Published date: 13 December 2019

A recent RPAS accident has highlighted an issue affecting aircraft with some recent versions of Arducopter firmware.

The accident involved a loss of the flight controller, which is believed to have been caused by ArduPilot causing the main processor to crash due to a situation referred to as i2c storm.

In such situations, the the i2c (an integrated circuit to integrated circuit communications bus) experiences external noise, and lots of interrupt messages. These interrupt messages flood the processor, and result in the processor rebooting.

Noise on any peripheral or bus should not cause the flight controller to reboot.

Arducopter 3.6.11 was released and introduced a bug fix to solve the issue of these interrupts from causing a processor crash, by introducing an interrupt limit. It was not released as a critical safety update.

Further testing in the community has shown that the issue still exists in 3.6.11, and in Release Candidate (RC) 4.0

This issue appears to exist in any STM32 based flight controller running ArduPilot/Plane/Copter and using the i2c bus. i2c is commonly used for magnetometers, range finders, and a range of external sensors.

Immediate actions

  • It is recommended that operators with this firmware cease all operations of aircraft running ArduPilot and i2c peripherals, until code is produced, tested, and proven to solve the issue.
  • Discussions around solutions to the issue are ongoing.
  • Discussions around reviewing and promulgating critical software/firmware updates are ongoing.

Until this situation is resolved, please avoid flying over people or congested areas.