Fly View action to toggle ArduPilot hardware safety switch

[DonLakeFlyer]

Summary

Add a Fly View action to engage/disengage the ArduPilot hardware safety switch from QGC, with the current safety state shown in the UI.

Requested in a user comment:

an interface element to allow toggling of the "hardware" safety switch would be nice. Would have saved @Ryanf some issues the other day. MissionPlanner allows it from its "quick actions" stuff on its main flight screen, and MAVProxy always as "arm safetyoff". It's an extremely useful workflow element - being able to turn off your motor and servo outputs after landing is very handy, for example.

Background

On Pixhawk-class boards (and many GPS modules) there is a physical safety button with an LED. When safety is engaged (LED blinking) the flight controller cuts all PWM outputs — motors and servos are dead and the vehicle refuses to arm ("Hardware safety switch" pre-arm failure). Pressing the button disengages safety (LED solid), enabling outputs and allowing arming.

Why a GCS toggle is useful:

• Button unreachable / absent — vehicle on a launch rail, in a cage, on a boat, far away, or boards without a button (BRD_SAFETY_DEFLT / BRD_SAFETY_MASK setups). Without a software toggle the operator is stuck on a pre-arm failure.
• Post-landing safety — disarming stops motors, but servos (control surfaces, gimbals, grippers, camera triggers) stay live. Re-engaging safety kills every output so the aircraft is safe to handle.
• Bench work — engage safety, then configure/test with no risk of a prop spinning.

How other GCSs do it

Mission Planner — Flight Data → Actions tab → Do Action dropdown → Toggle_Safety_Switch (GCSViews/FlightData.cs, actions enum). Implementation:

• Reads current state from SYS_STATUS.onboard_control_sensors_enabled bit MAV_SYS_STATUS_SENSOR_MOTOR_OUTPUTS (set = safety off / outputs enabled).
• Sends SET_MODE with base_mode = MAV_MODE_FLAG_SAFETY_ARMED (128) and custom_mode = 1 (engage safety) or 0 (disengage).

For reference, the full MP Do Action list: Loiter_Unlim, Return_To_Launch, Preflight_Calibration, Mission_Start, Preflight_Reboot_Shutdown, Trigger_Camera, System_Time, Battery_Reset, ADSB_Out_Ident, Scripting_cmd_stop_and_restart, Scripting_cmd_stop, HighLatency_Enable, HighLatency_Disable, Toggle_Safety_Switch, Do_Parachute, Engine_Start, Engine_Stop, Terminate_Flight, Format_SD_Card. The surrounding grid also has Arm/Disarm, Set Mode, Set WP, Set Mount, Auto/Manual/RTL, Set Home Alt, Restart/Resume Mission, Abort Land, Change Speed/Alt/Loiter Radius, Send Message, Joystick, Raw Sensor View, Clear Track.

MAVProxy — arm safetyon / arm safetyoff, same SET_MODE + MAV_MODE_FLAG_DECODE_POSITION_SAFETY mechanism.

Newer ArduPilot also accepts MAV_CMD_DO_SET_SAFETY_SWITCH_STATE (param1: 0 = safety off, 1 = safety on).

Current QGC state

Nothing exists for this. The only related code reads the same heartbeat flag to derive armed state (src/Vehicle/Vehicle.cc, src/Comms/MAVLinkProtocol.cc). The safetySwitch ids in src/AutoPilotPlugins/Common/MotorComponent.qml and src/AutoPilotPlugins/PX4/ActuatorComponent.qml are only UI guards on the motor/actuator test sliders and do not talk to the vehicle's safety switch.

Proposed implementation

• Track hardware safety state on Vehicle from SYS_STATUS MAV_SYS_STATUS_SENSOR_MOTOR_OUTPUTS (enabled bit), exposed as a Q_PROPERTY.
• Vehicle / FirmwarePlugin method to set safety state. ArduPilot-only via APMFirmwarePlugin (vehicle->firmwarePlugin(), no if (apm) branches). Prefer MAV_CMD_DO_SET_SAFETY_SWITCH_STATE, fall back to SET_MODE for older firmware if needed.
• Fly View action (Guided Actions / toolbar) to toggle, only shown when the firmware plugin supports it. Disable while armed; confirm before disengaging safety.
• Show current safety state (e.g. in the arming/flight-mode indicator) so the operator can see why arming is blocked.
• Logging via QGC_LOGGING_CATEGORY and unit test coverage of the state tracking + command send.

[DonLakeFlyer]

@peterbarker Was asking about this.