Navigation Integrity and Recoverable Autonomy in GPS Denied Environments

State estimation, integrity monitoring and the preservation of safe recovery options.

Abstract

Autonomous navigation without reliable satellite positioning is an estimation problem, a safety problem and a problem of preserving future options. A robot can produce a smooth trajectory while losing information about motion along a corridor, accepting a false map association or inheriting a common error from its collaborators. Position accuracy averaged across a completed run does not reveal whether the robot recognised dangerous errors before those errors affected control. We therefore investigate navigation integrity as an operational contract linking bounded state uncertainty, timely withdrawal of navigation availability and a physically feasible recovery policy.

We propose a Subterra research architecture in which estimation, integrity assessment and motion admission have distinct responsibilities. The estimator proposes states and maps. The integrity layer records fault hypotheses, dependence between information sources, observability, timing and the scope of each protection claim. A recovery supervisor admits motion only while the resulting uncertainty set remains compatible with a safe continuation or a defined terminal condition. Collaborative information enters through versioned factors with explicit ancestry; recovery requires removing the consequences of suspect information rather than merely disconnecting its transmitter. We derive conditional protection and recovery propositions, including an impossibility result for an unobserved common position offset.

Our computational study comprises five synthetic measurement conditions with 100,000 paired snapshots per condition, exact Gaussian correlation calculations, a corridor observability example, stopping-distance analysis and an exhaustive return-energy example. Under a 1 m common offset, a residual monitor accepts 99,899 snapshots and leaves 99,703 accepted errors beyond a 0.75 m alert limit. An independently bounded reference rejects all snapshots in that condition, but fails when it shares the offset. In 64 bounded energy configurations, an information-greedy route exceeds the available energy in 40 configurations; the reserve-constrained route retains its specified terminal reserve in every configuration while collecting less information. These results establish mechanisms and trade-offs within the stated models. The implementation programme separately addresses nonlinear estimation, field sensing, communications, actuation and human supervision.

Our central conclusion is that recoverable autonomy requires a maintained argument about what remains observable, what may be wrong and which actions preserve a viable response. More sensing and better average accuracy can improve performance, but neither supplies that argument automatically. The appropriate research objective is useful mission progress under explicit integrity and recovery constraints, with unresolved assumptions visible in the action decision.

Contents

1 Research problem and contribution

The operational question

We ask when an autonomous platform should continue, reduce its operating envelope, seek additional observations, return or terminate motion after losing reliable absolute positioning. GPS denial includes physical exclusion of satellite signals, insufficient geometry, receiver failure and environmental interference. The same reasoning applies when a position service remains available but its information cannot support the current safety requirement. Underground access routes, enclosed industrial structures, damaged facilities and cluttered urban interiors expose the distinction: successful navigation depends on more than replacing one unavailable sensor.

A robot traversing a tunnel can estimate lateral distance from walls accurately while remaining poorly constrained along the tunnel. A visual system can repeatedly recognise the wrong junction. Several robots can agree because they inherited the same map transformation. A delayed state can have a small covariance at its timestamp and still be unsuitable for present control. In each example, a nominally healthy software pipeline can supply information that is operationally misleading. The risk arises when the platform acts as though an unsupported proposition about its state were established.

The relevant outcome is therefore task dependent. An inspection vehicle may tolerate metre-scale uncertainty in its global map while requiring centimetre-scale relative clearance from live equipment. A flying vehicle may tolerate brief mapping interruptions but have little time to arrest motion. A ground robot on unstable terrain may be unable to stop safely at every location. We treat the navigation requirement as a property of a proposed action in its environment, rather than a fixed accuracy label attached to the estimator.

Research claims

The study develops four connected claims. First, navigation integrity requires a stated family of possible faults and a justified bound on errors under those faults. Second, the geometry and ancestry of information matter as much as the number of available measurements. Third, a recovery policy must remain feasible from the physical states that could actually have been reached. Fourth, evaluation must count dangerous accepted estimates, delayed interventions and failed recoveries alongside ordinary localisation error.

Our contribution is the integration of these claims into a proposed research architecture, supported by explicit mathematical conditions and reproducible computational counterexamples. We do not introduce the underlying ideas of probabilistic localisation, integrity monitoring, covariance intersection or invariant-set control. Those foundations are identified in the literature. We examine their interfaces and the failure modes that arise when a property established for one component is incorrectly assumed to hold for the complete autonomous system.

We use Subterra as the name of the proposed navigation and recovery research architecture. Its incubating mechanisms are an evidence-bearing navigation output, a provenance-aware collaborative factor interface, a contract for admissible motion and a structured re-entry procedure after navigation degradation. Their intended contribution lies in their joint specification and evaluation. Whether the resulting implementation offers a practical advantage is a question for the comparative experiments defined in this study.

Scope of the argument

We examine ground and aerial robots undertaking mapping, inspection, access assessment and infrastructure support. The state includes position, orientation, velocity, sensor biases, map alignment, resource reserves and relevant environmental conditions. Navigation integrity is necessary for these tasks but does not establish structural safety, atmospheric suitability, correct object interpretation or reliable mechanical operation. Those quantities enter as additional constraints or explicit dependencies.

Our empirical work uses synthetic measurements and finite analytical models. Its purpose is to isolate mechanisms that would otherwise be confounded in a large robotic stack. We distinguish those executed exercises from the proposed field programme. The distinction is essential to interpreting the results: an algebraically conservative bound under a specified noise model does not demonstrate that a camera, a map or a robot conforms to that model in a dusty passage.

2 Research method and technical foundations

Evidence selection

The research basis comprises publications available by 11 October 2016. We use the publicly available version of a work that satisfies that horizon. We organise evidence by the proposition it supports: estimation capability, uncertainty consistency, integrity monitoring, collaborative dependence, recoverable control or evaluation methodology. Publication prestige and aggregate benchmark performance do not substitute for relevance to the proposition.

The method combines a critical synthesis, a formal architectural specification, constructive counterexamples and computational experiments. We first identify assumptions that are frequently hidden when algorithms are integrated. We then define interfaces that carry those assumptions into planning and control. We derive conditional results and deliberately test conditions that defeat them. Finally, we specify the evidence needed to replace analytical assumptions with justified implementation claims.

What the foundations establish

Probabilistic robotics supplies a coherent framework for representing uncertain state and incorporating noisy measurements (Thrun, Burgard and Fox, 2005). The SLAM literature also identifies persistent problems in robustness, scalability, data association and operation over extended periods (Cadena et al., 2016). These foundations motivate probabilistic state estimation, but they do not imply that an estimator's covariance is an integrity bound. The distinction becomes important whenever fault distributions, association errors or common disturbances are absent from the nominal likelihood.

Calhoun (2016) develops quantitative integrity approaches for image-rendering navigation, including discrete detection and probabilistic state inference in a precision relative-navigation setting. We take from this work the requirement to analyse unsafe navigation errors explicitly. The transfer to tunnels or industrial interiors requires different scene models, operating boundaries and failure assumptions. A numerical integrity result in a constrained visual task cannot be transferred unchanged to general underground navigation.

Joerger and Pervan (2013) connect fault detection in linear dynamic estimation to the probability of unacceptable state errors remaining undetected. Blanch et al. (2015) describe advanced receiver integrity calculations using fault hypotheses, nominal error models and protection levels. We use these as foundations for hypothesis-aware monitoring. Their navigation setting also illustrates why a protection claim requires more than comparing residuals with a convenient threshold.

Estimation and planning comparators

LOAM separates fast odometry from more demanding map registration, providing a useful example of allocating computation across different update rates (Zhang and Singh, 2014). Keyframe visual-inertial optimisation supplies a complementary estimator with bounded-window computation and explicit visual and inertial terms (Leutenegger et al., 2015). ORB-SLAM contributes a visual mapping and relocalisation comparator (Mur-Artal, Montiel and Tardós, 2015). We use these as distinct algorithmic baselines rather than treating their published accuracy as evidence for our proposed architecture.

Incremental graph optimisation can revise past state estimates efficiently (Kaess et al., 2012), while IMU preintegration can summarise high-rate inertial measurements between keyframes (Forster et al., 2015). Both are relevant to implementation efficiency. They also create obligations: marginalised information retains dependencies, and changing an estimated history can invalidate previously derived maps or commands.

For exploration, receding-horizon next-best-view planning provides a concrete means of selecting observations online (Bircher et al., 2016). Information-gathering methods can account for motion and resource budgets (Hollinger and Sukhatme, 2014). We extend the decision specification to require that information acquisition preserve a certified recovery option. This is an architectural requirement; its computational feasibility depends on the chosen state abstraction and planning horizon.

The integration gap

Table 1 distinguishes the useful contribution of each research family from the claim that remains open when it is incorporated into Subterra. This separation prevents a system-level assurance argument from inheriting guarantees that the component paper did not establish.

The resulting study is an argument about composition. A navigation stack can contain strong individual algorithms yet fail because its error budget excludes clock uncertainty, its recovery estimator shares a corrupted prior or its planner consumes the reserve required by its fallback. The research task is to expose and test those interfaces.

3 Navigation integrity as an operational contract

State and information

Let the physical state at time t include pose, velocity, inertial biases, actuator condition and remaining energy. Let the environmental state include geometry, traversability and relevant hazards. A map is an estimate of aspects of that environment, with its own reference frame and history. A belief is a distribution over the joint unknowns conditioned on observations and actions. This representation follows the general logic of partially observable decision models (Kaelbling, Littman and Cassandra, 1998).

For implementation, we distinguish a nominal estimate from a protection set. The nominal estimate supports efficient prediction and planning. The protection set encloses states that must be considered by the integrity and recovery argument under its stated assumptions. It may be an interval, ellipsoid, collection of hypotheses or reachable tube. A covariance matrix can help construct such a set, but it does not define one without distributional and model-validity assumptions.

Every estimate has a timestamp, coordinate frame, map version and validity interval. A position in a local odometric frame is not interchangeable with a position in a surveyed infrastructure frame. A change of frame has uncertainty; it is not an exact cosmetic transformation. We preserve the distinction between relative clearance, local route consistency and absolute registration throughout the architecture.

Definitions

Accuracy characterises the relationship between an estimate and truth, usually through an error distribution or empirical summary. Integrity concerns the risk that navigation information is dangerously wrong while remaining authorised for use. Availability is the fraction of the specified operating opportunity for which the required navigation service is declared usable. Continuity concerns interruption of that service over a defined interval. Recoverability concerns whether an admissible policy can reach or maintain a specified safe condition from the states consistent with current evidence.

Let the task-relevant position error be e, its alert limit be A, and the declared protection level be L. Let a denote acceptance for the action. A hazardous misleading snapshot satisfies |e| > A and a = 1. A protection failure satisfies |e| > L. These events differ: a conservative bound can exceed the alert limit and correctly withdraw service, while a small bound can fail without the error yet crossing the physical hazard threshold.

Equation 1. Hazardous accepted error and protection-bound exceedance for one task-relevant scalar component.

For a vector state, the alert condition must be defined geometrically. An axiswise bound is not automatically a horizontal radial bound. A pose confidence region must account for rotational uncertainty when converting body geometry into swept volume. If axiswise probabilities are combined, their joint risk requires an appropriate multivariate model or a conservative union bound.

Time to alert and hazardous exposure

An alert is useful only if the system can respond before losing the required safety margin. We define hazardous exposure as the time spent using navigation after a relevant error or condition violates its contract. A detector's computation time is only one term. Sensor exposure, scan formation, buffering, time alignment, communication, scheduling, decision execution and actuator response all contribute.

There are two distinct obligations. The monitor must identify a violation within its specified detection conditions, and the supervisor must complete a feasible response within the remaining physical margin. Increasing a detection window can improve sensitivity to small biases while reducing the time left to stop. The monitoring design must therefore be coupled to speed, clearance and braking or manoeuvring capability.

We avoid a universal time-to-alert target. The same delay can be acceptable in an open inspection chamber and unacceptable near a narrow aperture. A task-specific navigation contract declares an alert geometry, a maximum evidence age, an admissible response delay and the fallback that justifies those values. If the fallback is unavailable, the contract changes even if the estimator is unchanged.

Risk over an entire mission

A one-step error probability does not describe a mission containing repeated decisions. For events H over N decisions, the union bound gives a valid upper bound without assuming independence. Independence produces a different expression and must be justified rather than inferred from a high update rate.

Equation 2. Mission aggregation and the special case of identical independent per-decision risk p.

The architecture maintains a mission-level allocation and records how risk is consumed or reassessed. Replanning does not create a fresh independent mission. Conditional allocations must remain valid for the histories under which the decision is made. Risk from unmodelled common faults, map errors and recovery failure must not disappear into a nominal localisation covariance.

4 Sensing calibration and fault assumptions

Complementarity and common causes

We propose a sensing architecture selected by the operating environment rather than by a fixed requirement to maximise sensor count. Inertial sensing supports short-time propagation; range sensing supplies geometry; cameras provide appearance and bearing information; wheel or leg motion may constrain contact-relative movement. Surveyed references, local beacons or independently established landmarks can constrain drift where the mission permits them. Each source supplies information only under conditions that must be monitored or bounded.

Optical and range sensors can fail together in airborne particulates. Ryde and Hillier (2009) experimentally compare laser and radar behaviour under dust and rain and show that performance depends on both environmental transmission and the device's measurement characteristics. We therefore treat radar or thermal sensing as possible complementary channels, not as universal replacements. A channel that survives one obscurant may still have inadequate angular resolution, ambiguous targets or insufficient geometric information for the required task.

The appropriate diversity is diversity of failure mechanisms. Two cameras sharing a saturated scene are not independent references. A LiDAR and camera aligned to the same wrong map can share a global position error despite different physical sensing principles. A separate computer running the same estimator over the same inputs provides computational redundancy, but not independent evidence about the world.

Calibration as a maintained state

Spatial calibration includes sensor extrinsics, lever arms and axis conventions. Temporal calibration includes acquisition times, clock offsets and timing uncertainty. Calibration errors can imitate physical motion, particularly during rotation. Li and Mourikis (2014) analyse online camera-IMU time-offset estimation and its identifiability. Their work supports treating timing as an estimation variable where the motion supplies sufficient information; it does not justify assuming that every online calibration estimate is observable.

We require calibration records to carry conditions of validity. A rigid mounting assumption can be defeated by a collision, loose attachment or thermal deformation. A timing model can be defeated by a change in buffering or timestamp semantics. The supervisor should respond to such changes through a defined calibration-degraded mode, rather than retaining the previous small uncertainty by default.

If a parameter is poorly identifiable, the system should retain a conservative range for it and propagate that range into navigation or withdraw the affected capability. Freezing an uncertain parameter can improve numerical stability while concealing physical uncertainty. A fixed value is a computational choice, not evidence that the parameter is known.

A fault model suitable for integration

We distinguish random measurement error, persistent bias, dropout, outlier correspondence, incorrect map association, stale data, frame mismatch, resource exhaustion and malicious or accidental message corruption. Multiple categories can occur together. An erroneous map association can be internally consistent across many observations, so it should not be modelled solely as independent pixel noise.

For each claim, the study specifies whether a fault is bounded deterministically, assigned a probability, explicitly detected or excluded from the available service. Assigning a very small probability to an inconvenient failure without evidence would strengthen the numerical result while weakening its meaning. Where a credible probability is unavailable, we prefer conditional guarantees and conservative action restrictions.

Threats to the evidence itself

Authentication can establish who sent a measurement, but cannot establish that the measurement is true. An authorised robot can be miscalibrated. A genuine map can be outdated. A signed state packet can carry an old coordinate-frame convention. Message verification therefore precedes, but does not replace, physical and statistical consistency checks.

Fawzi, Tabuada and Diggavi (2014) show how recoverability of state under corrupted channels depends on structural properties of a linear system and the assumed corruption model. For our architecture, the transferable principle is that redundancy must be informative in the relevant state directions. We do not assume that a majority vote over sensors or robots establishes integrity when those participants share an error source.

5 Estimation observability and map integrity

The proposed estimation structure

We represent navigation as a graph of state variables, calibration variables, map variables and measurement factors. Dellaert (2012) provides a useful account of the factor-graph formulation. In Subterra, each factor additionally carries its acquisition interval, source identity, calibration version, coordinate frame, association hypothesis and dependency identifiers. Those fields allow the integrity layer to ask which estimate depends on which evidence and what must be recomputed after evidence is withdrawn.

The main estimator may combine inertial propagation, local geometric constraints, visual observations and accepted collaborative factors. It outputs a nominal state, an uncertainty representation and a dependency summary. A separate monitoring computation uses declared exclusion hypotheses or alternative physical references. Separation means an explicit difference in the evidence or assumptions being tested. It does not require every monitor to be implemented as another full navigation stack.

We retain a local control frame whose evolution is constrained and understood by the controller. Global map optimisation may change the transformation between that frame and the mission frame. Such changes are published as versioned transformations. They are not injected into a running control loop as an unexplained pose jump. The command consumer checks that its trajectory and obstacle geometry refer to compatible versions.

Observability and artificial confidence

Observability concerns whether measurements can distinguish relevant states. Local numerical conditioning concerns sensitivity near the current solution. They are related but not interchangeable. A well-conditioned problem after an arbitrary gauge has been fixed can still lack an independent absolute reference. Conversely, a poorly conditioned local geometry may become informative after a safe change in viewpoint.

Hesch et al. (2014) identify spurious information gain in unobservable directions as a cause of inconsistency in visual-inertial estimation. Zhang, Kaess and Singh (2016) analyse degeneracy in optimisation-based estimation and separate well-constrained directions from poorly constrained ones. These results motivate two checks: preserve the correct unobservable subspace, and examine the information contributed by current measurements rather than relying only on the accumulated posterior covariance.

For a linearised measurement model with Jacobian H and covariance R, the information contribution is H transpose times R inverse times H. We evaluate its directional structure after choosing physically meaningful state scaling and accounting for known gauge freedom. Comparing unscaled eigenvalues of metres, radians and bias states can produce arbitrary thresholds. The monitor therefore states the state metric and separates geometry-sensitive diagnostics from physical uncertainty bounds.

Equation 3. Information from new measurements in a declared local state parameterisation.

A corridor with parallel walls can provide many range returns while contributing little information about axial displacement. Increasing the number of returns from those same surfaces does not restore the missing direction. A small axial covariance in that condition may reflect an inherited prior, a motion assumption or an inconsistent update. The architecture records which of those explanations supports the bound.

Maps as uncertain measurements

A map can be wrong in geometry, topology, time or reference frame. We distinguish a measured occupied region, a measured free region and an unobserved region. Occupancy mapping such as OctoMap supports this distinction in a compact three-dimensional representation (Hornung et al., 2013). Our motion-admission layer additionally requires a validity interval and uncertainty allowance for the region used to justify clearance.

An old free-space observation is not a permanent guarantee that the space remains clear. Temporary equipment, doors, water, debris or people can alter traversability. For static infrastructure, a map may support a longer validity interval, but that interval must be related to the operational process. High confidence in the original measurement cannot compensate for an unbounded possibility of subsequent change.

Map uncertainty is also correlated with pose uncertainty when the robot built the map. Treating the estimated wall and the estimated robot as independent can either overstate or understate relative clearance. We require relative geometry to be computed from the appropriate joint representation, or conservatively bounded when cross-correlation is unavailable. Absolute uncertainty can be large while relative wall clearance remains useful; the architecture should preserve that useful distinction.

False associations and retained contamination

Switchable constraints and mixture-based graph inference offer mechanisms for reducing the influence of incorrect associations (Sünderhauf and Protzel, 2012; Olson and Agarwal, 2013). We include them as candidate robust-estimation comparators. Their role is to improve the estimate under their modelling assumptions. A low robust cost does not establish that a visually repetitive branch has been identified correctly.

The difficult case is a coherent alternative explanation. A repeated tunnel module may support many mutually consistent wrong correspondences. If all accepted constraints favour that interpretation, residual checks can become small as the estimate moves towards the wrong solution. The integrity layer should retain competing topological hypotheses when the observations do not distinguish them, or restrict motion to actions safe under every retained hypothesis.

Marginalisation makes recovery more demanding. Removing a recent factor does not remove its influence if that information has already entered a marginal prior, an updated map or another robot's estimate. We propose dependency-aware checkpoints and bounded replay segments. Recovery recomputes all affected descendants or declares the resulting estimate unsuitable for the affected claim. When ancestry is incomplete, uncertainty inflation alone requires a justified bound; an arbitrary multiplier is not a proof that contamination has been contained.

6 Integrity monitoring and protection claims

Hypotheses before thresholds

A monitor begins with a hypothesis set. Examples include nominal operation, a fault in one measurement group, an uncertain map transform, a delayed input or loss of an observable direction. The grouping should follow failure mechanisms. Thousands of points from one scan can constitute one group when they share a clock, calibration or obscurant. Counting them as thousands of independent protections against that common fault would misrepresent the evidence.

A residual test compares a discrepancy with its expected distribution. Its threshold has meaning only under the assumed covariance, model and degrees of freedom. Reusing measurements after selecting correspondences, estimating calibration or rejecting outliers can alter that distribution. The implementation must either derive the relevant distribution, calibrate a conservative bound using an appropriate independent procedure, or restrict the claim to a narrower validated regime.

We maintain a distinction between detection and isolation. Detection establishes that the accepted model set is inadequate. Isolation identifies which information can be removed while retaining a justified estimate. When two sources disagree, the smaller residual after excluding one source does not necessarily identify the faulty source. Fault exclusion can improve availability, but its error probability belongs in the integrity argument.

A conservative reference-envelope construction

Consider a scalar state x, a proposed estimate x-hat and a family of reference estimates indexed by h. Under hypothesis h, the corresponding reference estimate has error no greater than r-h except on an event with probability alpha-h. We form a protection level by taking the largest separation between the proposed estimate and each reference, augmented by that reference's valid error bound.

Equation 4. Reference-envelope protection level. Each reference bound is valid only under its stated hypothesis.

Proposition 1. Suppose the true operating condition belongs to one of the declared hypotheses, and the corresponding reference satisfies its stated error bound. Then the proposed estimate is within L of the true state. The result does not require statistical independence between the proposed estimate and that reference.

Proof. For the true hypothesis h, the triangle inequality gives |x-hat minus x| no greater than |x-hat minus x-hat-h| plus |x-hat-h minus x|. The second term is at most r-h on the reference coverage event. The first term plus r-h is no greater than the maximum defining L. Therefore a violation of L under h implies failure of the reference bound under h. This proves the deterministic implication and the corresponding probability bound.

If the hypotheses are mutually exclusive, have probabilities pi-h and leave probability beta outside the declared family, an unconditional bound is beta plus the sum of pi-h times alpha-h. Those probabilities describe the operating population or an explicitly justified conditional experiment. They must not be assigned after looking at an inconvenient residual. If all covered hypotheses have error probability at most alpha, a conservative alternative is beta plus alpha. Without a justified beta, the result remains conditional on the hypothesis family.

The envelope deliberately sacrifices availability when credible explanations disagree. It can be implemented with leave-group-out solutions, independently surveyed references or bounded local geometric estimates. A Gaussian reference may use a quantile multiplied by its standard deviation, plus a justified bias allowance. A reference with an unbounded state direction cannot supply a finite protection level for that direction.

Why agreement cannot certify an unknown common offset

Proposition 2. Suppose every available absolute-position observation has the form z-i = x + c + noise-i, where c is an unrestricted common offset, and all other observations are invariant under translation of the absolute frame. Consider a system that accepts with probability q and reports a finite protection level no larger than an alert limit A. There exist two indistinguishable physical interpretations for which at least one has accepted bound violations with probability at least q divided by two.

Proof. Choose two states separated by more than 2A. Change the common offset by the opposite amount, leaving the distribution of every available observation unchanged. The algorithm consequently has the same acceptance and output distribution in both interpretations. On an accepted observation, an interval of radius at most A cannot contain both states. Summing the two accepted-coverage indicators is therefore at most the acceptance indicator. At least one interpretation has accepted non-coverage probability no smaller than q divided by two.

This is an identifiability result. A different residual threshold cannot resolve it because the observations have the same distribution. To establish absolute integrity, the system needs additional information that breaks the ambiguity, a justified bound on the common offset or withdrawal of the affected service. The result does not prohibit local collision avoidance when relative robot-obstacle geometry is invariant to the same offset. It prohibits an unsupported absolute-position claim.

Multiple tests and monitor dependence

Running more monitors increases opportunities for both useful detection and false interruption. Their outputs are generally dependent because they share measurements and states. We therefore allocate false-alert and missed-detection budgets across a declared test family. A union bound can be conservative, but an independence assumption made for convenience can be unsafe.

The monitoring state includes elapsed exposure. A windowed detector that resets on every reinitialisation may repeatedly discard evidence of slow drift. Conversely, carrying a statistic through a genuine change of model can invalidate its distribution. Reset conditions, baseline changes and quarantine transitions must be logged and included in evaluation. The same requirement applies to thresholds adapted from recent data: adaptation may improve performance, but it changes the test being claimed.

7 Collaborative localisation and information containment

Cooperation changes the dependence structure

Relative observations between robots can improve localisation. Distributed formulations can reproduce appropriate centralised updates when the required information is preserved (Roumeliotis and Bekey, 2002). The integrity challenge is that repeated sharing creates common information. A robot's own earlier estimate can return through a collaborator and appear to be an independent confirmation.

We require a collaborative factor to identify its source observations and any prior information already used. The recipient records the ancestry it can establish and the ancestry it cannot. A message with unknown dependence is treated differently from a fresh relative measurement. Map alignment is also an estimated quantity: a collaborator's local position cannot be fused into the mission frame without accounting for the uncertain transformation between frames.

The proposed architecture keeps collaborative corrections separate from the local control frame until the receiving estimator and integrity layer have admitted them. This does not make local estimates immune to common faults. It creates a controllable interface at which dependency, freshness and frame checks can occur before a correction changes motion authority.

Conservative fusion under unknown correlation

Covariance intersection provides a conservative fusion approach when cross-correlations are unknown and the input uncertainty descriptions are themselves valid (Julier and Uhlmann, 1997). For two compatible estimates with positive-definite covariance bounds, its information-form combination uses a weight between zero and one.

Equation 5. Covariance-intersection covariance for two estimates in a common state parameterisation.

The fused mean uses the same weighted information terms. The method addresses unknown correlation, not arbitrary bias, invalid marginal uncertainty or mismatched states. For nonlinear pose estimates, frame alignment and tangent-space consistency must be resolved before applying a Euclidean formula. Repeatedly applying a conservative fusion rule does not establish that a shared incorrect map has become correct.

Our analytical example shows why the distinction matters. Two equally uncertain estimates with almost identical errors can be averaged without materially reducing actual error. A fusion rule that treats them as independent reports an unjustified reduction in variance. With ten exact copies of one observation, the nominal uncertainty can shrink by the square root of ten while the actual error is unchanged. This is an information-accounting failure, not a shortage of sensor precision.

Quarantine and dependency recovery

When a collaborative source becomes suspect, the immediate action is to prevent new information from that source from affecting the relevant service. The next action is to identify existing descendants. Those descendants can include pose estimates, marginal priors, map tiles, detected-object coordinates, route costs and messages sent to other robots. The source identifier alone is insufficient when information has been transformed or merged.

We propose three recovery levels. A local rollback recomputes a bounded estimation window after removing suspect factors. A map recovery reconstructs affected map products and transformations from a checkpoint with justified ancestry. A service recovery withdraws the affected navigation capability when neither bounded recomputation nor an independent reference is available. The system can retain unaffected capabilities, such as local clearance, if their dependencies remain valid.

A checkpoint is a computational state, not a previous physical location. Restoring an estimator does not move the robot back to the checkpoint. Recovery must propagate the reconstructed estimate to the robot's current time and retain uncertainty about the motion that occurred during the contaminated interval. If that interval contains no sufficiently informative observations, the recovered state may remain too uncertain for further motion.

Communication loss and re-entry

Each robot must have a declared policy for loss of communication. Continuing indefinitely on the last received collaborative correction is not a complete policy. The contract states how uncertainty grows, which tasks remain available, when a rendezvous or return is required and what terminal condition applies if communication cannot be restored.

Reconnection is not automatic re-trust. The robots reconcile frame versions, clocks, map ancestry and outstanding hypotheses. Messages are checked for duplication and replay at the application level as well as for transport authenticity. If each robot's estimate already contains the other's earlier information, that dependence remains after a network interruption. A fresh connection does not create fresh evidence.

8 Recoverable autonomy and safe resumption

An information state for recovery

We define a recovery information state q as a set of possible physical states together with resource bounds, map validity, timing bounds and the sensor capabilities expected to remain available. A recovery set K contains those information states from which one admissible observation-based policy can reach a specified terminal set G while respecting safety constraints under all declared disturbances. Requiring one policy matters: knowing that a different control could save each hidden physical state does not establish that the robot can choose the right control without observing which state it occupies.

Possible terminal conditions include a stable stopped state, a surveyed refuge, a validated landing area, a communications waypoint or a recovered navigation service. The appropriate terminal set depends on the platform and hazard. Hovering consumes energy and may be impossible under degraded localisation. Stopping on a slope or beneath a developing hazard may not be safe. Return along a previously traversed route requires that the route remain traversable and observable enough for the return policy.

Reachability methods provide a foundation for reasoning about possible system evolution under bounded disturbances (Mitchell, Bayen and Tomlin, 2005). Simpler recovery certificates can be used where the dynamics permit them. The objective is not to force every platform into a large continuous-state computation, but to state exactly what the chosen approximation preserves.

Admission of motion

A candidate action is admissible when its entire swept uncertainty tube remains within the safety constraints and every possible resulting information state remains in K. The decision uses the current protection set rather than only the nominal trajectory. It includes actuation limits, deadlines, map uncertainty and the resources needed by recovery.

Equation 6. Safety of the inter-update motion and preservation of a recoverable information state.

Proposition 3. Assume that the initial information state belongs to K and contains the true physical state; the disturbance and timing bounds hold; the computed tube and successor sets over-approximate all possible evolutions; and the actuator executes only admitted actions or the certified recovery policy. Then admitted motion preserves safety and the availability of a recovery policy. If recovery is invoked and its stated progress condition holds, the terminal set is reached within its certified horizon.

Proof. The tube condition establishes safety until the next update. The successor condition places every possible next information state in K. Induction therefore preserves the same argument at subsequent updates. When recovery is invoked, the definition of K supplies a single admissible policy for all states consistent with the information. Its progress condition, such as a bounded decreasing rank or a finite-horizon certificate, establishes arrival in G. The admission condition alone does not establish mission completion; the controller could otherwise continue indefinitely within K.

The assumptions identify the principal implementation obligations. A state set that omits the true state, an underestimated braking delay or a route closure outside the disturbance model defeats the argument. A successful optimiser return is not proof that the sets are conservative or that the command reached the actuator in time.

Separation of performance and protection

We propose a high-performance navigation and planning path supervised by a smaller recovery mechanism with explicit contracts. Sha (2001) motivates the use of simpler dependable control to constrain more complex functionality. Aswani et al. (2013) demonstrate a related separation between learned performance models and bounded models used for robust constraints. These foundations support an architecture in which improving nominal performance does not silently relax the safety assumptions.

Control-barrier formulations offer another means of enforcing set constraints when their state, dynamics and feasibility conditions are satisfied (Ames et al., 2016). For Subterra, evaluating a barrier at a single estimated pose is insufficient when position uncertainty is operationally significant. We require the constraint to hold for the relevant uncertainty set or use a justified robust approximation. Input saturation and numerical infeasibility have defined transitions to recovery.

The recovery mechanism must remain viable after the fault that caused its invocation. If both the main controller and the fallback depend on the same failed camera, the nominal presence of a fallback provides little protection. A dependency analysis should identify which functions remain after each declared failure and whether the required terminal set is still reachable.

Resuming autonomy after degradation

Re-entry requires positive evidence that the affected contract has been restored. Clearing an error flag or restarting a process is insufficient. We require a valid frame, bounded state uncertainty, adequate observability for the intended action, reconciled ancestry, a feasible recovery option and a confirmation interval chosen to suppress rapid mode oscillation.

Hysteresis should be physical as well as numerical. The condition for resuming higher-speed motion can require more clearance or better protection than the condition that initially triggered speed reduction. Repeatedly crossing a single threshold can produce unstable switching and consume reserve. The re-entry procedure therefore records both the reason for degradation and the evidence that addresses that reason.

The operator may authorise a different mission objective, but cannot make missing state information appear by approving a button. A changed objective can legitimately relax an alert limit or select a different terminal condition when the hazard analysis permits it. The system records that change as a new contract, preserving the distinction between a restored capability and an accepted change in operational risk.

9 Exploration with integrity and return reserves

The value of an observation

Exploration should acquire information that supports both the mission and continued safe movement. Maximising mapped volume can favour a long feature-poor passage. Maximising the determinant of a covariance reduction can favour directions irrelevant to the immediate hazard. We therefore distinguish information about mission objects, information about navigability and information that resolves a critical state ambiguity.

A candidate viewpoint is evaluated by the hypotheses it is expected to distinguish. Observing a junction from a different angle may be more valuable than collecting more images of a repeated wall texture. A short return to a uniquely identified structure may restore a useful bound. Such actions consume energy and time, so their value must be assessed against the remaining recovery budget.

We formulate the planning objective as expected mission utility subject to integrity, physical and recovery constraints. Chance-constrained partially observable planning supplies a relevant formal framework; RAO* explicitly reasons about execution risk while searching a finite-horizon policy (Santana, Thiébaux and Williams, 2016). Our use of this principle requires a model for how sensing and motion affect future integrity. A probability of collision computed from an overconfident belief is not repaired by placing it inside a constrained optimiser.

Route certificates

The exploration graph records directed traversability, conservative resource cost, clearance, localisation support and the validity of each edge. Direction matters. A descent can be easy to enter and costly or impossible to reverse. A passage suitable for a small flying robot may not support the ground robot carrying the communications equipment. A return path is therefore a platform-specific directed policy, not simply the outward path with its points reversed.

Let E-low be a lower bound on remaining usable energy, c-out-high an upper bound on the proposed traversal cost, c-return-high a certified upper bound for a feasible return policy, and E-terminal the required reserve at termination. A conservative resource-admission test is the following inequality, alongside the geometric and navigation constraints.

Equation 7. Conservative energy admission for a proposed excursion with a specified return policy.

The cost bound includes sensing, computation, communications and time spent on expected recovery actions where those loads matter. A nominal battery percentage is inadequate if temperature, ageing or load changes reduce usable capacity. If the energy model has a probabilistic error, its exceedance belongs in the mission risk allocation. If the bound is deterministic, its operating assumptions must be explicit.

Topology uncertainty and blocked returns

An energy certificate cannot guarantee return through a route that disappears. We distinguish bounded cost uncertainty on an available edge from uncertainty about whether the edge remains traversable. The former can be handled with conservative cost bounds; the latter requires an alternative route, a safe terminal condition on the far side or a risk argument for route loss.

The planner records what would invalidate each recovery certificate. Examples include a door closing, water rising, a communications relay failing or the loss of a distinctive landmark required for relocalisation. Some of these events can be monitored before commitment. Others cannot. The admission decision must then reflect the remaining uncertainty rather than treating the current map as a permanent truth.

This approach gives a precise meaning to recoverable exploration. The robot may deliberately sacrifice immediate information gain to preserve an observable return path. It may also undertake a high-value task without a return-to-base guarantee if a different terminal condition has been explicitly authorised and justified. The contract names that condition; it does not silently redefine a lost platform as successful autonomy.

Cooperation and communications resources

Team planning includes relay placement, rendezvous opportunities and observation geometry. A collaborator can provide useful relative information while also consuming the bandwidth or energy required by its own return. We therefore evaluate joint commitments, not only individual route costs. Two robots should not both assume that the other will remain as a reference after either is free to leave.

An inter-robot commitment identifies duration, location uncertainty, required sensing and release conditions. If the communication link is lost, each robot follows the pre-agreed local policy. A relay node may extend communication range, but neither link quality nor message delivery establishes navigation truth. The mapping and communications graphs are related resources with different failure models.

10 Architecture timing and executable contracts

Functional architecture

Figure 1 summarises the proposed separation of responsibilities. The state estimator, collaborative interface and integrity assessor supply evidence to a recovery supervisor. The performance planner proposes motion. The supervisor admits a bounded command only if the navigation contract and the recovery argument remain valid. Actuator observations and environmental measurements close the loop.

Figure 1. Proposed Subterra architecture. The arrows identify required information flows; they do not imply statistical independence. The recovery supervisor mediates every motion command, including retries and operator-initiated movement.

A navigation output contains a state estimate, protection representation, timestamp, frame identifier, map version, calibration version, hypothesis coverage, excluded sources and valid-until condition. The output also identifies which tasks it supports. A global mapping estimate can remain available while a narrow-clearance transit service is unavailable, or the reverse. A single green health indicator cannot express these distinctions.

The motion contract binds a specific command to a specific evidence snapshot and its expiry. If the controller executes a different speed, a different frame or a different route segment, the previous admission does not apply. Evidence changes during the decision interval are handled by revalidation or a conservative bound on the intervening evolution. The command path must prevent bypass through maintenance interfaces, queued commands or retry workers.

Latency translated into clearance

For a simplified stopping example, let v be speed, b the guaranteed deceleration, tau the sum of observation age and response delay, L-zero the localisation allowance at the observation time, m the map allowance, r the robot radius and g an upper bound on growth of position uncertainty per second. Assume constant speed until braking, a stationary obstacle, and no additional acceleration during the delay. Required centre-to-obstacle clearance is then bounded by:

Equation 8. A one-dimensional stopping certificate for clearance measured at the observation timestamp.

This expression combines travelled distance with uncertainty growth over the complete stopping interval. If the state and obstacle distance have already been propagated to a common current timestamp, the age term must be handled consistently rather than counted twice. If acceleration can continue during the delay, the trajectory bound must include that acceleration and the resulting higher braking-entry speed. Moving obstacles require an additional relative-motion model.

The numerical study uses b = 0.60 m/s², L-zero = 0.25 m, m = 0.15 m, r = 0.40 m, g = 0.03 m/s and observation age 0.10 s. These are declared illustrative assumptions. At 1 m/s, increasing response delay from 0.20 s to 1.00 s increases required clearance from 1.992 m to 2.816 m. At 2 m/s and 1.00 s response delay, the requirement is 6.466 m. A low-latency claim therefore has a direct physical consequence that can be checked against the available space.

Computation and deadline failures

We distinguish estimator output rate, sensor acquisition rate, age of information and worst-case time to an admitted actuator command. Reporting a high average update rate can conceal rare stalls caused by loop closure, memory pressure or communication bursts. The admission layer uses bounded execution times for the functions on which its safety argument depends, or a watchdog that invokes a feasible fallback before the deadline expires.

The proposed implementation gives control-critical processing priority over nonessential map refinement. Heavy optimisation can improve a future map without delaying an imminent stop decision. A resource budget reserves memory and computation for integrity assessment, logging and recovery. Exhaustion of those reserves is itself a degraded condition, not an excuse to continue with stale permission.

The recovery path is tested under the same load that can overload the main path. A fallback that works only when the processor is otherwise idle does not address the intended failure. Similarly, power loss and actuator communication failure require a hardware-level response whose behaviour is included in the plant model.

Record of a navigation decision

For each admitted or rejected action, the system records the candidate command, the evidence versions, protection bounds, active hypotheses, map and resource assumptions, decision time, validity interval and observed outcome. The log is sufficient to reconstruct why the action was considered admissible. It should also preserve a rejected action when that rejection affects mission completion.

The log distinguishes a command acknowledgement from a physical response. A successful software call does not establish that a brake engaged or a platform stopped. Where stopping is part of the certificate, independent motion observations or an appropriately justified actuator-state model establish the result. The outcome can remain unresolved when observations are unavailable; the system should not invent completion from an acknowledgement.

11 Operational analyses across domains

Subterranean inspection and infrastructure access

Autonomous mine exploration already demonstrates the importance of communications independence and failure recovery in harsh spaces. Baker et al. (2004) describe a field system and repeated underground deployments with those concerns central to its design. Our study extends the research question to the integrity of the information that authorises movement and return.

Consider a ground robot inspecting a service tunnel after an interruption to normal access. The route contains repeated support structures, a narrow equipment crossing and an unlit branch. Local range sensing can support clearance near the walls. Global branch identity remains ambiguous because several junctions have similar geometry. The system maintains the competing branch hypotheses instead of committing to the most convenient label. Inspection observations are stored with that unresolved registration.

At the equipment crossing, the permitted speed is determined by the stopping certificate and current map validity. If dust reduces useful range observations, the supervisor recomputes the protected clearance and may restrict motion to a short observation manoeuvre. If no admissible observation restores the bound before the energy threshold is reached, the robot returns along the still-supported route or reaches its defined refuge. The loss of global registration does not automatically eliminate every local capability, but it limits which inspection findings can be associated with infrastructure assets.

For critical infrastructure, that distinction affects downstream decisions. An anomaly detected at an uncertain location should not be reported as an unambiguous defect on a specific pipe or cable. The navigation record accompanies the observation, including frame uncertainty and map version. This allows an engineer to distinguish a well-localised fault from a useful but incompletely registered indication.

Defence support and contested logistics

Defence support tasks can involve inventory movement, facility inspection, access assessment and recovery of equipment in enclosed or disrupted environments. The navigation challenge is intensified by intermittent communications, uncertain maps and the need to maintain accountability for physical movement. These conditions favour local safety decisions and evidence that remains interpretable after disconnection.

Consider a robot transporting maintenance equipment through a large enclosed facility. It receives a route update from another platform whose map has recently been aligned to an external reference. The recipient checks the transform version and uncertainty before using that update. If the collaborating robot later reports a calibration fault, the recipient identifies whether the update affected its current route, its inventory handover position or only a noncritical map layer.

The required recovery may be a controlled stop in a designated bay, a return to the last verified junction or a bounded rendezvous. It should not depend on immediate remote intervention when communication loss is part of the operating assumption. Commands from a remote operator still pass through the local physical contract. Remote authority can change the mission priority, but the system preserves the evidence about clearance, resource limits and actuator capability.

This architecture is relevant to assurance and accountability because it makes the chain from observation to authorised movement inspectable. It does not require a special estimator reserved for defence use. The difficult requirements arise from the environment and consequences: stale information, common errors, failed handovers and recovery commitments. Those same mechanisms appear in civilian emergency response and industrial logistics.

Aerial inspection and aerospace adjacency

Aerial systems have limited ability to wait when sensing degrades. Flight requires continuing control, and hovering consumes reserve. A landing manoeuvre must remain feasible from the true state set, including velocity and attitude uncertainty. A ground-robot stopping certificate cannot simply be reused for a vehicle whose control constraints and terminal conditions differ.

For inspection inside a hangar or large industrial chamber, the supervisor maintains landing or retreat options whose visibility, geometry and energy requirements are included in the recovery state. A camera failure near a repetitive roof structure can reduce both localisation quality and the ability to identify a safe landing area. A floor map created from the same failed visual interpretation does not constitute an independent fallback reference.

Precision relative navigation offers a useful methodological bridge to aerospace tasks because the hazard is often expressed relative to another object rather than a global coordinate system. Calhoun's (2016) integrity analysis illustrates that requirement in a constrained setting. Our transfer is methodological: define the operational boundary and analyse misleading estimates relative to it. Different dynamics, lighting, sensor geometry and environmental conditions require their own models and evidence.

Planetary or enclosed aerospace inspection would add communication delay, unfamiliar surfaces, thermal constraints and limited recovery assistance. A research extension should begin by specifying which terminal conditions are physically achievable. The architecture can organise those requirements, but a terrestrial demonstration alone cannot establish their validity.

Heterogeneous teams

Ground, legged and aerial platforms offer different access and recovery options. We propose treating this heterogeneity as a resource-allocation problem with explicit dependencies. An aerial vehicle can inspect an inaccessible volume while a ground platform carries additional sensing or communications equipment. The team plan must account for where each platform can stop, how it can return and whether its observations remain useful after map reconciliation.

The strongest team is not necessarily the one with the most robots. Additional collaborators can add correlated information, consume bandwidth or create mutually incompatible rescue assumptions. The evaluation therefore tests whether cooperation improves valid availability and delivered mission utility under the declared fault cases, including the case where a collaborator becomes the source of misleading information.

12 Reproducible computational study

Design and interpretation

The computational supplement executes six related exercises: a synthetic integrity comparison, exact correlation calculations, local observability analysis, stopping-envelope calculations, finite return-energy enumeration and confidence-limit arithmetic. Their purpose is to test the logic of the architecture under controlled assumptions. The synthetic estimator is a scalar measurement average. It is not an implementation or benchmark of LOAM, visual-inertial odometry or a complete Subterra system.

For the integrity comparison, truth is x = 0. Three sensors have declared independent Gaussian errors with standard deviation 0.15 m. An additional reference has declared standard deviation 0.10 m. The alert limit is 0.75 m. We use a two-sided Gaussian tail allocation of 0.001, giving k = 3.290527. The nominal bound is k times 0.15 divided by the square root of three, approximately 0.285 m. The residual statistic has a chi-squared distribution with two degrees of freedom under the nominal model; its threshold is 13.815511 for a 0.001 upper-tail allocation.

We generate 100,000 independent noise snapshots using seed 104729 and reuse those draws across policies and conditions. This pairing permits direct comparison. Conditions are nominal sensing; a 1.8 m bias on one sensor; a 1 m common bias on all three sensors; actual sensor noise three times the declared standard deviation; and a 1 m common bias that also affects the reference. The conditions are separate stress cases, not samples from an asserted operational fault distribution.

Four policies use the same nominal position estimate. The covariance policy accepts whenever its nominal bound is within the alert limit. The residual policy adds the residual test. The subset policy uses Equation 4 with all three leave-one-sensor-out means, each having nominal reference standard deviation 0.15 divided by the square root of two. The anchored policy takes the maximum of that subset envelope and the separation from the additional reference plus k times 0.10 m. An action is available only if the resulting bound is at most the alert limit.

The bounds are specified from the declared models rather than fitted to the generated trials. The truth oracle uses the known scalar state and is independent of the monitor decisions. Within each condition, we count accepted estimates, accepted errors beyond the alert limit and accepted errors beyond the reported protection level. We also retain position root-mean-square error, which is identical across policies because the estimate itself is unchanged.

Availability and hazardous accepted estimates

Table 2 reports accepted snapshots out of 100,000. Table 3 reports the subset of those snapshots whose true error exceeds the 0.75 m alert limit. Counts should be read together: refusing service can reduce hazardous acceptance without improving localisation.

Table 2. Accepted snapshots under each policy. The four policies are analytical comparators with the same proposed position estimate.

Table 3. Hazardous accepted snapshots, using the same denominator of 100,000 for each cell.

The common-bias condition is the decisive counterexample. Subtracting the sample mean removes the common offset from the residuals, so the residual policy has exactly the same availability as in nominal sensing. The leave-one-out solutions share the same offset, so their separations also remain unchanged. Neither agreement nor small residuals supplies evidence about that offset.

The additional reference changes the result only when its error model remains valid. Under the common sensor bias, the anchored envelope declares no service available. It does not correct the biased estimate. When the reference shares the offset, the anchored policy again accepts almost all snapshots and leaves 99,672 hazardous accepted errors. This defeats any claim that merely adding a fourth channel establishes common-fault coverage.

The noise-mismatch condition tests a different assumption. The nominal protection level is exceeded on 27,150 snapshots, despite being designed for a nominal tail probability of 0.001. The anchored envelope has four accepted bound exceedances and no accepted error beyond the alert limit in this sample. Its useful protection in that condition derives from the unchanged reference model; the result does not validate the incorrect sensor-noise declaration.

The single-bias condition also illustrates a denominator trap. The subset policy has two hazardous accepted snapshots out of 100,000 trials, but only 54 accepted snapshots in total. Its observed hazardous fraction among accepted estimates is therefore about 3.70%. An unconditional accepted-hazard frequency and a conditional failure fraction answer different questions. Neither should be substituted for the other without identifying the denominator.

Correlation and repeated information

For two zero-mean Gaussian estimates with equal variance 0.16 m² and correlation rho, the arithmetic mean has variance 0.08 times one plus rho. Independent fusion would report 0.08 m². Equal-weight covariance intersection reports 0.16 m² in this symmetric case. We compute the exact probability that the average error exceeds each reported k-sigma bound.

Table 4. Exact Gaussian tail probabilities. The input marginal variances are assumed valid and the means are unbiased.

Figure 2. Treating correlated estimates as independent increases protection-bound exceedance. Covariance intersection remains conservative within the stated unbiased Gaussian example, at the cost of a larger reported bound.

With ten exact copies of one observation, treating those copies as independent produces a bound-exceedance probability of 0.298082. With twenty copies it becomes 0.461862. These are exact model calculations. They show how a network can manufacture apparent confidence without adding information. They do not establish the prevalence of a particular correlation structure in a field system.

Corridor observability and inertial growth

The observability example fixes orientation and assumes an anchored map so that only translational measurement geometry is being tested. Sixty independent constraints normal to the side walls and sixty normal to the floor or ceiling have standard deviation 0.10 m. In lateral, axial and vertical coordinates, the new-information matrix has diagonal entries 6,000, zero and 6,000. The axial direction is unobserved by these measurements.

Adding twenty independent end-wall constraints gives an axial information entry of 2,000 and restores full rank in this restricted model. This is not a claim that twenty real scan points are independent: points sharing a surface estimate, scan motion or calibration may contribute less information. The example isolates the role of geometry after removing that complication.

For an unobserved axial direction, assume independent Gaussian initial-position uncertainty of 0.10 m, initial-velocity uncertainty of 0.02 m/s and constant acceleration-bias uncertainty of 0.005 m/s². The position variance is the sum of the initial variance, the squared velocity term and the squared half-bias-times-time-squared term. The corresponding k-sigma bound grows from 0.329 m initially to 1.104 m at 10 s, 7.669 m at 30 s and 29.879 m at 60 s.

These illustrative values show why an inertial bridge must have a bounded duration. The bias term grows with the fourth power of time in the variance. An attractive short-time estimate does not justify indefinite motion through an unobserved direction. A practical model must additionally include attitude error, bias dynamics, vibration and the coupling between axes.

Stopping envelopes and return energy

Figure 3 plots Equation 8 with the assumptions in Section 10. For 2.5 m available centre-to-obstacle clearance, the calculated speed cap is 1.230 m/s with 0.20 s response latency, 1.083 m/s with 0.50 s latency and 0.884 m/s with 1.00 s latency. The calculation makes no assumption that those latencies or braking values have been demonstrated on a robot.

Figure 3. Required clearance as a function of speed and response latency. The 0.10 s observation age is included in every curve. The horizontal line illustrates an available clearance of 2.5 m.

The return-energy example contains a base B, junction J and two possible inspection branches A and C. Initial energy is 16 arbitrary units and the required terminal reserve is 2. Directed edge costs lie in the intervals shown in Figure 4. Branch A offers 10 information units and branch C offers 6. The environment is fixed during the excursion, every listed edge remains traversable and costs remain within their intervals.

Figure 4. Finite return-energy example. Each directed cost is independently evaluated at its lower or upper endpoint. Information values describe branch observations, not successfully delivered mission output.

All 64 endpoint combinations are enumerated. The greedy policy always chooses A. Its planned route requires more energy than available in 40 configurations and leaves less than the required reserve in 60. The guarded policy evaluates the conservative cost of the outward branch, return and terminal reserve at J. It chooses C in every configuration and retains at least 2 units at the base. The price is lower branch information, 6 rather than 10 units.

The counts are a finite-domain comparison, not operational failure probabilities. The 64 configurations are not asserted to be equally likely. The result also depends on route persistence. If an edge can close after entry and no alternative terminal policy exists, the reserve inequality alone cannot certify recovery. That counterexample is part of the architecture's boundary, rather than an exceptional case to be removed from evaluation.

Statistical strength and scope

For independent Bernoulli trials with zero observed events, the one-sided 95% upper confidence limit is one minus 0.05 raised to the power one divided by n. This is the zero-event case of exact binomial confidence reasoning (Clopper and Pearson, 1934). With 100,000 trials, the upper limit is approximately 0.00002996. At least 299,572 zero-event independent trials are needed to place that upper limit below 0.00001.

Those limits apply to the sampled distribution and the specified event. They do not bound the frequency of untested faults or the risk of a mission with dependent observations. A policy with zero accepted snapshots has zero hazardous accepted snapshots by construction, which provides no evidence of usable service. The supplement consequently retains both event counts and acceptance counts, together with two-sided exact intervals and one-sided upper limits.

The computational conclusions are narrow but consequential. Shared error defeats internal agreement; untracked correlation can invalidate uncertainty; missing geometric information cannot be restored by repeated measurements of the same direction; delay consumes physical margin; and resource-constrained exploration can preserve an otherwise lost recovery option. Each conclusion identifies a mechanism that the implementation programme must test in a richer system.

13 Independent evaluation programme

Separate development from evaluation

We propose an evaluation programme with distinct development, calibration and assessment sets. Thresholds, fault families and acceptance criteria are frozen before the assessment stage. Changes made after examining assessment failures require a new version and a fresh assessment set. The retained record includes failed runs, withdrawn service and incomplete missions, not only successful trajectories.

The principal experimental unit is a mission or a deliberately defined fault episode. Consecutive camera frames and overlapping estimator windows are dependent and should not be counted as independent reliability trials. For comparisons on matched routes, policies use paired disturbance schedules where feasible. Confidence intervals reflect clustering by route, site and mission when those clusters are the meaningful source of variation.

Baselines and ablations

The implementation comparison includes a nominal estimator with covariance-based admission, a residual-monitor variant, a hypothesis-envelope variant, and the complete recovery-supervised architecture. Separate estimator comparisons can use the eligible LiDAR, visual and visual-inertial methods described in Section 2. They should not be conflated with the integrity-layer comparison: otherwise an improvement caused by a better estimator may be wrongly attributed to a monitor.

Ablations remove ancestry tracking, correlation handling, observability checks, timing allowances, resource reserves or re-entry hysteresis one at a time. A useful ablation tests a causal claim. Removing a check that never activates says little about its importance; challenge conditions must exercise the mechanism. Equally, an ablation should not be made artificially weak through unrelated implementation differences.

Data and environmental coverage

EuRoC provides synchronised visual-inertial measurements and reference trajectories suitable for controlled estimator comparison (Burri et al., 2016). KITTI supplies outdoor vehicle sequences with different geometry and motion characteristics (Geiger, Lenz and Urtasun, 2012). The TUM RGB-D benchmark supports another set of indoor trajectories and standard trajectory-error comparisons (Sturm et al., 2012). These datasets establish useful baselines but do not jointly reproduce every subterranean hazard.

The field programme therefore requires independently measured test environments with controlled illumination, airborne obscurants, repeated structures, feature-poor passages, slopes and moving obstacles. Environmental severity is recorded physically where possible, including transmission or visibility, rather than described only as low, medium or high. Calibration and ground truth must remain reliable under the tested condition. If the truth system is degraded by the same obscurant as the robot, apparent agreement can conceal a shared failure.

We propose a core matrix of four environment geometries, five sensing conditions, three communication regimes and four fault classes, giving 240 scenario cells. Ten independent mission repetitions per cell would produce 2,400 missions per system configuration. This is a planned coverage design, not a reliability guarantee. Severe or rare-event conditions require additional targeted experiments, and the physical feasibility of every combination must be checked before treating the matrix as complete.

Metrics that preserve meaning

Trajectory alignment is declared before scoring. A freely fitted rigid or similarity transform can be useful for relative SLAM accuracy, but it removes some errors that matter to infrastructure registration. We therefore score absolute-reference tasks in the mission frame and report any alignment used for diagnostic comparisons separately. The same principle applies to excluding startup, relocalisation or recovery intervals: those exclusions require an explicit task-based reason.

Fault injection and independent truth

Software fault injection tests bias, dropout, time offsets, map-transform errors and message duplication with known ground truth. Hardware-in-the-loop testing adds real scheduling and actuator interfaces. Controlled physical trials then test effects that software corruption cannot faithfully reproduce, including motion blur, scattering, wheel slip and mechanical delays.

Faults are injected at different layers because those layers create different dependencies. Changing raw observations tests the estimator and monitor together. Changing only a published pose tests downstream admission. Corrupting a shared map can affect many robots simultaneously. An evaluator who changes a value after all relevant checks may test an interface bypass rather than the claimed sensor-fault mechanism; both are useful, but they must be labelled correctly.

Evaluation authority is separated from the component producing the claim. The truth source, hazard oracle and success criteria do not depend on the navigation output under test. Unresolved episodes remain in the record and are adjudicated using a predefined rule. This preserves the possibility that the system's confident explanation of a failure is itself wrong.

14 Assurance human supervision and lifecycle control

Claims connected to evidence

The assurance argument begins with a specific operating claim, such as maintaining clearance during bounded communication loss, rather than a general claim that the robot is safe. Each claim identifies its assumptions, supporting evidence, unresolved uncertainties and conditions that defeat it. Formal reasoning, simulation, laboratory measurements and field trials contribute different kinds of evidence. They should be connected without treating one as a universal substitute for the others.

Systems-based safety analysis is useful because losses can arise from interactions between components that are individually functioning as designed (Leveson, 2011). In Subterra, an estimator may correctly publish a delayed state, a planner may correctly use the latest available message, and a controller may correctly execute its command. The combination can still violate clearance if no interface accounts for the age of that message. The hazard belongs to the interaction.

We propose maintaining a claim-to-evidence record through every software, sensor and calibration change. The record identifies which assumptions are affected. Changing a camera driver can alter timestamp semantics. Changing the robot payload can alter braking and energy use. Updating a map can alter frame alignment or return-route validity. A change that leaves average trajectory error unchanged can still invalidate a recovery certificate.

Operator information and intervention

The operator display should state which navigation services are available, which constraints are active, the remaining recovery margin and the evidence needed to resume a withdrawn capability. It should distinguish uncertain global registration from poor local clearance. Showing only a pose trace and a generic confidence score forces the operator to infer distinctions that the software already knows.

Alerts identify the operational consequence. A message that axial localisation is weak should be accompanied by the resulting speed limit, allowed observation manoeuvre or return requirement. The operator should be able to inspect the relevant evidence, but normal control should not depend on interpreting a large residual plot under time pressure.

We evaluate human supervision as part of the system. Measures include response time, mode understanding, incorrect overrides, workload and the effect of simultaneous alerts from several robots. A fallback that assumes immediate human intervention is unsuitable for a mission whose communication or staffing model cannot provide it. Human approval remains valuable for changing goals and resolving ambiguous trade-offs, while local physical constraints continue to govern executable movement.

Security and configuration control

The navigation contract depends on trusted configuration as well as sensor data. Alert limits, frame definitions, noise parameters, recovery reserves and expiry rules are controlled configuration items. Their versions are bound to the decision record. A parameter change that improves availability by reducing a protection margin must be assessed as a change in the claim, not merely as a performance optimisation.

We separate permissions to propose a route, modify a map, change a safety parameter and authorise a mission. This is a practical means of limiting accidental or malicious changes to the evidence chain. It does not replace physical validation of the resulting configuration. A properly authorised but incorrect model can still produce misleading navigation.

The system preserves a coherent degraded mode under partial failure of logging or communications. Essential motion protection remains local. When evidence required for accountability cannot be retained, the contract can restrict new mission commitments while allowing the actions necessary to reach a terminal condition. This policy is specified in advance rather than improvised after the audit path fails.

Acceptance criteria

Acceptance requires a complete argument for the intended operating envelope. That argument includes measurement-model adequacy, protection coverage, response timing, physical recovery, resource margins and configuration control. Demonstrating a small average localisation error addresses only part of that requirement. Demonstrating no dangerous events in a small test set does not establish a rare-event risk target.

We propose staged acceptance: first validate interfaces and analytical properties; then demonstrate controlled fault response; then evaluate independently on representative missions; and finally monitor continued validity in operation. Each stage has an explicit withdrawal condition. The architecture is valuable only if those conditions can be observed and acted upon before the assumptions supporting safety cease to hold.

15 Conditional research projections

Development hypotheses

We expect useful progress from tighter integration of estimation, integrity and recovery, but formulate that expectation as testable conditional hypotheses. A performance target is not a measured outcome. A forecast becomes scientifically useful when its mechanism, operating assumptions and disconfirming evidence are specified.

The first hypothesis is that geometry-aware monitoring will reduce dangerous continuation in long repetitive passages more effectively than a scalar covariance threshold alone. The mechanism is explicit recognition of a weakly observed state direction. The prediction is defeated if the proposed diagnostic fails to track hazardous uncertainty under calibration error, or if its interventions consume so much availability that missions cannot be completed within the same resource envelope.

The second hypothesis is that source-ancestry control will improve the consistency of collaborative estimates when information circulates through a team. The mechanism is avoidance of duplicate evidence and bounded removal of contaminated descendants. A decisive experiment introduces the same underlying observation through multiple message paths. The prediction is defeated if reported uncertainty still shrinks without new information or if recovery cannot identify the affected products within its time and memory budget.

The third hypothesis is that a recovery constraint can improve delivered mission utility even when it reduces immediate information gain. The finite energy example establishes one mechanism. A field test must count recovered observations, safe terminal outcomes and intervention costs. The prediction fails in an operating regime where the conservatism of the recovery model consistently prevents high-value tasks without a corresponding reduction in consequential failures.

Computational development

Direct use of geometric measurements, selective keyframes, incremental optimisation and compact map representations are credible routes to reduced computation. The design question is where approximation changes the integrity argument. Removing a feature-processing stage may reduce overhead while increasing association ambiguity. Aggressive marginalisation may improve runtime while making later fault removal more expensive. Sparse communication may preserve bandwidth while delaying the evidence needed to reject a false alignment.

We propose budgeting computation by deadlines. For an illustrative 20 Hz control-facing navigation service, the update interval is 50 ms. That number is a design budget, not an achieved throughput claim. The critical path must include acquisition age, alignment, estimation, integrity assessment and publication. Longer-running map refinement can operate asynchronously if its outputs cannot bypass those contracts. Evaluation reports the deadline distribution and recovery behaviour under overload, not only average throughput.

We expect implementation choices that expose bounded intermediate products to be easier to assure than monolithic optimisation whose only output is a pose. This hypothesis can be tested through integration effort, failure localisation and the evidence required after a component update. It may be defeated if maintaining the additional contracts imposes prohibitive computational or engineering cost.

Multimodal and distributed mapping

Complementary sensing is expected to improve availability when failures differ across modalities and the remaining geometry is informative. The improvement will be smaller when obscurants, map alignment or calibration create common faults. The synthetic common-bias result predicts this boundary directly. A useful programme therefore evaluates combined degradation, not just one disabled sensor at a time.

Distributed maps can improve coverage and reduce repeated exploration, provided false place associations and information dependence remain controlled. Adding semantic labels may help distinguish repeated structures, but classification errors and changes in object appearance create another uncertainty source. We propose treating semantic information as evidence with its own reliability and dependencies, rather than as a categorical correction to geometry.

We also expect the most informative benchmark to combine accurate truth, controlled physical degradation and explicit recovery outcomes. A dataset that measures only trajectory error cannot establish the value of a recovery supervisor. Conversely, a successful return without accurate truth can conceal prolonged misleading navigation. Both kinds of evidence are needed in the same evaluation record.

Quantitative projections from the models

The analytical models support limited quantitative projections without extrapolating a particular platform's performance. In bias-dominated inertial propagation, halving an unobserved interval reduces the leading position-error standard deviation by approximately a factor of four. In the stopping model, halving speed reduces the braking-distance term by a factor of four while reducing the constant-speed latency term by a factor of two. These relationships explain why timely observation and speed adaptation can matter more than a small improvement in nominal estimator error.

The same models predict diminishing or negative returns from adding correlated channels without information accounting. Duplicating a measurement does not improve its physical accuracy. A team that accepts repeated copies as independent can become more confident while becoming no better localised. Future experiments should therefore test whether additional sensors or robots contribute new information in the hazard-relevant directions, rather than using their number as a proxy for resilience.

16 Conclusions

We find that navigation integrity and recoverable autonomy must be designed together. Integrity specifies when a state estimate supports an action. Recoverability specifies which actions preserve an admissible response when that support weakens. Their interface is a time-limited, task-specific contract carrying uncertainty, fault coverage, information ancestry, map validity and resource assumptions.

The formal analysis establishes conditional protection through a reference envelope and conditional preservation of recovery through conservative successor sets. It also establishes a structural limit: an unrestricted common position offset cannot be resolved by internal agreement among observations that share that offset. The computational exercises make the consequences visible. Residual monitoring can reject an isolated bias while remaining blind to a common one; repeated information can create false confidence; delay and unobserved motion consume clearance; and information-greedy exploration can lose the resources needed to return.

The proposed Subterra architecture responds by separating nominal estimation from the evidence needed to authorise motion, preserving dependency information through collaboration, and requiring a physically feasible terminal policy. Its research value lies in making those obligations explicit and testable. The next decisive evidence is an independently evaluated implementation that demonstrates useful availability, bounded hazardous exposure and successful recovery across the declared operating envelope.

Appendix A Interface contracts and decision procedure

A1 Navigation evidence record

These fields define a semantic contract, not a requirement for one particular message format. A compact implementation can reference protected records rather than duplicating every item in each packet. The referenced records must remain available and immutable for the lifetime of the decision they justify.

A2 Motion admission procedure

receive proposed motion and its command identifier

resolve navigation evidence and the requested service

validate frames, units, versions, timestamps and ancestry

propagate uncertainty to the command acceptance time

check hypothesis coverage and the applicable alert geometry

compute a conservative swept tube for the proposed motion

check map validity, actuation bounds and response deadlines

check successor recovery feasibility and resource reserve

if every obligation is established:

issue the bound command with an expiry and evidence digest

else:

invoke the feasible recovery policy or withhold new motion

observe the physical response and record the resulting state

The procedure assumes that withholding new motion has a defined physical meaning. A moving platform can require active braking; an aerial platform requires continuing stabilisation. The implementation therefore connects the rejection branch to a valid platform-specific policy. It also rechecks that command acceptance occurs within the expiry interval and that the executed payload matches the admitted one.

A3 Recovery and resumption record

A recovery episode records its initiating condition, last justified evidence, affected dependencies, possible physical states at invocation, selected terminal policy, resource bounds and final observed condition. Re-entry records which evidence addressed the initiating condition. If an estimator is reconstructed, the record identifies the checkpoint, removed factors, replay interval and remaining unobserved motion. A software restart and a successful physical recovery are different recorded events.

Appendix B Analytical details and reproduction

B1 Scalar snapshot formulas

For three measurements, the proposed state is their arithmetic mean. The leave-one-out reference for sensor j is the mean of the other two. The residual statistic is the sum of squared deviations from the full mean divided by the declared sensor variance. Under independent equal-variance Gaussian noise and a correct common mean, it has two degrees of freedom. The common offset cancels exactly from these deviations.

The subset envelope is the maximum absolute difference between the full mean and a leave-one-out mean, plus k times the declared subset standard deviation. Its single-fault interpretation assumes that at least one subset excludes every faulty measurement and that its remaining errors satisfy the declared model. It does not cover a shared offset or arbitrary simultaneous faults. The additional reference envelope requires only its own coverage condition for the scalar triangle-inequality argument, but its physical validity must be established separately.

B2 Correlation and inertial propagation

For equal marginal variance sigma-squared, the variance of the mean of two estimates is sigma-squared times one plus rho divided by two. The reported independent-fusion variance omits the rho term. For n exact duplicates, actual variance remains sigma-squared while the independent formula reports sigma-squared divided by n. The resulting Gaussian tail is twice the normal survival function evaluated at k divided by the square root of n.

For the axial inertial example, the error is the sum of initial-position error, time multiplied by initial-velocity error and half time-squared multiplied by a constant acceleration-bias error. Independent zero-mean Gaussian inputs give the variance used in Section 12. The calculation is a reduced model with fixed orientation. It intentionally exposes growth in a direction receiving no geometric update.

B3 Reproduction files

Run python compute_study.py from the computational supplement with NumPy and SciPy available. The script writes results.json and prints the principal counts and calculations. The configuration, seed, library versions and exact confidence intervals are retained in that file. No external dataset or proprietary implementation is required for these exercises.

The source manuscript and document builder are included for inspection and editing. Figures are generated from the same formulas and result file. The reference ledger records the publication basis used for the evidence horizon. Reproducing the calculations establishes agreement with the specified models; the field programme in Section 13 addresses whether those models cover a real operating system.

Appendix C Assurance challenges

The challenges are intended to defeat unsupported claims, not to demonstrate failure under impossible conditions. Each test must state which operating assumption it exercises. When an assumption is intentionally violated, the expected result may be timely withdrawal of service rather than continued navigation. The evaluation records that distinction before observing the outcome.

References

Ames, A.D., Xu, X., Grizzle, J.W. and Tabuada, P. (2016) 'Control Barrier Function Based Quadratic Programs with Application to Automotive Safety Systems', arXiv preprint 1609.06408, version 1, 21 September. Available at: https://arxiv.org/abs/1609.06408v1.

Aswani, A., Gonzalez, H., Sastry, S.S. and Tomlin, C. (2013) 'Provably safe and robust learning-based model predictive control', Automatica, 49(5), pp. 1216–1226. https://doi.org/10.1016/j.automatica.2013.02.003.

Baker, C., Morris, A., Ferguson, D., Thayer, S., Whittaker, C., Omohundro, Z., Reverte, C., Whittaker, W., Hähnel, D. and Thrun, S. (2004) 'A campaign in autonomous mine mapping', Proceedings of the IEEE International Conference on Robotics and Automation, 2, pp. 2004–2009. Available at: https://www.ri.cmu.edu/pub_files/pub4/baker_christopher_2004_1/baker_christopher_2004_1.pdf.

Bircher, A., Kamel, M., Alexis, K., Oleynikova, H. and Siegwart, R. (2016) 'Receding horizon next-best-view planner for 3D exploration', Proceedings of the IEEE International Conference on Robotics and Automation, pp. 1462–1468. https://doi.org/10.1109/ICRA.2016.7487281.

Blanch, J., Walter, T., Enge, P., Lee, Y., Pervan, B., Rippl, M., Spletter, A. and Kropp, V. (2015) 'Baseline advanced RAIM user algorithm and possible improvements', IEEE Transactions on Aerospace and Electronic Systems, 51(1), pp. 713–732. https://doi.org/10.1109/TAES.2014.130739.

Burri, M., Nikolic, J., Gohl, P., Schneider, T., Rehder, J., Omari, S., Achtelik, M.W. and Siegwart, R. (2016) 'The EuRoC micro aerial vehicle datasets', International Journal of Robotics Research, 35(10), pp. 1157–1163. First published online 25 January. https://doi.org/10.1177/0278364915620033.

Cadena, C., Carlone, L., Carrillo, H., Latif, Y., Scaramuzza, D., Neira, J., Reid, I.D. and Leonard, J.J. (2016) 'Simultaneous Localization And Mapping: Present, Future, and the Robust-Perception Age', arXiv preprint 1606.05830, version 1, 19 June. Available at: https://arxiv.org/abs/1606.05830v1.

Calhoun, S.M. (2016) Integrity Determination for Image Rendering Vision Navigation. PhD dissertation. Air Force Institute of Technology. AFIT-ENG-DS-16-M-251, 24 March. Available at: https://scholar.afit.edu/etd/277/.

Clopper, C.J. and Pearson, E.S. (1934) 'The use of confidence or fiducial limits illustrated in the case of the binomial', Biometrika, 26(4), pp. 404–413. https://doi.org/10.1093/biomet/26.4.404.

Dellaert, F. (2012) Factor Graphs and GTSAM: A Hands-on Introduction. Technical Report GT-RIM-CP&R-2012-002. Georgia Institute of Technology, September. Available at: https://hdl.handle.net/1853/45226.

Fawzi, H., Tabuada, P. and Diggavi, S. (2014) 'Secure estimation and control for cyber-physical systems under adversarial attacks', IEEE Transactions on Automatic Control, 59(6), pp. 1454–1467. https://doi.org/10.1109/TAC.2014.2303233.

Forster, C., Carlone, L., Dellaert, F. and Scaramuzza, D. (2015) 'IMU preintegration on manifold for efficient visual-inertial maximum-a-posteriori estimation', Proceedings of Robotics: Science and Systems XI. https://doi.org/10.15607/RSS.2015.XI.006.

Geiger, A., Lenz, P. and Urtasun, R. (2012) 'Are we ready for autonomous driving? The KITTI vision benchmark suite', Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 3354–3361. Available at: https://www.cs.toronto.edu/~urtasun/publications/geiger_et_al_cvpr12.pdf.

Hesch, J.A., Kottas, D.G., Bowman, S.L. and Roumeliotis, S.I. (2014) 'Consistency analysis and improvement of vision-aided inertial navigation', IEEE Transactions on Robotics, 30(1), pp. 158–176. https://doi.org/10.1109/TRO.2013.2277549.

Hollinger, G.A. and Sukhatme, G.S. (2014) 'Sampling-based robotic information gathering algorithms', International Journal of Robotics Research, 33(9), pp. 1271–1287. https://doi.org/10.1177/0278364914533443.

Hornung, A., Wurm, K.M., Bennewitz, M., Stachniss, C. and Burgard, W. (2013) 'OctoMap: An efficient probabilistic 3D mapping framework based on octrees', Autonomous Robots, 34(3), pp. 189–206. https://doi.org/10.1007/s10514-012-9321-0.

Joerger, M. and Pervan, B. (2013) 'Kalman filter-based integrity monitoring against sensor faults', Journal of Guidance, Control, and Dynamics, 36(2), pp. 349–361. https://doi.org/10.2514/1.59480.

Julier, S.J. and Uhlmann, J.K. (1997) 'A non-divergent estimation algorithm in the presence of unknown correlations', Proceedings of the American Control Conference, 4, pp. 2369–2373. https://doi.org/10.1109/ACC.1997.609105.

Kaelbling, L.P., Littman, M.L. and Cassandra, A.R. (1998) 'Planning and acting in partially observable stochastic domains', Artificial Intelligence, 101(1–2), pp. 99–134. Available at: https://www.cassandra.org/arc/papers/aij98.pdf.

Kaess, M., Johannsson, H., Roberts, R., Ila, V., Leonard, J.J. and Dellaert, F. (2012) 'iSAM2: Incremental smoothing and mapping using the Bayes tree', International Journal of Robotics Research, 31(2), pp. 216–235. Available at: https://www.cs.cmu.edu/~kaess/pub/Kaess12ijrr.html.

Leutenegger, S., Lynen, S., Bosse, M., Siegwart, R. and Furgale, P. (2015) 'Keyframe-based visual-inertial odometry using nonlinear optimization', International Journal of Robotics Research, 34(3), pp. 314–334. https://doi.org/10.1177/0278364914554813.

Leveson, N.G. (2011) Engineering a Safer World: Systems Thinking Applied to Safety. Cambridge, MA: MIT Press. ISBN 9780262016629.

Li, M. and Mourikis, A.I. (2014) 'Online temporal calibration for camera-IMU systems: Theory and algorithms', International Journal of Robotics Research, 33(7), pp. 947–964. https://doi.org/10.1177/0278364913515286.

Mitchell, I.M., Bayen, A.M. and Tomlin, C.J. (2005) 'A time-dependent Hamilton-Jacobi formulation of reachable sets for continuous dynamic games', IEEE Transactions on Automatic Control, 50(7), pp. 947–957. https://doi.org/10.1109/TAC.2005.851439.

Mur-Artal, R., Montiel, J.M.M. and Tardós, J.D. (2015) 'ORB-SLAM: A versatile and accurate monocular SLAM system', IEEE Transactions on Robotics, 31(5), pp. 1147–1163. https://doi.org/10.1109/TRO.2015.2463671.

Olson, E. and Agarwal, P. (2013) 'Inference on networks of mixtures for robust robot mapping', International Journal of Robotics Research, 32(7), pp. 826–840. https://doi.org/10.1177/0278364913479413.

Roumeliotis, S.I. and Bekey, G.A. (2002) 'Distributed multirobot localization', IEEE Transactions on Robotics and Automation, 18(5), pp. 781–795. https://doi.org/10.1109/TRA.2002.803461.

Ryde, J. and Hillier, N. (2009) 'Performance of laser and radar ranging devices in adverse environmental conditions', Journal of Field Robotics, 26(9), pp. 712–727. https://doi.org/10.1002/rob.20310.

Santana, P., Thiébaux, S. and Williams, B. (2016) 'RAO*: An algorithm for chance-constrained POMDPs', Proceedings of the AAAI Conference on Artificial Intelligence, 30(1). Published 5 March. https://doi.org/10.1609/aaai.v30i1.10423.

Sha, L. (2001) 'Using simplicity to control complexity', IEEE Software, 18(4), pp. 20–28. https://doi.org/10.1109/MS.2001.936213.

Sturm, J., Engelhard, N., Endres, F., Burgard, W. and Cremers, D. (2012) 'A benchmark for the evaluation of RGB-D SLAM systems', Proceedings of the IEEE/RSJ International Conference on Intelligent Robots and Systems, pp. 573–580. https://doi.org/10.1109/IROS.2012.6385773.

Sünderhauf, N. and Protzel, P. (2012) 'Switchable constraints for robust pose graph SLAM', Proceedings of the IEEE/RSJ International Conference on Intelligent Robots and Systems, pp. 1879–1884. https://doi.org/10.1109/IROS.2012.6385590.

Thrun, S., Burgard, W. and Fox, D. (2005) Probabilistic Robotics. Cambridge, MA: MIT Press. Available at: https://mitpress.mit.edu/9780262201629/probabilistic-robotics/.

Zhang, J. and Singh, S. (2014) 'LOAM: Lidar odometry and mapping in real-time', Proceedings of Robotics: Science and Systems X. Available at: https://publications.ri.cmu.edu/storage/publications/pub_files/2014/7/Ji_LidarMapping_RSS2014_v8.pdf.

Zhang, J., Kaess, M. and Singh, S. (2016) 'On degeneracy of optimization-based state estimation problems', Proceedings of the IEEE International Conference on Robotics and Automation, pp. 809–816. https://doi.org/10.1109/ICRA.2016.7487211.