Safety Configuration (Failsafes)
PX4 has configurable failsafe systems to protect and recover your vehicle if something goes wrong! These allow you to specify areas and conditions under which you can safely fly, and the action that will be performed if a failsafe is triggered (for example, landing, holding position, or returning to a specified point).
The most important failsafe settings are configured in the QGroundControl Safety Setup page. Others must be configured via parameters.
Failsafe Actions
Each failsafe defines its own set of actions. Some of the more common failsafe actions are:
| Action | Description |
|---|---|
| None/Disabled | No action (the failsafe will be ignored). |
| Warning | A warning message will be sent to QGroundControl. |
| Hold mode | The vehicle will enter Hold mode. For multicopters this means the vehicle will hover, while for fixed/wing the vehicle will circle. |
| Return mode | The vehicle will enter Return mode. Return behaviour can be set in the Return Home Settings (below). |
| Land mode | The vehicle will enter Land mode, and lands immediately. |
| RC Auto Recovery (CASA Outback Challenge rules) | TBD |
| Terminate/Flight termination | Turns off all controllers and sets all PWM outputs to a failsafe value (defined in airframe configuration using FAILSAFE variable). For a fixed-wing vehicle this might allow you to glide the vehicle to safety. |
| Lockdown | Kills the motors (sets them to disarmed). This is the same as using the kill switch. |
It is possible to recover from a failsafe action (if the cause is fixed) by switching modes. For example, in the case where RC Loss failsafe causes the vehicle to enter Return mode, if RC is recovered you can change to Position mode and continue flying.
If a failsafe occurs while the vehicle is responding to another failsafe (e.g. Low battery while in Return mode due to RC Loss), the specified failsafe action for the second trigger is ignored. Instead the action is determined by separate system level and vehicle specific code. This might result in the vehicle being changed to a manual mode so the user can directly manage recovery.
QGroundControl Safety Setup
The QGroundControl Safety Setup page is accessed by clicking the QGroundControl Gear icon (Vehicle Setup - top toolbar) and then Safety in the sidebar). This includes the most important failsafe settings (battery, RC loss etc.) and the settings for the return actions Return and Land.
Low Battery Failsafe
The low battery failsafe is triggered when the battery capacity drops below one (or more warning) level values.
The most common configuration is to set the values and action as above (with Warn > Failsafe > Emergency).
With this configuration the failsafe will trigger warning, then return, and finally landing if capacity drops below the respective levels.
It is also possible to set the Failsafe Action to warn, return, or land when the Battery Failsafe Level failsafe level is reached.
The settings and underlying parameters are shown below.
| Setting | Parameter | Description |
|---|---|---|
| Failsafe Action | COM_LOW_BAT_ACT | Warn, Return, or Land based when capacity drops below Battery Failsafe Level, OR Warn, then return, then land based on each of the level settings below. |
| Battery Warn Level | BAT_LOW_THR | Percentage capacity for warnings (or other actions). |
| Battery Failsafe Level | BAT_CRIT_THR | Percentage capacity for Return action (or other actions if a single action selected). |
| Battery Emergency Level | BAT_EMERGEN_THR | Percentage capacity for triggering Land (immediately) action. |
RC Loss Failsafe
The RC Loss failsafe is triggered if the RC transmitter link is lost.
The settings and underlying parameters are shown below.
| Setting | Parameter | Description |
|---|---|---|
| RC Loss Timeout | COM_RC_LOSS_T | Amount of time after losing the RC connection before the failsafe will trigger. |
| Failsafe Action | NAV_RCL_ACT | Disabled, Loiter, Return, Land, RC Auto Recovery, Terminate, Lockdown. |
| RC Loss Loiter Time | NAV_RCL_LT | If the Failsafe Action (NAV_RCL_ACT) is set to CASA Outback Challenge rules this sets the loiter time after RC loss. |
Data Link Loss Failsafe
The Data Link loss failsafe is triggered if a telemetry link (connection to ground station) is lost.
The settings and underlying parameters are shown below.
| Setting | Parameter | Description |
|---|---|---|
| Data Link Loss Timeout | COM_DL_LOSS_T | Amount of time after losing the data connection before the failsafe will trigger. |
| Failsafe Action | NAV_DLL_ACT | Disabled, Hold mode, Return mode, Land mode, Data Link Auto Recovery (CASA Outback Challenge rules), Terminate, Lockdown. Selecting the Data Link Auto Recovery (CASA Outback Challenge rules) action additionally enables the Data Link Loss parameters. |
Geofence Failsafe
The Geofence is defined as a "virtual" cylinder around the home position. If the vehicle moves outside the radius or above the altitude the specified Failsafe Action will trigger.
The settings and underlying geofence parameters are shown below.
| Setting | Parameter | Description |
|---|---|---|
| Action on breach | GF_ACTION | None, Warning, Hold mode, Return mode, Terminate. |
| Max Radius | GF_MAX_HOR_DIST | Horizontal radius of geofence cylinder. Geofence disabled if 0. |
| Max Altitude | GF_MAX_VER_DIST | Height of geofence cylinder. Geofence disabled if 0. |
Setting
GF_ACTIONto terminate will kill the vehicle on violation of the fence. Due to the inherent danger of this, this function is disabled using CBRK_FLIGHTTERM, which needs to be reset to 0 to really shut down the system.
The following settings also apply, but are not displayed in the QGC UI.
| Setting | Parameter | Description |
|---|---|---|
| Geofence altitude mode | GF_ALTMODE | Altitude reference used: 0 = WGS84, 1 = AMSL. |
| Geofence counter limit | GF_COUNT | Set how many subsequent position measurements outside of the fence are needed before geofence violation is triggered. |
| Geofence source | GF_SOURCE | Set whether position source is estimated global position or direct from the GPS device. |
| Circuit breaker for flight termination | CBRK_FLIGHTTERM | Enables/Disables flight termination action (disabled by default). |
Return Home Settings
Return is a common failsafe action that engages Return mode to return the vehicle to the home position. This section shows how to set the land/loiter behaviour after returning.
The settings and underlying parameters are shown below:
| Setting | Parameter | Description |
|---|---|---|
| Climb to altitude | RTL_RETURN_ALT | Vehicle ascend to this minimum height (if below it) for the return flight. |
| Return behaviour | Choice list of Return then: Land, Loiter and do not land, or Loiter and land after a specified time. | |
| Loiter Altitude | RTL_DESCEND_ALT | If return with loiter is selected you can also specify the altitude at which the vehicle hold. |
| Loiter Time | RTL_LAND_DELAY | If return with loiter then land is selected you can also specify how long the vehicle will hold. |
The return behavour is defined by RTL_LAND_DELAY. If negative the vehicle will land immediately. Additional information can be found in Return mode.
Land Mode Settings
Land at the current position is a common failsafe action that engages Land Mode. This section shows how to set whether the vehicle will automatically disarm after landing. For Multicopters (only) you can additionally set the descent rate.
The settings and underlying parameters are shown below:
| Setting | Parameter | Description |
|---|---|---|
| Disarm After | COM_DISARM_LAND | Select checkbox to specify that the vehicle will disarm after landing, and enter delay after landing before disarming (must be non-zero). |
| Landing Descent Rate | MPC_LAND_SPEED | Rate of descent (MC only). |
Other Failsafe Settings
This section contains information about failsafe settings that cannot be configured through the QGroundControl Safety Setup page.
Position (GPS) Loss Failsafe
The Position Loss Failsafe is triggered if the quality of the PX4 position estimate falls below acceptable levels (this might be caused by GPS loss) while in a mode that requires an acceptable position estimate.
The failure action is controlled by COM_POSCTL_NAVL, based on whether RC control is assumed to be available (and altitude information):
0: Remote control available. Switch to Altitude mode if a height estimate is available, otherwise Stabilized mode.1: Remote control not available. Switch to Land mode if a height estimate is available, otherwise enter flight termination.
Fixed Wing vehicles additionally have a parameter (NAV_GPSF_LT) for defining how long they will loiter (circle) after losing position before attempting to land.
The relevant parameters for all vehicles shown below (also see GPS Failure navigation parameters):
| Parameter | Description |
|---|---|
| COM_POS_FS_DELAY | Delay after loss of position before the failsafe is triggered. |
| COM_POSCTL_NAVL | Position control navigation loss response during mission. Values: 0 - assume use of RC, 1 - Assume no RC. |
| CBRK_GPSFAIL | Circuit breaker that can be used to disable GPS failure detection. |
| CBRK_VELPOSERR | Circuit breaker for position error check (disables error checks in all modes). |
Parameters that only affect Fixed Wing vehicles:
| Parameter | Description |
|---|---|
| NAV_GPSF_LT | Loiter time (waiting for GPS recovery before it goes into flight termination). Set to 0 to disable. |
| NAV_GPSF_P | Fixed pitch angle while circling. |
| NAV_GPSF_R | Fixed roll/bank angle while circling. |
| NAV_GPSF_TR | Thrust while circling. |
Offboard Loss Failsafe
The Offboard Loss Failsafe is triggered if the offboard link is lost while under Offboard control. Different failsafe behaviour can be specified based on whether or not there is also an RC connection available.
The relevant parameters are shown below:
| Parameter | Description |
|---|---|
| COM_OF_LOSS_T | Delay after loss of offboard connection before the failsafe is triggered. |
| COM_OBL_ACT | Failsafe action if no RC is available: Land mode, Hold mode, Return mode. |
| COM_OBL_RC_ACT | Failsafe action if RC is available: Position mode, Altitude mode, Manual mode, Return mode, Land mode, Hold mode. |
Mission Failsafe
The Mission Failsafe checks prevent a previous mission being started at a new takeoff location or if it is too big (distance between waypoints is too great). The failsafe action is that the mission will not be run.
The relevant parameters are shown below:
| Parameter | Description |
|---|---|
| MIS_DIST_1WP | The mission will not be started if the current waypoint is more distant than this value from the home position. Disabled if value is 0 or less. |
| MIS_DIST_WPS | The mission will not be started if any distance between two subsequent waypoints is greater than this value. |
Traffic Avoidance Failsafe
The Traffic Avoidance Failsafe allows PX4 to respond to transponder data (e.g. from ADSB transponders).
The relevant parameters are shown below:
| Parameter | Description |
|---|---|
| NAV_TRAFF_AVOID | Set the failsafe action: Disabled, Warn, Return mode, Land mode. |
Adaptive QuadChute Failsafe
Failsafe for when a pusher motor fails (or airspeed sensor) and a VTOL vehicle can no longer achieve a desired altitude setpoint in fixed-wing mode. If triggered, the vehicle will transition to multicopter mode and enter failsafe Return mode.
The relevant parameters are shown below:
| Parameter | Description |
|---|---|
| VT_FW_ALT_ERR | Maximum negative altitude error for fixed wing flight. If the altitude drops more than this value below the altitude setpoint the vehicle will transition back to MC mode and enter failsafe RTL. |