Add a focused airship build target (make px4_fmu-v6x_airship) on the
reference flagship, mirroring the existing spacecraft and uuv
experimental-vehicle variants on the same board. It enables
control_allocator and airship_att_control and keeps land_detector
(the airship startup runs `land_detector start airship`), and disables
the fixed-wing, multicopter and VTOL controllers an airship does not use.
Builds at 86.76% flash with the Cloudship airframe included.
Signed-off-by: Hyunduk Shin <hyunduk@icarus-airship.com>
Pxh lazily initializes the builtin app map from client handler threads. Concurrent first commands can both enter init_app_map() and mutate the static std::map at the same time.
Use pthread_once so the map is populated exactly once before process_line() or tab completion read it.
* fix(failsafe): allow orbit on the first command after a failsafe
modifyUserIntendedMode() downgrades a requested Orbit to Loiter when
releasing control after an active failsafe action, to avoid silently
auto-resuming a stale Orbit intention. It could not distinguish that auto-resume
from a fresh, explicit DO_ORBIT the operator sends right after resolving the
failsafe: two DO_ORBIT commands where needed to actually re-start an orbit.
Now using user_intended_mode_updated signal, the downgrade is skipped when the orbit is explicitely requested.
* fix(failsafe): fix ITCM symbol and test names after orbit fix
The added modifyUserIntendedMode() parameter changed its mangled name,
breaking the ITCM check (fmu-v6xrt, mr-tropic, tropic-community). Update the
symbol and rename the two new tests to CamelCase for clang-tidy.
* fix(failsafe): suggestion for a simpler approach to solve the divverted Orbit after failsafe problem
* fix(failsafe_test): inherit from Failsafe instead of FailsafeBase to not duplicate modifyUserIntendedMode()
Also change all test names to consistent camel case.
---------
Co-authored-by: Matthias Grob <maetugr@gmail.com>
Disabled if ICE_IDLE_RPM is 0.
The idle state is entered when the commanded throttle is close to zero
or the measured RPM drops below the idle threshold.
The idle state is exited if the commanded thrust is increased to above
the last needed throttle to keep idle.
Signed-off-by: Silvan <silvan@auterion.com>
Co-authored-by: Silvan <silvan@auterion.com>
Add a 2nd-order critically-damped attitude reference model whose angular-velocity output is fed forward onto the rate setpoint, removing the steady-state ramp-tracking lag of the pure-P attitude law. The model uses an exact closed-form discretisation, so it is unconditionally stable.
Parameters:
- MC_REF_W_N reference-model bandwidth [rad/s]
- MC_REF_FF feedforward gain [0..1]; 0 disables the anticipation
- MC_REF_FF_MAX per-axis feedforward saturation [deg/s]
The commanded yaw rate is always fed forward at unity (it is a setpoint, not a model prediction), so MC_REF_FF scales only the error-driven anticipation and MC_REF_FF=0 is the exact legacy pure-P law. Shipped disabled by default to avoid changing behaviour on existing platforms; enable per-airframe. Includes docs and the updated controller diagram.
Homebrew 6.0 (2026-06-11) makes tap-trust mandatory and refuses to load
formulae from untrusted third-party taps. This broke every macOS build:
brew install aborted with "Refusing to load formula px4/px4/fastdds from
untrusted tap px4/px4" before pouring any package, so ccache (and the
rest of the toolchain) was never installed and setup-ccache failed with
"ccache: command not found".
Trust the three required taps non-interactively before installing from
them. Guarded behind a brew trust capability check so older Homebrew,
which has no trust gate, skips it.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
* fix(boards): update STM32H7 bootloaders with ECC scrub and enable bl_update
The committed extras/*_bootloader.bin for every STM32H7 flash-parameter
target predate #27642, so none carry the uncorrectable-flash-ECC scrub
that keeps a torn parameter-flash write from bricking the board on every
boot. Rebuild each bootloader from current main with the release
toolchain (GCC 13.2.1) and enable CONFIG_SYSTEMCMDS_BL_UPDATE so the fix
can be applied in the field via SYS_BL_UPDATE without a debugger; the
~40-45 KB image is embedded in ROMFS only when the option is on.
ark/fpv drops LANDING_TARGET_ESTIMATOR to fit the embedded image,
x-mav/ap-h743v2 gets its first committed bin, and a stray duplicate
bootloader bin is removed from kakuteh7dualimu/extras.
Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>
* fix(boards): remove SCH16T from ARK FPV mavlink-dev.px4board
---------
Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>
This setting comes from a time where takeoff was accepted immediately if the acceptance radius was too big and also the mission behavior was completely different:
95a8414895
The previous behaviour was equal to this (we only sent the
geofence_result at all if GF_ACTION != 0).
If we set the failsafe flag even if a geofence is triggered but no
action is configured, the failsafe state machine does not trigger the
failsafe action (only on rising edge).
This means the geofence_breached failsafe flag has, and used to have,
the meaning of "geofence breached and action needed", which would change
if we set it always when a geofence was breached.
Currently there is the this bug:
- Set GF_ACTION=2, breach a geofence
- While the breach is still occurring, set GF_ACTION=0
- Fly out of the geofence
- The warning from GeofenceChecks::checkAndReport sticks around
This is because the entire section is gated by GF_ACTION != 0, so if it
is changed to 0, no geofence_result message is published again.
All consumers are then left with stale data.
Solution: Do not gate on GF_ACTION != 0. Regularly send geofence_result
with the configured action in geofence_action. The individual
`geofence_*_triggered` flags are still populated - consumers ignore them
if GF_ACTION is 0.
The low_bandwidth mode (mavlink start -m low_bandwidth) targets telemetry
over constrained RF links, but as tuned it wasted bandwidth on high-rate
redundant streams (e.g. TIMESYNC at 10 Hz, which normal mode does not stream
at all) while updating flight instruments too slowly to fly by.
Speed up flight-critical streams for manual instrument flight and to catch
transient states:
- ATTITUDE_QUATERNION 2 -> 4 Hz (artificial horizon responsiveness)
- VFR_HUD 1.5 -> 4 Hz (primary instrument; matches normal mode)
- BATTERY_STATUS 0.5 -> 1 Hz (catch transient states)
- RAW_RPM 1 -> 2 Hz (catch transient states; matches normal)
Slow down or drop redundant/low-value traffic for a net bandwidth decrease:
- TIMESYNC removed (mirrors normal mode, which does not stream
it; the stream only makes PX4 initiate
timesync to align incoming external
estimator inputs that a GCS link does not
carry. PX4 still responds to GCS-initiated
timesync via the receiver, and SYSTEM_TIME
still carries the wall clock for GCS log
alignment)
- SYSTEM_TIME 2 -> 0.5 Hz (kept low for vehicle/GCS clock alignment)
- RC_CHANNELS 5 -> 1 Hz (vehicle->GCS echo of RC, not control uplink)
- GPS_RAW_INT 2 -> 1 Hz (fix type / sat count; 1 Hz fine)
- GPS2_RAW 2 -> 1 Hz (was above normal mode's 1 Hz)
- ESC_STATUS 2 -> 1 Hz (was above normal mode's 1 Hz)
- GPS_GLOBAL_ORIGIN 1 -> 0.1 Hz (EKF origin set once at init, ~static)
ALTITUDE stays at 1 Hz: VFR_HUD at 4 Hz already carries altitude and climb
rate, and normal mode also keeps it at 1 Hz. Only the
MAVLINK_MODE_LOW_BANDWIDTH case is touched; onboard_low_bandwidth and all
other modes are unaffected.
Signed-off-by: Gregor Hohl <gregor.hohl@auterion.com>
* fix(docs): invert vectorized diagram SVGs in dark mode
* docs(docs): Apply fix as a class
* Add yarn lock to fix CI
---------
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* fix(i2c_spi): prevent use-after-free when stopping driver instances
module_stop() deleted each instance before unlinking it from the global
i2c_spi_module_instances list. The instance *is* the intrusive list node,
so removeInstance()/List::remove() then dereferenced the freed node to fix
up the links. If another thread reused that heap block in the window, the
list got corrupted, sporadically leaving instances linked (a later start
reports "already running") or hard-faulting. This regressed in the 2020
array->linked-list refactor: the old array version only nulled an array
slot after delete, which was safe.
Unlink each instance before freeing it. Also only delete/unlink when the
task actually exited: if request_stop_and_wait() times out the work queue
may still reference the object, so leave it allocated and listed rather
than freeing it. module_stop() now returns -1 when an instance failed to
stop.
Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>
* Update platforms/common/i2c_spi_buses.cpp
* Update platforms/common/i2c_spi_buses.cpp
---------
Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>
* failsafe: prevent manual fallback without RC
* fix(commander): consolidate manual fallback RC loss handling
Use NAV_RCL_ACT from a single post-cascade check for manual fallback modes,
and add coverage for non-default NAV_RCL_ACT behavior.
Cross-correlation scripts to measure CAN transport delay from flight
logs. Compares CAN sensor signals against the FC's directly-connected
IMU to estimate the total pipeline latency.
- range_sensor_latency.py: cross-correlates range rate with IMU-derived
vertical velocity
- flow_sensor_latency.py: cross-correlates flow sensor gyro with FC gyro
