PR - Danger Zone Framework

[atharva-airbound]

Implementation of the danger zone framework.

[atharva-airbound]

@greptileai could you have a look?

[greptile-apps]

Greptile Summary

This PR introduces the Danger Zone framework — a 5-level escalating failsafe for quadplane VTOL flight that disables weathervaning (zone 2), relaxes attitude control (zone 3), triggers an auto-bailout to QLOITER (zone 4), and deploys the parachute + disarms (zone 5) based on pitch error, control effort, and tilt-motor saturation metrics evaluated at 50 Hz.

• The core AP_DangerZone library is self-contained and vehicle-agnostic; zone definitions, metric getters, and actions live in ArduPlane/danger_zone_config.cpp. The ring-buffer / check infrastructure in DZ_Check.cpp is well-structured.
• Attitude-controller changes in AC_AttitudeControl add pitch setpoint relaxation, yaw rate disabling, and roll gain suppression triggered by the zone 3 flag; the pitch relaxation uses a Euler to_euler/from_euler conversion that is numerically degenerate at the ±90° pitch where a tailsitter hovers.
• The zone state machine and ring buffers have no reset path between arm/disarm cycles, so a vehicle that lands after reaching zone 4 may immediately re-enter zone 4 or trigger a parachute action at the start of the next flight.

Confidence Score: 3/5

This PR introduces emergency flight-safety actions (mode change to QLOITER, parachute deployment, disarm) driven by a new zone state machine — three issues in that path need resolution before this is safe to fly.

The zone-4 QLOITER mode switch has no fallback if GPS is unavailable; a silent failure at the moment the aircraft is in an extreme attitude leaves it without a recovery path. The zone state and ring buffers are never reset between arm/disarm cycles, so a vehicle that entered zone 4 during a flight could immediately re-trigger the same emergency actions at the very start of the next flight. The pitch-setpoint relaxation in zone 3 uses Euler to_euler/from_euler at the ~90° pitch angle where tailsitters hover, which is numerically degenerate and could produce an uncommanded yaw or roll impulse instead of the intended pitch reduction. Together these three issues affect the core safety path of the framework.

ArduPlane/danger_zone_config.cpp (zone 4 bailout and missing reset on disarm), libraries/AC_AttitudeControl/AC_AttitudeControl.cpp (Euler gimbal lock in pitch relaxation), and libraries/AP_DangerZone/AP_DangerZone_config.h (global default-on enabling).

Important Files Changed

Filename	Overview
ArduPlane/danger_zone_config.cpp	Zone table and vehicle actions. Zone 4 QLOITER bailout has no fallback if mode switch fails (GPS absent). Zone state and ring buffers are not reset on disarm.
libraries/AC_AttitudeControl/AC_AttitudeControl.cpp	Pitch relaxation applies euler to_euler/from_euler at potential 90° pitch (gimbal lock territory for tailsitters). Yaw rate disabling with _dz_z3_active is unconditional within the attitude controller.
libraries/AP_DangerZone/AP_DangerZone_config.h	AP_DANGERZONE_ENABLED defaults to 1 globally with the comment 'can be tightened later' — this unconditionally adds new parameters and RAM usage to all AC_AttitudeControl consumers.
libraries/AP_DangerZone/AP_DangerZone.cpp	Core zone state machine: evaluates entry/exit checks, advances by one level per call. Logic is sound; no reset mechanism between flights.
libraries/AP_DangerZone/DZ_Check.cpp	Ring buffer and check evaluation logic. Buffer is never reset between arm/disarm cycles; stale statistics could affect zone decisions on re-arm.
libraries/AP_DangerZone/DZ_Check.h	DZ_CHECK_BUFFER_SAMPLES uses integer division; could undersize buffer if window_ms is changed to a non-multiple of 1000. Static globals add ~28 KB RAM for all windowed checks.
libraries/AC_AttitudeControl/AC_AttitudeControl.h	Adds RELX_TC/RELX_ANG/RELX_EN params and _dz_z3_active/_dz_z3_factor fields to base class shared by all vehicles (Copter, Sub, etc.) because AP_DANGERZONE_ENABLED defaults to 1 globally.
libraries/AC_AttitudeControl/AC_AttitudeControl_Multi.cpp	Adds update_roll_gain_suppression() called only when tailsitter is enabled; cleanly gates roll I-term reset and motor factor on _dz_z3_active.
ArduPlane/parachute.cpp	New parachute_release_with_disarm() correctly retains alt_min check and calls existing parachute_release(). Pre-existing double landing-gear deploy in parachute_manual_release() is unchanged.
ArduPlane/RC_Channel.cpp	RC parachute switch now bypasses parachute_manual_release() for tailsitters, calling parachute_release_with_disarm() directly; altitude check is preserved.
ArduPlane/tailsitter.cpp	Zone 2 weathervane gain ramp uses linear_interpolate over 500 ms; correctly resets weathervane on zero gain. Zone 3 flag is set each output() cycle.
libraries/AP_Motors/AP_MotorsTailsitter.cpp	Roll thrust suppression via _roll_gain_suppression_factor applied before mixing; straightforward and correctly bounded.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    Z1["Zone 1 – Normal VTOL\n(baseline)"]
    Z2["Zone 2 – Weathervane disabled\n(gain ramped to 0 over 500 ms)"]
    Z3["Zone 3 – Attitude relaxed\n(pitch setpoint → 0, yaw rate disabled,\nroll gain suppressed)"]
    Z4["Zone 4 – Auto-bailout\n(mode → QLOITER)"]
    Z5["Zone 5 – Emergency\n(parachute + disarm)"]

    Z1 -->|"control effort > 0.1"| Z2
    Z2 -->|"pitch err mean > 20° OR\npitch oscillation range > 10° OR\nabs(att pitch) > 45°"| Z3
    Z3 -->|"raw pitch < 40° for 200 ms OR\ntilt saturation same-dir for 100 ms"| Z4
    Z4 -->|"raw pitch < -15° for 100 ms OR\ntilt saturation same-dir for 500 ms"| Z5

    Z2 -->|"mean pitch err < 5° AND\npeak pitch err < 10° AND\ncontrol effort < 0.08 (5 s window)"| Z1
    Z3 -->|"mean pitch err < 10° AND\npeak pitch err < 15° (5 s window)"| Z2
    Z4 -->|"mean pitch err < 20° AND\npeak pitch err < 30° (5 s window)"| Z3
    Z5 -.->|"no exit – terminal"| Z5

    style Z5 fill:#ff4444,color:#fff
    style Z4 fill:#ff8800,color:#fff
    style Z3 fill:#ffcc00
    style Z2 fill:#aaffaa
    style Z1 fill:#ddffdd

Loading

_{Reviews (1): Last reviewed commit: "Make `get_current_danger_zone()` return ..." | Re-trigger Greptile}

[greptile-apps]

Integer division in DZ_CHECK_BUFFER_SAMPLES can silently undersize the buffer

(DZ_BUFFER_MAX_WINDOW_MS / 1000) * DZ_UPDATE_RATE_HZ truncates before multiplying. With the current defaults (10000 / 1000 = 10 × 50 = 500) the result is exact, but any future change to a non-multiple-of-1000 window — e.g., 9500 ms — would yield 9 × 50 = 450 samples, silently covering only 9 000 ms of data instead of the requested 9 500 ms. The full() guard would then incorrectly report a complete window when it is not. Use (DZ_BUFFER_MAX_WINDOW_MS * DZ_UPDATE_RATE_HZ) / 1000 to prevent this.

Suggested change

	static const uint16_t DZ_CHECK_BUFFER_SAMPLES =
	(DZ_BUFFER_MAX_WINDOW_MS / 1000) * DZ_UPDATE_RATE_HZ;
	static const uint16_t DZ_CHECK_BUFFER_SAMPLES =
	(DZ_BUFFER_MAX_WINDOW_MS * DZ_UPDATE_RATE_HZ) / 1000;

[greptile-apps]

Commented-out mission-resumption block should be tracked in an issue, not left in source

The block // Mission resumption after exiting Zone 4 contains placeholder logic that is intentionally unimplemented. Leaving commented-out code of this kind in safety-critical flight code makes it hard to distinguish deliberate stubs from unfinished work. Recommend removing the block and tracking the feature in a ticket, or at minimum adding a // TODO(#<issue>): reference.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!