From 82279bed8380258a1c868e0a66e449d0c00d89d1 Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Fri, 10 Jul 2026 22:46:08 +0200 Subject: [PATCH 1/2] plan(falcon): v1.115 rotor-out robustness + verification-fidelity follow-ups MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Lands the release plan for the follow-ups surfaced by the v1.114 rotor-out work (the parasitic-moment flip the idealised Monte-Carlo campaign could not falsify — dispersion is breadth, not fidelity): - SWREQ-FALCON-FAULT-P03 (proposed) — single-rotor-out FDI robustness under heavy GNSS/gyro noise; detection latency blew up in the v1.114 dispersed full-loop campaign at the heavier envelope. Issue #255. - SWREQ-FALCON-FAULT-P04 (proposed) — supervisor-driven controlled landing after a rotor loss (close the altitude scope the campaign reports-not-gates) + a clean gz confirmation run and the recordable recovery video. Issue #256. - FEAT-FALCON-v1.115 (proposed) — the release grouping; also tracks the verification-fidelity audit of other safety campaigns (issue #257). Both reqs derive-from SYSREQ-FALCON-005 (control allocation). rivet PASS (proposed reqs carry the expected "needs verification" backlog warning until implemented). Co-Authored-By: Claude Opus 4.8 --- artifacts/features/FEAT-FALCON-v1.115.yaml | 34 +++++++++++++++++++++ artifacts/swreq/SWREQ-FALCON-FAULT-P03.yaml | 33 ++++++++++++++++++++ artifacts/swreq/SWREQ-FALCON-FAULT-P04.yaml | 32 +++++++++++++++++++ 3 files changed, 99 insertions(+) create mode 100644 artifacts/features/FEAT-FALCON-v1.115.yaml create mode 100644 artifacts/swreq/SWREQ-FALCON-FAULT-P03.yaml create mode 100644 artifacts/swreq/SWREQ-FALCON-FAULT-P04.yaml diff --git a/artifacts/features/FEAT-FALCON-v1.115.yaml b/artifacts/features/FEAT-FALCON-v1.115.yaml new file mode 100644 index 0000000..3f52fdc --- /dev/null +++ b/artifacts/features/FEAT-FALCON-v1.115.yaml @@ -0,0 +1,34 @@ +artifacts: + - id: FEAT-FALCON-v1.115 + type: feature + title: "v1.115 — rotor-out robustness + verification-fidelity follow-ups" + status: proposed + description: > + PROPOSED (release falcon-v1.115.0). The follow-ups surfaced by the v1.114 + rotor-out work — where a parasitic-moment allocation flipped the vehicle + on the real plant despite being "verified" and dispersed over thousands of + Monte-Carlo trials, because the campaign and point-test both ran an + IDEALISED attitude-only sim (constant thrust, true-state feedback, no + estimator, no rotational drag). The lesson, now driving this release: + dispersion is breadth, not fidelity. + + Scope: + - SWREQ-FALCON-FAULT-P03 — single-rotor-out FDI robustness under heavy + GNSS/gyro sensor noise (detection latency blew up in the dispersed + full-loop campaign at the heavier envelope). GitHub #255. + - SWREQ-FALCON-FAULT-P04 — supervisor-driven controlled landing after a + rotor loss (close the altitude scope the v1.114 campaign reports but + does not gate) + a clean gz confirmation run and the recordable + recovery video. GitHub #256. + - Verification-fidelity audit (GitHub #257): sweep the other + safety-behaviour campaigns/point-tests for the idealised-harness blind + spot and promote the safety-critical ones to full-production-loop + guards (the pattern v1.114 established with + run_fullloop_motor_out_campaign). + + Builds on v1.114 (FV-FALCON-FAULT-003): the rank-3 allocation, the + full-loop recovery oracle, and the dispersed full-loop campaign. + tags: [falcon, fault-tolerance, rotor-loss, verification-fidelity, roadmap, v1.115, proposed] + links: + - type: implements + target: SYSREQ-FALCON-005 diff --git a/artifacts/swreq/SWREQ-FALCON-FAULT-P03.yaml b/artifacts/swreq/SWREQ-FALCON-FAULT-P03.yaml new file mode 100644 index 0000000..91be480 --- /dev/null +++ b/artifacts/swreq/SWREQ-FALCON-FAULT-P03.yaml @@ -0,0 +1,33 @@ +artifacts: + - id: SWREQ-FALCON-FAULT-P03 + type: sw-req + title: "FAULT-P03 — single-rotor-out FDI robustness under sensor noise" + status: proposed + description: > + On loss of a single rotor the FDI shall isolate the failed rotor within + a bounded latency across the realistic GNSS/gyro sensor-noise envelope — + not only in the low-noise regime. The v1.114 dispersed full-loop campaign + (FV-FALCON-FAULT-003) showed the CUSUM FDI's detection latency blows up + under heavier noise (gps σ up to 0.3 m, gyro-white up to 0.02 rad/s): + isolation reached ~1882 steps in early trials and a few mis-isolated or + never isolated, because the near-level/low-rate detection gate + (tilt_cos > 0.90 && rate2 < 1.0) is pushed shut by noise on the rate. + v1.114 scoped its guard to a modest envelope (gps σ ≤ 0.12, gyro ≤ 0.006) + where detection is reliable (worst 5 steps); this requirement covers the + heavier regime — filter the effectiveness residual, adapt the gate, or add + hysteresis so the RECOVERY (already parasitic-free and non-flipping) is not + gated behind a delayed/missed isolation. Not a v1.114 regression + (pre-existing). GitHub: pulseengine/relay#255. + tags: [falcon, fault-tolerance, rotor-loss, fdi, robustness, sensor-noise, v1.115, proposed] + fields: + req-type: safety + priority: should + verification-criteria: > + Dispersed full-loop rotor-out campaign at the heavier envelope + (gps σ up to 0.3 m, gyro-white up to 0.02 rad/s): the FDI isolates the + CORRECT rotor within a bounded latency for the whole recoverable + envelope, with zero mis-isolation and zero missed isolation. Regression + bound on worst detection latency set just above the measured worst case. + links: + - type: derives-from + target: SYSREQ-FALCON-005 diff --git a/artifacts/swreq/SWREQ-FALCON-FAULT-P04.yaml b/artifacts/swreq/SWREQ-FALCON-FAULT-P04.yaml new file mode 100644 index 0000000..6e8798f --- /dev/null +++ b/artifacts/swreq/SWREQ-FALCON-FAULT-P04.yaml @@ -0,0 +1,32 @@ +artifacts: + - id: SWREQ-FALCON-FAULT-P04 + type: sw-req + title: "FAULT-P04 — supervisor-driven controlled landing after single-rotor loss" + status: proposed + description: > + On single-rotor loss the FlightSupervisor shall command LAND and bring the + vehicle down in a CONTROLLED descent to touchdown — bounded sink rate, + thrust axis kept upright, settled on the surface — managing the ALTITUDE + the reduced-attitude core (FAULT-P02) deliberately does not. Rationale: a + 3-rotor quad is near neutrally-buoyant on this airframe (two rotors at max + thrust ≈ hover weight), so the bare FlightCore holds/drifts altitude rather + than descending; the v1.114 full-loop campaign therefore GUARDS attitude + (no flip, bounded spin) but only REPORTS altitude ("supervisor's LAND + job"). This requirement closes that scope with a supervisor-driven + full-loop rotor-out landing oracle/campaign, and pairs it with a clean gz + confirmation run + the recordable recovery video (the v1.114 gz run showed + the correct rank-3 allocation but a degenerate pose feed). + GitHub: pulseengine/relay#256. + tags: [falcon, fault-tolerance, rotor-loss, supervisor, landing, gz, v1.115, proposed] + fields: + req-type: safety + priority: should + verification-criteria: > + Supervisor-driven full-loop rotor-out oracle/campaign: an injected rotor + loss ⇒ the supervisor commands LAND, and the vehicle descends (net + altitude lost) at a bounded sink rate to an upright touchdown, thrust + axis within the FAULT-P02 tilt bound throughout. Plus a clean gz run + demonstrating the same on the higher-fidelity plant. + links: + - type: derives-from + target: SYSREQ-FALCON-005 From 9c1d4d6c609749d2208b5840b9faac5324351df0 Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Fri, 10 Jul 2026 22:50:43 +0200 Subject: [PATCH 2/2] plan(falcon): tag v1.115 artifacts with release: field for readiness query MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add `release: falcon-v1.115.0` to FAULT-P03/P04 + FEAT-v1.115 so the release scope is a QUERY, not an opinion: $ rivet release status falcon-v1.115.0 Release falcon-v1.115.0 — 2 artifact(s) proposed 2 ✗ NOT cuttable — 2 artifact(s) not yet verified. `rivet release status` exits non-zero when not cuttable (CI-gateable); it burns down to cuttable as P03/P04 reach `verified`. Pairs with `rivet list --release falcon-v1.115.0`. Co-Authored-By: Claude Opus 4.8 --- artifacts/features/FEAT-FALCON-v1.115.yaml | 1 + artifacts/swreq/SWREQ-FALCON-FAULT-P03.yaml | 1 + artifacts/swreq/SWREQ-FALCON-FAULT-P04.yaml | 1 + 3 files changed, 3 insertions(+) diff --git a/artifacts/features/FEAT-FALCON-v1.115.yaml b/artifacts/features/FEAT-FALCON-v1.115.yaml index 3f52fdc..cea6900 100644 --- a/artifacts/features/FEAT-FALCON-v1.115.yaml +++ b/artifacts/features/FEAT-FALCON-v1.115.yaml @@ -3,6 +3,7 @@ artifacts: type: feature title: "v1.115 — rotor-out robustness + verification-fidelity follow-ups" status: proposed + release: falcon-v1.115.0 description: > PROPOSED (release falcon-v1.115.0). The follow-ups surfaced by the v1.114 rotor-out work — where a parasitic-moment allocation flipped the vehicle diff --git a/artifacts/swreq/SWREQ-FALCON-FAULT-P03.yaml b/artifacts/swreq/SWREQ-FALCON-FAULT-P03.yaml index 91be480..823d36d 100644 --- a/artifacts/swreq/SWREQ-FALCON-FAULT-P03.yaml +++ b/artifacts/swreq/SWREQ-FALCON-FAULT-P03.yaml @@ -3,6 +3,7 @@ artifacts: type: sw-req title: "FAULT-P03 — single-rotor-out FDI robustness under sensor noise" status: proposed + release: falcon-v1.115.0 description: > On loss of a single rotor the FDI shall isolate the failed rotor within a bounded latency across the realistic GNSS/gyro sensor-noise envelope — diff --git a/artifacts/swreq/SWREQ-FALCON-FAULT-P04.yaml b/artifacts/swreq/SWREQ-FALCON-FAULT-P04.yaml index 6e8798f..e8e0f24 100644 --- a/artifacts/swreq/SWREQ-FALCON-FAULT-P04.yaml +++ b/artifacts/swreq/SWREQ-FALCON-FAULT-P04.yaml @@ -3,6 +3,7 @@ artifacts: type: sw-req title: "FAULT-P04 — supervisor-driven controlled landing after single-rotor loss" status: proposed + release: falcon-v1.115.0 description: > On single-rotor loss the FlightSupervisor shall command LAND and bring the vehicle down in a CONTROLLED descent to touchdown — bounded sink rate,