# Pyro Drone System Design ## The Safety Benefits of an Integrated System ### Failure State Handling Independent systems fail independently. With pyro on drones, that statement is catastrophic. As the table below shows, mutual failure of systems is necessary to mitigate safety risks. Independent systems require fast-paced manual human intervention. It’s a recipe for safety risks to go unmitigated.


Failure Mode	Independent Result	Independent Mitigition	Integrated Result	Integrated Mitigition
Drone Power Failure	Drone begins plummeting. Firing is system still active.	Operator must disable pyro module before or after impact. Damage to pyro module while still active may lead to undesirable results.	Firing system turns off. Drone is disabled.	None necessary
Pyro Power Failure	Firing system is disabled. Drone continues show safely.	None necessary	Firing system is disabled. Drone continues show safely.	None necessary
Drone Comms Loss	Firing operator may continue to monitor system state for arm/disarm.	Operator must discover and disable associated pyro module asset as a drone comms failure requires it.1	Drone detects loss of heartbeats from GCS and internally disables the firing module.	None necessary
Pyro Comms Loss	No ability to arm or disarm pyro module remotely.	No possible mitigation. With no path to the pyro module it cannot be armed or disarmed automatically or manually while in flight.2	Module can no longer be fired. It is disabled by virtue of no comms to the drone.	None necessary
Drone Failsafe	Drone autolands or returns to home. Firing module continues to be active.	Operator must disable pyro module before it lands or it returns to the launchpad such that it doesn’t fire improperly.	Firing module is automatically disabled	None necessary
Drone Doesn’t Launch	Module continues to be armed.	Operator must disable pyro module manually before it fires.	Firing module is never armed	None necessary

1 A well-behaving light-show drone failsafes automatically upon GCS link-loss, so the operator MUST disable that drone's pyro, or all pyro, to ensure ignition does not occur as the drone is failsafing. The additional complexity of identifying the drone and mapping it to an associated firing module is extremely difficult to do in a time-sensitive manner. Functionally, the only mitigation is to disable all firing modules. 2 As an example of module behavior, modern versions of firmware for the Cobra wireless firing module have a very long auto-disarm time. If communication is lost, by either going out of range, or if the firing remote dies, the module will not disarm itself for upwards of 60 seconds. [See reference here](https://help.cobrafiringsystems.com/hc/en-us/articles/5495286986907-If-I-power-off-my-18R2-will-my-modules-stop-firing). ### Eliminating Address Confusion - Which Drone Has Which Firing Module? There is always some kind of mapping between firing systems and drones. Drones will take up a role in a show and be assigned an address ID associated with that role. Likewise, each firing system in an independent system must also be assigned an ID so that firing timings and cues are mapped appropriately. As the firing system and drone system are independent, very specific drones must be placed in very specific roles in order to be mapped appropriately. Otherwise, there may be gaps or products may fire out of order. It is for this reason that the majority of pyro effects seen in drone shows fire products simultaneously or use limited product diversity within a show. This same complexity makes it impossible to identify and command a pyro module as their order and position change constantly throughout a show. Existing firing systems have not been designed to accommodate these challenges as the assumption is that they are going to be in a fixed location with a fairly static environment.

In this screenshot from the Verge Design Studio, the drone address values can be seen after transitioning to a circle

As can be seen above, drones do not address in an “ordered” fashion in a given shape. Even if firing modules were addressed to map 1:1 between drone role ID and firing module ID, it would be very difficult to know which of the positions represents an ID at any given time visually. Keep in mind that many drone shows have drone quantities into the thousands and payloads may vary from done to drone. This is why it is essential that failures be handled automatically with an integration of these two systems. The majority of reasons for disabling pyro modules would already be driven by the reasons for terminating a drone show. In the least, any action that would disable or end a drone’s performance would certainly coincide with disabling pyro modules. Thus, allowing the same controller to disable both devices would be superior from a safety perspective. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.verge.aero/drone-show-technology/safety/pyro-drone-system-design.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.