Update safety.md, remote_id.md, and releases/main.md to document the extended COM_ARM_ODID parameter and the new in-flight failsafe behaviour that will be introduced in PX4 v1.18.
Extend COM_ARM_ODID into a unified arming + in-flight failsafe parameter (0 = Disabled, 1 = Warning, 2 = Return, 3 = Land, 4 = Terminate)
Values >= 2 block arming and trigger the configured action if Remote ID
is lost while airborne.
PIDTest never exercised the D path with a non-zero gain, which let the
sign error fixed in #27140 slip through. Add a D-only test that asserts
the output opposes a known feedback ramp.
Fails on main, passes with #27140.
The px4-sim / px4-sim-gazebo Homebrew meta-formulae can no longer
pull their Gazebo dependency chain because Homebrew 4.5+ stopped
auto-resolving cross-tap deps. PX4/homebrew-px4#104 already
deprecated px4-dev into a no-op; #111 does the same for the sim
formulae. This PR is the PX4-side counterpart: move the sim install
into Tools/setup/macos.sh with an explicit package list and tap
registration, mirroring the pattern already used for the toolchain
block. Adds xquartz install on --sim-tools.
Beyond install, three runtime and configure gaps kept make px4_sitl
gz_x500 from working on a clean macOS:
- gz-gui8 (pulled in by gz-sim8) links against Qt5, but Homebrew's
qt@5 is keg-only so CMake cannot find it. Add a POSIX-scoped hint
in platforms/posix/cmake/px4_impl_os.cmake that resolves
brew --prefix qt@5 and appends it to CMAKE_PREFIX_PATH. No-ops on
non-APPLE builds and respects a user-set Qt5_DIR.
- On macOS, dyld does not search /opt/homebrew/lib by default.
gobject-introspection typelibs reference libs by bare basename,
causing gst-plugin-scanner to fail to load plugins and adding
~90s of timeout to Gazebo's cold start. Set
DYLD_FALLBACK_LIBRARY_PATH to the Homebrew prefix lib dir in
gz_env.sh so the bridge launch inherits it. Darwin-scoped, no
effect on Linux or CI.
- configure_file on gz_env.sh.in now uses @ONLY so shell ${VAR}
references pass through untouched.
Verified locally on macOS 26.4 / arm64 / Homebrew 5.1.7: configure
clean, 1119/1119 targets compile and link, vehicle spawns in
Gazebo Harmonic 8.11.0 with a single "Waiting for Gazebo world"
wait (was ~18 before the dyld fix).
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Add the GStreamer pkg-config library directories so the Gazebo camera plugin links cleanly with Homebrew installs on macOS. Cast ESC actuator outputs to double before publishing rotor velocities to avoid clang's -Wdouble-promotion build failure.
Signed-off-by: Dima Timofeev <dimkat@gmail.com>
The nested CycloneDDS CMake invocation in msg/CMakeLists.txt exists
only to produce the 'idlc' IDL compiler as a host-side code-gen
tool. It does not need CycloneDDS's TLS transport or DDS Security
features, but both default to ON in cyclonedds' upstream CMake.
When ENABLE_SSL=AUTO (the default), cyclonedds finds the system
OpenSSL and builds ddsi_ssl.c. On macos-latest the system OpenSSL
is 3.x, which removed the deprecated SSL_get_peer_certificate()
symbol used in our pinned cyclonedds revision (2023). The host
build then fails at link time with:
Undefined symbols for architecture arm64:
"_SSL_get_peer_certificate", referenced from:
_dds_report_tls_version in ddsi_ssl.c.o
This broke every Zenoh-enabled board build on macOS (boards that
select CONFIG_MODULES_ZENOH pull in LIB_CDRSTREAM, which is what
triggers the nested build). v5 and v6x never hit it because they
don't enable Zenoh.
Passing -DENABLE_SSL=OFF -DENABLE_SECURITY=OFF skips compilation of
ddsi_ssl.c and the security plugins entirely. idlc is unaffected
(pure C code generation, no DDS runtime).
Verified locally on macOS ARM64: clean distclean + make
px4_fmu-v6xrt_default completes in 2090/2090 ninja steps, producing
a 2.1 MB .px4 with 59% FLASH used.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
tflite-micro's Makefile fetches 5 third-party dependencies (flatbuffers,
kissfft, gemmlowp, ruy, pigweed, plus CMSIS/CMSIS-NN for ARM targets)
via wget and git clone at build time. This breaks reproducible builds:
the build output depends on GitHub and pigweed.googlesource.com being
reachable and serving the exact pinned archives, which is not guaranteed
and has broken in the past when GitHub silently regenerated archive zips.
Bump the tflite_micro submodule to the new px4/vendored-deps branch on
PX4/tflite-micro, which commits the deps directly under
tensorflow/lite/micro/tools/make/downloads/. Upstream's download scripts
already no-op with "already exists, skipping the download" when the
target directories are present, so no Makefile patches are needed.
Drop the add_custom_command, build_tflm_native target, and the empty
generate_cc_arrays.py shim from CMakeLists.txt. They existed solely to
drive the (now-removed) make third_party_downloads invocation and to
overwrite the submodule's generate_cc_arrays.py to keep that invocation
quiet. With the download step gone, none of that machinery is needed,
and the submodule stays clean after a build.
Verified builds against the new submodule:
- px4_sitl_neural (linux/amd64 devcontainer)
- mro_pixracerpro_neural (linux/amd64 devcontainer)
- px4_fmu-v6xrt_allyes (linux/amd64 and linux/arm64 devcontainers)
Fixes#27054
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
The array access
_airspeed_validator[valid_airspeed_index - 1]
is only valid if valid_airspeed_index > 0. After an airspeed failure, we
have valid_airspeed_index = -1 (see AirspeedSource enum definition) and
are thus accessing array element -2. This is UB and pollutes the log
(and potentially other modules) with garbage values.
Fix: Like already done for other fields, we initialise the values with
NaN and only populate (using the array access) when the airspeed source
is a real sensor, and thus valid.
Replace dimensionally wrong max(pos/vel_var, orientation_var) floor
with physically correct additive variance from the cross-product
δp = δθ × p (and δv = δθ × v). The old code compared rad² directly
to m² or (m/s)², ignoring lever arm / speed.
Also include EV position (guarded by yaw_align) in
isNorthEastAidingActive() so that mag fusion doesn't spuriously
clear yaw_align when it stops during EV-only flight.
Supersedes #25703
* feat(astyle): add make format_changed for diff only style fixes
`make format` is pretty slow because it always considers the entire
source tree. For developing on top of a clean state, considering only
files that differ from HEAD should be sufficient.
* docs(astyle): document new format_changed target
Homebrew 4.5 (April 2026) stopped auto-tapping cross-tap
dependencies declared in formulae, as a security + performance
change. The px4-dev meta-formula pulled in packages from
osx-cross/arm, PX4/px4, and discoteq/discoteq, so 'brew install
px4-dev' now aborts before any real work unless every tap has been
added explicitly. On macos-latest CI runners the chain broke at the
first unreachable dep (discoteq/discoteq/flock) and subsequent make
steps failed with 'ccache: command not found'.
Since Tools/setup/macos.sh is the canonical install path and already
tapped osx-cross/arm and PX4/px4 before calling brew install, the
simplest fix is to inline the package list and call brew install
directly. The px4-dev meta-formula will be kept upstream as a
deprecated no-op so older copies of macos.sh on long-lived branches
and cached Docker images keep working.
The inlined package list is the same set px4-dev depended on, minus
the dead-weight flock dependency that hadn't been invoked in the PX4
build since the NuttX 9.1.x era. See the accompanying PX4/homebrew-px4
PR for formula changes.
Docs updated to match: docs/en/dev_setup/dev_env_mac.md no longer
names the px4-dev formula, describes the package list directly.
Verified locally on macOS ARM64:
- ./Tools/setup/macos.sh runs to completion with both taps and all 13
packages resolving correctly
- make distclean && make px4_fmu-v6x_default builds successfully
(1250/1250 ninja steps, 1930096 B FLASH used)
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
After a soft reset with a non-zero bank selected, _last_register_bank
is default-initialized to 0 but the hardware state is unknown. Register
reads then skip the bank select (cached value matches) and read from
the wrong bank, so probe fails and the device stays stuck until a power
cycle.
Force bank 0 at the start of each probe retry so the first transfer
synchronizes the cached bank with hardware. Drop the post-fail bank
inspection — it's no longer reachable.
Applies to all multi-bank Invensense drivers: IIM42652, IIM42653,
ICM42688P, ICM42605, ICM40609D, ICM20948 (main and I2C passthrough),
ICM20649. ICM45686 and ICM42670P have a single bank and are unaffected.
Takes over PR #25894 from @spiderkeys.
Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>
Peter van der Perk
PX4BuildBot
gguidone
Hamish Willee
bresch
Jacob Dahl
Nathaniel-hl
Eurus
Michael Fritsche
Ramon Roche
Dima Timofeev
Kristiyan Dimitrov
Balduin
Nanwan
Jonas Perolini
ZeroOne-Aero
Jacob Dahl
kuralme
Ivan Zivotic