Engineering systems / ICARUS
ICARUS: when a small error budget is not enough for confidence
ICARUS investigates geometric state representation and navigation advisories. Its saved ascent example makes one mechanism unusually clear: a small estimated error relative to a reachable envelope can coexist with an inadequate sampling rate.
Research settingMach IndustriesCollaboration with Dr. Ryan Rapetti
TL;DR
In brief
The question
Can a geometric comparison between accumulated navigation error and where a vehicle could reach flag conditions that a conventional error budget alone misses?
What the work does
The work implements a C++ advisory library, wraps it as a passive F Prime component with no output ports, and drives a synthetic two-stage ascent through it, saving 601 samples.
What is still open
Nothing has flown: the desktop build has no timing characterisation, the disturbance and control-authority models are unjustified, and false-alert and missed-event rates are unmeasured.
Available recordComputational demonstrator developed in collaboration with Mach Industries and Dr. Ryan Rapetti; saved synthetic scenario and controlled ablations.
From the research record
Inspect the work
Original figures, recorded values, and explicit model details. Each exhibit identifies its source and what the comparison means.
One instant, three advisory decisions
Scroll horizontally to inspect the full table →
| Quantity / configuration | Value at T + 66 s | Interpretation |
|---|---|---|
| Envelope radius | 207.142 m | Four-second model envelope |
| Error budget | 12.5109 m | About 6.04% of the radius |
| Highest represented frequency | 25.445 Hz | Above the 25 Hz Nyquist limit of 50 Hz navigation |
| Full advisory | Observe | Sampling guard remains active |
| Blind-envelope ablation | Confident | Saved levelBlind = 2 |
| Guard ablation | Confident | Saved levelAblate = 2 |
Read from sample 132 of the 601-point trace (zero-based indexing). A small budget/envelope ratio alone misses the sampling problem. The scenario is synthetic; these are not flight-test measurements.
The research in context
A launch vehicle's navigation filter blends inertial sensors, satellite fixes and ground tracking into one estimate of position and velocity, and reports its own confidence. The failure that matters is not a large reported error but a small one that is wrong. If the vehicle is exposed to motion faster than the filter samples, such as buffet or staging transients, the unmodelled content folds into the estimate: true position error grows while the filter's self-reported confidence barely moves. The degradation is invisible from inside: the only instrument reporting on the estimate is the estimator. Guidance, navigation and control therefore needs a check structurally independent of the thing it is watching.
ICARUS, a research collaboration with Mach Industries and Dr. Ryan Rapetti, implements that check as a C++ library with no framework dependency, no heap allocation and no external calls. It links through F Prime's external-library mechanism, so it builds and unit-tests in the standard toolchain, and a passive component wraps it, receiving state on one input port and publishing telemetry and events. That component declares no output ports, so the autocoder emits only logging, time and telemetry methods: non-actuation is confirmable from the generated header rather than asserted in review. The saved demonstration drives a synthetic two-stage ascent at half-second steps to 300 seconds through the compiled library, with the navigation rate held at 50 Hz.
Classification compares the accumulated error budget against the radius of a four-second reachable set. Above half the radius the library reports Observe and above a fifth Caution, while a separate sampling-adequacy check can force Observe on its own authority. Three event windows are flagged, two of them by sampling adequacy. The frequencies that trigger them are scenario choices, buffet content peaking at 28.5 Hz and a staging spike at 34.5 Hz, both above the 25 Hz half-sampling boundary, and the comparison monitor is a fixed 25-metre residual threshold standing in for a conventional check. Across a sweep of those choices the stored lead time ranged from 2.5 to 11.5 seconds.
What happens at T + 66 seconds
The companion contains 601 samples over a synthetic 300-second ascent. At 66 seconds, its four-second envelope radius is 207.142 metres and its error budget is 12.5109 metres, about 6.04% of that radius. On that ratio alone the situation looks favorable.
The assumed dynamics at that instant have a maximum frequency of 25.445 Hz, while the navigation stream samples at 50 Hz. The implemented sampling rule fails because the assumed frequency exceeds the 25 Hz half-sampling-rate boundary. The full advisory returns Observe immediately.
An ablation explains the verdict
Removing the hard sampling branch while retaining its budget inflation changes the stored classification to Confident. Disabling the sampling check also returns Confident. These comparisons isolate why the complete implementation refuses the more favorable label.
Observe and Confident are names chosen by the algorithm, not calibrated probabilities or flight-readiness certifications. The companion identifies the radii, budgets, and classifications as library outputs; vehicle evolution, frequency inputs, and the residual-monitor behavior are scenario ingredients.
The drawing and its physical limits
The detailed illustration revolves the scalar radius model to explain the envelope. It does not establish lateral maneuvering authority: the source model uses axial thrust acceleration. The stored 8.5-second gap between the first advisory and one chosen residual-monitor crossing is also a scenario comparison, not a general advance-warning guarantee.
The next research step
The next engineering comparison needs justified disturbance and control-authority models, followed by false-alert, missed-event, and delay measurements under sensor loss and timing errors. The existing ablation already provides a precise mechanism to test.
Background mathematics and definitions
Specify state dynamics, observation dynamics, disturbances, and actuator limits. Place the proposed representation at one named interface. Compare conventional and geometry-informed components using identical trajectories, measurements, and constraints.
- x and u
- System state and control input.
- w and v
- Declared process and measurement disturbances.
- Calibration
- Agreement between stated uncertainty and observed errors across evaluated cases.
Illustrative example
An estimator can follow a simulated trajectory closely while reporting uncertainty intervals that are too narrow. If the true state repeatedly lies outside them, the confidence output is poorly calibrated even though average tracking error is small.
This background example is separate from the source records and the main technical figure.
Source record
No new experiments are reported in this research note. Figure captions distinguish saved research records, source-model calculations, and explanatory diagrams.