ICARUS: when a small error budget is not enough for confidence Bee Rosa Davis Research note · Version 0.3 · Updated 8 October 2026 ICARUS investigates geometric state representation and navigation advisories. Its saved ascent example makes one mechanism unusually clear: a small estimated error relative to a reachable envelope can coexist with an inadequate sampling rate. TL;DR The question: Can a geometric comparison between accumulated navigation error and where a vehicle could reach flag conditions that a conventional error budget alone misses? What the work does: The work implements a C++ advisory library, wraps it as a passive F Prime component with no output ports, and drives a synthetic two-stage ascent through it, saving 601 samples. What is still open: Nothing has flown: the desktop build has no timing characterisation, the disturbance and control-authority models are unjustified, and false-alert and missed-event rates are unmeasured. THE RESEARCH IN CONTEXT A launch vehicle's navigation filter blends inertial sensors, satellite fixes and ground tracking into one estimate of position and velocity, and reports its own confidence. The failure that matters is not a large reported error but a small one that is wrong. If the vehicle is exposed to motion faster than the filter samples, such as buffet or staging transients, the unmodelled content folds into the estimate: true position error grows while the filter's self-reported confidence barely moves. The degradation is invisible from inside: the only instrument reporting on the estimate is the estimator. Guidance, navigation and control therefore needs a check structurally independent of the thing it is watching. ICARUS, a research collaboration with Mach Industries and Dr. Ryan Rapetti, implements that check as a C++ library with no framework dependency, no heap allocation and no external calls. It links through F Prime's external-library mechanism, so it builds and unit-tests in the standard toolchain, and a passive component wraps it, receiving state on one input port and publishing telemetry and events. That component declares no output ports, so the autocoder emits only logging, time and telemetry methods: non-actuation is confirmable from the generated header rather than asserted in review. The saved demonstration drives a synthetic two-stage ascent at half-second steps to 300 seconds through the compiled library, with the navigation rate held at 50 Hz. Classification compares the accumulated error budget against the radius of a four-second reachable set. Above half the radius the library reports Observe and above a fifth Caution, while a separate sampling-adequacy check can force Observe on its own authority. Three event windows are flagged, two of them by sampling adequacy. The frequencies that trigger them are scenario choices, buffet content peaking at 28.5 Hz and a staging spike at 34.5 Hz, both above the 25 Hz half-sampling boundary, and the comparison monitor is a fixed 25-metre residual threshold standing in for a conventional check. Across a sweep of those choices the stored lead time ranged from 2.5 to 11.5 seconds. AVAILABLE RECORD Computational demonstrator developed in collaboration with Mach Industries and Dr. Ryan Rapetti; saved synthetic scenario and controlled ablations. TECHNICAL FIGURE saved scenario playback 601 stored samples from a synthetic ascent. Classification strips are saved library outputs; frequency and vehicle inputs belong to the scenario. Playback frames: https://www.davisgeometric.com/research/figure-data/player-guidance-control.json One instant, three advisory decisions Saved synthetic ascent Quantity / configuration | Value at T + 66 s | Interpretation Envelope radius | 207.142 m | Four-second model envelope Error budget | 12.5109 m | About 6.04% of the radius Highest represented frequency | 25.445 Hz | Above the 25 Hz Nyquist limit of 50 Hz navigation Full advisory | Observe | Sampling guard remains active Blind-envelope ablation | Confident | Saved levelBlind = 2 Guard ablation | Confident | Saved levelAblate = 2 Read from sample 132 of the 601-point trace (zero-based indexing). A small budget/envelope ratio alone misses the sampling problem. The scenario is synthetic; these are not flight-test measurements. icarus.json — Saved project data; values read directly What happens at T + 66 seconds The companion contains 601 samples over a synthetic 300-second ascent. At 66 seconds, its four-second envelope radius is 207.142 metres and its error budget is 12.5109 metres, about 6.04% of that radius. On that ratio alone the situation looks favorable. The assumed dynamics at that instant have a maximum frequency of 25.445 Hz, while the navigation stream samples at 50 Hz. The implemented sampling rule fails because the assumed frequency exceeds the 25 Hz half-sampling-rate boundary. The full advisory returns Observe immediately. An ablation explains the verdict Removing the hard sampling branch while retaining its budget inflation changes the stored classification to Confident. Disabling the sampling check also returns Confident. These comparisons isolate why the complete implementation refuses the more favorable label. Observe and Confident are names chosen by the algorithm, not calibrated probabilities or flight-readiness certifications. The companion identifies the radii, budgets, and classifications as library outputs; vehicle evolution, frequency inputs, and the residual-monitor behavior are scenario ingredients. The drawing and its physical limits The detailed illustration revolves the scalar radius model to explain the envelope. It does not establish lateral maneuvering authority: the source model uses axial thrust acceleration. The stored 8.5-second gap between the first advisory and one chosen residual-monitor crossing is also a scenario comparison, not a general advance-warning guarantee. THE NEXT RESEARCH STEP The next engineering comparison needs justified disturbance and control-authority models, followed by false-alert, missed-event, and delay measurements under sensor loss and timing errors. The existing ablation already provides a precise mechanism to test. TEACHING CONSTRUCTION (not project measurements) Specify state dynamics, observation dynamics, disturbances, and actuator limits. Place the proposed representation at one named interface. Compare conventional and geometry-informed components using identical trajectories, measurements, and constraints. xₖ₊₁ = f(xₖ,uₖ,wₖ) ; yₖ = h(xₖ) + vₖ x and u: System state and control input. w and v: Declared process and measurement disturbances. Calibration: Agreement between stated uncertainty and observed errors across evaluated cases. An estimator can follow a simulated trajectory closely while reporting uncertainty intervals that are too narrow. If the true state repeatedly lies outside them, the confidence output is poorly calibrated even though average tracking error is small. SOURCE RECORD Advisory demonstration: https://www.davisgeometric.com/icarus/advisory-demo.html Envelope and ablation study: https://www.davisgeometric.com/research/figures/icarus.html ICARUS project material: https://www.davisgeometric.com/icarus/ Source versions: https://www.davisgeometric.com/research/account-source-records.json No new experiments are reported in this research note. Illustrated study: https://www.davisgeometric.com/research/figures/draft-guidance-control.html