RTL: do not RTL if RTL alt is above max HAGL

[bresch]

Solved Problem

When using a downward looking sensor for navigation (e.g.: optical flow), the EKF sends a height above ground limit that the vehicle shouldn't exceed to avoid a loss of navigation. Currently, commander/navigator are unaware of this and are allowed to trigger RTL with an altitude higher than the maximum value, leading to a descend. When below the max HAGL, the navigation re-starts and commander tries to RTL again. The vehicle is then stuck in a loop.

Solution

RTL shouldn't send the vehicle to an altitude above the mag HAGL. Sending the drone to the max HAGL and then to home is dangerous too, so the best option is to land instead.

New uORB topic: navigator_status is used to report when a navigator mode fails to execute.
Commander monitors this field and triggers a failsafe if the current navigator mode fails.

Changelog Entry

For release notes:

-
New parameter: -
Documentation: -

Test coverage

sitl with optical flow

[KonradRudin]

For the case when we trigger an RTL where at the beginning the hagl condition (_rtl_alt - terrain > hagl_max) is not true, we would make a normal RTL. When then the terrain changes and the hagl altitude is exceeded, then it would also go into failsafe descend first and then into RTL again, correct? Is there a way to avoid that? Or flying in this situation should always trigger land instead of RTL? An alternative approach would be to enforce that in navigator rather than in the RTL.

[bresch]

I will in fact try to do something similar to geofence:

1. Navigator sends a uorb topic with the "breached" flag
2. commander/HealthAndArmingChecks subs to that topic and sets a failsafe flag
3. failsafe.cpp gets that flag and switches to land