Glossary

Terms as this site uses them. Several are used inconsistently across the field; where that is true the entry says so rather than picking a winner and pretending the argument is settled.

Autonomy stack

The layered software between sensors and actuators: state estimation, perception, world model, planning, control, and the arbitration that decides which of them is currently in charge. Used loosely — some people mean only the decision-making layers, others include the flight or motion controller underneath.

Autonomy level

A position on a numbered scale meant to describe how much a machine decides for itself. Several incompatible scales exist, produced for different domains, and they do not map onto each other. A level number quoted without naming the scale it comes from carries almost no information, and a single number cannot describe a system whose autonomy differs by function — one that plans its own route but never selects its own targets is not at a single level of anything.

Arbitration

The mechanism that resolves competing commands from different sources — an operator, a planner, a safety monitor — into the one command the actuators receive. The place where authority is actually implemented, as opposed to described.

Behaviour tree

A way of structuring decision logic as a tree of composable nodes that are ticked at a fixed rate. Popular because it is readable and reorderable; limited because expressing continuous conditions and long-running commitments in it tends to push state into places the tree cannot see.

Contested environment

An environment where an adversary is actively degrading the things the system depends on — the datalink, satellite navigation, the sensing itself. Distinct from a merely degraded environment, where the same capabilities are lost to terrain, weather or equipment failure. The difference matters because an adversary chooses the worst moment and a mountain does not.

Dead reckoning

Propagating a position estimate forward from a last known fix using measured motion. Its error grows with elapsed time and has no bound, so it is a way of buying a stated interval, not a way of navigating indefinitely.

Deconfliction

Keeping vehicles out of each other’s space, by geometry, by time separation, by assigned volumes, or by explicit negotiation. Sometimes used to mean the planning-time allocation and sometimes the runtime avoidance manoeuvre; they are different problems with different failure modes.

Degraded mode

Any operating state entered because something the system depends on is missing or untrustworthy. Worth distinguishing from a failure mode: the system is still doing its job, under a reduced set of assumptions, and the reduction should be visible to the operator.

Fail-operational

Continuing to deliver the function after a fault, usually by having enough independent capability left to do so. Distinct from fail-safe, and more expensive, because it requires the remaining capability to be sufficient rather than merely present.

Fail-safe

Moving to a state that is safe when a fault occurs. On a static machine this is often “stop”. On a moving vehicle there is no stop, so the safe state is a manoeuvre, and the manoeuvre has to be safe under the same fault that triggered it.

Geofence

A boundary in space the vehicle must remain inside or outside. Implemented well, it is enforced by a component simple enough to be trusted independently of the planner. Implemented badly, it is a check inside the planner, which means the planner’s own faults can disable it.

GNSS denial

Loss of satellite navigation, whether by jamming, by obstruction or by interference. Not binary: the fix degrades before it disappears, and there is a region in between where a fix is still reported and is wrong.

GNSS spoofing

Transmitting false satellite signals so a receiver computes a plausible but incorrect position or time. Its defining property is that confidence stays high while correctness is gone, which is why cross-checking against independent estimators matters more than trusting any single one.

Handover

Transfer of control authority between machine and operator, in either direction. The critical parameters are the lead time given and whether either party can be mistaken about who currently holds it.

Heartbeat

A periodic message whose absence is the signal. Cheap, and the standard way of turning “is the other end alive” into a timeout that can be tuned rather than a question that has to be asked.

Human-in-the-loop

The human is a required step in the control path: nothing happens until they act. Implies that the loop period includes human latency, which is a real timing constraint and not a governance statement.

Human-on-the-loop

The machine acts and the human may intervene. Widely used and widely meant differently — for some it implies an explicit veto window with a defined length, for others it means only that a person is watching. Worth pinning down before agreeing to it in writing.

Lost link

Loss of the command or telemetry channel. Almost always specified as a single condition with a single response, when the underlying behaviour is a partial, asymmetric and often reversible degradation with several distinguishable stages.

Operational design domain

The stated set of conditions under which a system’s behaviour is claimed to be adequate. Borrowed from road vehicle work and increasingly used elsewhere. Without one, no coverage or adequacy argument can be constructed, because the question “adequate for what” has no answer.

Perception stack

The pipeline that turns raw sensor data into objects, classifications and tracks. Usually the least faithfully simulated part of an autonomy system, which is why claims resting on it need physical evidence.

Positive control

An arrangement in which the vehicle acts only while a valid, current authority is held, rather than continuing by default until told to stop. The distinction shows up in the link-loss behaviour: positive control makes silence a reason to stop, not a reason to continue.

Redundancy and diversity

Redundancy is more than one of the same thing; diversity is more than one different thing. Redundancy covers random failures. Only diversity covers systematic ones, because identical units share identical design faults and identical blind spots.

Runtime assurance

An architecture in which a simple, verifiable monitor watches a complex, unverifiable component and can force a bounded fallback. Its value is that it converts an untestable claim about the complex component into a testable claim about the monitor — but only if the monitor is genuinely simpler, genuinely independent, and actually holds authority.

Sensor fusion

Combining several sensors into one estimate. The interesting engineering is not the combination but the disagreement: what the system does when two sensors contradict each other determines whether fusion adds robustness or averages a good measurement together with a bad one.

Simulation-to-reality gap

The difference between behaviour in simulation and behaviour in the world. Most usefully treated not as a single quantity but as a per-claim question: which claims does this model support, and which does it not.

State estimation

Maintaining a best estimate of the vehicle’s own state — position, attitude, velocity — together with a measure of how uncertain that estimate is. The uncertainty is the part that gets dropped downstream, and dropping it is how a vehicle comes to act confidently on a poor estimate.

Swarm

Used for at least three different things: many vehicles under one operator, many vehicles coordinating through a central planner, and many vehicles coordinating locally with no central planner. The engineering, the failure modes and the communications requirements differ completely between them.

Teleoperation

Direct remote control by a person, with the loop closed through the link. Not autonomy at all, but frequently present in the same vehicle as a mode, which means the transitions between it and autonomous modes have to be designed as carefully as either mode itself.

Uncrewed, unmanned, autonomous

The first two are the same claim — no person aboard — with the first now the more common phrasing. Neither says anything about autonomy: a vehicle with nobody aboard may be entirely teleoperated. “Autonomous” is about who decides, “uncrewed” is about who is on board, and treating them as synonyms is the source of a great deal of confused specification.

Watchdog

A timer that must be reset by a healthy system and that takes action if it is not. The simplest form of runtime monitor, and the one most often defeated by being reset from inside the same thread whose health it was meant to check.

Waypoint following

Flying or driving a fixed sequence of positions. Frequently described as autonomy, but it is automation of a plan somebody else made: the system is not deciding anything, and its behaviour when the plan stops making sense is the whole question.