Sooner or later, your control link is going to fail. No radio control system is perfect, and we collectively tend to stress the limits of them from time to time. What will happen when that link finally breaks? You’d best know the answer before you take off, instead of finding out in the middle of a long flight.
Failsafe settings are the “last resort” behavior when your craft no longer receives control signals. In the community, pilots sometimes talk about “getting a fail safe”, which simply means the control link stopped working. Your radio receiver will be the first to notice if you’ve lost control, and can adjust its behavior as well as notify the flight controller. You can also manually force a quad into failsafe mode using a switch on your radio, so FAILSAFE can refer to a flight controller “modes” action. These fallback conditions are sometimes hyphenated as “fail-safe”, spelled with two words as “fail safe”, or abbreviated either as “F/S” or “FS”.
Why Do We Need Failsafe?
Failsafe prevents your quad from acting dangerously if you lose control. It also prevents what is called a ‘fly away’, where an uncommunicative craft continues to travel indefinitely. Finally, failsafe can manage short-term control link quality problems.
If your drone has GPS and barometer sensors, sometimes failsafe can automatically return it to you and help it land softly, further protecting your equipment. For racing and freestyle drones, we don’t recommend this. Our drones are simply not built for this level of automation. Attempting this without additional proximity and environment sensors can have unexpected and dangerous results. A quick search for “phantom return to home fail” should convince you why this isn’t appropriate: even expensive drones often can’t get it right. That’s not to mention the expense and weight of such components and the risk of damaging them in inevitable crashes.
How Does it Work?
When control is first lost, your radio receiver is the first to know and uses its own failsafe settings. The receiver decides what to set each control channel to in the absence of a signal, and may pass on a ‘failsafe’ flag to a connected flight controller. If your flight controller sees that there is a problem with the control signal, it will activate its own failsafe mode. To be more specific, Betaflight goes into failsafe when a switch turns on the FAILSAFE mode, when a receiver sends a ‘failsafe’ flag, or when any control channel signal is outside the allowed range. A control channel is throttle, pitch, roll, or yaw. If an AUX channel goes out of range, it will use that channel’s individual fallback setting without triggering failsafe for everything else.
A flight controller can be smarter than a receiver about how it handles a failsafe, so it’s usually preferable to let it do most of the work.
Setting up Failsafe in Betaflight
As with all bench work, remove your props before making configuration changes. Fire up Betaflight and head over to the “Failsafe” tab. The “Failsafe” tab only appears if you enable “Expert mode”.
Each standard functioning RC channel provides a value from 1000 to 2000. These limits can be adjusted from the transmitter to give you more control range, but we do not recommend this for miniquad pilots. In the “Valid Pulse Range Settings”, you can decide how far out of range the signal needs to go before Betaflight will kick over into Failsafe mode. The defaults of 885 and 2115 rarely need to change unless you’ve made changes to the “EPA” or “end points” on your transmitter. Leave them alone unless you have a special need with your transmitter and receiver.
When Betaflight goes into failsafe, it starts in “Stage 1”. Within the Stage 1 panel, set what you’d like each channel to do immediately when the signal gets lost. Your options for control channels (throttle, pitch, roll, and yaw) are “Hold” and “Auto”. The options for AUX channels are “Hold” and “Set”.
- Hold means that this channel will continue as if the radio switches and sticks have not changed
- Auto means different things for different channels:
- Throttle will go to its lowest value (off)
- Roll, Pitch and Yaw will go to center
- Set allows you to choose a specific value that will be used—an input area appears for the channel when selected
Stage 1 is only active for a short time. This time is configurable in the Stage 2 panel, and the default four tenths of a second is a good value. Why set up behavior that lasts just a fraction of a second? Stage 1 is most useful for catching temporary control signal dropouts. If something goes between you and your model, or there’s some brief interference, Stage 1 gives you a buffer where it’s easy to regain control during flight. If the radio signal comes back during Stage 1, you will pick up right where you left off and can keep flying. (If this happens, consider safely landing right away to investigate the cause of the signal loss.)
If you normally fly in acro/rate or horizon mode, then roll, pitch, and yaw are safest when set to “Auto”. If you are rotating when failsafe kicks in, “Auto” will stop the rotation. With “Hold”, your quad would continue spinning and could easily flip upside-down. Angle mode pilots should consider leaving these on “Auto” as well, since centering the stick will level the quad and slow its momentum. Using “Hold” during angle mode is also acceptable, because the quad will simply continue to fly in the direction it was already heading. It’s generally okay to do this because Stage 1 lasts only a short time.
For throttle, there’s some debate about which method is safest:
- Auto will stop the props as soon as the signal is gone, which causes the least amount of damage to whatever the quad crashes into.
- Hold will keep the quad’s velocity the same, which allows you to more easily recover if the signal returns.
Here at Propwashed, we think it’s okay to set Stage 1 failsafe to “Hold” on throttle, as long as you keep the guard time for Stage 1 to a low value. A fraction of a second probably isn’t going to make a big difference in the amount of damage caused in a crash, but recovering faster may prevent a crash from happening at all. To us, that sounds like the safer situation.
For your AUX channels, “Hold” is often appropriate. However, you can consider switching to angle mode automatically through the “Set” option. Each configured mode appears as a label by the channel to help you set these up. Remember that if any control channel goes out of range, all of these fallbacks apply, but if only AUX channels go out of range then the only fallback that is used is for the specific AUX channel that is failing. Without a failing control channel Stage 1 doesn’t become fully active.
Stage 2 kicks in once the Stage 1 timer has run out. You set this timer within the “Stage 2” settings, as its ‘Guard time’. This number is in tenths of a second. Previous Betaflight versions had the option to enable or disable Stage 2. If you’re running an older Betaflight and you see this option, be sure “Stage 2” is enabled! Without it, Stage 1 continues indefinitely. There is no good reason to disable Stage 2, so newer versions don’t even have the option anymore.
The Failsafe Throttle Low Delay allows the quad to simply disarm instead of following the full failsafe procedure when the signal is gone. If the throttle has been off for this amount of time when failsafe kicks in, it will simply disarm normally. The default time here is appropriate for most pilots.
Your options for the Stage 2 procedure are “Drop” or “Land”.
- Drop disarms immediately, shutting all of the motors off and then exiting Stage 2
- Land sets the motors to a low throttle value and uses the accelerometer to keep the craft level
When it comes to Stage 2, the choice for nearly all pilots is clear: “Drop”. The idea behind “Land” is that the quad levels out and then gently lowers itself to the ground. The software makes many assumptions about the quad and its environment, and it’s easy to imagine situations where these assumptions aren’t all true. Betaflight doesn’t know when the quad actually touches down or if the ground is level—the propellers will just keep spinning after it lands, repeatedly biting into anything nearby. ‘Low throttle’ is just a numeric value, so the actual amount of thrust produced can change with your battery output. If your craft is near people when signal is lost, the throttle value isn’t adequate, or the accelerometer has lost calibration, then “Land” can make a dangerous situation even worse. It’s best to stop the propellers from moving. We strongly recommend that everyone sets Stage 2 to “Drop”.
If you must set Stage 2 to “Land”, the props will continue spinning for as long as the craft stays in Stage 2. Stage 2 has an ‘active time’ as well, when configured to “Land”. After this duration, it will disarm and exit Stage 2. Take extreme care in setting up the ‘landing throttle’ value. If you make a mistake while testing this value, you can cause your quad to fly away. Consider using failsafe set on a switch during testing, and tethering the craft well away from anything or anyone. Use a fresh battery of the highest voltage you will ever use on this craft, (i.e. use 4S if you fly both 3S and 4S,) so that under failsafe the throttle value will not produce more thrust than you expect.
Automatic disarming within Stage 2 also activates an internal safety check where the control link must remain established for 30 seconds before it can re-arm again. If you use a kill switch, the re-arm delay is only 3 seconds. If you never took off to begin with, this delay isn’t activated.
In Stage 2, AUX channels continue to use their Stage 1 fallback settings.
You will immediately regain control of the craft if your link is re-established during either Stage 1 or 2. It’s really important to remember that your flight controller will still be armed until Stage 2 exits. It is dangerous to set a long ‘active time’ for Stage 2 in “Land” mode. For example, if your quad goes down after a failsafe, it will sit there, armed, until the Stage 2 timer runs out. Regaining the control link will cause it to immediately jump back to the throttle value and control direction that the radio is broadcasting. This will happen without warning! Avoid this by keeping your Stage 2 timer as short as possible (or just use “Drop”).
You can also enter Failsafe via a switch on your radio from the Modes tab. If you set this up, then choose in Betaflight whether this will place you in Stage 1, Stage 2, or simply disarm the quad right away.
Setting up Failsafe on Your Receiver
All receivers have a failsafe behavior, and most allow you to configure it in some way. Receiver failsafe is necessary if you are not running a flight controller at all, like with wings and other kinds of model aircraft. This is not a case where setting things up in more than one place always provides safety through redundancy. When you set up failsafe on the receiver, you can prevent your flight controller from noticing that the control link has died so it never switches to failsafe mode. Be sure you conduct a failsafe test each time you set up a new quad or re-bind your receiver.
Recent FrSky receivers get their failsafe settings passed to them from the radio. Enter the menu for your model. In the Model Setup page, scroll to “Failsafe” or “Failsafe mode”. Here, you can choose what to do when the connection is lost:
- No pulses effectively sets all channels to zero
- Receiver passes control of the Failsafe behavior to whatever is configured on the receiver itself
- Custom allows you to set each channel’s value
- Hold keeps the last received value in place indefinitely for all channels
- Not set also sets all of the channels to zero, but will warn the user that they have not consciously selected a failsafe behavior
To have Betaflight take over, set the failsafe mode to “No pulses”. Other options can keep Betaflight from seeing an out-of-range signal value, preventing the switch into failsafe mode.
Most FrSky receivers have a button on the receiver itself to set up failsafe. Check your specific receiver’s manual, but this will usually bet set to “No pulses” each time you bind, and will use the current stick and switch positions on the radio if you activate it. Again, to have Betaflight retain control, keep this on the “No pulses” default.
Spektrum receivers acquire their failsafe settings when they are paired. In general, make sure that your throttle is full low and your sticks are otherwise centered when binding the radio to the receiver, and you will be good to go. There are ways to customize failsafe further, but they’re not relevant for miniquads. If for some reason your failsafe is not working properly, try re-pairing your RX and TX to reset the failsafe settings.
It takes some extra effort to get FlySky receivers to send out-of-range singals, even when the radio link is lost. It’s possible with a bit of clever configuring. We previously looked at this in detail in our article on configuring iBus.
The Last Resort
If your receiver can’t be configured to send out-of-range signals but you have a spare channel, you can use Betaflight’s “modes” to force it into the failsafe condition. Start by opening Betaflight and switching to the “Receiver” tab. Turn both your radio and receiver on and make sure you establish a connection, then shut off the radio. Find a spare AUX channel that you can use for this purpose and take note of its position.
Switch to the “Modes” tab and find the FAILSAFE mode. Enable it and set it to the AUX channel you have chosen, with the slider set so that it is active now, when your radio is off. At this point your quad won’t be able to fly since it’s in FAILSAFE mode all of the time.
Turn your radio back on and it will re-establish the connection. Through your radio’s settings, find the AUX channel that you were using and change the value to be something very different than what you saw before you turned it on. For example, if the ‘off’ value is 1000, setting the channel to “100%” should give you a value in Betaflight near 2000. Finally, make sure the FAILSAFE mode range covers the position when the radio is “off” but doesn’t cover when it’s “on”. Flip the radio on and off to be sure.
Finally, on the “Failsafe” tab, set the Failsafe Switch to “Stage 1”.
This will allow you to use Betaflight’s failsafe settings as you would normally.
A Final Word
When you’re setting up failsafe, consider switching on the buzzer option for RX_LOST in the “Confiruration” tab. If you have a buzzer installed, this will help you find your downed quad much more easily. If you don’t have a buzzer but you’re running DShot, set up ESC beacon instead. In recent Betaflight, this is easily done right from the “Configuration” tab as well. (Older versions require some command line work, and the commands changed over time, so you’ll have to look up your specific version.) In our experience, warnings about motors overheating while using the ESC beacon are overblown. We’ve run a test with a quad on beacon for nearly an hour, and a second test where we literally put a clamp on a motor while the beacon ran at full strength for half an hour. In both cases, the motor didn’t even begin to get hot. Even so, it’s better to lose a motor than it is to lose the whole quad!