failsafe requires RC connection loss AND computer connection loss

[austinhurst]

@robpneu , please take a look at this and give me a call sometime so we can talk about it.

ROSflight goes into failsafe mode if there is no ppm signal for 40 milliseconds OR there is a ppm value below 900 or above 2100. I suggest we also setup our R9 module to output a pwm on all channels less than 900 in the event of an RC connection loss.
That can be found in rc.cpp, in check_rc_lost(). It can be adjusted there too.

The failsafe means that the Status message indicates if this failsafe is set.
It also means that the x, y, z, and F (servo and motor commands) will follow a different procedure.
That procedure is determined in command_manager.cpp in run(). Currently if the failsafe is tripped it defaults to a specific failsafe command. For Fixedwing vehicles it is just trim, ailerons = 0, elevator = 0, throttle = 0, etc.
The command_manager knows if there is a computer talking to it and also if there is an RC talking to it.
I propose that if the computer doesn't respond for 100 milliseconds AND RC connection is lost or out of the 900 - 2100 range, then the trim failsafe kicks in. Otherwise it listens to the RC and computer like normal. This should work because ROSplane is always outputing what it should if ROS were in control, but ROSflight decides whether to listen to the RC or ROS for the right command to send to the servos and motors.