what it does, and the answer to give if you are not sure.
How new firmware reaches your board, and every rule that stops the wrong firmware reaching it.
The checks worth doing on the bench, in the order that catches the expensive mistakes first.
Setup
Nothing about your aircraft is configured by editing firmware, not on a controller you fitted yourself, and not on one we assembled into an aircraft for you. Plug it in over USB, open the configurator, and the settings are questions on a screen: which channel arms it, which switch selects the flight mode, how many cells the battery has, which way each motor turns, how sharply it should respond to the sticks.
Values are checked as you enter them. A setting the board would not survive is refused with the reason, on the spot, not accepted politely and discovered in the air.
Settings are stored on the board itself, in their own area of flash, written append-only with a checksum. A firmware update does not erase them, and a power cut in the middle of saving leaves the last good set intact.
Radio: channel map, reversals, arm switch, mode switch.
Motors: order and direction, tested with props off.
Battery: cell count and chemistry, so the warnings mean something.
Modes: what each position of the switch does.
Rates and gains: how it answers the sticks. The defaults fly.
Updates
Four things stand between your aircraft and a bad update, and three of them are inside the board, where no website and no computer can talk them out of it.
The list of releases on this server is signed with our release key and the configurator checks it against the key built into it, over the exact bytes it received. An installer carries its own signature, checked before the tool runs it. A server that is taken over can withhold an update; it cannot invent one.
Every firmware image is signed for the bootloader, which verifies it against a key burned into the chip before it writes a single byte. The tool cannot produce that signature, and neither can this website. Wrong key, wrong board, or an image that does not fit: refused, with the reason.
A genuinely signed but older image is refused too. Replaying last month's version to bring back a bug we fixed is exactly the attack that stops. And an update requested while the aircraft is armed is simply answered ARMED.
New firmware is written to the slot the board is not running, and gets three trial boots to declare itself healthy: three seconds running, disarmed, with a live gyro. If it cannot, the bootloader returns to the version that worked and marks the new one bad. A failed update costs one reboot.
What this means in practice. You can accept an update at the field. The worst case is that the aircraft comes back up on the firmware it had five minutes ago, which is the firmware you flew in with.
Before you fly
We do all of this before an aircraft leaves us. Do it yourself after anything changes: a repair, a new prop set, a controller you fitted to your own airframe. These are the mistakes that cost the whole aircraft in the first two seconds.
Everything on the bench (motor test, direction, arming, mode switch) is done with the propellers off. The tool refuses the motor test unless you say so, and it is not a formality.
Each motor must spin the way the diagram says and sit where the tool says it does. A swapped pair flips the aircraft on takeoff, every time, and nothing in the air can save it. This is the one to check after any motor is replaced.
Watch the live view: sticks move the right way, the arm switch arms and disarms, the mode switch reads the mode you expect at each position. Then check failsafe by turning the transmitter off.
Open space, no people, a battery you can afford to land on. Hover a metre up, land, look at the log. Local rules about where and how high apply to you as the pilot in command.
