EKF Failsafe

The EKF failsafe monitors the health of EKF (the position and attitude estimation system) to catch problems with the vehicle’s position estimate (often caused by GPS glitches or compass errors).

In fixed wing flight a bad EKF solution is handled by falling back to the DCM attitude estimator, so no failsafe action is taken. The EKF failsafe described on this page therefore only applies to QuadPlanes, and only while flying in a VTOL mode that requires a position estimate (QLOITER, QRTL, QLAND, QAUTOTUNE and VTOL AUTO). It is not active in QSTABILIZE, QHOVER or QACRO, nor in any fixed wing mode.

When will it trigger?

The EKF failsafe will trigger when any two of the EKF “variances” for compass, position or velocity are higher than the FS_EKF_THRESH parameter value for 1 second.

These “variances” come from the EKF itself and are numbers indicating the EKF’s confidence in its estimates. The values are between 0 and 1 with 0 meaning the estimate is very trustworthy and 1.0 is very untrustworthy.

The EKF calculates these “variances” by comparing the results from multiple sensors. So for example, if the GPS position suddenly jumps but the accelerometers do not show a sudden acceleration, the EKF variance for position would climb (i.e become less trustworthy)

The check only runs while the vehicle is armed.

In addition, the check only runs while the QuadPlane is in a VTOL mode that requires a position estimate. Leaving such a mode clears the failsafe.

The variances can be viewed in real-time on the ground station. If using Mission Planner click on the “EKF” label on the HUD.

../_images/ekf-failsafe-variance-viewer.png

What will happen when the failsafe triggers?

  • The autopilot’s LED will flash red-yellow or blue-yellow and the tone-alarm will sound

  • “EKF variance” will appear on the ground station’s HUD if telemetry is connected

  • An EKF failsafe error will be written to the dataflash logs

  • If the QuadPlane is flying a VTOL part of an AUTO mission the vehicle will switch to QLAND mode, since the pilot is not controlling the vehicle with the sticks

  • In any other VTOL mode requiring position (QLOITER, QRTL, QLAND, QAUTOTUNE) the vehicle will switch to QHOVER mode, which holds altitude and gives the pilot control of roll and pitch so the vehicle can be flown home manually

There is no FS_EKF_ACTION parameter on Plane, these actions are fixed. After an EKF failsafe occurs, the pilot can re-take control using the flight mode switch, either in QHOVER/QSTABILIZE or by transitioning back to fixed wing flight.

Adjusting the Sensitivity of the failsafe

The FS_EKF_THRESH parameter can be adjusted to control the sensitivity of the failsafe

  • Set FS_EKF_THRESH = 0 to disable the EKF failsafe

  • Increase FS_EKF_THRESH to values between 0.8 and 1.0 to reduce the chance of an EKF failsafe. The downside of increasing this parameter value is that during a flyaway caused by a bad compass or GPS glitch, the vehicle will fly further away before it is automatically switched to QHOVER or QLAND

  • Decrease FS_EKF_THRESH to values as low as 0.6 to increase the chance of an EKF failsafe triggering quickly. The downside of lowering this value is the EKF failsafe could trigger during aggressive VTOL maneuvers

EKF’s Glitch Protection

The EKF’s glitch protection works as follows:

  1. When new GPS position and velocity measurements are received, they are compared to a position predicted using IMU measurements.

  2. If the position difference exceeds a statistical confidence level set by EK3_POS_I_GATE then the measurement won’t be used. Similarly the velocity is checked using EK3_VEL_I_GATE.

  3. If the GPS glitch lasts long enough (usually about 7 seconds), the EKF’s position and velocity estimates will be reset to the GPS position and velocity.

  4. EK3_GLITCH_RAD controls the maximum radial uncertainty in position between the value predicted by the filter and the value measured by the GPS before the filter position and velocity states are reset to the GPS. Making this value larger allows the filter to ignore larger GPS glitches but also means that non-GPS errors such as IMU and compass can create a larger error in position before the filter is forced back to the GPS position. If EK3_GLITCH_RAD set to 0 the GPS innovations will be clipped instead of rejected if they exceed the gate size set by EK3_VEL_I_GATE and EK3_POS_I_GATE which can be useful if poor quality sensor data is causing GPS rejection and loss of navigation but does make the EKF more susceptible to GPS glitches. If setting EK3_GLITCH_RAD to 0 it is recommended to reduce EK3_VEL_I_GATE and EK3_POS_I_GATE to 300