Pr auto disarm landing

[vigneshm-debug]

Based on the historical analysis and the mid-air disarm observed during back transition, the default values of LAND_ALTCHG and LAND_RELAX_MS have been changed to 0.8 m and 400 ms, respectively.

https://app.notion.com/p/airbound/Auto-disarm-during-the-flight-midair-analysis-38621adf4be98058a17ed728a5d2dab2?source=copy_link

[greptile-apps]

Greptile Summary

This PR adjusts auto-disarm and landing detection parameters following analysis of a mid-air disarm event observed during back-transition (VTOL→fixed-wing). It makes three interrelated changes: tightens the landing altitude-change threshold for the Pixhawk6C-bdshot hardware (1.5 m → 0.8 m), replaces two hardcoded timing constants in the land-detector with tunable parameters (LND_RELAX_MS, LND_LLIM_MS), and fixes a state-machine deadlock where an unexpected mid-air disarm during QPOS_LAND_FINAL left the aircraft permanently stuck in that state.

• Parameter range + defaults: LAND_ALTCHG range extended to 2.0 m (fixing the pre-existing out-of-range value of 1.5 m in defaults.parm); two new AP_Int16 params (LND_RELAX_MS / LND_LLIM_MS) replace the hardcoded 1000 ms values in should_relax() and land_detector().
• State-machine fix: check_land_complete() now sets QPOS_LAND_COMPLETE and returns true whenever motors are already disarmed in QPOS_LAND_FINAL, allowing the state machine to progress after an unexpected mid-air disarm.
• Hardware defaults: The Pixhawk6C-bdshot defaults.parm receives the tuned values (0.8 m / 400 ms / 200 ms) from the historical analysis.

Confidence Score: 3/5

The landing state-machine change is intentional and addresses a real stuck-state bug, but it unconditionally accepts any mid-flight disarm as 'land complete' without verifying the aircraft is actually on the ground.

The fix in check_land_complete() solves the observed deadlock, but the new early-return path fires for every disarm source — not just the back-transition scenario. A failsafe disarm during QPOS_LAND_FINAL (e.g., brief RC loss mid-descent) will immediately set QPOS_LAND_COMPLETE and skip all altitude-stability and time-window checks. The consequences of a false 'land complete' declaration while airborne — suppressed motor commands, mode transitions, mission progression — depend on callers that aren't modified in this PR and warrant careful verification before merging.

ArduPlane/quadplane.cpp — specifically the check_land_complete() change and how callers respond to an early QPOS_LAND_COMPLETE transition.

Important Files Changed

Filename	Overview
ArduPlane/quadplane.cpp	Core landing-detection logic changed: new tunable params replace hardcoded constants; check_land_complete() now fast-paths to QPOS_LAND_COMPLETE on any mid-flight disarm, which is a deliberate fix but bypasses all altitude/time verification checks.
ArduPlane/quadplane.h	Adds two AP_Int16 members to the landing_detect struct; minor trailing whitespace present on one line.
libraries/AP_HAL_ChibiOS/hwdef/Pixhawk6C-bdshot/defaults.parm	Hardware-specific defaults updated: Q_LAND_ALTCHG lowered from 1.5 m to 0.8 m (previously out of the declared param range), and the two new timing params are set per the analysis results.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["check_land_complete() called"] --> B{"poscontrol state\n== QPOS_LAND_FINAL?"}
    B -- No --> C["return false"]
    B -- Yes --> D{"motors->armed()?"}
    D -- "No (NEW PATH)" --> E["poscontrol.set_state(QPOS_LAND_COMPLETE)\nreturn true"]
    D -- Yes --> F["Start / update disarm watchdog"]
    F --> G["land_detector()"]
    G --> H{"land_detector\nreturns true?"}
    H -- No --> I["return false"]
    H -- Yes --> J["poscontrol.set_state(QPOS_LAND_COMPLETE)\nplane.arming.disarm(LANDED)"]
    J --> K["return true"]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["check_land_complete() called"] --> B{"poscontrol state\n== QPOS_LAND_FINAL?"}
    B -- No --> C["return false"]
    B -- Yes --> D{"motors->armed()?"}
    D -- "No (NEW PATH)" --> E["poscontrol.set_state(QPOS_LAND_COMPLETE)\nreturn true"]
    D -- Yes --> F["Start / update disarm watchdog"]
    F --> G["land_detector()"]
    G --> H{"land_detector\nreturns true?"}
    H -- No --> I["return false"]
    H -- Yes --> J["poscontrol.set_state(QPOS_LAND_COMPLETE)\nplane.arming.disarm(LANDED)"]
    J --> K["return true"]

Loading

_{Reviews (1): Last reviewed commit: "default values of parameters, LND_RELAX_..." | Re-trigger Greptile}

[greptile-apps]

Disarm-triggered land-complete bypasses all ground-detection checks

Any unintended disarm event (RC failsafe, battery failsafe, GCS disarm command) while the state machine is in QPOS_LAND_FINAL will now immediately set QPOS_LAND_COMPLETE and return true, regardless of whether the aircraft is actually on the ground. Previously the function returned false and kept the state machine in QPOS_LAND_FINAL; the new path skips the altitude-change guard (detect_alt_change) and both time-window checks in land_detector(). If a failsafe disarm fires mid-descent (e.g., short RC loss), the system declares landing complete while still airborne, potentially stopping motor commands or suppressing any subsequent recovery attempt.

[greptile-apps]

Code-level default for LND_RELAX_MS (200 ms) diverges from analysis recommendation (400 ms)

The AP_GROUPINFO default is 200 ms, but the defaults.parm for Pixhawk6C-bdshot sets 400 ms, and the PR description cites 400 ms as the validated safe value. Any board that does not load this hardware defaults file will get 200 ms — half the debounce time — which was not tested against the mid-air disarm dataset. Consider either raising the compile-time default to 400 ms or documenting that 200 ms is intentionally conservative for general hardware.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Trailing whitespace on the relax_debounce_ms declaration — minor cleanup.

Suggested change

	AP_Int16 relax_debounce_ms;
	AP_Int16 lower_limit_extra_ms;
	AP_Int16 relax_debounce_ms;
	AP_Int16 lower_limit_extra_ms;

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!