PX4 handles faults through failsafes that escalate in severity: None, Warning, Hold, Return, Land, Disarm and Flight Termination. Most failsafes first enter Hold for a short period, set by COM_FAIL_ACT_T, so a pilot can override. If several trigger at once, the most severe action wins.
The common failsafes
| Failsafe | Trigger | Key setting |
|---|---|---|
| Data link loss | Connection to the ground station is lost | NAV_DLL_ACT, timeout COM_DL_LOSS_T |
| Manual control loss | No selected manual controller after a timeout | NAV_RCL_ACT, timeout COM_RC_LOSS_T |
| GPS or position loss | Position estimate becomes invalid | Fallback chain, COM_POS_FS_ACT |
| Geofence | Vehicle leaves a horizontal or vertical limit | GF_ACTION |
| Battery | Charge falls below warn, failsafe or emergency levels | COM_LOW_BAT_ACT |
| Remote ID (v1.18) | Module missing or unhealthy while armed | COM_ARM_ODID |
The table is a summary of the PX4 documentation. Parameter names and defaults change between releases, so check the page for your version.
What happens when GPS goes away
For multicopters, PX4 falls back to Altitude or Stabilized mode when the position estimate becomes invalid, then moves through Return, Land and Descend. Fixed wing aircraft follow a similar chain, with a loiter before descent. A setting can request Termination instead of Descend on newer main branch versions.
A GNSS check added in version 1.18 raises an action when the receiver count falls below a set level or two receivers disagree. The default action is a warning, and options include Return, Land, Terminate or a warning that blocks arming.
Link loss is a policy decision
The data link action can be Disabled, Hold, Return, Land, Disarm or Terminate. There is no universal right answer. Return is common in open areas. Land may be safer near obstacles on the return path. Disarm and Terminate are drastic and can cause a fall.
Write the choice down by site type, and review it before each job. A setting copied from a tutorial is a risk.
Remote ID as a failsafe
From version 1.18, PX4 can check that a Remote ID module is present and healthy while armed. The action can be Disabled, Warning, Error, which blocks arming, Return, Land or Terminate. For regulated operations, blocking arming is the cleaner choice, because it stops a flight that would break the broadcast rule.
Test it before you rely on it
- Run link loss and RC loss tests in simulation first, then in a safe field.
- Confirm the return altitude clears the tallest obstacle.
- Check what the aircraft does when GPS and link fail together.
- Record the parameter set in version control and diff it after each update.
- Treat a firmware update as a change that can alter defaults.
Where the software supply chain fits
A flight stack pulls in many libraries and build tools. If you build firmware yourself, keep an inventory of what goes into each build. Safeguard can scan a project's dependencies for known vulnerabilities, and its free scan is a quick way to look at the code around your ground tools and companion software.
Quick check
Which action wins if two failsafes trigger together?
The most severe one, according to the PX4 documentation.
Does PX4 hold briefly before acting on most failsafes?
Yes. Most failsafes first enter Hold for COM_FAIL_ACT_T seconds, so the pilot has time to override.
Sources
- PX4 User Guide, Safety configuration: failsafe types, actions and parameters. The page was truncated at the end in my fetch.
Last reviewed: 19 October 2026.
