The day it climbed

1. 0.1s Takeoff command Hawk
2. 6.4s Takeoff → Hold, levelled at ~1.8 m PX4
3. 13.2s Mode switch → LAND RC
4. 21.3s Set mode → HOLD Hawk
5. 21.6s Reposition to the 2 m target Hawk
6. 22.7s KILL RC

From the flight controller’s ulog. Source 245 is Hawk, the AI pilot. RC is the transmitter.

Written from the flight logs.

Field day. Same hillside, same buildings, and a battery I should not have flown on.

Three stick flights first. One tipped at lift-off and got the kill switch before it left the ground. The log calls that one an attitude failure in pitch and shows a high accelerometer bias afterwards. Something physical, cause still open. The other two were fine.

Then Hawk. “Hawk, take off.” The aircraft armed and took off on the spoken order. The acknowledgement came back late over the noisy radio, so the pilot code believed it had failed and said so, but log 39 is unambiguous: armed by external command, takeoff detected. The first time a sentence lifted this aircraft. I did not have time to enjoy it.

Second attempt, it climbed to about 1.8 m and held, wandering. I flipped Land on the transmitter. It came down steadily. About a metre from the ground it pitched up and climbed, hard. Kill. The battery tray tore off its rails when it hit.

What the log says

I pulled the logs off the flight controller over USB that evening and read every command PX4 received, who sent it, and every mode change. The readout above is that list. Two things in it matter.

At 7.9 s, Hawk sent a reposition to top up the altitude, because the aircraft had levelled off short of two metres. That is a feature I wrote: PX4’s takeoff often stops a little low, so the executor nudges it the rest of the way. At 13.2 s I selected Land. At 21.3 s Hawk sent a mode change back to Hold, and at 21.6 s a second reposition to the original target. My top-up was a loop of three attempts with a twelve-second wait between them. It never checked whether a human had taken over. The second attempt fired on schedule, and the call it uses switches to Hold before repositioning.

By then the GPS had also drifted. Thirty satellites, a claimed vertical accuracy of 0.3 m, and an altitude that slid four metres in ten seconds while the aircraft was near the ground. Multipath off the buildings. The barometer, read from the same log, was honest throughout. So the second reposition was a five-metre climb order, issued a metre off the ground.

Nothing failed. The battery failsafe was set to warning only, so it never acted. PX4 did exactly what it was told. It was told the wrong thing, by me.

I had told myself earlier that evening it was the battery failsafe climbing to a return altitude. The log said otherwise. Worth writing down: the first explanation that fits is not the explanation.

What changed that night

The executor now watches the flight mode continuously. Any mode it did not command, Land, Return, Position, Altitude, Manual, means the pilot has control: every running routine stops, nothing further is sent, and even a spoken “stop” is refused while the switch says Land. The altitude top-up is a single attempt, only from Hold. I reproduced the flight in the simulator, Land selected mid-takeoff and mid-move, and in both cases Hawk went silent and the aircraft landed under my mode.

Height reference moving to the barometer. Battery failsafe to Land, which never climbs. Default takeoff height down to 1.5 m. And a flow sensor on the list, because a GPS that reflects off walls is not a position source this site will ever give me.

The design rule from day one was that the transmitter always wins. I believed the code enforced it. It did not. Now it does, and I have the log that proves both halves.