diff --git a/artifacts/features/FEAT-FALCON-v1.115.yaml b/artifacts/features/FEAT-FALCON-v1.115.yaml new file mode 100644 index 0000000..cea6900 --- /dev/null +++ b/artifacts/features/FEAT-FALCON-v1.115.yaml @@ -0,0 +1,35 @@ +artifacts: + - id: FEAT-FALCON-v1.115 + type: feature + title: "v1.115 — rotor-out robustness + verification-fidelity follow-ups" + status: proposed + release: falcon-v1.115.0 + description: > + PROPOSED (release falcon-v1.115.0). The follow-ups surfaced by the v1.114 + rotor-out work — where a parasitic-moment allocation flipped the vehicle + on the real plant despite being "verified" and dispersed over thousands of + Monte-Carlo trials, because the campaign and point-test both ran an + IDEALISED attitude-only sim (constant thrust, true-state feedback, no + estimator, no rotational drag). The lesson, now driving this release: + dispersion is breadth, not fidelity. + + Scope: + - SWREQ-FALCON-FAULT-P03 — single-rotor-out FDI robustness under heavy + GNSS/gyro sensor noise (detection latency blew up in the dispersed + full-loop campaign at the heavier envelope). GitHub #255. + - SWREQ-FALCON-FAULT-P04 — supervisor-driven controlled landing after a + rotor loss (close the altitude scope the v1.114 campaign reports but + does not gate) + a clean gz confirmation run and the recordable + recovery video. GitHub #256. + - Verification-fidelity audit (GitHub #257): sweep the other + safety-behaviour campaigns/point-tests for the idealised-harness blind + spot and promote the safety-critical ones to full-production-loop + guards (the pattern v1.114 established with + run_fullloop_motor_out_campaign). + + Builds on v1.114 (FV-FALCON-FAULT-003): the rank-3 allocation, the + full-loop recovery oracle, and the dispersed full-loop campaign. + tags: [falcon, fault-tolerance, rotor-loss, verification-fidelity, roadmap, v1.115, proposed] + links: + - type: implements + target: SYSREQ-FALCON-005 diff --git a/artifacts/swreq/SWREQ-FALCON-FAULT-P03.yaml b/artifacts/swreq/SWREQ-FALCON-FAULT-P03.yaml new file mode 100644 index 0000000..823d36d --- /dev/null +++ b/artifacts/swreq/SWREQ-FALCON-FAULT-P03.yaml @@ -0,0 +1,34 @@ +artifacts: + - id: SWREQ-FALCON-FAULT-P03 + type: sw-req + title: "FAULT-P03 — single-rotor-out FDI robustness under sensor noise" + status: proposed + release: falcon-v1.115.0 + description: > + On loss of a single rotor the FDI shall isolate the failed rotor within + a bounded latency across the realistic GNSS/gyro sensor-noise envelope — + not only in the low-noise regime. The v1.114 dispersed full-loop campaign + (FV-FALCON-FAULT-003) showed the CUSUM FDI's detection latency blows up + under heavier noise (gps σ up to 0.3 m, gyro-white up to 0.02 rad/s): + isolation reached ~1882 steps in early trials and a few mis-isolated or + never isolated, because the near-level/low-rate detection gate + (tilt_cos > 0.90 && rate2 < 1.0) is pushed shut by noise on the rate. + v1.114 scoped its guard to a modest envelope (gps σ ≤ 0.12, gyro ≤ 0.006) + where detection is reliable (worst 5 steps); this requirement covers the + heavier regime — filter the effectiveness residual, adapt the gate, or add + hysteresis so the RECOVERY (already parasitic-free and non-flipping) is not + gated behind a delayed/missed isolation. Not a v1.114 regression + (pre-existing). GitHub: pulseengine/relay#255. + tags: [falcon, fault-tolerance, rotor-loss, fdi, robustness, sensor-noise, v1.115, proposed] + fields: + req-type: safety + priority: should + verification-criteria: > + Dispersed full-loop rotor-out campaign at the heavier envelope + (gps σ up to 0.3 m, gyro-white up to 0.02 rad/s): the FDI isolates the + CORRECT rotor within a bounded latency for the whole recoverable + envelope, with zero mis-isolation and zero missed isolation. Regression + bound on worst detection latency set just above the measured worst case. + links: + - type: derives-from + target: SYSREQ-FALCON-005 diff --git a/artifacts/swreq/SWREQ-FALCON-FAULT-P04.yaml b/artifacts/swreq/SWREQ-FALCON-FAULT-P04.yaml new file mode 100644 index 0000000..e8e0f24 --- /dev/null +++ b/artifacts/swreq/SWREQ-FALCON-FAULT-P04.yaml @@ -0,0 +1,33 @@ +artifacts: + - id: SWREQ-FALCON-FAULT-P04 + type: sw-req + title: "FAULT-P04 — supervisor-driven controlled landing after single-rotor loss" + status: proposed + release: falcon-v1.115.0 + description: > + On single-rotor loss the FlightSupervisor shall command LAND and bring the + vehicle down in a CONTROLLED descent to touchdown — bounded sink rate, + thrust axis kept upright, settled on the surface — managing the ALTITUDE + the reduced-attitude core (FAULT-P02) deliberately does not. Rationale: a + 3-rotor quad is near neutrally-buoyant on this airframe (two rotors at max + thrust ≈ hover weight), so the bare FlightCore holds/drifts altitude rather + than descending; the v1.114 full-loop campaign therefore GUARDS attitude + (no flip, bounded spin) but only REPORTS altitude ("supervisor's LAND + job"). This requirement closes that scope with a supervisor-driven + full-loop rotor-out landing oracle/campaign, and pairs it with a clean gz + confirmation run + the recordable recovery video (the v1.114 gz run showed + the correct rank-3 allocation but a degenerate pose feed). + GitHub: pulseengine/relay#256. + tags: [falcon, fault-tolerance, rotor-loss, supervisor, landing, gz, v1.115, proposed] + fields: + req-type: safety + priority: should + verification-criteria: > + Supervisor-driven full-loop rotor-out oracle/campaign: an injected rotor + loss ⇒ the supervisor commands LAND, and the vehicle descends (net + altitude lost) at a bounded sink rate to an upright touchdown, thrust + axis within the FAULT-P02 tilt bound throughout. Plus a clean gz run + demonstrating the same on the higher-fidelity plant. + links: + - type: derives-from + target: SYSREQ-FALCON-005