Industries
Firmware rollouts for drone fleets.
Flight-critical software, updated only on the ground, verified in the air, and provable afterwards. Temper soaks releases in flights rather than hours and stops a rollout at the first airframe that saves itself.
What breaks in drone operations, specifically
Nothing here is exotic, but all three make a generic device-update tool the wrong shape for an aviation fleet.
Updates happen on the ground, or not at all
Flight-controller firmware is not something you stage opportunistically. The install needs the airframe disarmed, landed, charged and not mid-mission, and the rollout has to understand that state rather than retry into it.
The failure mode is a grounded fleet
A bad build on a rover means a slow rover. A bad build on an airframe means every airframe of that type stops flying, and the revenue stops with them, usually on the day the weather was finally good.
You have to prove which build flew
After an incident the question is specific: what was on that tail number, on that flight, and who signed it off. The binding has to exist before you need it.
What a health gate looks like on an airframe
| Signal | Why it gates here |
|---|---|
hover_attitude_rms_deg | Control loop regressions show up in hover long before they show up as an incident. This is the single most useful post-update signal on a multirotor. |
gnss_fix_seconds | A build that slows time to a 3D fix turns a two minute turnaround into a five minute one, across every sortie, forever. |
hover_current_a vs baseline | Efficiency regressions read as reduced endurance, which the pilot discovers at the far end of the survey rather than on the pad. |
selftest: failsafe, rtl, geofence | The behaviours that only matter when something has already gone wrong get tested explicitly, on the ground, before the airframe is cleared. |
c2_link_margin | A release that quietly costs a few dB of command and control margin is fine on the pad and not fine at range. |
The same rollout, written for an aviation fleet
# Nothing installs on a live airframe. release: flight-controller@2.4.1 rollback_to: 2.3.0 preconditions: - state: disarmed - on_ground: true - battery_pct: > 60 - mission: none verify: # first flight after update is the trial trial_boot: 3 attempts confirm_within: 1 flight checks: - selftest: failsafe, rtl, geofence - metric: hover_attitude_rms_deg < 1.2 - metric: gnss_fix_seconds < 40 - metric: hover_current_a within 5% of baseline - reachable: c2-link on_failure: revert_and_report rings: - name: canary match: { fleet: internal, airframe: m400 } soak: 5 flights - name: same-airframe match: { airframe: m400 } # never advance across airframe types soak: 25 flights - name: fleet match: { all: true } requires_approval: true ring_gate: min_confirmed: 10 airframes max_self_reverts: 0 stale_after: 21d on_timeout: escalate record: bind: tail_number, build_hash, flight_id on_gate_failure: ground_and_rollback
Two differences matter. Soak is counted in flights, because twenty-four hours on a charger proves nothing about a flight controller, and five flights proves quite a lot. And rings never advance across airframe types: a build that is healthy on one platform tells you almost nothing about another with different geometry, different mass and a different tune.
The record.bind line exists so that the question after an incident has an answer that does not depend on anybody's memory. Tail number, build hash, flight id, recorded at the time.
How Temper handles it
01Preconditions, not retries
The agent will not stage into an armed airframe or one below its battery threshold. It waits for a state where installing is safe, then does it once.
02The first flight is the trial
The new build boots on trial and has to clear its checks in the air before the boot counter is cleared. Anything short of a positive result and the airframe comes back on the previous build unaided. See automatic rollback.
03One self-revert stops the ring
In a fleet where the downside is grounded aircraft, a single airframe saving itself is enough evidence to halt. Gates count confirmed units, never elapsed time. See staged rollouts.
04A record that outlives the release
Build hash bound to tail number and flight, kept for as long as your operations approval requires. See audit and compliance.
Early access
Flying a fleet you cannot ground?
If a flight-controller release currently means a spreadsheet of tail numbers and a long evening, we should talk.
Founding customers get direct engineering time and a permanent founding rate.