There were a number of cases where the state was not correct or not as
desired after disarming, when running an external mode 'MyMission' with
executor:
- run MyMission, which triggers Hold, then Land
- before: Mode: Hold, executor_in_charge: 1
- after: Mode: MyMission, executor_in_charge: 1
- run MyMission, then user switches to RTL
- before: Mode: MyMission, executor_in_charge: 0
- after: Mode: MyMission, executor_in_charge: 1
- run MyMission, then while in Hold mode, low battery failsafe (RTL)
- before: Mode: Hold, executor_in_charge: 1
- after: Mode: MyMission, executor_in_charge: 1
- run MyMission, then stop external mode (terminate the process)
- before: Mode: (mode not available), executor_in_charge: 0
- after: Mode: Hold, executor_in_charge: 0
This case is unchanged:
- run MyMission, then low battery failsafe (RTL)
- before: Mode: MyMission, executor_in_charge: 1
- after: Mode: MyMission, executor_in_charge: 1
There was a race condition: for example when an external mode disabled
failsafe deferring, that then triggered a failsafe, while the mode executor
immediately sends a command (to e.g. switch modes).
In that case the failsafe got triggered but the mode switch was still
allowed.
This was because of the processing ordering:
- mode updates (and propagating the failsafe_action_active state)
- failsafe updates
- command handling
This patch makes sure failsafe_action_active is set immediately after
updating the failsafes.
Beat Küng