Skip to the lesson
FixTheRobot Explore Robotics / Navigation / M7 Safety, Uncertainty and Recovery / M7-T7

Navigation · Theory · M7

M7-T7 — Localization Loss and the Kidnapped Robot

The one fault that makes every other safety margin meaningless: a robot that is sure of its pose and wrong.

  • Lesson 7 of 7
  • Module 7: Safety, Uncertainty and Recovery
  • Theory
  • About 9 minutes to read

Margins, speed limits and recoveries all assume that Scout knows where it is. If it does not, the walls it is avoiding are in the wrong place. A robot can lose its pose slowly, as scan matching drifts in a bare corridor, or suddenly, when someone picks it up and puts it down elsewhere (the “kidnapped robot”). This lesson covers how to notice, what to do while the pose is in doubt, how to find it again, and how to know that you did.

Learning objectives

After this lesson, you should be able to:

  • List signals that a pose estimate is failing: covariance growth, a map-to-odom jump, a falling match score and inconsistent innovations.
  • Compute a jump test and a normalised-innovation test for a pose update.
  • Describe the response ladder (slow, stop, relocalize, verify, ask) and why the robot must stop first.
  • Explain global localization and augmented Monte Carlo localization, and why the kidnapped robot is hard.

The intuition

You wake up in a hotel and for a moment do not know which way the bathroom is. You do not walk quickly towards where it was in your last hotel. You stop, look for a landmark, the window or the door, and only when what you see matches what you expect do you move. Everything between “something is wrong” and “now I know” is the part a robot needs to write down.

The difficulty is that the localizer does not shout. A filter that has locked onto the wrong place reports a small covariance and a plausible pose, because it is internally consistent. Its failure shows in other ways: the pose jumps by more than the robot could have driven; the scan stops lining up with the map; the corrections the filter has to make each step are bigger than its own noise model says they should be.

The kidnapped robot is the extreme version of this. A filter that has concentrated its belief on one place has no mass left anywhere else, so it cannot recover by itself. Algorithms for that case deliberately keep a little belief everywhere, and the safe system around them decides when to use it. The figure shows the states of that system.

States of a robot that can lose its positionFour states in a loop. Tracking, where the pose is trusted. Suspect, where a check has failed and the robot slows. Lost, where the robot stops. Relocalizing, where the robot searches for its pose. A verified pose returns it to tracking, and a failure to verify sends it to ask for help.TRACKINGSUSPECTLOSTRELOCALIZINGHELP check fails persists stop checks pass again no fix in time pose verified The robot moves normally only in TRACKING, slowly in SUSPECT, and not at all in LOST.
A state machine around the localizer. Only TRACKING allows normal driving; LOST means stopped; RELOCALIZING must end in verification or in a request for help.

The mathematics

Signals

Signals that a pose estimate is failing
SignalTestWhat it catchesWeakness
Covariance growthtrace of position Σ above a limitSlow loss of features, long featureless stretchCan stay small when wrong
Map-to-odom jumpsize of the correction ≫ distance the robot can drive in that timeSudden relocation of the estimateA big legitimate loop closure also jumps
Match scorescan-to-map agreement below a thresholdWrong place, changed environment, bad sensorThreshold depends on the place
Innovation (NIS)νᵀS⁻¹ν above a chi-square gateMeasurements that the filter cannot explainNeeds a correct S
Independent fixdock, QR code, AprilTag or beacon disagrees with the poseAnything, including a confident wrong poseOnly where such a fix exists

The jump test

If the transform from map to odom changes by Δ between two updates a time δt apart, a robot with top speed vmax cannot have moved more than vmax δt. A change much larger than that is not motion:

Jump test
jump ratio=∥Δ∥vmax⁡⋅δt\text{jump ratio}=\frac{\lVert \Delta \rVert }{v_{\max}\cdot \delta t}
flag if the ratio ≫ 1

The innovation test

A filter predicts a measurement and compares it with the real one. The innovation is ν = z − ẑ, with covariance S (from the filter). If the filter is right, the normalised innovation squared is chi-square distributed with as many degrees of freedom as the measurement:

Normalised innovation squared
NIS=ν⊤ S−1 ν∼χ2(m)\mathrm{NIS}=\nu ^{\top}\,S^{-1}\,\nu \sim \chi ^{2}(m)
2 degrees of freedom: 95% gate 5.99, 99% gate 9.21

A run of NIS values above the gate means the filter’s model of itself is wrong, which is exactly what happens when the pose is wrong.

Recovering

  • Local search around the last good pose: a wider scan match or a rotation in place if there is room. Works for drift, not for a kidnap.
  • Global localization: spread hypotheses over the whole map and let measurements select. In AMCL this is the global-localization service, which re-initialises the particles uniformly over free space.
  • Augmented MCL: keep short-term and long-term averages of the measurement likelihood, wfast and wslow, and inject random particles with probability max(0, 1 − wfast / wslow). When the likelihood drops, the filter adds hypotheses by itself.
  • Landmarks: a docking station, a coded marker or a known door gives a pose with a small error and a known frame.
  • A person: the operator places the robot on the map.

Verify before you move

A relocalization attempt ends with a test: the covariance below a limit, the match score above a limit, and these holding for a minimum time or distance. Until then the robot is not allowed to resume its mission.

A worked example

The jump. Scout drives at 0.6 m/s towards a goal. The localizer updates every 0.1 s. At one update the map-to-odom transform changes by 1.48 m (the case of lab M1-L1, incident 3). In 0.1 s Scout can have moved 0.6 · 0.1 = 0.06 m.

Jump ratio
jump ratio=1.480.06=24.7\text{jump ratio}=\frac{1.48}{0.06}=24.7

The correction is 25 times what motion could explain. With a threshold of, say, 5, this flags immediately. The covariance, meanwhile, grew from 0.02 to 0.85 m²: a second signal. A rule that accepted the new pose silently produced the failure of that lab, a robot that stopped well past its goal and reported success.

The innovation. A position measurement has innovation ν = (0.5, 0.3) m and the filter predicts S = diag(0.04, 0.04) m².

NIS
NIS=0.520.04+0.320.04=6.25+2.25=8.5\mathrm{NIS}=\frac{0.5^{2}}{0.04}+\frac{0.3^{2}}{0.04}=6.25+2.25=8.5

The 95% gate for two degrees of freedom is 5.99 and the 99% gate is 9.21. This one fails the first and passes the second. A single such value is not alarming (5% of good ones fail the 95% gate); five in a row are.

Time is distance. At 0.6 m/s a detector that needs three consecutive bad updates at 5 Hz takes 0.6 s, during which Scout travels 0.36 m on a pose that may be wrong. Stopping then needs 0.6 · 0.3 + 0.6²/(2 · 0.8) = 0.405 m (lesson M7-T1). The robot has therefore moved about 0.77 m before it is still. The choices are a faster detector, a lower speed in places where a mistake is costly, or a larger margin.

Augmented MCL. The long-term likelihood average is wslow = 0.8 and, after the robot is moved, the short-term average falls to wfast = 0.5. The probability of drawing a random particle at the next resampling is 1 − 0.5/0.8 = 0.375. If the likelihood keeps falling that probability rises, and the random particles are what let the filter find the true pose.

Engineering implications and limitations

Stop first, then think

While the pose is in doubt, the margins, the speed limits and the recoveries are all drawn around a position that may be wrong. Spinning or backing up on a wrong pose is more dangerous than standing still. Stop (a controlled stop within the deceleration limit), publish a clear status, and only then relocalize.

Several independent checks

No single signal is enough. Use at least one that does not depend on the filter, such as a landmark or a scan-to-map score computed separately. Require that a bad pose is rejected by any one of them, and a good pose accepted only by all.

Plan where you can relocalize

If the robot must restart from a dock or a marked place, say so in the map, and design the recovery to drive there (slowly, when the pose is still plausible) or to ask for a person to carry it there. In a bare corridor a global search can return several equally good answers. Do not accept an ambiguous one.

Do not hide jumps

Some stacks smooth a map-to-odom correction. That is good for a small drift and bad for a large one, because the robot drives in the wrong direction while the estimate catches up. Treat a large correction as an event, not as noise.

Scope

The logic here belongs to navigation. A robot that works around people and in places with hazards also needs protective functions that do not depend on the pose at all (lesson M7-T2 and the standards named there). This track does not replace a safety case.

Common misconceptions

“If the covariance is small, the pose is good.”

The covariance is the filter’s own opinion. A filter locked onto the wrong place is typically confident.

“A pose jump is always a localization failure.”

A genuine loop closure also jumps, sometimes by metres. What matters is whether it is verified, and whether the robot is moving safely meanwhile.

“Relocalizing is just driving around until the covariance shrinks.”

Driving on a wrong pose is the danger. Search while stopped or rotating in place if the clearance allows.

“A particle filter will recover on its own.”

Only if hypotheses exist elsewhere. A collapsed particle set has none, which is why augmented MCL injects random particles.

Engineering takeaways

  1. Signs of a failing pose are covariance growth, a map-to-odom jump, a low match score and inconsistent innovations; none is enough alone.
  2. A jump is suspicious when it is far larger than vmax · δt; an innovation is suspicious when NIS exceeds its chi-square gate for several steps.
  3. Respond in steps: slow, stop, relocalize, verify, and ask a person if the pose cannot be verified.
  4. Global localization and random-particle injection let a filter recover from a kidnap; landmarks and people give independent fixes.
  5. Detection takes time, and time is distance travelled on a possibly wrong pose.

References and further reading

Probabilistic Robotics covers the kidnapped robot and augmented MCL; the other sources are the original Monte Carlo localization papers.

  • S. Thrun, W. Burgard and D. Fox, “Probabilistic Robotics”, MIT Press, 2005 (global localization, the kidnapped robot problem and augmented MCL, chapter 8).
  • D. Fox, W. Burgard, F. Dellaert and S. Thrun, “Monte Carlo Localization: Efficient Position Estimation for Mobile Robots”, AAAI, 1999.
  • S. Thrun, D. Fox, W. Burgard and F. Dellaert, “Robust Monte Carlo Localization for Mobile Robots”, Artificial Intelligence, 128, 2001.
  • Nav2 documentation, “AMCL” (including the global localization service and the recovery_alpha parameters), docs.nav2.org.

Knowledge check

Three conceptual questions. Write an answer, then reveal the explanation. Your answers stay in your browser.

Question 1

A robot with a top speed of 0.8 m/s gets a localization update every 0.1 s with a map-to-odom correction of 0.9 m. What is the jump ratio, and what does it suggest?

Explanation

0.9 / (0.8 · 0.1) = 11.25. The correction is eleven times what the robot could have moved, so it is not motion: it points to a failure or a loop closure that must be verified before the robot drives on.

Question 2

An innovation of (0.4, 0.2) m has S = diag(0.04, 0.01) m². Compute NIS and compare it with the 95% gate of 5.99.

Explanation

0.16/0.04 + 0.04/0.01 = 4 + 4 = 8. It exceeds 5.99, so this update is inconsistent at the 95% level; a run of such values means the filter’s model or pose is wrong.

Question 3

Why should a robot stop before it starts relocalizing, even if it has a rough idea where it is?

Explanation

Every margin and plan is computed relative to the pose estimate. If the pose is wrong, moving can drive the robot into obstacles that are not where it believes. Standing still or rotating in place when clearance allows keeps the risk low while the search runs.

What’s next

Next: beyond a single trip, ordering stops, covering a floor and sharing space with other robots.

Practice this lesson

Detect and Escape a Stuck Robot

Scout rocks back and forth for ten minutes without noticing: detect no-progress and break out.

Next lesson

M8-T1 — Waypoint Missions and Route Ordering

Order a set of stops with nearest-neighbour and 2-opt, and explain why this is hard in general.

Nothing below is required to finish this lesson.