Shutdown Autopilot as safety precaution via MAVLink

Hi Everyone,

I’m trying to set up proper safety precautions for retrieving the drone after a flight mission. The goal is to ensure that the rotors cannot start spinning unexpectedly while the vehicle is being picked up.

The target setup is an automated quadrocopter with companion computer in lab environment. The companion is reachable via ssh and sends MAVLink messages via UART to a Pixhawk with PX4. At the moment, however, I am testing everything in SITL with Gazebo.

My current strategy was to send MAV_CMD_DO_FLIGHTTERMINATION to PX4. This seems to work while the drone is airborne, but not after landing. When the drone has landed and is disarmed, I receive MAV_RESULT_DENIED, even though the command and parameters are the same as when it worked in the air. The vehicle also remains armable afterward when denied. As far as I understand, ‘denied’ should be reserved for bad input only, shouldn’t it?

Further, I had situations where the mav status was reported as MAV_STATE_UNINIT, where trying to restart via MAVLink (MAV_CMD_PREFLIGHT_REBOOT_SHUTDOWN) is also denied. but it does as well in a regular state (e.g., standby). The params i tried were [1.0, 0.0, 0.0, 0.0, 0.0, 20190226.0, 0.0]. Trying to restart via QGC also fails. Is “Uninit” considered a ‘safe’ state for the given context of drone retrieval?

Part of my problem is that I am unsure whether these operations are unsupported in PX4 SITL, unsupported by PX4 in general, or whether I am missing something important.

More generally, I would appreciate to possibly get any hints or links on how to make working with such a semi-automated drone safer. In particular, while assuming the companion via UART or mavlink peers via radio could possibly invoke arbitrary commands via mavlink during retrieval, (which normally shouldn’t happen, but just to be safe).

Thank you!