A synthetic two-stage launch profile driven through the ICARUS envelope-advisory library, running as an F Prime component. Every advisory number below is real output from the compiled library. The vehicle profile and the comparison monitor are models, labelled as such throughout.
A spacecraft always has an opinion about where it is and how fast it is going. That opinion comes from a navigation filter blending accelerometers, gyroscopes, GPS and ground tracking. Most of the time it is very good. Occasionally it is confidently wrong, and the dangerous part is the word confidently — the filter usually reports strong confidence right up until the moment it does not.
ICARUS is a second opinion. It watches the same telemetry and asks a different question: not "where is the vehicle" but "how much should anyone trust that answer right now?" It compares two things. First, how far the vehicle could possibly move in the next four seconds given its thrust and control authority — a volume of space we call the reachable set. Second, how much accumulated uncertainty is in the navigation solution. When the uncertainty grows large relative to the space the vehicle could occupy, the estimate has stopped being useful for decisions, and ICARUS says so.
It also runs a second, simpler check that turns out to matter more: is the navigation system sampling fast enough for what the vehicle is actually doing? If a rocket starts vibrating at 28 times a second and the navigation filter only looks 50 times a second, the filter cannot faithfully see that motion. It does not report an error — it quietly folds the motion it missed into the answer, and its confidence stays high while its accuracy degrades. This is aliasing, and it is invisible from inside.
ICARUS never flies the vehicle. It has no connection to any engine, thruster or control surface, and this is enforced by the structure of the software rather than by policy — the component declares no output ports, so the code that would command something does not exist to be called. It publishes a verdict, and a human or a separate supervisor decides what to do with it.
This page runs a simulated launch through the real library and shows what it caught. It then re-runs the same launch with parts of ICARUS switched off, so you can see precisely which piece of the check earned which warning. All of the underlying data is available to download.
Scrub the launch and watch the reachable set — everywhere the vehicle could be four seconds from now — open and collapse. The shaded band inside it is the navigation error budget. When the band becomes a real fraction of the cone, the estimate has stopped being useful for decisions. The verdict strip shows what three different configurations of the same library conclude from the same instant.
Every control below re-runs the whole flight through the advisory maths in your browser and redraws every figure on this page. Nothing is pre-baked. The most instructive one is the navigation rate: drop it and watch events appear, raise it and watch the ascent warnings disappear entirely while the orbit-insertion warning stays exactly where it is — because that one never depended on sampling.
Comparing the in-browser engine against the compiled C++ trace…
ICARUS classifies by comparing accumulated error budget against the vehicle's reachable set over a four-second horizon. Above half the cone radius it reports Observe; above a fifth, Caution. A separate check asks whether the navigation filter is sampling fast enough for the dynamics it is actually exposed to, and that check can force Observe on its own authority regardless of the budget.
ICARUS is the component as shipped. EARLY-RET keeps the inflation penalty that the sampling check feeds into the budget but removes the hard branch, isolating what that one line of code buys. BLIND disables the sampling check entirely, leaving the error budget to argue on its own. Each strip is a separate classification of the same flight.
Under-sampling does not announce itself. When the filter is exposed to dynamics above its Nyquist limit, the unmodelled content aliases into the state estimate: true position error grows while the filter's own covariance barely moves. The estimate degrades and reports that it has not.
—
The last two columns are not estimates. They are the same scenario re-classified by the same library with parts of the sampling check removed, so the counterfactuals are computed rather than argued. Cone radius, budget and ratio are taken at each window's onset.
| Window | Flight event | Trigger | ICARUS | Cone radius | Budget | Ratio | Early-return removed | Sampling-blind |
|---|
—
Everything plotted above, at full precision, exactly as the library emitted it. The download is generated from the same embedded array that drew the charts, so the file you get is the file the page used — there is no separate, tidied copy.
| Column | Units | Meaning |
|---|---|---|
| t | s | Time from liftoff |
| a_max | m/s² | Control authority in the scenario model |
| f_max | Hz | Dominant dynamic frequency the filter is exposed to |
| f_sample | Hz | Navigation rate, held constant |
| e_link | m | Ground-link contribution to the error budget |
| cone_radius | m | Reachable-set radius at the 4 s horizon (inflated) |
| budget_total | m | Davis error-budget total |
| ratio | — | budget_total / cone_radius |
| limited | 0/1 | Manifold-Nyquist verdict: sampling inadequate |
| level | 0/1/2 | ICARUS advisory: 0 Observe, 1 Caution, 2 Confident |
| cone_blind, budget_blind, ratio_blind, level_blind | — | Same run with the sampling check disabled |
| level_early_return_removed | 0/1/2 | Inflation kept, hard branch removed |
| nav_err_model | m | Modelled true position error (not library output) |
| filter_sigma_model | m | Modelled filter self-reported 1σ (not library output) |
This distinction is the point of the page. Anything sourced from the library is a real return value; anything else is a scenario input chosen to exercise it.
cpcAdvisory()aMax is modelled as axial thrust acceleration, which overstates lateral control authorityThe advisory library is plain C++ with no framework dependency, no heap allocation and no external calls. It is wrapped by a passive F Prime component that receives state on a single input port and publishes telemetry and events.
That component declares no output ports. The autocoder therefore emits only
Log, LogText, Time and Tlm — there is no
method on the generated base through which it could command anything. Non-actuation is not a
review convention or a comment in the source; it is a property a reviewer can confirm from
the generated header. The advisory is visible to operators and to any component that chooses
to subscribe, and it reaches no actuator on any path.
The library links through the framework's external-library mechanism, so it builds and unit-tests through the standard toolchain while remaining separately licensed and separately versioned.