Interview preparation

Thrust, battery size, impact energy and therefore failure consequences all scale with mass, so mass sets the payload, endurance and the rigour of the safety case.

No; it is risk-based on the operation (location, distance from people, line of sight, autonomy), with mass as one factor, and details differ by jurisdiction.

A small multirotor that can hover and fly slowly indoors, with enough payload mass for camera, IMU, LiDAR and a companion computer, and endurance with those loads.

A wing lifts for a small drag cost ($L$/$D$ around ten or more), so cruise power is about $W$ v/($L$/$D$), whereas a rotor must accelerate air downward to hover, costing much more power for the same weight.

The transition between hover and wing-borne flight: control allocation changes, airspeed estimation must be good, and failures there are severe, plus the weight penalty of carrying both systems.

Speed: a fast fixed-wing accumulates position error per second quickly and cannot stop to recover, while a multirotor can hold still.

Peak currents cause voltage sag and brown-outs, switching noise couples into sensors and radios, and current-carrying wires disturb the magnetometer; all of these degrade the estimator or reset the computer.

Log the IMU, inspect its spectrum and the flight controller’s vibration metrics with props on and motors running, look for clipping and blade-pass lines, and improve balancing and mounting.

Peak current occurs in manoeuvres and failsafes, where heating and voltage drop are largest; undersized wires fail exactly when needed.

NED is North-East-Down and ENU is East-North-Up. PX4 uses NED for world frames and FRD for the body; ROS (REP-103) uses ENU for world frames and FLU for the body. Position converts as $(x,\,y,\,z)_{\text{ENU}}=(y,\,x,\,-z)_{\text{NED}}$.

The frame conventions at the VIO-to-EKF2 boundary: ENU/FLU versus NED/FRD, including the sign of $y$ and $z$ and the yaw convention, and whether a single axis flip produced a left-handed frame.

An accelerometer measures specific force: the non-gravitational force per unit mass. Resting on a surface, the support force equals −$g$ in the inertial sense, so it reads 1 $g$ opposite to gravity, which points up in a z-up frame and is −$g$ on $z$ in a z-down frame.

It has four inputs (total thrust and three torques) but six degrees of freedom. It cannot produce horizontal force directly; it tilts so the thrust vector has a horizontal component, which is why attitude control sits inside position control.

Level attitude and total thrust equal to weight, $T=m\,g$, with zero angular rate. Tilted, the vertical component must still equal weight, so $T=m\,g/(\cos \phi \,\cos \theta )$.

The position loop commands tilt; if attitude responds slowly, the position loop sees a delayed plant and loses phase margin. A common rule of thumb is a several-times bandwidth separation.

Each propeller exerts a reaction torque on the airframe about the vertical axis. Equal numbers of clockwise and counter-clockwise propellers cancel these at equal speeds, and speeding up one pair gives a controlled yaw torque.

Yaw. It is the weakest and slowest axis and its loss is the least dangerous, whereas losing roll or pitch authority leads to a crash.

It inverts the linear map from four motor thrusts to total thrust and three torques. With four motors the map is square and invertible; with more motors it is solved with a pseudo-inverse or an optimisation.

For a given thrust, ideal power falls with the square root of the rotor disc area, $P=T^{3/2}/\sqrt{2\rho A}$; a larger disc accelerates more air by less, wasting less kinetic energy.

KV is the unloaded speed per volt. It does not give thrust, current or efficiency under load, which depend on the propeller and battery and must come from test data.

Enough to hold altitude and recover attitude in gusts and at end-of-mission voltage; roughly 2 is a common rule of thumb for general-purpose multirotors, but the requirement should be derived from the mission and verified.

IMU: rate and specific force, fails by bias drift and vibration; barometer: pressure/height, fails with weather and propwash; magnetometer: field direction, fails near iron and currents; GNSS: position and velocity, fails by blockage, multipath, jamming and spoofing.

It depends on the local sea-level pressure, which changes with weather by several hectopascals per day, each about 8 m of apparent altitude.

The field has a vertical component; when the vehicle tilts it projects into the horizontal sensor axes and produces a heading error unless roll and pitch are used to level the measurement.

Different requirements: real-time determinism and a small auditable code path for control, versus general-purpose compute and a full OS for perception; separation lets the vehicle survive a companion crash.

State, setpoints, commands and odometry: small, low-rate, control-critical data; not raw sensor streams.

The FC detects the lost heartbeat or setpoint stream and executes the configured failsafe such as hold, return or land.

Measure the pipeline’s CPU, GPU and memory use, set the power and mass budgets, check I/O and software support, then verify on the target in the real enclosure at worst-case ambient, with margin; do not select on peak throughput.

It silently lowers frame rate and raises latency in flight, degrading estimation exactly when the vehicle is committed.

tegrastats for per-interval CPU, GPU, memory, temperature and power; nvpmodel to set the power mode; jetson_clocks to fix clocks for benchmarking.

With 20 log₁₀ of both distance and frequency: 6 dB per doubling of either, so it is an upper bound on range before fading and obstruction.

It is differential, multi-drop and robust to noise over long cables, with built-in error detection.

A defined rate and latency budget, a heartbeat or timeout, and a documented failure behaviour.

An interface table behind it: producer, consumer, rate, frame, units, timestamp semantics and owner for each arrow, checkable by a program.

Rate, coordinate frame and timestamp meaning (acquisition versus arrival).

Backward state flow to the planner, health and covariance to the supervisor, and logging and time distribution.

There are four unknowns: $x$, $y$, $z$ and the receiver clock bias. Each pseudorange gives one equation, so four are needed; more make the problem over-determined and allow least-squares and integrity checks.

How satellite geometry amplifies range errors into position errors: position error ≈ DOP × range error. It is a property of geometry, independent of signal quality.

All satellites are above the horizon, so no line of sight constrains the vertical solution from below; VDOP is therefore larger than HDOP.

More satellites are visible in obstructed sky, giving better geometry and more availability, though the individual measurement errors are unchanged.

Each system has its own time scale, so the receiver clock offset relative to each system differs; these offsets are estimated or taken from broadcast values.

More channels (power and cost), more bookkeeping, and exposure to a faulty satellite from any system unless integrity checks are used.

RTK uses carrier-phase observations and resolves integer ambiguities with a base station, giving centimetre-level accuracy, whereas DGNSS only corrects pseudoranges and reaches decimetre to metre level.

Accuracy can degrade by an order of magnitude when ambiguities are lost or corrections go stale while the receiver still outputs position.

Atmospheric and orbit errors decorrelate with distance, so accuracy degrades roughly proportionally to baseline length and ambiguity resolution becomes harder.

Satellite orbit and clock, ionosphere, troposphere, multipath and receiver noise.

It cancels the $1/f^{2}$ ionospheric delay using two frequencies, at the price of amplifying noise by about three times for L1/L2.

Airframe and ground reflections and nearby electronics affect the antenna, and no correction service removes multipath, so antenna placement and masking are the main defences.

Geometry matters: satellites clustered along one direction give a large DOP even with many in view, and reflected signals can be counted while being wrong.

From a 3-D model of obstructions and the satellite almanac: compute visible satellites and DOP along the path.

Satellite count, DOP and per-satellite C/N0 with their trends, plus cross-checks against odometry, with hysteresis on mode changes.

Jamming removes the signal (availability loss, easy to see). Spoofing replaces it with a plausible lie (integrity loss, hard to see). Spoofing needs cross-checks against independent sensors.

Each fix is within the gate because the filter tracks the ramp. Only a comparison over a longer window against an independent displacement estimate reveals the accumulating disagreement.

Stop fusing GNSS, continue on odometry-aided inertial navigation, reduce mission risk (speed, geofence), and execute a defined failsafe if confidence drops. The exact policy is a system requirement set before flight.

It measures specific force, the non-gravitational force per unit mass. The table’s support force is what it senses; free fall would read zero.

Attitude error, because it rotates the measured specific force and leaks gravity into horizontal acceleration at about $g\cdot \delta \theta$, which becomes position error growing as $t^{2}$.

Double integration turns even small biases into quadratic position error: a few milli-g bias gives tens of metres within a minute. It needs an aiding sensor.

Quadratic: $\delta p$ = ½ $b\,t^{2}$, because the bias is integrated twice.

It causes tilt that grows linearly, which leaks gravity into horizontal acceleration and is integrated twice more, giving $\delta p$ ≈ ⅙ $g\,b_{g}\,t^{3}$, a cubic term.

Estimate and remove biases while aiding is available, use a better IMU, add other aiding sensors (vision, LiDAR, airspeed), and reduce the outage duration by detecting and responding sooner.

Image motion in pixels per second; velocity needs the height above the surface and removal of rotation using gyro rates.

It observes motion relative to the scene, giving velocity without accelerometer bias, so position error grows linearly with distance instead of quadratically with time.

Low light, blur, uniform or repetitive surfaces, dynamic scenes and wrong scale (height) information.

Images are unchanged if the scene and translation are scaled together, so the epipolar constraint determines translation only up to scale. Scale needs extra information: stereo baseline, IMU accelerations, known altitude or object size.

$E=[t]$ₓ$R$ relates normalised image points in two views by $x'^{\top}$Ex = 0. It encodes relative rotation and translation direction between two calibrated cameras.

Matches contain outliers that destroy least-squares fits. RANSAC finds the model supported by the largest consistent set by sampling minimal subsets, tolerating a large fraction of wrong matches.

The accelerometer measures metric acceleration; comparing it with the visual second difference during accelerating motion gives the scale factor.

Global position and yaw (four degrees of freedom): shifting or rotating the world about gravity changes no measurement, so these drift.

MSCKF is a filter that marginalises features and updates with constraints between past camera poses; sliding-window systems optimise keyframe states and features jointly with IMU preintegration factors.

Quadratically: $\sigma _{Z}=Z^{2}\,\sigma _{d}/(f\,B)$, so doubling the distance quadruples the depth error.

The known baseline between the cameras fixes the scale of triangulated points, so motion estimated from them is in metres.

Disparity assumes both images capture the same instant and a fixed relative geometry; motion between exposures or flexing of the mount corrupts depth.

The surface normals span only two directions, so motion along the corridor axis changes no residual: the scan registration does not constrain it.

From the eigenvalues of the information matrix (or the registration Hessian): a small eigenvalue marks an unconstrained direction.

Treat it as unobserved: inflate its covariance or exclude the update, and rely on another sensor for it.

Match each source point to its nearest target point, compute the rigid transform that best aligns the matches, apply it, and iterate until convergence.

ICP is local: wrong correspondences from a poor start lead to a wrong minimum; the IMU gives an accurate initial motion estimate.

Registering to an accumulated map reduces compounding drift because each scan is tied to a consistent reference rather than only the previous noisy one.

Direct radial velocity (Doppler) and operation in dust, smoke, fog and darkness.

For stationary targets the radial velocity is minus the line-of-sight direction dotted with the vehicle velocity; a robust least-squares fit over many detections gives the velocity.

Low angular resolution, sparse and noisy detections, multipath ghosts and specular effects.

Redundant identical sensors fail together in the same conditions (common-mode failure). Diverse sensors have different failure modes, so one usually survives.

Validity and uncertainty: covariance or inflation, plus health indicators such as feature count, inlier ratio, registration residual and innovation statistics, so a manager can grade confidence.

Loose fusion treats a subsystem’s pose as a measurement; tight fusion uses raw features or residuals in the filter, preserving correlations and working with fewer features, at higher complexity.

No: independent variables are uncorrelated, but uncorrelated variables can be dependent; Gaussian jointly distributed variables are the exception.

It combines the prior belief with the measurement likelihood and normalises to give the posterior: evidence multiplies.

Decisions depend on how wrong the estimate may be, not only its value.

Correlations between errors and the orientation and shape of the uncertainty ellipse, which matter for how a measurement of one quantity improves another.

To first order as $J\,\Sigma \,J^{\top}$ with the Jacobian at the mean; for large uncertainty use sigma points or Monte Carlo.

Measuring how many standard deviations a point is from the mean in the metric of the covariance: gating and consistency tests.

Predict: propagate the belief through the motion model; update: multiply by the measurement likelihood and normalise.

The Markov assumption on the state and conditional independence of measurements given the state.

When the true posterior is multimodal, as in global localisation or data association ambiguity; use particles or a grid.

It weights the correction by relative certainty: $K=P$⁻$H^{\top}$(HP⁻$H^{\top}+R$)$^{-1}$, high when the prediction is uncertain or the measurement precise, low when the measurement is noisy.

The filter becomes overconfident in its model: covariance shrinks, the gain falls, it lags real changes and eventually ignores measurements.

It guarantees symmetry and positive semi-definiteness numerically and is valid for any gain, while the short form ($I$−KH)$P$ is only exact for the optimal gain and can lose positive definiteness.

It linearises the nonlinear process and measurement models at the current estimate using Jacobians. The state goes through the nonlinear functions; the covariance goes through their linearisations.

When uncertainty is large compared with the nonlinearity (poor initialisation, strong curvature), producing overconfident covariance and divergence; also from wrong Jacobians or unwrapped angles.

Check Jacobians against finite differences, test on simulated data with known noise, and check NIS/NEES against chi-square expectations.

The error is a small three-vector that needs no constraint and is well approximated by a linear model, while the nominal rotation is propagated nonlinearly and kept on the manifold.

After a measurement the estimated error is added to the nominal state (injection) and the error state is set to zero with a covariance correction (reset).

Roll and pitch only; yaw about the vertical direction is unobservable from gravity.

Noise density sets sample-to-sample white noise (error shrinks by averaging); bias random walk sets how fast the slowly varying offset wanders (error grows with time). They show up on opposite ends of the Allan plot.

At short times white noise dominates and averaging helps; at long times the random walk dominates; the minimum is where the bias flicker floor is the limiting error.

They set the covariance of IMU preintegration and of bias evolution, which weights IMU against vision in the optimisation. Wrong values mis-weight the sensors.

The relative-motion increments do not depend on the world pose and velocity at the start, so the optimiser can change those states without re-integrating hundreds of IMU samples; bias changes are handled with first-order Jacobians.

The initial velocity and gravity over the interval, and the initial rotation to express the body-frame increments in the world frame.

Bias (corrected to first order via Jacobians) and white noise (propagated into a covariance), plus the bias random walk as a separate factor between keyframes.

Loose: fuse a pose produced by a vision module; tight: feed raw feature observations and IMU into one estimator, retaining correlations and using even single features.

When features are scarce or intermittent, because a pose cannot be computed but individual measurements still constrain the state.

The images and IMU samples refer to different instants if the offset is wrong, which biases the residuals especially in fast motion.

Points in one scan are measured at different times while the sensor moves; each point is transformed to a common reference time using the IMU-propagated pose at its timestamp.

The IMU provides high-rate motion for deskewing and prediction but drifts; LiDAR registration corrects the drift and biases each scan.

The rotation and translation between the sensors and the time offset between their clocks.

If their errors are correlated (shared IMU, shared process noise) and treated as independent, the same information is counted twice and the covariance is too small.

A fused covariance that is consistent for any unknown cross-correlation, at the cost of conservatism.

When you need to handle delayed or asynchronous measurements, relinearisation and loop closures, and can afford the computation.

Global position (three) and yaw about gravity (one): shifting or rotating the world about the vertical changes no measurement; roll, pitch, scale and biases are observable with sufficient motion.

Linearising at the current estimate can give the filter spurious information in those directions, shrinking its covariance when the truth is drift.

Add a measurement that depends on it: magnetometer, GNSS course or position over a path, a map or loop closure.

Zero mean, covariance $S=H\,P$⁻ $H^{\top}+R$ as predicted by the filter, and whiteness in time (no autocorrelation), because nothing predictable should remain in the residual.

Unmodelled dynamics on that time scale, or a time delay between the measurement and its prediction.

It needs no ground truth and reveals bias, noise and model errors online.

Chi-square with $m$ degrees of freedom when the filter is consistent, because the innovation is zero-mean Gaussian with covariance $S$, so $y^{\top}S^{-1}y$ is a sum of $m$ squared standard normals.

A gate catches single outliers, while a window averages many samples and detects small persistent shifts in consistency, such as slow bias drift, that never exceed the single-sample gate.

Noise parameters are too large (underconfident filter): the filter is wasting information and reacting slowly.

NEES compares the actual state error with the reported covariance, testing the estimate itself; NIS only tests the measurement residuals and needs no truth. A filter can pass NIS and still be inconsistent in unobservable states.

One run is a single sample; averaging $N$ runs reduces the test variance so the chi-square band is tight enough to detect inconsistency.

The filter is overconfident: real errors exceed its reported uncertainty, so anything using that covariance (gates, planners, monitors) will be too trusting.

Detection decides that a fault exists, isolation decides which element is faulty, recovery reconfigures the system (exclude, switch, degrade or stop) to remain safe.

Small persistent shifts: it accumulates evidence over time so a bias well below the single-sample threshold is eventually caught.

With two, a disagreement cannot say which is wrong; the third provides the deciding comparison, assuming only one fault at a time.

The front-end extracts constraints from sensor data (tracking, matching, loop candidates); the back-end estimates the trajectory and map from those constraints by filtering or optimisation.

Landmarks are measured relative to the robot pose, so any error in the pose appears in all landmarks seen from it; revisiting a landmark therefore corrects the pose and the other landmarks through the correlations.

Odometry accumulates drift; SLAM adds recognition of revisited places and global optimisation to remove it.

The sum of squared (robustified) reprojection errors over all observations, by adjusting camera poses and 3-D points jointly.

BA cost grows rapidly with the number of keyframes, so only recent keyframes and the points they see are optimised online, with the rest fixed or marginalised.

Global rotation and translation (six) and scale (one): fixed by anchoring a pose and a distance or by priors.

Visual-inertial operation with a maximum-a-posteriori initialisation, fisheye camera models, and the Atlas multi-map system that merges maps after tracking loss.

Hamming distance is extremely fast and the descriptors are compact, enabling real-time matching on CPUs, at the cost of lower discriminative power than floating-point descriptors.

It needs texture and sufficient compute, and produces sparse maps unsuitable for obstacle avoidance without another module.

It bounds the optimisation cost to recent keyframes; older states are marginalised into a prior that keeps their information.

Eliminating states from the problem by the Schur complement, summarising their effect on the remaining states as a prior, exact in the linear case.

A four-degree-of-freedom pose graph (three translations and yaw), because roll, pitch and scale are observable and already well constrained.

Project the feature residual into the left null space of the feature Jacobian so the update constrains only the camera poses and the feature never enters the state.

Linearising at the first estimate keeps the filter’s unobservable subspace (global position and yaw) intact, avoiding spurious information and inconsistency.

Camera–IMU extrinsics, time offset and camera intrinsics, given enough excitation and a reasonable initial guess.

LOAM extracts edge and planar features and registers them; FAST-LIO registers downsampled raw points directly to a map, avoiding feature extraction.

It bounds the point count and gives uniform density so the registration cost is predictable and accuracy is unharmed.

It encodes the scan in a way that is comparable across viewpoints and headings, proposing candidates that are then verified geometrically.

By the smoothness (curvature) of points along a scan line computed from neighbouring points: high curvature is an edge, low is planar.

Scan-to-scan odometry is fast and approximate; scan-to-map mapping is slower but more accurate, and benefits from the odometry initial guess.

An open-source “advanced” implementation of LOAM using Ceres and Eigen without an IMU, popular as a baseline.

LOAM extracts edge and planar features and registers those; FAST-LIO2 registers the raw (downsampled) points directly against the map, which avoids feature extraction and works across LiDAR types.

The residual is nonlinear in pose; a single linearised update can be inaccurate. Iterating relinearises at improved estimates while keeping the IMU prior, converging to the MAP solution.

In geometrically degenerate scenes such as long corridors or open fields, where the scan does not constrain motion along some direction; other sensors or global references are needed.

Their failure modes are complementary: LiDAR is geometric and light-independent but can be degenerate, cameras are texture-based and fill degenerate directions but need light.

Each sensor adds a positive semi-definite information matrix; a direction unconstrained by LiDAR can be constrained by the camera, so the sum has no small eigenvalue.

Camera–LiDAR–IMU extrinsics and time offsets, and for photometric methods, camera exposure.

It uses raw LiDAR points and image intensities directly (point-to-plane and photometric residuals) without extracting geometric or visual features.

Applying the LiDAR and then the visual update to the same iterated filter is cheaper than one joint update and equivalent for independent linear measurements.

The LiDAR supplies accurate depth of the map points so photometric patches need no visual depth estimation.

Recognition from appearance or global descriptors can match different but similar places; checking that the geometry aligns with many inliers rejects most false loops, which would otherwise distort the map.

By encoding the scan in polar bins and comparing descriptors under all cyclic column shifts, taking the best; the shift is the heading difference.

Precision: a false positive can ruin the map while a missed loop only leaves drift.

Nodes are poses, edges are relative-pose measurements; loop closures add constraints independent of the drifted path, and least-squares optimisation distributes the correction along the loop.

It is a strong constraint pulling two unrelated places together, distorting every pose between them; hence geometric verification and robust kernels.

Each edge connects only two nodes, so the Jacobian and normal matrix have a structure mirroring the graph, enabling sparse solvers for very large maps.

Global localisation (unknown start, possibly multimodal), pose tracking (known start, refine), and relocalisation after loss (kidnapping).

They represent multimodal beliefs and nonlinear, non-Gaussian measurement models, unlike a single Gaussian.

The belief stays multimodal because several poses predict the same measurements; the system must report the ambiguity and use motion or another sensor to disambiguate.

When the route length times the drift ratio stays under the position requirement (clearance divided by a safety factor).

Abrupt failure when the environment differs from the map, because localisation depends on matching and has no gradual degradation.

Odometry between periodic absolute corrections from a map, landmarks or GNSS, with correction spacing set by the drift budget.

A localiser that locks onto the wrong place can have an excellent fit; only independent evidence such as odometry, another sensor or consistency over time reveals it.

The map-based pose against an independently propagated odometry pose, using their covariances, with a chi-square threshold.

The manager chooses graded responses (continue, slow down, hold, land) depending on how bad and why.

Outer-loop planning and MPC where the attitude loop is fast compared with the manoeuvre: acceleration is treated as the input, limited by what the thrust and tilt permit.

The angle between heading and course needed so that airspeed plus wind gives the desired ground track.

Aerodynamic forces and control authority depend on velocity relative to the air, not the ground.

With a pendulum or bifilar test: measure the oscillation period and use the pendulum formula with the pivot geometry, subtracting the parallel-axis term.

It adds phase lag inside the attitude loop and limits achievable bandwidth; models without it predict better stability than the vehicle has.

Apply the same small command to the vehicle in flight and to the model and compare the responses (rise time, overshoot, settling).

At ±$90^{\circ}$ pitch the roll and yaw axes align, a degree of freedom is lost, and the Euler-angle rates become singular; the attitude is still well defined but not as three angles.

For display and logs; not in control, estimation or interpolation, where matrices, quaternions or rotation vectors avoid the singularity.

Exp maps a rotation vector to a rotation matrix (Rodrigues); Log maps a rotation matrix back to the rotation vector.

Euler angles have singularities (gimbal lock) and non-uniform interpolation; quaternions represent any attitude with four numbers and one constraint, compose cheaply and integrate without singularities.

Numerical integration violates the unit-norm constraint; without renormalisation the quaternion stops representing a pure rotation and the derived matrix is not orthogonal.

$q$ and −$q$ represent the same rotation, so comparisons and averaging must account for the sign.

A control law whose error is defined on SO(3) ($e$_R from the skew part of $R_{d^{\top}R}-R^{\top}R$_d) with PD feedback and gyroscopic compensation, giving almost-global stability without Euler-angle singularities.

Available torque over inertia (maximum angular acceleration), motor and ESC lag, sensor noise and delay.

The angle loop treats the rate loop as its actuator, so the inner loop must be fast and well damped before the outer is closed.

The dynamics are a chain of integrators from torque to position, so each stage is controlled by a loop whose setpoint comes from the outer loop. Inner loops must be several times faster than the outer ones or phase lag makes the outer loop oscillate.

The integral term keeps accumulating while the actuator is saturated and then overshoots when saturation ends. Prevent it by clamping the integrator or using back-calculation from the saturation difference.

A setpoint step would create an impulse in the derivative of the error (derivative kick); the measurement is smooth, so it avoids the kick while still providing damping.

It minimises the sum of squared state errors weighted by $Q$ plus squared control effort weighted by $R$. Larger $Q$ relative to $R$ gives a faster, more energetic response.

It assumes a linear model and no constraints. Aggressive flight, saturation, delays and model error reduce performance and margins; MPC handles constraints explicitly.

LQR designs all state-feedback gains jointly and optimally from a model, giving coordinated corrections; cascaded PID tunes loops independently, which is simpler and robust but not optimal.

Solve a finite-horizon optimal control problem, apply only the first control, then re-solve from the new measured state at the next step, so feedback corrects model error and disturbances.

The prediction horizon is how far ahead outcomes are evaluated, which sets how early the controller anticipates; the control horizon is how many free input moves are optimised, trading flexibility for computation.

It solves a QP at every step instead of one matrix multiply; manage with short horizons, move blocking, warm starts, fast solvers, and fallbacks for overruns.

Because a quadrotor is differentially flat: acceleration gives thrust and tilt, jerk gives body rates, and snap gives angular accelerations and so the changes in motor thrust, so minimising snap minimises the control effort needed.

Choose segment times, evaluate speed, acceleration and thrust along the result, and stretch times (acceleration scales as $1/s^{2}$) until limits hold, adding corridor constraints for obstacles.

Waypoint positions, boundary derivatives at the ends, and continuity of derivatives up to jerk across joints; intermediate derivatives are free for the optimiser.

The signed perpendicular distance from the planned leg. Guidance laws such as carrot or line-of-sight steer to reduce it with a time constant set by the look-ahead distance divided by speed.

Larger than the achievable position accuracy (so the vehicle can arrive) and smaller than the mission tolerance. Trade corner speed against precision: tight acceptance forces slow, near-stopped corners.

The cross-track time constant is L/v. A fixed $L$ makes the loop faster as speed rises, until the vehicle’s inner-loop lag makes it oscillate.

It never overestimates the true remaining cost. With an admissible heuristic A* is guaranteed to return an optimal path on the graph; an inadmissible one can return suboptimal paths faster.

If a solution exists the probability that the planner finds one approaches 1 as the number of samples grows. It gives no bound on time and no guarantee on path quality.

It is geometric: it has corners and no timing. The vehicle has bounded acceleration and jerk, so the path must be smoothed and time-parameterised into a dynamically feasible trajectory.

The state and inputs can be written as functions of flat outputs (position and yaw) and their derivatives, so planning smooth position and yaw curves automatically yields dynamically consistent attitude, rate and thrust commands.

The front end solves the nonconvex topological problem (which way around obstacles) with search; the back end solves a smooth, often convex, optimisation inside the chosen corridor for comfort, speed and clearance.

Unmodelled drag and wind, controller tracking error, actuator limits and lag, and latency between planning and execution.

From stopping distance: speed times total latency plus $v^{2}$/(2a_b), which must be below the reliable detection range minus a margin. The sensor range, latency and braking capability set the speed, not the algorithm.

Local minima, oscillation in narrow passages, and no formal guarantee. They are cheap and reactive but need a higher layer to avoid trapping.

For the assumed dynamics, obstacle estimate and actuation limits, the state stays in the safe set. Model error, sensing error and saturation can break the guarantee.

Feedback acts only after an error has appeared, so a pure PD controller lags a moving reference by an amount proportional to its acceleration. Feedforward supplies the acceleration needed at the moment it is needed.

The desired thrust vector $m(a+g\,e_{3})$ gives the body $z$ axis and the thrust magnitude; a yaw reference fixes the remaining rotation about that axis through cross products.

Actuator and tilt limits, inner-loop bandwidth and estimation quality: the achieved acceleration must follow the commanded one.

Each loop must be several times slower than the one beneath it so that the lower loop acts as an almost ideal actuator. Otherwise its phase lag eats the outer loop’s phase margin and causes oscillation.

Preserve roll and pitch authority first, then collective thrust, and give up yaw first, because losing attitude loses the vehicle.

The quantity and frame, the rate and latency, and the limits the lower layer can deliver, plus how saturation is reported upward.

Integral action removes constant offsets slowly and risks windup; a disturbance observer estimates the disturbance from model mismatch and cancels it quickly, but its noise gain grows with bandwidth and it relies on the model.

By modelling drag as a function of velocity relative to the air and augmenting the EKF with wind states, so that the measured acceleration and the vehicle’s motion make wind observable (airspeed measurements make it more direct).

The lean angle needed to balance drag against the tilt and thrust margin available. When the margin is exhausted the vehicle drifts and cannot recover from gusts.

Each cell has 26 neighbours instead of 8, with step costs of 1, $\sqrt{2}$ and $\sqrt{3}$, the heuristic uses all three axes (the 3-D octile distance), and memory and search effort grow with the cube of the resolution, so the map resolution becomes a main design choice.

It is the exact cost of the best path on an empty grid with the same moves, and obstacles can only add cost, so it never overestimates the true cost. It is also consistent, so A* returns an optimal path without reopening cells.

An obstacle surface can lie anywhere inside an occupied cell and a path through cell centres can deviate by up to half a cell diagonal, so the clearance must also cover the cell resolution and the vehicle’s tracking and localisation error. The radius alone would leave no margin.

PX4 runs the real-time loop: sensing, state estimation, control, mode and failsafe logic. Perception, mapping, global planning and mission-level autonomy normally run on a companion computer and talk to PX4 over MAVLink or DDS.

Control loops need predictable timing at hundreds of hertz. A dedicated microcontroller with an RTOS isolates the stabilisation from the variable timing and crashes of a general-purpose companion OS.

Behaviour, parameters and message definitions change between releases; the exact baseline is needed to reproduce a flight, interpret a log and trace a fault.

From requirements: vehicle type, licence constraints, companion interface, hardware and team experience, then confirm with a short SITL prototype of the actual mission. No blanket ranking.

ArduPilot is GPLv3 (copyleft) and PX4 is BSD 3-clause (permissive); distributing modified firmware in a closed product has different obligations under each, so it should be settled early with legal advice.

EKF-based estimation, cascaded control, MAVLink, flight modes and failsafes, logging and external setpoints: names and parameters differ but the architecture and the debugging approach are the same.

Navigator or offboard setpoint → position/velocity controller (thrust vector and attitude setpoint) → attitude controller (rate setpoint) → rate controller (torque and thrust) → control allocator (motor commands), with EKF2 supplying the state.

It manages arming, flight modes and failsafes from vehicle status, link health and sensor validity, deciding which setpoint source is active and what to do when something fails.

You can replace or tap any stage (for example inject external odometry or send rate setpoints), and every interface is a topic that can be logged and replayed.

Typed publish/subscribe with latest-value semantics by default: subscribers track their own position, and unread messages are overwritten unless the topic has a queue depth above one.

With latest-value semantics a burst between reads overwrites earlier messages and events are silently lost; a queue preserves up to $q$.

Use uorb top for the rates, listener to view messages, and the .msg definition for fields; the logger records them for post-flight analysis.

The squared normalised difference between a measurement and its prediction, divided by the gate; below 1 means the measurement is accepted, persistently high means the source and the filter disagree.

The filter compares the measurement with the state at the wrong time; the discrepancy scales with speed, so it looks like noise that grows with motion.

Check resets and status flags at the time, plot innovation ratios of each source, check vibration and magnetometer health, and compare each aiding source with the estimate.

A valid horizontal position or velocity estimate from an aiding source such as GNSS, vision or optical flow; altitude mode only needs height and attitude.

It depends on the plan, but typically a controlled fallback (hold in altitude or land, with pilot takeover) rather than a return that relies on the lost position estimate; it must be configured and tested.

To avoid chattering between modes when a source flickers: fall back after a loss timeout, and return only after the source has been stable for a regain timeout.

It seeds the checksum with a value derived from the message definition, so differing message layouts between two ends fail the check instead of being silently misparsed.

It announces each system and component, its type, autopilot, mode and state, and its absence at about 1 Hz lets peers detect link loss and trigger failsafes.

Larger message ids (24 bits), payload truncation, extension fields, incompatibility and compatibility flags, and optional message signing.

ROS uses ENU world and FLU body frames; PX4 uses NED world and FRD body. Positions and velocities swap $x$ and $y$ and flip $z$; body vectors flip $y$ and $z$; yaw converts as $\pi /2-\psi$.

A QoS mismatch: for example a reliable subscriber to a best-effort publisher is not matched. Match the publisher’s reliability and durability.

When you need a MAVLink-level interface that works across autopilots or existing MAVROS-based software; the native bridge is preferred for direct access to PX4 uORB topics with lower overhead.

The uxrce_dds_client running in PX4, a Micro XRCE-DDS Agent on the companion computer, and the px4_msgs ROS 2 message package whose definitions must match the firmware.

A QoS mismatch (for example a reliable subscriber to a best-effort publisher) or a mismatch between firmware and px4_msgs message versions.

The link has finite bandwidth shared by all topics; control-critical traffic must not be starved by high-rate telemetry.

The frame (NED/FRD), the sample timestamp (acquisition time), honest variances, and NaN for unknown fields.

The measurement is fused against the wrong past state, so the error is roughly speed times the timing error, which grows with velocity.

In SITL first, with GNSS fusion disabled via the EKF2 parameters, an external odometry source, and the logs checked to confirm that only vision is used.

The stream proves the external controller is alive. PX4 refuses to enter offboard without it and exits offboard if it stops, giving a built-in failsafe against a dead companion.

Which control quantities the external system supplies (position, velocity, acceleration, attitude, body rate…), so PX4 knows which controllers to run and which setpoint fields to use.

Publish setpoints from a dedicated fixed-rate timer or node, feed it from the planner through a buffer, and test deliberate stalls against the configured failsafe.

Undocumented parameter changes make results irreproducible and can hide the cause of a failure; a diff against a baseline documents exactly what differs.

Bias, scale factor and axis misalignment, using static poses with known gravity; the residual of the norm against $g$ after calibration checks quality.

The calibration quality and warnings, the sensor values (norm of acceleration at rest, heading against a reference), and the estimator status in the log.

Mark the event time, then separate estimation (what the vehicle believed), intent (setpoints, mode) and execution (tracking and actuators), look for the first signal to deviate, and test one hypothesis at a time.

The controller tracks the estimated state; if the estimate is wrong, tracking can look perfect while the true motion is wrong. Compare against an independent reference.

The logging rate: half of it is the Nyquist limit, and higher frequencies alias. Enable high-rate profiles for vibration analysis.

The flight stack code and your companion software are real; the physics, sensors, motors, environment, link and possibly the clock are models.

It ties simulated time to the control steps so results do not depend on computer speed, making runs repeatable and suitable for regression tests.

Hardware drivers and timing, real sensor behaviour, vibration, power and thermal effects, radio links and the accuracy of the physics model; these need hardware-in-the-loop, bench and flight tests.

The real target: CPU load and timing, drivers, serial links, boot and storage, wiring and the integration with a real companion, using the real firmware binary.

Real sensor performance, vibration, magnetic interference, motors and aerodynamics, power and thermal behaviour: these need bench and flight tests.

When the risk is in the target or the integration (tight timing, many interfaces, new hardware) and a bench test with real sensors cannot cover it; for pure logic, SITL is cheaper.

The companion has large, variable current draw and noise; on a shared rail its transients can brown out the autopilot. A separate regulated supply isolates faults and noise.

A heartbeat or the offboard setpoint stream with a loss timeout of $m$ missed periods, balancing detection delay against false alarms, with a defined autopilot action on timeout.

It can hide a persistent fault, flood the logs and keep the vehicle in a half-working state; use restart limits and escalate to a safe state.

By latency and determinism needs, compute needs and failure containment: hard-real-time and safety-critical loops stay on the microcontroller, heavy perception and planning go to the companion behind a narrow, monitored interface.

The rate-monotonic bound guarantees schedulability below it, but task sets above it can still be schedulable; response-time analysis settles it.

Designing so that a fault in one part does not propagate: the flight controller supervises the companion’s outputs and heartbeat and degrades to a safe state if they fail.

Thermal throttling: as the temperature approaches the limit the system lowers clocks to stay within it, which increases processing time and latency.

Treat it as an upper bound; measure your own pipeline in the chosen power mode at flight temperature, take a high percentile and add margin.

It selects a predefined power mode: the number of active cores and the maximum clocks within a power budget, trading performance for power and heat.

An unbounded queue converts a transient overload into an ever-growing delay; a bound with a drop policy caps the age of the data at the cost of missing some, which is the right trade for estimation and control.

Queueing delay grows like $\rho /(1-\rho )$, so it rises steeply as utilisation approaches 1, and any slowdown from contention pushes it past the limit.

Percentiles (p50, p95, p99) and the maximum under the worst combined load, because deadline misses come from the tail.

In hard real-time a missed deadline is a failure (an attitude control loop); in soft real-time it degrades quality (a late video frame).

A high-priority task waits for a resource held by a low-priority task that a medium-priority task preempts; priority inheritance temporarily raises the holder’s priority so that blocking is bounded.

Use utilisation bounds as a quick sufficient test, and response-time analysis with measured worst-case execution times and blocking for a definitive answer on fixed-priority systems.

The executor is non-preemptive: if another callback on the same thread is running, the timer waits until it finishes, so jitter is bounded by the longest callback sharing the thread.

Callbacks in a mutually exclusive group never run concurrently; callbacks in a reentrant group can, so their code must be thread-safe.

Best-effort reliability and keep-last with a small depth, so the consumer sees recent frames and an overload drops old data rather than building latency.

Means hide the tail, and failures happen in the tail: a rare 200 ms delay during a manoeuvre matters more than a 40 ms average.

A delay $L$ adds phase lag $\omega L$ at frequency $\omega$, reducing phase margin; vision-in-the-loop controllers can oscillate unless the delay is small, compensated, or kept out of the fast loop.

From the sensor exposure timestamp, through every stage, to the output; arrival time omits driver and transport delay.

Record monotonic timestamps at the start (and end) of each cycle, compute the period error against the nominal period or the ideal grid, and report percentiles and the maximum alongside deadline misses and the longest run of consecutive misses.

From the control requirement: the tolerated error in derived quantities (for example velocity error = $v$ $e$ / $T$) fixes the allowed timing error, with margin.

Without it a borderline condition toggles states repeatedly, flooding logs and causing mode flapping; thresholds for entering and leaving a state should differ.

Fusion assumes simultaneous measurements; at rotation rate $\omega$ and speed $v$, a $\delta t$ error is $\omega \,\delta t$ of orientation and $v\,\delta t$ of position, which filters mistake for bias or extrinsic error. It matters most in fast motion.

Compare the gyro rate with the angular rate derived from images and find the shift that maximises their correlation, or estimate it online within VIO. It needs varied rotation to excite both sensors.

A hardware trigger gives deterministic, sub-millisecond image times on the IMU clock; software timestamps include transfer and scheduling jitter of milliseconds.

The pulse time is measured on the IMU clock with microsecond-level latency, while arrival includes exposure, readout, transfer, driver and scheduling delays that are large and variable.

At the exposure midpoint for a global shutter (and a reference row for a rolling shutter), so the stamp is the time the scene was effectively sampled.

By sequence number or frame counter (unwrapped), never by order, and check the image interval against the pulse interval.

The delay between event and arrival is non-negative with a long tail, so the average is late by the mean delay; the information about the true time is in the earliest arrivals.

Fit a straight line (period and offset) to arrival times from below, or use device timestamps related to the host clock by a regression, so that the variable delay is largely removed.

The fixed delay (readout, transfer, driver), which acts as a constant offset and must be calibrated or estimated online.

From four timestamps (Sync send and receive, Delay_Req send and receive): offset is half the difference of the two one-way measured times, assuming a symmetric path; the mean delay is half their sum.

The algorithm attributes half of any difference between forward and backward delay to the clock offset, so an asymmetry of a microsecond causes half a microsecond of error that no amount of averaging removes.

Timestamps taken in the NIC or PHY avoid interrupt and scheduling jitter in software, which otherwise dominates the error budget.

Failures occur when loads peak together; averages hide bursts, and the combined peak depends on correlation, so the combined percentile must be measured.

By the consequence of overrun and the uncertainty of the measurements: hard-real-time functions need larger margins than soft ones, and unmeasured or unrepresentative data needs more.

Memory use grows with maps, queues and leaks; the peak at the end of the longest mission is what must fit, which short tests miss.

It adds to total draw, so the fractional loss in endurance is roughly $P_{\text{avionics}}/P_{\text{total}}$ for fixed propulsion power; extra mass for batteries or cooling adds to propulsion power as well.

The hot case: highest ambient with solar loading, minimal airflow (hover), full payload and the highest-power mode, run long enough to reach steady state.

The battery’s terminal voltage falls under load as the state of charge drops, and a transient current peak can pull a regulator’s input below its minimum.

Compute each stream’s rate including overhead, sum per link, compare with usable (not nominal) capacity and require headroom; reduce load by compression, decimation and region of interest where needed.

Queues grow, delays vary and samples drop silently, producing jitter and stale data rather than errors.

High-rate raw sensor data needed only by onboard consumers; send summaries and operator-relevant data over the limited downlink.

How well the model explains the detected corners; it estimates pixel noise only if the model is right, so it must be judged on held-out images and checked for systematic residual patterns.

To make the focal length, principal point and distortion separately observable; flat-on views leave them correlated and poorly determined.

After a shock, lens or focus change, large temperature changes, or when held-out reprojection error or a VIO consistency check exceeds the stated threshold.

Rotation about all three axes for the rotation and time offset, and rotational acceleration (plus translation) for the lever arm; slow or planar motion leaves parameters unobservable.

Correlate the magnitudes of the angular rates of the two sensors, which are independent of the rotation between the frames, and find the shift that maximises the correlation.

A calibration can fit its own motion well while being wrong for others (over-fitting or low observability); independent data or an external reference reveals this.

Units, frames and conventions, rates and maximum age, timestamp meaning and clock, validity flags, timeouts, behaviour on loss or invalid data, and the version and change policy.

The consumer’s response to a missing, stale or invalid message is a safety function that both teams must agree on and test; leaving it implicit hides hazards.

Keep it as structured data, generate definitions and tests from it, run a consistency checker in CI, and verify each interface in SIL, HIL and flight tests.

Links from needs and hazards down to requirements, design, tests and results, and back up again, so you can ask both “what verifies this?” and “why does this exist?”.

A gap is a requirement without design or verification; an orphan is a test, design element or requirement with no upward trace. Both indicate a missing link and must be resolved or justified.

The links give the impact set: the design elements and tests that must be re-reviewed and rerun when a requirement or component changes.

A record of the hashes and versions of every configuration item on the vehicle at take-off (firmware, software, parameters, calibration, hardware), stored with the flight log so the configuration can be identified and restored.

The hash tells you that something differs; the value-level diff tells you what changed, which is what the reviewer needs.

Pinned dependencies and base images, recorded compiler and tool versions, no network fetches of unpinned content, and deterministic build steps, so that the same source gives the same binary.

It has a measurable quantity, a numerical threshold, a statistic, the conditions under which it applies and a stated verification method with a pass criterion.

Errors are random; “below 2 m” means different designs and test efforts if it must hold always, in 95 % of samples or on average, and the claim cannot be verified without it.

With zero failures allowed, $n\ge \ln (0.05)/\ln (0.99)\approx 299$ independent trials, which is why such claims are often shown by validated simulation or analysis rather than flights alone.

Independent random terms add in quadrature (RSS); biases or fully correlated terms add linearly; then apply the appropriate percentile factor and compare with the requirement, keeping margin.

The radial error of two independent Gaussian components is Rayleigh distributed, whose 95th percentile is about $2.45\sigma$.

Reduce the largest contributor, change the design, negotiate the requirement or limit the operating condition, in a reviewed decision with the traceability updated.

Verification checks that the system meets its requirements (built right); validation checks that it meets the real need in the real environment (the right system built).

By the nature of the requirement: measurable performance with statistics needs test or validated analysis; static facts use inspection; qualitative capabilities can use demonstration; and strength of evidence must match the risk.

As much as its validation against real data supports for the conditions in question; state the validation basis and limits, and show real flight evidence for safety-relevant claims.

Cost to find a defect rises steeply with each level; lower levels find logic and integration defects cheaply, while only flight reveals some environment-dependent ones. The staging puts each defect class where it is cheapest to find.

To require evidence that the lower level has nothing more to find (tests passed on this baseline, defects closed) before taking the risk and cost of the next level.

Real sensor performance, vibration, magnetic and optical environment effects and flight dynamics: those need ground and flight tests.

Objective and hypothesis, baseline and configuration, entry criteria, step list, measurable abort criteria, data to record, roles (pilot, observer), and the expected result.

To bound the consequence of an unexpected outcome and to keep failures attributable to the single change made; each step is reviewed before the next.

From the excursion: speed times detection and reaction time plus braking distance, plus margin, which must fit within the clear area in every direction of travel.

Fail means the system did not meet the criterion in a correctly executed test; invalid means the test did not execute as specified (missing reference, wrong baseline), so it says nothing about the system and must be rerun.

Samples in a time series are strongly correlated, so the effective sample size is much smaller; use run-level metrics or block methods for the sample size.

To reproduce failures exactly, turn them into regression tests and attribute differences to code changes rather than chance.

FMEA is bottom-up: start from component failure modes and trace effects. Fault-tree analysis is top-down: start from a hazard and find the failure combinations that cause it. They complement each other.

It multiplies ordinal scores, so very different risks can give the same value and a severe but rare failure can rank low. Use a severity-first rule or action-priority tables.

Give every high-risk mode a monitor or mitigation requirement and a named test case or simulation that demonstrates it, and track them in a traceability matrix.

It is a smallest combination of basic events that causes the top event; order-1 sets are single points of failure and low-order sets show where redundancy is thin.

A basic event that feeds several branches (shared power, clock, software) appears alone or in small cut sets once the tree is solved, showing that the apparent redundancy is defeated by one event.

It approximates the top-event probability by the sum of cut-set probabilities, an upper bound that is accurate when basic-event probabilities are small.

It is complete (every analysed fault has a row and an unlisted fault has a safe default), deterministic with explicit rules for simultaneous faults, monotonic in severity, and every row is tested by fault injection.

It can be reviewed, version-controlled and checked mechanically for completeness and consistency, and test cases can be generated from it.

The sum of detection delay, decision latency and execution time must be shorter than the time the hazard takes to develop, for example the time for drift to reach the clearance.

The navigation basis, the allowed and forbidden operations, the entry condition, the exit condition with hysteresis, and the verification test.

From stopping distance: the vehicle must be able to stop, including reaction latency, within the detection range minus the clearance needed for the current position uncertainty.

Without it the mode toggles whenever the signal hovers near a threshold; hysteresis plus a hold time makes down-transitions fast and up-transitions deliberate.

From the position uncertainty growth rate and the clearance requirement: choose $t_{\max}$ such that $k\cdot \sigma (t_{\max})$ equals the clearance, and verify drift in test. Use distance rather than time when drift scales with distance.

Marginal GNSS can toggle repeatedly; requiring a continuous good period before trusting it avoids mode chatter and sudden jumps.

The correction should be applied smoothly (blended) after trust is regained, not as a step, to avoid abrupt setpoint and attitude changes.

Different failures show in different indicators: a repetitive texture keeps the feature count high while the matches are wrong, and a clean low-texture scene can have few features but fine tracking; combine indicators and add consistency with the inertial prediction.

Until position error from velocity error, bias and attitude error (growing roughly quadratically) reaches the drift budget, typically seconds to a few tens of seconds for a small vehicle, so the safe action must start at detection.

It prevents flapping: the system enters degraded mode quickly on a few bad frames and leaves only after a sustained period of good ones.

A disagreement is symmetric: either unit could be wrong. A third unit provides a majority, or a model-based residual provides a tie-breaker.

With model-based residuals: compare integrated gyro with attitude change from a magnetometer, vision or GNSS velocity, check that the accelerometer norm at rest equals gravity, and monitor estimator innovations and sensor variance.

A single cause that affects all redundant units at once (shared power, vibration, temperature, software), which defeats voting and has to be handled by design, isolation and separate mounting.

It depends on a valid position estimate, a clear path and enough energy; if any is missing, landing in place or holding may be safer, so the action must be chosen per failure and escalate when it cannot complete.

From the link’s measured loss statistics: require $p^{m}$ below the spurious-trigger budget and a detection time ($m$ + 1) $T$ below what the hazard allows.

Leave offboard control and enter a mode that is valid without the companion’s data (hold with the autopilot’s own estimate or land), configured and tested, with the pilot able to take over.

The proximate cause is the immediate event leading to the outcome; the root cause is the underlying condition that, if corrected, prevents recurrence, usually in design, process or requirements.

Align them on a common time base with stated offsets and uncertainties, rank them by timing confidence, and use independent sources to confirm each key event.

It changes the system (design, monitor, procedure, test), has an owner and a date, and is verified by a test or review that shows it works.

A product of severity and likelihood can rate a rare catastrophic event the same as a frequent nuisance; ranking by severity first keeps catastrophic risks visible and demands independent barriers and evidence.

With zero events, about 3/p = 3000 flights at 95 % confidence (rule of three); fewer flights support only a weaker claim, so other evidence (analysis, design barriers) must carry the argument.

Eliminate the hazard, reduce likelihood, reduce severity, then warnings, procedures and training; the later items depend more on human performance and are weaker.

To prevent hindsight bias and disputes: a rule chosen after seeing the data can be tuned to pass, whereas a rule agreed in advance can be applied by anyone to the same evidence.

Consumer’s risk is the probability of accepting a system that is actually unacceptable; producer’s risk is the probability of rejecting one that is actually acceptable. A sampling plan trades them off through $n$ and the allowed failures.

As a recorded decision by the accountable authority, with rationale, the conditions under which it holds, and a matching operational limitation.

Take the verified conditions (cells of speed, environment, duration and so on), back off with a margin, add independent bounds such as stopping distance, and state each limit with its rationale, how it is monitored and what to do on exceeding it.

Extremes tested separately do not cover their combinations; only conditions inside a tested cell, or a justified neighbour, are supported by evidence.

By adding test points (with build-up, FMEA review and acceptance criteria) that cover the new conditions on the frozen baseline, then updating the limits table.