FCS Switcher: Push-Button Switching Between Betaflight, INAV, and ArduPilot on a Single Flight Controller

Consumer flight controllers ship with proprietary bootloaders that assume a single resident firmware, forcing hobbyists and researchers to re-flash from a host computer whenever they change flight stacks. We present FCS Switcher, a mechanism that provides power-cycle-equivalent switching among three major open-source flight firmwares — Betaflight, INAV, and ArduPilot — on the BrainFPV Radix 2 HD (STM32H750, 16 MB QSPI NOR flash) with no hardware modification, no host computer, and no changes to the closed-source vendor bootloader: a switch is requested by a tap-and-hold gesture on the board's single BOOT button (a configurator or ground-station command surface is also provided). Using only probes executed by the running firmware — no JTAG, no case opening, and no disassembly of the bootloader — we characterize the vendor boot contract and show that the bootloader does not boot a fixed flash slot at all: it mounts a private FAT12 filesystem inside QSPI flash and boots whichever cluster chain begins at a hardcoded cluster. Firmware switching therefore reduces to an in-place filesystem rewrite: staging the target image in an unused region of flash, rewriting one 4 KB file-allocation sector and one directory entry, resetting the flash device, and resetting the MCU — an atomic surface of roughly 10 ms rather than the multi-second slot copy assumed by our original design. We report the full design evolution across more than 230 build–flash–bench iterations, including a ledger of ~90 root-caused failures, the verification-gate protocol that emerged from silently wrong builds, and the recovery invariant that made iterating on a boot-critical code path safe on $100-class production hardware. All six directed switches among the three firmwares are demonstrated on hardware, each triggered from the physical button alone. We distill portable lessons for firmware coexistence above closed bootloaders: live-probe-before-design, minimum-privilege linker memory maps, survival-class-aware diagnostics, and atomicity of boot-metadata rewrites.