Subterranean Intelligence

An integrity governed architecture for autonomous sensing navigation and decision support

This study develops a testable architecture for autonomous systems operating in mines, tunnels, shafts, caves and other environments where satellite positioning and continuous communications cannot be assumed. Its central proposition is that the authority to move, infer and coordinate should depend on the integrity of the evidence supporting each action.

We integrate spatial estimation, navigation integrity, subsurface sensing, geomechanical interpretation, cooperative robotics and evidence governance. Analytical experiments expose the consequences of correlated observations, unmodelled faults, registration error and mission risk accumulation. A prospective evaluation programme defines how the proposed architecture can be challenged against independent measurements.

Numerical experiments in this study are explicitly defined analytical models; field results are attributed to the research that reports them.

Abstract

Subterranean autonomy presents a coupled inference and control problem. Darkness, obscurants, repeated geometry, uncertain terrain, changing infrastructure and intermittent communications can produce position estimates that are internally consistent yet operationally wrong. Improving average localisation accuracy does not, by itself, establish whether a robot can complete a particular manoeuvre, preserve a viable return route or support an engineering decision. We develop an architecture in which navigation integrity constrains the authority of estimation, planning and cooperative information exchange.

Our method combines a date-bounded critical synthesis of robotics and sensing research with explicit mathematical formulation, reproducible analytical experiments and a prospective validation design. The robot maintains a hybrid belief over physical state and fault hypotheses. An independent supervisory interface translates that belief into time-limited motion permissions, with platform-specific constraints on clearance, braking, latency, energy and recovery. Shared evidence retains ancestry so that a fleet cannot manufacture confidence by repeatedly circulating the same observation. Semantic models connect spatial findings to assets and decision rules while preserving the distinction between an observation, an interpretation and an authorised action.

The analytical studies identify material failure mechanisms. With eight equally precise observations and pairwise error correlation of 0.8, an interval reported as 95% under an independence assumption covers the true value only approximately 55.45% of the time. In a declared fault-mixture model, a 1% probability of a 1.2 m bias raises the probability of exceeding a 0.5 m position-error limit to approximately 1%, despite very small nominal Gaussian tails. Increasing point density offers little improvement to deformation detection when registration uncertainty dominates. A mission-level failure allocation also differs fundamentally from applying the same permissive threshold independently to every segment.

These results support a research programme focused on calibrated evidence, bounded action and demonstrable recovery. They do not establish field performance for an integrated Subterra implementation. We specify comparisons, ablations, independent reference measurements, exposure-based outcomes and release gates capable of falsifying the proposed benefits. The principal contribution is an assurance-oriented synthesis that makes the connection between uncertain underground observations and operational authority explicit and testable.

1 Research problem and contribution

The practical object of subterranean intelligence is a defensible decision about a partially observed environment. That decision may concern whether a vehicle can traverse a passage, whether an observed surface has moved, whether a suspected void warrants further investigation or whether several robots have actually supplied independent corroboration. These questions require geometry, uncertainty and operational context to be treated together. A dense map may be visually persuasive while concealing a wrong place association, a calibration defect or a region that has never been observed adequately.

SLAM research has developed effective methods for estimating motion and environmental structure, while identifying persistent difficulties in robustness, representation and long-term operation (Cadena et al., 2016). Subterranean field programmes demonstrate that successful autonomy requires coordination between perception, planning, communications and platform capabilities (Agha et al., 2021; Tranzatto et al., 2022). We take these results as a foundation for a narrower question: what evidence should be sufficient to permit a particular action, and how should that permission change when the evidence weakens?

We define subterranean intelligence as the production and controlled use of spatially and temporally grounded beliefs about underground conditions. Intelligence includes knowledge of an estimate's limitations, the ability to choose observations that resolve a consequential ambiguity, and the retention of an accountable connection between measurements and decisions. The definition excludes the assumption that additional sensors, larger maps or more robots necessarily produce better decisions.

Our first contribution is a common formulation linking a hybrid state belief to admissible actions and recoverability. The formulation separates ordinary estimation uncertainty from discrete failure hypotheses such as false map association, timing faults and sensor degradation. Our second contribution is an evidence architecture for cooperative systems, in which observation ancestry and uncertain map alignment remain visible after communication and fusion. Our third contribution is a set of analytical counterexamples and prospective tests that turn general claims of resilience into falsifiable requirements.

The originality claimed here concerns the combination and operational framing of these elements. We do not claim to originate covariance intersection, chance constraints, belief-space planning or change-detection theory. Nor does an architectural synthesis establish that every interface has been implemented or that every operating regime is supported. Its research value depends on identifying consequential relationships and exposing where the integrated proposition can fail.

The intended scope includes infrastructure inspection, mining geotechnical assessment, emergency reconnaissance and defence engineering survey. These applications share difficult sensing conditions but differ in tolerable consequences, permitted actions and recovery arrangements. The architecture therefore supplies explicit interfaces and evaluation logic rather than a universal safety threshold. Deployment acceptance belongs to the complete machine, site and operating procedure.

2 Research method and evidence structure

We use a critical integrative review supported by mathematical analysis. The evidence horizon is 19 April 2024. Eligibility depends on the public availability of the specific version used, not simply the year printed on a later journal issue. A dated preprint can support a claim present in that version; a later conference revision cannot silently supply additional results. Conversely, an article released online before the horizon remains eligible even if assigned to a later issue. The GPR dataset article by ter Huurne, Olde Scholtenhuis and Dorée (2024), first released on 16 March, illustrates this distinction.

The research corpus spans state estimation, field robotics, uncertainty-aware planning, cooperative mapping, underground geomechanics, radar interpretation, confined-space mechanisms, human supervision and operational technology governance. Primary research is preferred for technical claims. Reviews are used to establish conceptual coverage rather than to supply unsupported performance comparisons. Publication metadata, version dates, experimental setting and the distinction between simulation and physical deployment are recorded in the accompanying source audit.

This is not a statistical meta-analysis. Sensor configurations, trajectory alignment conventions, environments, ground-truth systems and failure definitions differ too much to justify pooling headline accuracy scores. We instead compare mechanisms: which failure is addressed, what information is assumed available, how uncertainty enters the decision, and which operating conditions remain untested. This approach avoids interpreting the best score from one dataset as evidence of general underground reliability.

We distinguish four forms of statement. Empirical statements describe measurements reported by an identified source. Mathematical statements follow from specified definitions or assumptions. Architectural statements specify a proposed system relationship. Prospective statements define hypotheses or evaluation criteria. Their separation matters because an analytically sound mechanism can be implemented incorrectly, and a successful experiment can fail to generalise beyond its tested domain.

For reproducibility, the numerical examples use declared distributions, parameters and units. Closed-form answers are checked by direct calculation and, for correlated fusion, Monte Carlo simulation with a retained random seed. The calculations are deliberately simple enough to inspect. Their function is to show the direction and possible magnitude of a failure mechanism, not to estimate the prevalence of that mechanism in a mine or a deployed fleet.

The evidence selection has limitations. It is purposive rather than an exhaustive systematic search with a registered screening protocol. Several systems have extensive supplementary material and software whose continuing evolution is outside the date-bounded claim. We therefore avoid claims of exhaustive novelty, universal superiority or an independently established technology-readiness level for the proposed integration. The experimental programme in Section 15 provides the route from architectural plausibility to measured support.

3 Operating regimes and failure mechanisms

An underground environment is not one homogeneous distribution. A lined tunnel can offer strong planar surfaces but weak longitudinal position information. A natural cave can provide distinctive geometry while imposing unstable footing, overhangs and severe visibility changes. An operating mine adds moving equipment, evolving excavations, dust, water, ventilation constraints and controlled access. Confined ducts impose a different relationship between body shape, contact and the possibility of retreat. The operating domain must therefore be described through measurable conditions rather than the label underground.

Table 1 Operating regimes and consequential ambiguity

Failure analysis must include coupled causes. Dust can affect both a camera and a laser scanner, while the same time synchronisation defect affects every fused channel. A robot can also move into a geometry that makes calibration parameters weakly observable at precisely the moment that vibration changes them. Sensor diversity is valuable only to the extent that the channels provide complementary information under the actual failure distribution (Ryde and Hillier, 2009).

A second distinction concerns uncertainty and error. A wide but correctly calibrated interval represents acknowledged uncertainty. A narrow interval around the wrong tunnel branch represents an integrity failure. The latter can remain invisible to residual tests when all measurements are explained consistently by the wrong association. We therefore require monitoring of competing explanations and external constraints, not only the numerical conditioning of the currently selected estimate.

The operational consequence determines the necessary resolution. Mapping a broad access corridor and assessing millimetric deformation do not have interchangeable error budgets. Likewise, detecting an anomaly is not equivalent to identifying its material, geometry or structural significance. The state representation should preserve the task for which an observation is informative and the conditions under which that interpretation remains valid.

Environmental exposure also changes the meaning of time. A last-known clear route can become obstructed, and a previously acceptable atmosphere can change. We treat validity as a function of age, context and observed disturbance. A timestamp is therefore a prerequisite for evaluating evidence rather than a sufficient test of freshness. The architecture should retire or reduce the authority of evidence whose continued relevance cannot be established.

4 Mathematical formulation

4.1 Hybrid state and belief

Let the physical state include pose, velocity, inertial biases, calibration parameters, environmental structure, hazards and available energy. A discrete variable represents alternative fault or association hypotheses. We denote their joint posterior by a hybrid belief conditioned on the complete retained observation and action history.

Here T is a rigid-body pose in SE(3), v is velocity, b is inertial bias, theta contains calibration quantities, M is the map, H contains task-relevant hazard variables and E is available energy. Z can distinguish nominal operation, degraded sensing, a clock fault or an alternative place association. The map itself may contain discrete topological alternatives and continuous geometry. No practical implementation is expected to retain an unrestricted distribution over all these variables; the formulation identifies what an approximation must preserve or deliberately bound.

The recursive update integrates uncertain dynamics and sums over fault hypotheses. With observations y and executed action u, its schematic form is:

This expression makes two assumptions visible. First, the motion and observation models must be appropriate for the selected mode. Second, the prior over modes must not assign zero probability to a physically plausible failure merely because the nominal estimator lacks a representation for it. A Gaussian approximation can be useful within a locally correct association, but it cannot represent two widely separated places with one narrow covariance.

The planner receives an admissible action set rather than unrestricted access to the most likely pose. An action is admissible only when platform feasibility, evidence validity, risk allocation and recovery requirements are simultaneously satisfied.

The feasibility condition includes actuation limits and swept volume. Evidence validity includes age, calibration and the observation conditions supporting the bound. Recovery includes the existence of an executable route or another defined safe terminal state with sufficient resources. Permission reflects the operational authority of the platform and task. These conditions are not interchangeable: a geometrically feasible manoeuvre can remain unauthorised, while a permitted mission can become physically unrecoverable.

We propose a hierarchical implementation. High-rate estimation supplies continuous local motion. A slower global process maintains map associations and long-range structure. A supervisory process evaluates whether the resulting belief supports the requested action over its execution horizon. This division follows the computational motivation of feedback information roadmaps and hierarchical belief-space planning while retaining a separately testable action interface (Agha-mohammadi, Chakravorty and Amato, 2014; Kim et al., 2021).

4.2 Mission risk and decision objectives

A mission contains multiple opportunities for failure. Applying a permissive probability threshold afresh to each movement can exhaust the intended mission-level allowance. Let Fk be a failure event during interval k, conditioned on successful completion of earlier intervals and on the information available when the interval begins. If each conditional risk is bounded by εk, the mission failure probability is bounded by their sum.

The bound does not require independent interval failures. It does require a valid bound under each relevant history, including adaptations made by the planner. If the robot selects an action after inspecting noisy alternatives, the risk model must remain valid for that selection. A calibration result for an average randomly chosen segment is insufficient to justify a worst-case claim over adaptively selected segments.

The allocation can be conservative, particularly when events overlap or the robot repeatedly checks the same physical hazard. Nevertheless, an explicit allocation exposes whether apparent caution at the local level produces an unacceptable aggregate mission risk. Risk categories should also be disaggregated: collision, stranding, misleading reporting and loss of critical evidence have different consequences and dependencies.

For costs with important tails, we use conditional value at risk as one possible objective. For a loss L and confidence alpha, the standard optimisation representation is:

Rockafellar and Uryasev (2000) provide the underlying representation. It is useful because the objective can penalise large losses beyond a quantile instead of considering only expected loss. Its practical value depends on the quality of the loss distribution. A precisely solved optimisation over an implausible distribution still yields an unreliable policy. A static terminal CVaR objective also does not automatically provide time-consistent decisions under repeated replanning; a dynamic risk construction or an explicitly specified commitment policy is required when that property matters.

A candidate mission objective combines task value and decision-relevant information with energy, elapsed time and tail loss, subject to the admissible action constraints. The weighting coefficients carry units so that metres mapped, joules consumed and expected loss are not added without a declared conversion.

Information reward should target the uncertainty that changes a decision. Reducing uncertainty in a decorative texture may be less useful than clarifying whether a passage supports a return manoeuvre. Belief-space planning makes this distinction possible in principle, but computing an information proxy cheaply enough for onboard use remains a design problem. We therefore require sensitivity analysis over objective weights and a comparison against simpler, interpretable policies before accepting additional algorithmic complexity.

5 Sensing and spatial estimation

5.1 Architecture and evidence flow

We organise the proposed system around six responsibilities: acquisition, belief estimation, integrity supervision, mission planning, platform control and evidence interpretation. The relationships are shown in Figure 1. Their separation is functional; several may share a processor, but the action-permission interface must remain testable independently of the mission reward. A semantic service cannot expand a controller's permissible motion simply by describing an objective as urgent.

Figure 1 Proposed evidence and action architecture. Sensor evidence informs state and fault hypotheses. The supervisor limits what the controller may execute. The mission planner requests actions inside those limits, while the evidence layer retains context and provenance. Arrows identify logical dependencies, not guaranteed process isolation.

The acquisition layer records measurement timestamps, frame identifiers, calibration versions, sensor status and processing lineage. The estimator returns a distribution or a documented approximation, together with residual and observability diagnostics. The supervisor produces a time-limited envelope specifying where, how fast and for how long the platform may move. The planner chooses among permitted trajectories and can request observations that restore sufficient confidence. The controller verifies the current envelope before execution and reports actual motion and stopping behaviour.

Map correction is an especially important boundary. A global optimisation can revise a robot's pose substantially after a loop closure. Feeding that discontinuity directly to a high-rate controller can create an artificial motion command. We retain a continuous local odometry frame and represent global corrections through a separate transform. Outstanding trajectories and spatial constraints are then revalidated against the corrected map before continuation. Incremental smoothing provides efficient estimation machinery; it does not remove this interface obligation (Kaess et al., 2012).

The evidence layer stores raw or recoverable observations alongside derived claims, subject to practical storage limits. A claim contains the relevant location, time, uncertainty, source lineage and interpretation method. Retention can prioritise measurements surrounding anomalies, map revisions and supervisory interventions, while recording the deliberate loss of lower-priority data. An audit trail that silently omits the measurements responsible for a consequential change is not an adequate basis for later investigation.

This architecture makes rejection an explicit outcome. A sensor reading can be retained as evidence while excluded from control; a map association can remain a hypothesis; a semantic conclusion can be recorded without granting action authority. These distinctions allow the system to remain informative during degradation rather than choosing only between unconditional motion and complete informational shutdown.

5.2 Sensor selection and complementary failure

The appropriate sensor suite depends on geometry, environmental conditions, motion and the decision being supported. LiDAR can supply detailed range geometry; inertial sensors bridge short observation gaps; cameras contribute texture and semantic evidence; thermal cameras respond to different scene properties; radar can remain useful under some optical obscurants. None supplies a universal independent reference. We evaluate complementarity through physical failure mechanisms and conditional information, not the count of devices mounted on a chassis.

Table 2 Sensing roles and limitations

LIO-SAM and FAST-LIO2 exemplify efficient approaches to laser-inertial estimation with different choices of representation and optimisation (Shan et al., 2020; Xu et al., 2022). IMU preintegration provides a principled way to incorporate high-rate inertial measurements into optimisation without reintegrating every sample at every update (Forster et al., 2017). These methods are relevant building blocks, but their reported accuracy does not establish a protection level for arbitrary faults or a guarantee that a particular robot can stop within its available clearance.

Super Odometry illustrates an IMU-centred combination of laser, visual and inertial estimates (Zhao et al., 2021). Its architectural relevance lies in coordinating complementary observations and their influence on motion estimation. A separate analysis is still required for shared clock errors, mutual dependence and common environmental degradation. Calling two outputs separate estimators does not make them statistically independent if both depend on the same IMU or map.

Calibration belongs inside the uncertainty model. Sensor extrinsics can change after impact or mechanical servicing, and timestamp offset can turn platform motion into apparent scene distortion. We propose a start-of-mission calibration record, continuous plausibility checks and explicit rules for invalidating an estimate when calibration evidence becomes weak. Online calibration is appropriate only when the motion and scene make the parameters observable; otherwise the system should retain conservative uncertainty rather than claim convergence from repeated uninformative data.

5.3 Observability and spatial consistency

A long uniform corridor illustrates the difference between a large point cloud and a well-constrained pose. Its walls can constrain lateral position and orientation while providing little information about translation along the corridor. Adding more points on the same surfaces increases data volume without necessarily repairing that weak direction. An observability diagnostic should therefore examine the structure of the information supplied by measurements, including the directions in which uncertainty remains large.

LION explicitly connects laser-inertial estimation with a measure of geometric constraint and supervisory use of estimator confidence (Tagliabue et al., 2021). DARE-SLAM addresses resilient loop closing in perceptually degraded conditions (Ebadi et al., 2021). These works motivate checking both local degeneracy and global association. They do not imply that a single eigenvalue threshold can establish integrity in every geometry; numerical conditioning depends on units, parameterisation, linearisation and the validity of the selected correspondence set.

We propose three complementary consistency checks. The first asks whether recent innovations match the assumed noise model after accounting for dependence and selection. The second examines whether the environment supplies information along the motion directions that matter for the proposed manoeuvre. The third challenges map associations using independently informative history, topology or an additional viewpoint. Disagreement between checks is a reason to restrict authority and investigate, not to average the diagnostics into an unexplained confidence score.

Spatial representations should preserve the scale at which a claim is valid. A local elevation map is useful for contact and traversability, while a global pose graph represents relationships among longer trajectory segments. Probabilistic terrain mapping can retain uncertainty in local surface height (Fankhauser, Bloesch and Hutter, 2018), but extrapolating a locally observed support surface beyond sensor visibility remains a separate inference. A terrain cell should therefore distinguish observed surface, inferred continuation and genuinely unobserved space.

Trajectory evaluation also requires care. Absolute trajectory error depends on reference-frame alignment; relative error describes local motion consistency over a selected interval. A post hoc rigid alignment may be suitable for measuring drift, but it can conceal an initialisation error that matters operationally. The evaluation protocol should state the allowed alignment and separately measure error in the frame actually used for action. Benchmark conventions such as those formalised by Sturm et al. (2012) are valuable only when their assumptions remain visible.

Finally, map consistency is not geological truth. A geometrically self-consistent reconstruction can omit a hidden void, misclassify a moving object as permanent structure or preserve a stale excavation boundary. Integrity monitoring must therefore distinguish localisation confidence from coverage, material inference and environmental currency. Collapsing these dimensions into a single map quality score would hide the reasons why a decision may be unsupported.

6 Navigation integrity and action authority

6.1 From an estimate to a permission

We use navigation integrity to mean the ability to detect or bound consequential estimation error, and to communicate the loss of that ability within the time available for intervention. Accuracy measures realised error under a specified evaluation. Integrity additionally asks whether an unacceptable error can occur without timely detection. A covariance describes an estimator's uncertainty under its model; it becomes operationally useful only when the model and calibration evidence justify the intended interpretation.

The supervisor should receive the requested trajectory, its execution horizon, environmental clearance, controller limits and a structured account of estimation health. Its output is a permission with an expiry time and explicit constraints. The controller must reject an expired permission, a frame mismatch or a request outside the authorised envelope. Reusing a formerly valid permission after a map correction or loss of sensing defeats the purpose of the supervisory boundary.

We propose four operating modes. Normal operation requires sufficient evidence for the requested action. Restricted operation reduces speed, range or manoeuvre complexity while retaining a feasible stopping or recovery option. Observation mode executes a bounded movement or stationary measurement intended to discriminate among hypotheses. Recovery follows a previously assessed route or reaches another defined terminal state. Mode transitions should include hysteresis and minimum evidence requirements so that transient residual fluctuations do not produce rapid, unsafe oscillation between commands.

A protection distance is a bound with an associated probability, fault coverage and validity horizon. It is not simply a selected multiple of position standard deviation. It may need to incorporate map uncertainty, orientation-dependent swept volume, unmodelled association alternatives and delayed detection. The action interface should state which components it covers and which remain the platform controller's responsibility. Otherwise two individually reasonable subsystems can each assume that the other has accounted for the same hazard.

Control barrier functions provide a formal means of enforcing state constraints when the dynamics, state information and feasibility conditions are appropriate (Ames et al., 2017). Their inclusion does not eliminate uncertainty in those ingredients. We therefore distinguish a controller's mathematical invariance property from the empirical evidence that its state bound, actuator response and environmental model satisfy the required assumptions. A proof conditional on an accurate clearance estimate cannot certify clearance that was never observed.

The decisive research issue is coverage of the fault model. A monitoring system can achieve low false-alarm rates by ignoring difficult faults, or achieve low missed-detection rates by halting almost continuously. Evaluation must report both outcomes together with task progress, intervention delay and exposure. A useful integrity supervisor should preserve enough availability to perform the mission while containing specifically defined hazards; the acceptable trade-off must be set before seeing the evaluation results.

6.2 Motion envelopes and recoverability

Consider forward motion towards a limiting boundary. Let D be available distance, P a position protection distance, m a geometric margin, tau the total response latency and a the guaranteed braking deceleration for the declared surface and platform condition. A simple stopping constraint is:

The terms describe travel during latency, braking travel, position uncertainty and geometric reserve. This is a one-dimensional conservative design model, not a complete vehicle safety model. It assumes an adequate braking response, a valid boundary estimate and no new obstacle entering the envelope. Slopes, steering dynamics, tyre or foot contact, load changes and actuator saturation require additional treatment in the platform implementation.

Solving the inequality gives the permitted speed when non-negative residual clearance remains:

If D is smaller than P plus m, the model provides no positive forward-motion permission. At equality, only zero speed satisfies the constraint. This result shows why improving localisation integrity can create operational value: it can enlarge the feasible action set for the same clearance and braking capability. Conversely, a supervisor that acknowledges increased uncertainty should reduce the action envelope even when the estimated centre position has not changed.

Latency must include sensing age, processing delay, communications within the machine, permission checking and actuator response. Mean processing time is inadequate when a missed deadline can invalidate the bound. We require measured tail latency under representative compute load, thermal conditions and simultaneous logging. A faster estimator that causes occasional long scheduling stalls can produce a worse stopping envelope than a slower, predictable pipeline.

Recoverability extends beyond immediate stopping. A stopped robot may remain in an unstable or obstructive location, and a route that was feasible outbound may be infeasible in reverse. The planner should maintain a set of reachable terminal states: a portal, a refuge, a supervised rendezvous or another site-approved condition. Energy requirements include the return manoeuvre, degraded traction, sensing and computation, waiting time and a reserve supported by platform measurements.

We treat return-route confidence as a maintained resource. Passage observations carry age and disturbance context, and a topology change triggers re-evaluation. If the only viable return edge becomes uncertain, further exploration may consume the remaining recovery option. The appropriate response can be to observe that edge, relocate to a more informative position or return while the route is still supportable. Maximising newly mapped area without this constraint can reward precisely the behaviour that makes successful recovery less likely.

7 Belief space planning and recoverable exploration

Exploration is a decision about future information as well as future position. A shortest path to an unexplored frontier may enter a repetitive corridor that degrades localisation, while a slightly longer path may retain distinctive geometry and an accessible return route. The state relevant to planning therefore includes uncertainty and the expected effect of an action on that uncertainty. This is the motivation for belief-space planning rather than planning solely over a point estimate.

FIRM links feedback policies through belief-space representations, while PLGRIM uses hierarchical reasoning to connect local risk-aware behaviour with broader exploration objectives (Agha-mohammadi, Chakravorty and Amato, 2014; Kim et al., 2021). Graph-based subterranean exploration also exploits local and global structure in tunnel networks (Dang et al., 2020). These approaches support a computational division in which a global planner chooses informative regions and a local planner verifies executable trajectories under current conditions.

Our proposed planning state contains a topological graph with uncertain edges, local traversability estimates, observation opportunities and recovery resources. An edge records more than distance: it includes the last supporting observation, the platform configuration required, the expected communication condition and the uncertainty relevant to traversing or reversing it. A path is admissible only if each step preserves a supported continuation to a terminal state or if the mission explicitly authorises a different recovery arrangement.

Information gain should be decision-specific. Suppose two tunnel branches are visually similar. An additional forward scan may reduce local geometric noise while leaving their identity unresolved. A short lateral observation at a junction may discriminate the branches much more effectively. The planner should prefer the observation that changes the posterior over the consequential hypotheses, after accounting for the cost and risk of obtaining it. Generic entropy reduction can otherwise favour measurements that are easy to collect but irrelevant to the pending decision.

Risk-aware terrain planning, including STEP, illustrates the value of representing uncertainty in traversability costs rather than treating all mapped ground as equally reliable (Fan et al., 2021). We extend that principle to recovery feasibility and the age of environmental information. The extension is a design proposal requiring evaluation; it does not follow automatically from adding another scalar cost to an existing planner.

Three controls are needed in experiments. First, compare against a conservative baseline with comparable average speed, because slowing down alone can improve outcomes. Second, equalise sensing and compute budgets so that gains cannot be attributed entirely to more measurements. Third, report the proportion of missions abandoned or declared unsupported. A policy that avoids all difficult environments may reduce failures while providing little useful capability. The research objective is an improved relationship between useful completion and bounded consequence within a declared operating domain.

8 Cooperative robots and distributed evidence

8.1 Shared maps and dependence

Several robots can provide wider coverage, different viewing angles and opportunities for mutual localisation. They can also share the same map error, repeat the same mistaken association and circulate one observation until it appears to be widespread agreement. Cooperative intelligence therefore requires a representation of dependence. Counting agreeing messages is not equivalent to counting independent measurements.

LAMP develops large-scale mapping for challenging environments, while Kimera-Multi addresses distributed multi-robot metric-semantic SLAM (Ebadi et al., 2020; Tian et al., 2022). Active multi-robot mapping based on submap joining explores how planned actions and map combinations interact (Chen et al., 2022). These contributions establish relevant mechanisms. The additional research requirement here is to preserve enough provenance to identify when an incoming estimate already contains local information or depends on a shared external source.

Each shared observation should carry a stable identifier, originating platform, acquisition interval, coordinate frame, calibration version and ancestry for derived claims. Map alignment itself must be represented as uncertain. A transform obtained from one ambiguous place match should not be treated as an exact coordinate conversion merely because the resulting maps look visually compatible. Multiple candidate alignments may need to remain active until independently informative evidence resolves them.

When cross-correlation is unknown, covariance intersection offers a conservative fusion construction for estimates whose individual covariance bounds are valid. Its information-form combination is:

The weight omega lies between zero and one and may be selected through an explicit covariance criterion. Julier and Uhlmann (1997) provide the underlying method. Its guarantee is conditional: it does not repair biased or inconsistent inputs, false associations or an invalid common state definition. It can also be conservative enough to sacrifice useful information. The comparison should therefore include both consistency and task performance, not just whether the fused covariance becomes smaller.

Provenance and conservative fusion serve different purposes. Ancestry can prevent exact double counting and help reconstruct a failure, while conservative fusion handles unresolved statistical dependence. Neither eliminates the need to challenge the correctness of the measurements. If every robot observes the same misleading landmark under the same model, the fleet may be confidently wrong even with perfectly retained message identifiers.

We propose evaluating cooperative performance through independent evidence gained per unit time, not only total area covered or packet count. Useful cooperation should improve the availability of decision-relevant observations, reduce unobserved regions or preserve recovery. Its benefit can disappear when shared calibration, limited communication or geometric repetition dominates the observation process.

8.2 Communication partitions and reconciliation

Underground radio conditions vary with geometry, materials, bends and infrastructure. A communication policy based on continuous connectivity can therefore fail even when each robot remains mechanically and computationally healthy. We treat network partition as an operating condition that changes coordination authority. Each robot should know which decisions it can make locally, which require fresh coordination and which must expire when their supporting information becomes stale.

The consistency requirement depends on the object being shared. Raw observations can be accumulated and reconciled later. A task claim can use a lease with an explicit expiry. Access to a narrow passage may require stronger mutual exclusion or a locally enforceable right-of-way protocol. A map revision should retain causal relationships so that a late message cannot silently restore an invalidated constraint. One generic eventual-consistency policy is not appropriate for all four objects.

Reconnection should initiate an evidence reconciliation process. The system first validates message identity, time bounds, schema and provenance. It then identifies duplicated information and competing map versions. Alignment hypotheses are tested before measurements are fused. Tasks are re-evaluated against current positions and energy rather than resumed solely because they were outstanding before the partition. Conflicting claims remain visible until resolved or explicitly downgraded.

A useful counterexample is two robots approaching opposite ends of a one-vehicle passage after losing contact. Both may possess a valid local map and an old assignment. A later central reconciliation cannot undo a physical blockage. The conflict must be prevented by the passage protocol, local sensing and recoverable behaviour. This illustrates why information consistency must be coupled to physical constraints and why communications loss cannot be handled only as delayed map upload.

Task allocation research provides a formal vocabulary for matching robot capabilities, task requirements and allocation costs (Gerkey and Matarić, 2004). We require those costs to include the uncertainty and communication needed to complete the task, as well as recovery and evidence value. An apparently efficient assignment can be poor if it sends the only robot with a suitable sensor beyond a communication bottleneck or duplicates observations that are strongly correlated.

Evaluation should deliberately partition the network at different mission stages, including during map correction, task transfer and entry to constrained spaces. Metrics include duplicated work, conflicting permissions, invalidated findings, time to reconcile and the number of robots recoverable at mission end. Packet delivery and average bandwidth remain useful diagnostics but cannot substitute for these operational outcomes. The architecture succeeds only if delayed information is contained before it becomes an unsupported physical action or an unjustified engineering conclusion.

9 Subsurface sensing and interpretation

9.1 Ground penetrating radar and negative evidence

Navigation observes accessible space; subsurface sensing infers properties beyond visible surfaces. Ground penetrating radar responds to electromagnetic contrasts and propagation conditions. Its interpretation depends on dielectric properties, conductivity, antenna characteristics, coupling, survey geometry and processing. A radargram is therefore an observation to be interpreted through a physical model, rather than a direct image of a uniquely identified buried object (Neal, 2004).

The ground-truth dataset of ter Huurne (2023) and its accompanying article provide a valuable connection between practical surveys and independently exposed utilities. The article reports 125 surveying activities and 959 radargrams, with trial-trench information and contextual features (ter Huurne, Olde Scholtenhuis and Dorée, 2024). Its operational diversity supports investigation of when GPR interpretation succeeds or fails. Transfer to an autonomous underground platform still requires attention to positioning, coupling, geology and the target classes of interest.

We propose storing a subsurface claim as a hypothesis with a spatial support region, observation conditions and alternative explanations. A detected reflection may be consistent with more than one material or geometry. The claim should distinguish anomaly detection, geometric localisation and material identification, because these require different evidence. Confidence in one stage should not be inherited automatically by the next.

Negative evidence is especially vulnerable to misinterpretation. Failure to detect an object changes belief only through the probability that the survey would have detected it if present. If attenuation, depth or coverage makes that probability low, a negative result provides little reassurance. The system should therefore record detectability as a function of local conditions and target class. Unsurveyed ground, surveyed ground with weak sensitivity and surveyed ground with a credible exclusion limit are separate states.

Sensor placement becomes an active sensing problem. A planner can choose an additional transect, different orientation or complementary modality to reduce ambiguity. The value of that action is the expected change in the pending decision, not the number of new pixels or traces. The action must also preserve physical access and recovery. A highly informative scan is not useful if obtaining it consumes the only viable return option.

Section 14 provides a transparent Bayesian example showing how the same negative result produces very different posterior probabilities under different detection sensitivities. The example is a declared model rather than an estimate of actual GPR performance. Its purpose is to expose the dependence of reassurance on sensitivity and to prevent a semantic reporting layer from converting the phrase nothing detected into the stronger and unsupported statement nothing present.

9.2 Gravity sensing and multimodal inversion

Gravity sensing offers a physically different source of information about subsurface density contrasts. In a field demonstration, Stray et al. (2022) used a quantum gravity gradiometer to detect a tunnel. The reported survey used 0.5 m spatial sampling along an 8.5 m line and detected a 2 m tunnel with signal-to-noise ratio eight. This result establishes a significant measurement capability under its demonstrated conditions. It does not establish that a small moving robot can obtain equivalent measurements at normal traversal speed.

The distinction between measurement and inversion is fundamental. Gravity reflects the integrated effect of surrounding mass, so multiple density configurations can explain similar observations. An inversion depends on geological and geometric priors, sensor placement, noise and the permitted model class. A posterior concentrated within a restrictive model class can understate uncertainty about whether that class describes the site. Model alternatives must therefore remain part of the interpretation.

We envisage gravity measurements as one possible layer in a multi-stage survey. Coarse observations can identify regions deserving closer investigation; accessible geometry and geological context can constrain candidate models; radar or other suitable measurements can test specific alternatives. Fusion should operate through compatible physical hypotheses and their uncertainties. Simply averaging confidence scores from unrelated instruments is not a principled inversion method.

Platform integration requires a separate measurement budget. Vibration, tilt, environmental variation, instrument dimensions, power demand and observation time influence where a sensor can be used. A stationary measurement station, a transported instrument that settles before measurement and a continuously moving payload have different noise models. Their operational concepts should be evaluated separately rather than treated as successive software configurations of the same validated capability.

We propose an information-to-cost comparison between survey actions. For each candidate measurement, estimate the expected reduction in uncertainty relevant to the engineering decision, the time and energy consumed, the positioning quality needed and the consequences of a misleading result. Where the sensitivity model is poorly known, uncertainty in expected information gain should itself be represented. A robust policy may prefer a less precise but well-characterised observation over an apparently superior sensor whose field response is unsupported.

The scientific opportunity is complementary discrimination. Optical and laser geometry, electromagnetic response and gravitational response depend on different physical properties. Their combination can reject explanations that survive a single modality. The remaining challenge is dependence through shared geometry, priors and site models. Independent physical channels can still produce dependent posterior conclusions if they use the same incorrect assumptions. Provenance must therefore retain the modelling choices as well as the raw sensor source.

10 Geomechanical intelligence

Mobile mapping can extend the spatial coverage of underground inspections and expose surfaces that are difficult or hazardous to approach. Jones (2020) describes both the practical value of mobile LiDAR for underground geomechanics and the importance of processing and interpretation between acquisition and engineering use. The research implication is that a point cloud is an input to assessment. Its density alone does not establish the reliability of a discontinuity measurement, deformation estimate or support decision.

Change detection requires registration between epochs, a suitable local surface model and a treatment of measurement dependence. A simplified uncertainty model for displacement along a local surface normal is:

The two sampling terms represent uncertainty in the epoch means, using effective sample sizes rather than raw point counts. The registration term describes residual relative alignment uncertainty projected into the measurement direction. The model assumes approximately Gaussian, zero-mean contributions and independence between the listed terms. Correlated registration and local surface errors require additional covariance terms. A 95% two-sided detection limit is 1.96 times the resulting standard deviation under these assumptions.

Lague, Brodu and Leroux (2013) provide an established framework for comparing complex three-dimensional surfaces with local uncertainty. The present analytical model isolates one practical lesson: increasing point density does little when inter-epoch registration dominates. A survey design should therefore invest in stable reference geometry and independent controls as well as sensor resolution. Alignment that uses the deforming surface itself can partially absorb the change it seeks to measure.

We propose retaining observation geometry, incidence conditions, registration controls and surface-selection decisions with every reported change. The interpretation should identify whether the finding is geometric displacement, apparent change caused by occlusion or a change in material visibility. Water, loose material, equipment and surface damage can alter observations without representing the same geomechanical process. A semantic label should not erase those alternatives.

Repeated surveillance introduces a statistical issue beyond a single confidence interval. Testing thousands of spatial regions or repeatedly examining the same region increases the chance of spurious alarms. Acceptance thresholds should account for the selected spatial and temporal testing procedure, and the system should separate a screening alert from an engineering conclusion. Reporting only the largest observed displacement after searching a large cloud can exaggerate evidential strength.

The operational output is a traceable change claim with location, magnitude, uncertainty, temporal interval and recommended verification. A decision to alter access or support remains governed by the site's engineering process. We propose prioritising verification where the consequences are high and the evidence is ambiguous, while preserving the original observations so that an expert can challenge the automated interpretation rather than merely accept a coloured surface map.

11 Confined spaces and morphological robotics

11.1 Configuration as part of the state

A robot entering a congested duct or narrow void must reason about its whole body, contact state and retrieval path. A point trajectory that appears collision-free can be infeasible for an articulated, deformable or tethered mechanism. The configuration space must include body shape, bending limits, contact forces and relevant tether state. A locally successful insertion does not demonstrate that the mechanism can reverse, turn or be recovered after a fault.

Gough, Conn and Rossiter (2021) present planning for morphing soft robots in congested environments, using geometric structure to address changing robot shape. Hawkes et al. (2017) demonstrate a soft robot that advances through growth at its tip. These approaches expand the range of accessible spaces, but the operational advantage depends on the specific mechanism and task. Payload delivery, sensing orientation, pressure supply, damage tolerance and retrieval impose additional constraints.

We propose a morphology-aware extension of the action envelope. The supervisor receives a predicted swept volume with uncertainty over body configuration, together with limits on contact and available actuation. For a tethered platform, it also receives the state of the deployed tether and a supported retrieval model. A permission should identify the portion of the body and environment for which clearance has been assessed. A safe tip position is insufficient if the trailing body can jam or damage a critical service.

Contact is both a hazard and an information source. Controlled contact can reveal a boundary that optical sensing cannot resolve, but the probing action must respect the fragility of the environment and the robot. This creates a dual-control problem: the action changes the physical state while acquiring information about constraints. Its value depends on whether the information gained supports a safer subsequent action and whether the probing operation itself is recoverable.

Experimental evaluation should include branching geometry, partial blockage, debris, wet surfaces and loss of a sensor or actuator. The outcome set should include retrieval success, time to recover, maximum contact load, retained sensor functionality and environmental disturbance. Reporting only maximum penetration distance would reward irrecoverable progress and hide failure modes that matter in infrastructure inspection.

Morphological adaptation also changes calibration. A sensor mounted on a deforming body may not retain a fixed transform to the control frame. The system must measure that transform, infer it with bounded uncertainty or reduce the authority of spatial claims that depend on it. This coupling between mechanism, sensing and evidence is why confined-space robotics belongs inside the overall intelligence architecture rather than being treated as a separate mobility accessory.

11.2 Swarms and transfer to remote environments

Swarm systems distribute capability across multiple agents, potentially improving coverage and tolerance of individual loss. Their effectiveness depends on the interaction rules, sensing range, communication, environment and task. Brambilla et al. (2013) distinguish systematic engineering of collective behaviour from demonstrations of emergent patterns. For subterranean work, the engineering question is whether a collective achieves a defined information and recovery objective under constraints that include geometry, energy and communication partitions.

Redundancy can protect against independent component failures while doing little against common causes. A shared software defect, bad map prior or environmental condition can affect every robot. Fault detection through collective behaviour, including synchronisation-based approaches, provides relevant ideas for detecting departures from expected operation (Christensen, O'Grady and Dorigo, 2009). Detection still depends on a credible account of normal variation; coordinated wrong behaviour may remain difficult to distinguish from correct consensus.

We propose measuring fleet scale through marginal decision value. The next robot is useful when its contribution exceeds the costs of coordination, interference, deployment and recovery. In a narrow tunnel, additional agents can obstruct one another, compete for radio capacity and duplicate observations. Section 14 presents a simple scaling model in which completion time initially decreases with fleet size and then increases. The optimum is conditional on declared coefficients, illustrating why larger fleets cannot be presumed superior.

A heterogeneous fleet can assign complementary roles: detailed local survey, communication relay, broad reconnaissance or sensor transport. Such specialisation creates dependencies. Losing the only relay or the only platform able to traverse a return route can compromise the rest of the mission. The mission graph should therefore represent capability bottlenecks, and experiments should remove those capabilities deliberately to test whether the nominal redundancy is meaningful.

Off-Earth lava tubes and other remote subsurface environments share communication and localisation difficulties with terrestrial caves, but they introduce different gravity, thermal conditions, dust behaviour, power constraints and repair possibilities. Terrestrial field experience supports hypotheses about architecture, not direct performance transfer. The relevant question is which mechanisms remain valid when the physical and operational domain changes and which require new characterisation.

We would prioritise transfer of interface principles before transfer of performance claims: time-limited action authority, evidence ancestry, competing hypotheses, measured resource reserves and explicit terminal states. These remain conceptually useful across platforms. Their numerical parameters must be re-established. A system designed for reduced gravity, for example, cannot inherit terrestrial braking, traction or falling-risk limits merely because the navigation software is unchanged. Domain transfer is an experimental programme with traceable assumptions, not a branding extension of an existing robot.

12 Semantic intelligence and initiative integration

12.1 From spatial observations to operational meaning

A spatial observation acquires operational meaning through its relationship to an asset, process, hazard and decision. A displaced surface near a support element has different implications from similar change in loose material on a roadway. A blocked passage can affect inspection access, emergency routes and production dependencies. We propose an ontology that makes these relationships explicit while retaining the evidence and uncertainty underlying each claim.

The minimum conceptual separation is between observation, interpretation, hypothesis and action. An observation records what a sensor measured. An interpretation applies a model to that measurement. A hypothesis represents a possible state of the environment. An action has an actor, prerequisites, authority and expected consequences. Combining these objects in one undifferentiated record encourages a detection to become a fact and a fact to become an instruction without an accountable transition.

Table 3 Minimum fields for an actionable evidence claim

Learned models can help identify objects, segment surfaces and prioritise anomalies. Their outputs require calibration appropriate to the deployment distribution. Guo et al. (2017) show the importance of checking probabilistic confidence in neural networks, while Kendall and Gal (2017) distinguish different sources of uncertainty in vision models. A calibrated classifier on one dataset is not automatically calibrated after a change in dust, illumination, sensor mounting or target prevalence. Nor does a class probability describe localisation error or structural severity.

We propose a semantic reasoner that can return an unresolved result. If asset identity is ambiguous, required evidence is absent or an inference depends on incompatible units, the output should retain the conflict. This is especially important where a later planning component may otherwise treat a fluent explanation as an authoritative state update. Narrative generation should be grounded in structured claims and should not overwrite them.

The architecture can support an investigation such as identifying which access routes or inspections are affected by an uncertain obstruction. It should not infer unrestricted authority to change the physical operation. The evidence-to-action chain includes policy, platform capability and human responsibilities, with completion verified by fresh observations. This structure provides a substantive connection between subterranean sensing and organisational intelligence without confusing contextual reasoning with control assurance.

12.2 Research alignment across LupoToro initiatives

This study forms part of the research support for Subterra. The initiative's focus on onboard positioning, mapping, navigation integrity, bounded autonomy and coordinated exploration provides the programme setting for the architecture developed here. Subterra is described as in development. We use its programme scope to define research interfaces; empirical claims in the study remain grounded in the dated scientific literature and the explicitly declared calculations.

We propose a Subterra evidence service that publishes local and global spatial claims with their frames, time bounds, uncertainty and ancestry. Its high-rate control interface remains small and deterministic: a validated estimate, an action envelope, an expiry and a reason for restriction. A separate research interface supports richer analysis, replay and interpretation. Separating their computational demands helps prevent an expensive semantic investigation from delaying a braking or stale-data check.

LTKAU and Lutine provide a related development direction for investigating operational dependencies and governed responses. The proposed connection is an exchange of evidence claims, affected entities and candidate responses. Lutine could assess which commitments depend on an unavailable passage or disputed asset state, while Subterra retains responsibility for the spatial evidence and the platform retains motion authority. This is an integration specification rather than a claim that the complete connection has been implemented or evaluated.

Digital Twins provides the complementary research direction for scenario comparison. A twin could use qualified observations to update a model, test alternative inspection sequences and estimate the consequences of restricted access. Simulated states must remain distinct from observed states. Model discrepancies should generate questions for further measurement rather than be overwritten by a visually coherent representation. The useful output is a tested decision comparison with visible assumptions and uncertainty.

Sovereign AI Energy and Assurance frames questions of deployment control, compute, energy and sensitive workloads. For underground systems, the proposed interfaces concern model and software provenance, local availability, permitted external dependencies and evidence retention. Customer-controlled operation requires more than the physical location of data: update authority, keys, privileged access and continuity all affect who can influence the system.

These relationships define a coherent research programme without making the navigation core dependent on every adjacent initiative. A first demonstrator should succeed with a bounded local interface and a simple evidence store. Richer interpretation and scenario services can then be introduced through controlled experiments that measure additional decision value, latency and failure modes. Integration is justified when it improves a stated outcome under test, not merely because several initiatives can exchange messages.

13 Disconnected operation and human supervision

13.1 Local continuity and controlled change

Disconnected operation requires a complete local operating contract. The robot needs the models, maps, credentials, time references and resource limits necessary for its permitted tasks. It also needs a defined response when any of those dependencies becomes unavailable or too old. A cached cloud response is not equivalent to a locally valid decision if its supporting evidence or authority has expired.

We propose signed and versioned deployment packages containing the executable system, model identifiers, calibration records, configuration and permitted operating domain. The machine records which package produced each consequential estimate and action. Updates are staged, checked and activated under a controlled transition; interrupted installation must leave a recoverable configuration. The evaluation should include rollback, depleted storage, unexpected restarts and loss of access to an assumed external service.

Operational technology security must account for physical reliability and timing as well as confidentiality. NIST SP 800-82 Revision 3 addresses these combined concerns and provides a relevant foundation for segmentation, access control and risk-based protection (Stouffer et al., 2023). For this architecture, the specific design requirement is that information-processing services cannot acquire motion authority simply by reaching the controller over a network interface.

Imported content is evidence to assess, not executable policy. A map annotation, maintenance note or retrieved document may be incorrect or contain instructions outside its authority. Parsing and interpretation should occur in a bounded process with explicit data types and permitted operations. The receiving system should distinguish the authenticated origin of a message from the truth or authorisation of its content. A valid signature establishes provenance, not physical correctness.

The local evidence store must be robust to partial writes and abrupt power loss. Critical records should include the last permission issued, the state that supported it, the executed action and any resulting intervention. Storage allocation should preserve the evidence needed to reconstruct consequential events even when routine sensor streams are reduced. Retention policies must state what has been discarded; otherwise a later reviewer may mistake an incomplete record for a complete operational history.

At reconnection, deferred uploads and pending actions require different treatment. Evidence can be reconciled with conflict handling. An action proposed earlier must be rechecked against present authority, state and dependencies before execution. Automatic retries are particularly dangerous when the earlier operation may have partly completed. The system should obtain an authoritative observation of current state and reconcile partial execution before issuing another command. This requirement connects digital workflow integrity directly to physical recovery.

13.2 Human authority and evaluation boundaries

Human supervision should be designed around decisions the operator can realistically understand and influence. A screen filled with point clouds, probability values and alerts can impose excessive interpretation work while obscuring the immediate question: what action is being requested, what evidence supports it and what happens if the evidence is wrong? The interface should identify current operating mode, remaining recovery options, the limiting uncertainty and the time available for intervention.

Parasuraman, Sheridan and Wickens (2000) distinguish levels and types of automation across information acquisition, analysis, decision and action. This framework is useful because an autonomous inspection system need not automate every stage to the same degree. A robot may collect evidence and propose a route while retaining human approval for a consequential access change. Conversely, high-rate collision avoidance may require a local automatic response because a remote operator cannot meet the timing constraint.

We propose authority boundaries tied to observable state transitions. An operator can approve a mission objective or a site-specific exception only within the authority granted by the operating procedure. The controller continues to enforce the physical envelope. If the system requests assistance, it should expose the competing hypotheses and the observation needed to resolve them. Asking an operator to accept an unexplained confidence score transfers responsibility without providing a basis for judgement.

Table 4 Decision boundaries and verification

ISO 17757:2019 provides a relevant safety framework for autonomous and semi-autonomous earth-moving and mining machinery. Its scope is a reminder that a navigation component is assessed within the complete machine and application. This study does not substitute a component benchmark for a platform safety assessment. Different machines, energy sources and environments require their applicable engineering and operating controls.

Human-centred evaluation should measure response correctness, response time, workload and the ability to identify unsupported conclusions. Tests should include plausible but wrong maps, ambiguous alarms and loss of a reference channel. A useful interface makes uncertainty actionable without encouraging either habitual acceptance or habitual rejection. The appropriate objective is effective supervision of a bounded system, not the maximum number of alerts presented or the minimum number of human interventions in isolation.

14 Analytical studies

14.1 Correlated evidence and false confidence

We first analyse n scalar reports of the same quantity, each with standard deviation sigma and equal pairwise correlation rho. For the equally weighted mean, direct expansion of the covariance gives:

If fusion assumes independence, it reports a standard deviation of sigma divided by the square root of n. Under a jointly Gaussian equicorrelated model, the actual coverage of the resulting nominal 95% interval is:

Table 5 Independence assumptions under correlated Gaussian errors

Phi denotes the standard normal distribution function and z the indicated quantile. The declared parameters are sigma = 0.4 m and rho = 0.8. As n increases, actual variance approaches sigma squared times rho. The independent part averages down; the common component remains. The interval becomes narrower mainly because of an assumption the observations do not satisfy. This is a mechanism by which a fleet can appear more certain while becoming less well calibrated.

Figure 2 Analytical sensitivity. Left: actual coverage of nominal 95% intervals as report count and correlation vary. Right: permitted forward speed as protection distance and response latency vary for D = 3 m, a = 0.8 m/s² and margin = 0.25 m. Curves are model calculations, not field measurements.

A Monte Carlo check with 200,000 draws per report count agrees with the closed-form coverage within two simulation standard errors. Non-Gaussian dependence and bias require separate models.

14.2 Fault tails and motion constraints

A second experiment separates nominal uncertainty from a rare but consequential fault. Let scalar position error follow a mixture with probability 0.99 of a zero-mean Gaussian with standard deviation 0.1 m and probability 0.01 of a Gaussian centred at 1.2 m with the same standard deviation. For a symmetric bound P, the probability of exceeding that bound is:

At P = 0.5 m, the nominal model alone gives an exceedance probability of approximately 5.733 × 10⁻⁷. The mixture gives approximately 0.01000057, or 1.000057%. A small nominal covariance therefore coexists with a material tail if an omitted association fault remains possible. Solving the mixture equation for an exceedance probability of 0.001 yields a bound of approximately 1.3282 m.

These numbers depend entirely on the declared fault probability, bias and spread. They are not estimates of underground localisation failure rates. Their purpose is to show why a supervisor must account for fault hypotheses separately from ordinary measurement noise. Sensitivity to the fault prior should be reported, and uncertainty about that prior should not be concealed by a precise numerical solution.

The stopping model then translates a protection distance into an action limit. With 3 m available distance, deceleration 0.8 m/s², latency 0.3 s and a 0.25 m geometric margin, the permitted speeds are:

Table 6 Protection distance and permitted speed

The result connects statistical integrity to operational availability. A wider bound can be the correct response to uncertainty, but it reduces the available speed. The architecture should therefore seek better evidence where doing so is beneficial, while retaining restriction when the bound remains large. A reduction in reported uncertainty is valuable only if its coverage is maintained; an unjustifiably narrow estimate produces apparent productivity by consuming unacknowledged risk.

The model also makes latency a measurable contributor. Figure 2 shows that slower response reduces the admissible speed even with unchanged localisation. Engineering effort should therefore address the entire observation-to-actuation chain. Optimising nominal pose accuracy alone may deliver little operational benefit when delayed intervention or weak braking dominates the stopping distance.

14.3 Change detection and subsurface evidence

For the deformation model, set the standard deviation of local surface samples in each epoch to 20 mm. Compare effective sample sizes of 25 and 100 and relative registration standard deviations of 15 mm and 5 mm. The resulting two-sided 95% detection limits are:

Table 7 Sensitivity of the deformation detection limit

With registration uncertainty fixed at 15 mm, quadrupling the effective sample size improves the limit by only approximately 1.50 mm. Reducing registration uncertainty to 5 mm produces a much larger change. This is a resource-allocation result under the model: additional point density has diminishing value when alignment dominates. It does not establish the minimum detectable displacement of any particular scanner, rock surface or processing pipeline.

For subsurface interpretation, assume a hazard prevalence of 1%, a detector sensitivity of 90% and a false-positive rate of 5%. Bayes' rule gives a posterior hazard probability of approximately 15.38% after a positive result. The positive signal is useful for prioritisation but does not establish that the hazard is present. Its meaning depends strongly on prevalence and the conditional detection model.

Now obtain a negative result from a second test. Suppose its negative probability is 0.95 when the hazard is absent. If its miss probability when the hazard is present is 0.10, the updated hazard probability is approximately 1.88%. If adverse sensing conditions increase the miss probability to 0.70, the updated probability is approximately 11.81%. The same word negative therefore supports substantially different conclusions.

This calculation assumes conditional independence of the two tests given the hazard state and the stated operating conditions. Shared attenuation, common interpretation errors or correlated geometry would violate that assumption. The second test should then be modelled jointly or its update conservatively bounded. The example explains why the evidence record must retain sensing conditions and why a reporting system should not replace a conditional probability with an unconditional absence claim.

Both studies concern the value of contextual uncertainty. In deformation assessment, the limiting uncertainty can reside in registration rather than the measured surface. In detection, it can reside in the probability of seeing the target rather than the output label. A useful subterranean intelligence system should expose these limiting factors so that the next measurement addresses the actual decision uncertainty.

14.4 Mission accumulation and fleet scaling

A mission-level risk allowance of 0.01 spread equally across 100 intervals assigns 0.0001 to each interval under the sum bound. In contrast, giving each interval an independent 0.01 failure probability produces a cumulative probability of at least one failure of 1 − 0.99¹⁰⁰, approximately 63.40%. The latter calculation uses independence; the sum-bound allocation does not. The distinction prevents a local threshold from being misreported as a mission-wide guarantee.

Risk estimation also requires enough independent exposure. With zero failures in n independent Bernoulli trials, the one-sided 95% upper confidence bound is one minus 0.05 raised to the power 1/n. To place that upper bound below 1% requires 299 trials; below 0.1% requires 2,995. Thousands of correlated frames from one successful run do not supply thousands of independent missions. The relevant statistical unit must match the claim.

For a declared fleet model, let completion time in seconds be T(n) = 1200/n + 12n(n − 1)/2 + 180. The first term represents ideally divisible work, the second a pairwise coordination cost and the third fixed overhead. This is an illustrative scaling law rather than a measured fleet model.

Table 8 Illustrative fleet completion time

The integer optimum over one to twelve robots is five. Altering the work, coordination or overhead coefficients changes the optimum. Real systems may have sparse rather than all-to-all coordination, indivisible tasks or geometry-dependent interference. The example identifies parameters to measure rather than predicting the correct fleet size for a site.

Finally, we examine the danger of overgeneralising a benchmark improvement. From the six absolute-position-error entries reported by Cai, Ou and Qin (2024, Table 1), the proposed method has an unweighted mean of 8.0167 m compared with 8.1567 m for FAST-LIO2, a reduction of approximately 1.72%, with lower error in three of six sequences. The evaluation used campus sequences and a desktop Intel i5 with RTX 3060 GPU. This arithmetic comparison does not establish statistical significance, onboard timing or consistent superiority. It motivates testing the proposed integration across operating conditions rather than treating an aggregate score as an integrity result.

The common conclusion across these experiments is conditionality. Performance depends on dependence, fault models, registration, prevalence, exposure and coordination cost. Those quantities should be measured or bounded in the intended application. A study that reports only one favourable number cannot establish how a system will behave when the assumptions controlling that number change.

15 Prospective experimental validation

15.1 Hypotheses and comparative design

We propose four primary hypotheses. H1 is that integrity-governed motion reduces the exposure rate of unalerted position-limit exceedances while preserving useful task completion. H2 is that ancestry-aware cooperative fusion improves interval calibration under shared observations and network partitions. H3 is that recovery-aware planning reduces unrecovered missions at comparable task value and resource budgets. H4 is that provenance-preserving semantic interpretation improves the correctness and traceability of consequential reports without unacceptable latency or operator workload.

Each hypothesis has an explicit falsifier. H1 fails if the apparent benefit disappears under a speed-matched baseline or if most useful tasks become unavailable. H2 fails if the method remains overconfident or achieves consistency only by discarding so much information that the task becomes ineffective. H3 fails if the reserve model does not predict executable return routes. H4 fails if users act on unsupported conclusions despite the additional evidence structure, or if the integration delays time-critical behaviour.

Table 9 Comparative conditions

The test environments should include repetitive corridors, irregular caves, changing excavation geometry and confined spaces where applicable to the platform. Degradation factors include obscurants, lighting, sensor dropout, calibration perturbation, clock offset, delayed processing, map mismatch and communication partition. Fault magnitudes and combinations should be specified in advance and bounded by the capabilities of the test setup. Testing only isolated faults would miss shared causes.

The early SubT-MRS dataset offers relevant multi-modal and degraded sensing conditions (Zhao et al., 2023). We use its July 2023 version as the date-bounded reference. Replay is valuable for comparing estimation under the same measurements, but it cannot establish the closed-loop consequences of a different trajectory or stopping action. Those require simulation with validated dynamics and supervised physical trials.

A staged programme begins with deterministic replay and analytical checks, progresses through hardware-in-the-loop fault injection, and then moves to controlled field trials. Advancement requires evidence that the previous stage's limiting assumptions remain credible. A successful demonstration at one site is a starting point for transfer testing, not a basis for declaring unrestricted underground autonomy.

15.2 Measurements, statistical units and acceptance

Independent reference measurements are essential. Where feasible, use surveyed controls, suitable tracking systems and independently characterised reference sensors. Their uncertainty must be smaller than the effect under investigation or incorporated into the comparison. Ground truth is an experimental measurement with its own coverage, synchronisation and calibration limits. Evaluating a system against a reference derived from the same observations can conceal shared error.

Primary localisation outcomes should include error distributions, directional error, nominal interval coverage, protection-limit exceedances and time to alert. Report exposure in a unit appropriate to the claim: distance, time, manoeuvres or complete missions. Task outcomes include useful surveyed area, evidence quality, completion, energy, intervention and recovery. The operating domain and severity of degradation must accompany every aggregate metric.

We propose blocking trials by environment and difficulty, randomising condition order where practical and retaining a held-out site for transfer assessment. Parameters are fitted on development data, calibration is established on a separate set, and final comparisons are made on untouched evaluation data. A route segment should not appear in both training and evaluation merely through a different sensor stream or time slice. Shared geography can otherwise make nominally separate trials dependent.

Confidence intervals should respect the unit of independence. For repeated traversals within sites, use a hierarchical analysis or resampling at the site or mission level rather than treating every frame as independent. Rare-event claims require adequate exposure and clearly stated upper bounds. If the planned sample is insufficient to establish a proposed failure rate, report the bound the experiment can support rather than presenting zero observed failures as proof of zero risk.

Thresholds and primary comparisons should be registered before the final trial set. Exploratory analyses remain useful but should be distinguished from confirmatory outcomes. Report unsuccessful runs, missing data, exclusions, intervention rules and implementation changes. If a configuration is modified after a failure, its subsequent performance belongs to a different version; pooling the results without version information hides the learning process.

Table 10 Evidence required for progression

The proposed criteria are a research design, not completed acceptance results. Numerical limits should be set with the platform owner and responsible engineering functions before trials, according to consequences and feasible measurement resolution. This preserves both scientific falsifiability and operational relevance: the system is tested against a declared requirement rather than judged retrospectively against whichever metric improved.

16 Architecture and development sequence

The development sequence should retire uncertainty at the interfaces most capable of creating consequential failure. We would begin with one platform, one sensor configuration and one representative underground environment. Establish independent trajectory measurements, braking behaviour, timing and baseline recovery before adding cooperative or semantic complexity. A convincing end-to-end demonstration should expose the evidence supporting an action and the reason for restriction when that evidence becomes insufficient.

Table 11 Requirements and verification obligations

The first integration milestone combines estimation, an expiring motion envelope and measured stopping. The second adds explicit fault hypotheses and observation-seeking behaviour. The third introduces recovery-aware planning and map-change handling. Cooperative fusion follows once individual platform behaviour is sufficiently characterised. Semantic and twin interfaces are then evaluated against decision tasks with clear ground truth and authority boundaries.

Each interface contract should specify units, frames, clock domain, maximum age, uncertainty meaning, failure response and version compatibility. A probability field without a defined event is not an adequate contract. A covariance without the represented state and coordinate convention is equally incomplete. Message validation should fail visibly and conservatively rather than convert an unsupported input to a default value that appears legitimate.

The assurance argument should connect a claim to evidence and assumptions. For example, the claim that expired permissions cannot authorise motion requires controller-level enforcement and tests under scheduling and communication faults. A unit test of message parsing alone does not establish that property. Likewise, a recovery claim requires demonstrated routes and resource bounds; a planner returning a path is insufficient.

Release decisions should retain unresolved limitations alongside supported capabilities. A narrowly defined operating domain with measured performance is more useful than an expansive claim whose exclusions are unknown. The development programme advances by expanding the domain through evidence, with every material hardware, model or configuration change triggering a proportionate review of affected claims.

17 Discussion and research limits

The central result is architectural: uncertainty should influence what a subterranean system is allowed to do, and the influence should remain traceable through sensing, estimation, planning and reporting. The analytical studies make that proposition concrete. Dependence can defeat apparent corroboration; a rare fault can dominate the error tail; registration can dominate surface-change detection; repeated local risk can overwhelm a mission objective. These are different mechanisms, but each exposes a gap between a convenient internal metric and the decision it is asked to justify.

The proposed architecture has costs. Explicit hypotheses consume computation and can remain unresolved. Conservative fusion may reduce apparent precision. An integrity supervisor can restrict availability, and provenance can increase storage and communication demand. These costs should be measured against the consequences they address. A design that records exhaustive lineage but misses its control deadlines is poorly integrated; a design that meets deadlines by erasing uncertainty may be equally unsuitable.

There is also a tension between model complexity and testability. A richer world model can represent more failure mechanisms while making calibration and verification harder. We propose selecting models according to the decisions they support and the evidence available to validate them. A simple conservative envelope may be preferable to a complex learned risk score when the latter has no credible transfer evidence. This is an empirical comparison, not a general argument against learning or sophisticated optimisation.

The scientific limits are explicit. The study does not contain a new integrated field campaign. Its numerical experiments establish consequences of declared assumptions rather than prevalence estimates for operational failures. The review is not exhaustive, and the architecture's novelty has not been established through a formal prior-art assessment. The date-bounded literature supports the component concepts and motivates the synthesis, while the prospective programme defines how the integrated claims can acquire stronger evidence.

Transfer across sectors requires re-establishing the consequence model. A mapping error that is tolerable for reconnaissance may be unacceptable for a close-clearance manoeuvre or deformation assessment. A communication outage that delays reporting may be harmless in one task and prevent recovery in another. The shared architecture can standardise how these differences are represented; it cannot standardise away the differences themselves.

A further research priority is dependence beyond Gaussian examples. Shared model bias, censoring, adaptive sampling and environmental selection can undermine nominal calibration. Protection bounds should be assessed under shifts that the system is likely to encounter, with explicit mechanisms for detecting unsupported conditions. Where distributional guarantees are unavailable, the operating envelope should reflect that limitation through narrower authority and additional observation rather than through confident extrapolation.

The long-term scientific challenge is to make evidence quality operationally measurable. The goal is not simply a robot that maps more territory, but a system whose conclusions and actions remain defensible when its environment, sensors and communications become less informative.

18 Conclusions

We have developed an integrity-governed research architecture for subterranean intelligence. Its organising principle is that an estimate should confer only the action authority justified by its evidence, fault coverage and validity horizon. Local positioning, global mapping, recovery planning, cooperative fusion and semantic interpretation therefore share an explicit account of uncertainty while retaining distinct responsibilities.

The architecture yields several concrete design consequences. Continuous local control must be insulated from discontinuous global map corrections. A motion permission must expire when its supporting evidence is no longer valid. Recovery feasibility must include energy, route currency and platform configuration. Cooperative systems must retain observation ancestry and uncertain alignment. Subsurface findings must preserve detectability and alternative explanations. Semantic systems must connect observations to operational consequences without converting interpretation into unrestricted control authority.

Our analytical results show why those requirements matter. Correlated reports can substantially under-cover nominal confidence intervals. A small probability of a biased localisation mode can dominate an otherwise benign error distribution. Dense sampling cannot eliminate registration uncertainty. A negative detector output provides little reassurance when sensitivity is weak. Mission-level exposure and fleet coordination also produce nonlinear consequences that are invisible in isolated per-step or per-robot metrics.

The results are accompanied by a validation design that separates replay, simulation, hardware timing, controlled field trials and transfer assessment. It requires independent reference measurements, speed-matched baselines, deliberate ablations, clustered statistical analysis and retention of unsuccessful runs. Claims about very low failure probabilities must be supported by adequate independent exposure and suitable confidence bounds. Zero observed failures in a small or dependent sample is not an acceptance argument.

For Subterra, the immediate research priority is a bounded demonstrator linking calibrated estimation to a measured motion envelope and an executable recovery policy. Cooperative and semantic functions should then be added through interfaces that preserve evidence and authority. Related LupoToro initiatives can supply investigation, scenario modelling and deployment-governance research, while the spatial and control claims remain tied to the platform and operating domain actually evaluated.

The proposed contribution is thus a route to demonstrable capability: define the decision, identify the evidence it requires, quantify the uncertainty that remains, constrain action accordingly and test the resulting behaviour against independent observations. A subterranean system becomes trustworthy through the strength of that chain and its response when the chain is incomplete. Better maps and stronger models are valuable insofar as they improve the quality, availability and accountability of the decisions built upon them.

Research priorities The next studies should establish conditional protection-bound calibration, jointly model common-cause faults, measure the cost of conservative fusion, validate recovery under environmental change and test whether semantic provenance improves real operator decisions. Each priority has an observable outcome and a credible failure condition, allowing the programme to develop through evidence rather than through increasingly broad capability claims.

Appendix Mathematical and reproducibility notes

Mission bound. Let Sk denote survival through interval k and let qk be the probability of failure in interval k conditional on survival through the preceding interval and the relevant history. The probability of first failure in interval k is the probability of survival through the preceding interval multiplied by qk, integrated over surviving histories. If qk is bounded by εk for every relevant history, summing first-failure events gives a bound no larger than the sum of εk. This proves the inequality in Equation 4 without interval independence. Valid conditional bounds remain the essential assumption.

Correlated mean. The variance of a mean equals the sum of all n² covariance terms divided by n². There are n diagonal terms of sigma squared and n(n−1) off-diagonal terms of rho times sigma squared. Rearrangement yields Equation 11. Dividing the naively reported interval half-width by the true standard deviation and applying the standard normal distribution gives Equation 12. The equicorrelation matrix is valid for n > 1 when rho lies between −1/(n−1) and 1; the numerical experiment uses 0.8.

Stopping envelope. Move P and m to the right-hand side of Equation 7 and solve the quadratic in non-negative v. The positive root is Equation 8 when residual clearance is non-negative. If residual clearance is negative, no stationary-position uncertainty envelope fits the available distance under the model. Braking deceleration and latency are treated as bounds, not means. Uncertainty in those bounds requires an additional conservative treatment.

Detection update. Posterior odds equal prior odds multiplied by the likelihood ratio. The first detector uses likelihood ratio 0.9/0.05. A subsequent negative test uses 0.10/0.95 or 0.70/0.95 in the two declared conditions. Multiplying these ratios assumes conditional independence given the hazard and operating conditions. The result must not be reused when the tests share unresolved error causes.

Reproduction. The companion package contains the manuscript, calculation script, generated numerical tables, figure code, equation sources, document builder and a source audit. Running calculate.py reproduces the nine analytical groups using NumPy and SciPy and creates the two figures with Matplotlib. The Monte Carlo component uses seed 19042024 and 200,000 draws per report count. The equation and document scripts regenerate the portable mathematical displays and editable Word text. Third-party source articles are identified by stable links rather than redistributed.

Version control. Scientific references end at the stated evidence horizon. Explicitly versioned preprints are retained where subsequent versions exist. The ter Huurne article is eligible through its 16 March 2024 online release. Programme links in Section 12 identify organisational research context and do not establish historical implementation results. Reference entries use author-date form, with et al. for longer author lists.

References

Agha, A. et al. (2021) 'NeBula: Quest for Robotic Autonomy in Challenging Environments; TEAM CoSTAR at the DARPA Subterranean Challenge', arXiv:2103.11470v4, 18 October. Available at: https://arxiv.org/abs/2103.11470v4.

Agha-mohammadi, A., Chakravorty, S. and Amato, N.M. (2014) 'FIRM: Sampling-based feedback motion-planning under motion uncertainty and imperfect measurements', The International Journal of Robotics Research, 33(2), pp. 268-304. https://doi.org/10.1177/0278364913501564.

Ames, A.D., Xu, X., Grizzle, J.W. and Tabuada, P. (2017) 'Control barrier function based quadratic programs for safety critical systems', IEEE Transactions on Automatic Control, 62(8), pp. 3861-3876. https://doi.org/10.1109/TAC.2016.2638961.

Brambilla, M., Ferrante, E., Birattari, M. and Dorigo, M. (2013) 'Swarm robotics: a review from the swarm engineering perspective', Swarm Intelligence, 7(1), pp. 1-41. https://doi.org/10.1007/s11721-012-0075-2.

Cadena, C. et al. (2016) 'Past, present, and future of simultaneous localization and mapping: Toward the robust-perception age', IEEE Transactions on Robotics, 32(6), pp. 1309-1332. https://doi.org/10.1109/TRO.2016.2624754.

Cai, Y., Ou, Y. and Qin, T. (2024) 'Improving SLAM techniques with integrated multi-sensor fusion for 3D reconstruction', Sensors, 24(7), article 2033, published 22 March. https://doi.org/10.3390/s24072033.

Chen, S., Zhao, L., Huang, S. and Hao, Q. (2022) 'Multi-robot active SLAM based on submap-joining for feature-based representation environments', Proceedings of the Australasian Conference on Robotics and Automation. Available at: https://ssl.linklings.net/conferences/acra/acra2022_proceedings/views/includes/files/pap131s2.pdf.

Christensen, A.L., O'Grady, R. and Dorigo, M. (2009) 'From fireflies to fault-tolerant swarms of robots', IEEE Transactions on Evolutionary Computation, 13(4), pp. 754-766. https://doi.org/10.1109/TEVC.2009.2017516.

Dang, T., Tranzatto, M., Khattak, S., Mascarich, F., Alexis, K. and Hutter, M. (2020) 'Graph-based subterranean exploration path planning using aerial and legged robots', Journal of Field Robotics, 37(8), pp. 1363-1388. https://doi.org/10.1002/rob.21993.

Ebadi, K. et al. (2020) 'LAMP: Large-scale autonomous mapping and positioning for exploration of perceptually-degraded subterranean environments', IEEE International Conference on Robotics and Automation, pp. 80-86. https://doi.org/10.1109/ICRA40945.2020.9197082.

Ebadi, K., Palieri, M., Wood, T., Padgett, C. and Agha-mohammadi, A. (2021) 'DARE-SLAM: Degeneracy-aware and resilient loop closing in perceptually-degraded environments', Journal of Intelligent and Robotic Systems, 102, article 2. https://doi.org/10.1007/s10846-021-01362-w.

Fan, D.D., Otsu, K., Kubo, Y., Dixit, A., Burdick, J. and Agha-mohammadi, A. (2021) 'STEP: Stochastic traversability evaluation and planning for risk-aware off-road navigation', arXiv:2103.02828v2, 25 June. Available at: https://arxiv.org/abs/2103.02828v2.

Fankhauser, P., Bloesch, M. and Hutter, M. (2018) 'Probabilistic terrain mapping for mobile robots with uncertain localization', IEEE Robotics and Automation Letters, 3(4), pp. 3019-3026. https://doi.org/10.1109/LRA.2018.2849506.

Forster, C., Carlone, L., Dellaert, F. and Scaramuzza, D. (2017) 'On-manifold preintegration for real-time visual-inertial odometry', IEEE Transactions on Robotics, 33(1), pp. 1-21. https://doi.org/10.1109/TRO.2016.2597321.

Gerkey, B.P. and Matarić, M.J. (2004) 'A formal analysis and taxonomy of task allocation in multi-robot systems', The International Journal of Robotics Research, 23(9), pp. 939-954. https://doi.org/10.1177/0278364904045564.

Gough, E., Conn, A.T. and Rossiter, J. (2021) 'Planning for a tight squeeze: Navigation of morphing soft robots in congested environments', IEEE Robotics and Automation Letters, 6(3), pp. 4752-4757. https://doi.org/10.1109/LRA.2021.3067594.

Guo, C., Pleiss, G., Sun, Y. and Weinberger, K.Q. (2017) 'On calibration of modern neural networks', Proceedings of Machine Learning Research, 70, pp. 1321-1330. Available at: https://proceedings.mlr.press/v70/guo17a.html.

Hawkes, E.W., Blumenschein, L.H., Greer, J.D. and Okamura, A.M. (2017) 'A soft robot that navigates its environment through growth', Science Robotics, 2(8), eaan3028. https://doi.org/10.1126/scirobotics.aan3028.

International Organization for Standardization (2019) ISO 17757:2019 Earth-moving machinery and mining Autonomous and semi-autonomous machine system safety. Geneva: ISO. Available at: https://www.iso.org/standard/76126.html.

Jones, E.W. (2020) 'Mobile LiDAR for underground geomechanics: learnings from the teens and directions for the twenties', in Wesseloo, J. (ed.) UMT 2020 Proceedings of the Second International Conference on Underground Mining Technology. Perth: Australian Centre for Geomechanics, pp. 3-26. https://doi.org/10.36487/ACG_repo/2035_0.01.

Julier, S.J. and Uhlmann, J.K. (1997) 'A non-divergent estimation algorithm in the presence of unknown correlations', Proceedings of the American Control Conference, 4, pp. 2369-2373. https://doi.org/10.1109/ACC.1997.609105.

Kaess, M. et al. (2012) 'iSAM2: Incremental smoothing and mapping using the Bayes tree', The International Journal of Robotics Research, 31(2), pp. 216-235. https://doi.org/10.1177/0278364911430419.

Kendall, A. and Gal, Y. (2017) 'What uncertainties do we need in Bayesian deep learning for computer vision?', Advances in Neural Information Processing Systems, 30, pp. 5574-5584. Available at: https://arxiv.org/abs/1703.04977.

Kim, S.K., Bouman, A., Salhotra, G., Fan, D.D., Otsu, K., Burdick, J. and Agha-mohammadi, A. (2021) 'PLGRIM: Hierarchical value learning for large-scale exploration in unknown environments', Proceedings of the International Conference on Automated Planning and Scheduling, 31(1), pp. 652-662. https://doi.org/10.1609/icaps.v31i1.16014.

Lague, D., Brodu, N. and Leroux, J. (2013) 'Accurate 3D comparison of complex topography with terrestrial laser scanner: Application to the Rangitikei canyon (N-Z)', ISPRS Journal of Photogrammetry and Remote Sensing, 82, pp. 10-26. https://doi.org/10.1016/j.isprsjprs.2013.04.009.

Neal, A. (2004) 'Ground-penetrating radar and its use in sedimentology: principles, problems and progress', Earth-Science Reviews, 66(3-4), pp. 261-330. https://doi.org/10.1016/j.earscirev.2004.01.004.

Parasuraman, R., Sheridan, T.B. and Wickens, C.D. (2000) 'A model for types and levels of human interaction with automation', IEEE Transactions on Systems, Man, and Cybernetics Part A Systems and Humans, 30(3), pp. 286-297. https://doi.org/10.1109/3468.844354.

Rockafellar, R.T. and Uryasev, S. (2000) 'Optimization of conditional value-at-risk', Journal of Risk, 2(3), pp. 21-41. https://doi.org/10.21314/JOR.2000.038.

Ryde, J. and Hillier, N. (2009) 'Performance of laser and radar ranging devices in adverse environmental conditions', Journal of Field Robotics, 26(9), pp. 712-727. https://doi.org/10.1002/rob.20310.

Shan, T. et al. (2020) 'LIO-SAM: Tightly-coupled lidar inertial odometry via smoothing and mapping', IEEE/RSJ International Conference on Intelligent Robots and Systems, pp. 5135-5142. https://doi.org/10.1109/IROS45743.2020.9341176.

Stouffer, K. et al. (2023) Guide to Operational Technology Security. NIST Special Publication 800-82, Revision 3. Gaithersburg, MD: National Institute of Standards and Technology, September. https://doi.org/10.6028/NIST.SP.800-82r3.

Stray, B. et al. (2022) 'Quantum sensing for gravity cartography', Nature, 602, pp. 590-594. https://doi.org/10.1038/s41586-021-04315-3.

Sturm, J., Engelhard, N., Endres, F., Burgard, W. and Cremers, D. (2012) 'A benchmark for the evaluation of RGB-D SLAM systems', IEEE/RSJ International Conference on Intelligent Robots and Systems, pp. 573-580. https://doi.org/10.1109/IROS.2012.6385773.

Tagliabue, A., Tordesillas, J., Cai, X., Santamaria-Navarro, A., How, J.P., Carlone, L. and Agha-mohammadi, A. (2021) 'LION: Lidar-inertial observability-aware navigator for vision-denied environments', arXiv:2102.03443v1, 5 February. Available at: https://arxiv.org/abs/2102.03443v1.

ter Huurne, R. (2023) Ground Penetrating Radar dataset with ground-truth data of utility surveying activities. Version 1. 4TU.ResearchData, 5 September. https://doi.org/10.4121/96303227-5886-41c9-8607-70fdd2cfe7c1.

ter Huurne, R.B.A., Olde Scholtenhuis, L.L. and Dorée, A.G. (2024) 'Ground penetrating radar at work: A realistic perspective on utility surveying in the Netherlands through a comprehensive ground-truth dataset', Data in Brief, 54, 110329. First published online 16 March 2024. https://doi.org/10.1016/j.dib.2024.110329.

Tian, Y. et al. (2022) 'Kimera-Multi: Robust, distributed, dense metric-semantic SLAM for multi-robot systems', IEEE Transactions on Robotics, 38(4), pp. 2022-2038. https://doi.org/10.1109/TRO.2021.3137751.

Tranzatto, M. et al. (2022) 'CERBERUS: Autonomous legged and aerial robotic exploration in the tunnel and urban circuits of the DARPA Subterranean Challenge', arXiv:2201.07067v1, 18 January. Available at: https://arxiv.org/abs/2201.07067v1.

Xu, W., Cai, Y., He, D., Lin, J. and Zhang, F. (2022) 'FAST-LIO2: Fast direct lidar-inertial odometry', IEEE Transactions on Robotics, 38(4), pp. 2053-2073. https://doi.org/10.1109/TRO.2022.3141876.

Zhao, S., Zhang, H., Wang, P., Nogueira, L. and Scherer, S. (2021) 'Super Odometry: IMU-centric LiDAR-visual-inertial estimator for challenging environments', arXiv:2104.14938v2, 20 August. Available at: https://arxiv.org/abs/2104.14938v2.

Zhao, S. et al. (2023) 'SubT-MRS: A subterranean, multi-robot, multi-spectral and multi-degraded dataset for robust SLAM', arXiv:2307.07607v1, 14 July. Available at: https://arxiv.org/abs/2307.07607v1.