PROMETHEUS OS
NATIVE AI OPERATING SYSTEM
[INIT] Prometheus OS loading...
[CORE] Neural interface initializing...
[AI] LLM router connecting...
[MEM] Memory graph loading...
[AGT] Agent chains on standby...
[SEC] Security protocols active...
[NET] Provider mesh established...
[UI] Workspace rendering...
[DONE] All systems nominal.
Welcome to PROMETHEUS OS.
READY · OFFLINE · SECURE · PRIVATE
🎨 THEME ENGINE
PROMETHEUS OS · 23 THEMES
Trial version: Dark + Light themes only.
Full theme access with PROMETHEUS OS license.
Dark theme active
Experience all 23 themes in PROMETHEUS OS

Robotics and Autonomous Systems

Advanced 21 min· 5 exercises

Explain and implement the core robotics stack (sensing, state estimation, SLAM, planning and control), understand how imitation learning, sim-to-real and vision-language-action models are changing it, and reason precisely about SAE automation levels and safety cases.

By the end of this lesson you will be able to
  • Describe the perception–planning–control loop and the strengths and failure modes of cameras, lidar, radar and IMUs.
  • Derive and apply the Kalman filter predict and update equations, and explain how SLAM uses loop closure and factor graphs.
  • Implement A* grid planning and compare graph search, sampling-based planning and MPC.
  • Explain behaviour cloning, compounding error, domain randomisation and how vision-language-action models map images and instructions to actions.
  • Classify driving-automation features by SAE J3016 level and outline the elements of an autonomous-system safety case.

Before this: Computer Vision: Tasks, Metrics, Models and Deployment, Reinforcement Learning, Linear Algebra for AI, Probability and Statistics for AI

Robotics is where AI meets physics. A robot has to sense a messy world, work out where it is, decide what to do and move its body, many times per second, with consequences that cannot be undone. The same stack runs warehouse robots, surgical assistants, agricultural machines, drones and self-driving cars. This lesson walks through that stack: the classical pieces every robotics engineer must know (estimation, SLAM, planning, control), the learning-based methods that are changing the field (imitation learning, sim-to-real, vision-language-action models), and how autonomous vehicles are classified, deployed and argued safe.

Intuition: driving to an unfamiliar address

Think about how you drive somewhere new. Your eyes and ears gather information (perception). You combine what you see with a map and your sense of motion to know where you are (localisation). You choose a route and, moment by moment, a path around the parked van ahead (planning). Your hands and feet turn that plan into steering and pedal movements, correcting continuously when the car drifts (control). Then you look again. Robots run the same loop, the perception–planning–control loop (often called sense–plan–act), typically at 10 to 100 Hz for planning and up to 1 kHz for low-level motor control.

The loop in detail

StageInputOutputTypical methods
PerceptionRaw sensor dataObjects, free space, semantic map, tracksCNN and Transformer detectors, segmentation, point-cloud networks, multi-object tracking
State estimation and localisationSensor data plus motion commandsPose (position and orientation) with uncertaintyKalman and particle filters, SLAM, factor graphs
PredictionTracks of other agentsLikely future trajectoriesLearned trajectory forecasting
PlanningMap, pose, goal, predictionsA trajectory or action sequenceA*, RRT, trajectory optimisation, MPC, learned planners
ControlPlanned trajectory, current stateMotor torques, steering, throttlePID, LQR, MPC

Classical systems build these as separate modules with well-defined interfaces, which makes them testable and explainable. End-to-end learned systems map sensor input more directly to actions and can capture subtle behaviour, but they are harder to verify. Most deployed systems in 2026 are hybrids.

Sensors

SensorMeasuresStrengthsWeaknesses
CameraColour imagesCheap, dense, rich semantics (signs, lights, text)No direct depth; struggles in glare, darkness and fog
LidarDistance by timing laser pulses; 3-D point cloudsAccurate geometry at tens to hundreds of metresCost, sparse at range, degraded by heavy rain or snow; no colour
RadarRange and radial velocity from radio reflections (Doppler)Works in bad weather, measures speed directlyLow angular resolution, clutter from metal objects
IMULinear acceleration and angular velocityHigh rate (hundreds of Hz), no external dependencyDrifts quickly when integrated over time
GNSS (GPS)Global positionAbsolute referenceMetres of error, lost in tunnels and urban canyons
Wheel encoders, joint encoders, force/torque sensorsRotation, joint angles, contact forcesPrecise proprioceptionWheel slip; contact is hard to model

Sensor fusion combines these so that each covers the others' weaknesses: the IMU fills gaps between camera frames, radar confirms speed in fog, lidar anchors camera depth. Fusion requires accurate calibration (each sensor's position and orientation relative to the others) and time synchronisation; a 50 ms timing error at 30 m/s is a 1.5 m position error.

State estimation and the Kalman filter

Every sensor is noisy, so robots maintain a belief: a probability distribution over the state. The Kalman filter is the optimal estimator for linear systems with Gaussian noise. It alternates two steps. With state estimate x^\hat{x}, covariance PP, motion model FF, process noise QQ, measurement model HH and measurement noise RR:

Predict (motion makes us less certain):

x^−=Fx^,P−=FPF⊤+Q\hat{x}^- = F\hat{x}, \qquad P^- = FPF^\top + Q

Update (a measurement zz makes us more certain):

K=P−H⊤(HP−H⊤+R)−1,x^=x^−+K(z−Hx^−),P=(I−KH)P−K = P^-H^\top\left(HP^-H^\top + R\right)^{-1}, \qquad \hat{x} = \hat{x}^- + K\left(z - H\hat{x}^-\right), \qquad P = (I - KH)P^-

The Kalman gain KK weighs the measurement against the prediction by their relative uncertainties.

Worked example (1-D). A robot's predicted position is x^−=10\hat{x}^- = 10 m with variance P−=4P^- = 4 m². A range sensor reads z=12z = 12 m with variance R=1R = 1 m². Here H=1H = 1, so K=4/(4+1)=0.8K = 4/(4 + 1) = 0.8. The updated estimate is 10+0.8×(12−10)=11.610 + 0.8 \times (12 - 10) = 11.6 m, and the variance becomes (1−0.8)×4=0.8(1 - 0.8) \times 4 = 0.8 m². The result sits closer to the more trustworthy sensor, and the variance is smaller than either source alone.

import numpy as np

dt = 0.1
F = np.array([[1, dt], [0, 1]])          # constant-velocity motion model
H = np.array([[1.0, 0.0]])               # we measure position only (e.g. GPS)
Q = np.diag([1e-4, 1e-2])                # process noise covariance
R = np.array([[4.0]])                    # measurement noise variance (2 m std)

rng = np.random.default_rng(1)
true_x = np.array([0.0, 1.5])            # start at 0 m moving at 1.5 m/s
x, P = np.array([0.0, 0.0]), np.eye(2) * 10.0
for k in range(100):
    true_x = F @ true_x
    z = H @ true_x + rng.normal(0, 2.0, 1)       # noisy measurement
    x, P = F @ x, F @ P @ F.T + Q                # predict
    S = H @ P @ H.T + R
    K = P @ H.T @ np.linalg.inv(S)               # Kalman gain
    x = x + K @ (z - H @ x)                      # update with the innovation
    P = (np.eye(2) - K @ H) @ P

print("true pos %.2f vel %.2f" % tuple(true_x))
print("est  pos %.2f vel %.2f | pos std %.2f m" % (x[0], x[1], np.sqrt(P[0, 0])))

Measurements have 2 m of noise, yet after 10 seconds the filter estimates position to within about 0.3 m (true 15.00, estimate 14.71) with a reported standard deviation of 0.62 m. It also recovers the velocity (1.43 against the true 1.5 m/s), which was never measured directly. For non-linear systems, practitioners use the extended or unscented Kalman filter, or a particle filter, which represents the belief with weighted samples and can handle multi-modal beliefs ("I am in one of these two identical corridors").

Localisation and SLAM

Localisation estimates the robot's pose within a known map, for example by matching lidar scans to a prior high-definition map. When no map exists, the robot must build one while localising in it: simultaneous localisation and mapping (SLAM). This is a chicken-and-egg problem, because the map needs the pose and the pose needs the map, and errors accumulate as the robot moves. The key correction is loop closure: recognising a previously visited place, which reveals the accumulated drift and lets the system correct the whole trajectory.

Modern SLAM is usually formulated as a factor graph: nodes are robot poses and landmarks, and factors are constraints from odometry, IMU, landmark observations and loop closures. Solving SLAM means finding the poses that best satisfy all constraints, a non-linear least-squares problem solved with sparse optimisers (libraries such as GTSAM, g2o and Ceres). Variants include visual SLAM (cameras, e.g. ORB-SLAM), lidar SLAM, and visual-inertial odometry, which fuses a camera with an IMU and is what phones use for augmented reality. Learned components increasingly supply features, depth and place recognition, while geometry still does the optimisation.

Motion planning

Planning finds a collision-free, feasible path from start to goal. Planners work in configuration space (C-space): the space of all robot configurations, such as (x,y,θ)(x, y, \theta) for a mobile robot or seven joint angles for an arm. Obstacles become forbidden regions in C-space.

  • Graph search on a discretised grid or lattice: Dijkstra, and A*, which expands nodes in order of f(n)=g(n)+h(n)f(n) = g(n) + h(n), where gg is the cost so far and hh an admissible heuristic (one that never overestimates the remaining cost), which guarantees an optimal path.
  • Sampling-based planners for high-dimensional C-spaces: RRT (rapidly exploring random trees) grows a tree toward random samples; RRT* and PRM (probabilistic roadmaps) add asymptotic optimality and reuse.
  • Trajectory optimisation: refine a path into a smooth trajectory that minimises cost (jerk, time, energy) subject to dynamics and collision constraints.
  • Model predictive control (MPC): repeatedly solve a short-horizon optimisation from the current state, execute the first control, and re-plan. MPC blurs planning and control and is standard in autonomous driving and legged locomotion.
import heapq

GRID = ["S...#....",
        ".##.#.##.",
        ".#.....#.",
        ".#.###.#.",
        "...#....G"]
ROWS, COLS = len(GRID), len(GRID[0])
find = lambda ch: next((r, c) for r in range(ROWS) for c in range(COLS) if GRID[r][c] == ch)
start, goal = find("S"), find("G")
h = lambda p: abs(p[0] - goal[0]) + abs(p[1] - goal[1])  # admissible on a 4-connected grid

def astar():
    heap, came_from, g_best = [(h(start), 0, start)], {start: None}, {start: 0}
    while heap:
        f, g, node = heapq.heappop(heap)
        if node == goal:
            path = []
            while node is not None: path.append(node); node = came_from[node]
            return path[::-1]
        if g > g_best[node]: continue                     # stale heap entry
        r, c = node
        for nb in [(r+1, c), (r-1, c), (r, c+1), (r, c-1)]:
            if 0 <= nb[0] < ROWS and 0 <= nb[1] < COLS and GRID[nb[0]][nb[1]] != "#":
                if g + 1 < g_best.get(nb, float("inf")):
                    g_best[nb], came_from[nb] = g + 1, node
                    heapq.heappush(heap, (g + 1 + h(nb), g + 1, nb))
    return None

path = astar()
print("length:", len(path) - 1, path)

A* finds a 12-step path through the gap in the walls. Here the path length equals the Manhattan distance, so the heuristic was exact along this route. Real planners add costs for proximity to obstacles, inflate obstacles by the robot's radius, and smooth the result into a dynamically feasible trajectory.

Control

The controller makes the robot follow the plan despite disturbances. The workhorse is the PID controller: with tracking error e(t)e(t) between desired and measured state, the command is

u(t)=Kp e(t)+Ki∫0te(τ) dτ+Kdde(t)dtu(t) = K_p\, e(t) + K_i \int_0^t e(\tau)\, d\tau + K_d \frac{de(t)}{dt}

where the proportional gain KpK_p reacts to the current error, the integral gain KiK_i removes steady offsets, and the derivative gain KdK_d damps oscillation. LQR (the linear–quadratic regulator) computes optimal feedback gains for linear models with quadratic costs, and MPC handles constraints such as actuator limits explicitly.

Learning in robotics

Imitation learning

Behaviour cloning trains a policy πθ(a∣o)\pi_\theta(a \mid o) by supervised learning on expert demonstrations of observations oo and actions aa, collected by teleoperation or kinesthetic teaching. It is simple and data-efficient, but it suffers from compounding error (covariate shift): small mistakes lead the robot into states the expert never visited, where its errors grow. DAgger (Ross, Gordon and Bagnell, 2011) fixes this by running the learned policy, asking the expert to label the states it actually reaches, and retraining. Modern recipes predict action chunks (short sequences of future actions) and use expressive generative heads, such as diffusion or flow-matching policies, to handle demonstrations with several valid ways to do a task. Low-cost bimanual teleoperation rigs such as ALOHA made collecting such data much cheaper.

Sim-to-real

Simulation offers unlimited, safe, parallel experience, which is ideal for reinforcement learning. Policies trained in simulation often fail on hardware because of the reality gap: mismatches in friction, masses, latency, sensor noise and visual appearance. Remedies:

  • Domain randomisation (Tobin et al., 2017): randomise textures, lighting, masses, friction and delays during training so the real world looks like just another variation.
  • System identification: measure real parameters and calibrate the simulator.
  • Fine-tuning on real data, and learning residual corrections on top of a simulated policy.

Sim-to-real RL is now standard for legged locomotion: quadruped and humanoid walking controllers are commonly trained in massively parallel GPU simulators and deployed zero-shot. OpenAI's 2019 Rubik's Cube work with a robot hand was a landmark demonstration of heavy domain randomisation for dexterous manipulation.

Vision-language-action models

Vision-language-action (VLA) models extend vision-language models so that they output robot actions. A pretrained VLM brings web-scale knowledge of objects and language; fine-tuning on robot demonstrations teaches it to map camera images plus an instruction ("put the banana in the blue bowl") to actions. Published examples:

  • RT-2 (Google DeepMind, 2023) introduced the VLA term, representing actions as text tokens in a VLM's vocabulary and showing transfer of web knowledge to new instructions.
  • OpenVLA (Kim et al., 2024), an open 7-billion-parameter VLA trained on the Open X-Embodiment dataset.
  • π0 (Physical Intelligence, 2024), which pairs a VLM backbone with a flow-matching action expert to produce smooth, high-frequency continuous actions across several robot bodies.
  • Gemini Robotics (Google DeepMind, 2025) and NVIDIA's GR00T N1 (2025), aimed at general-purpose and humanoid robots.

The trend is toward generalist policies trained across many robot embodiments. As of November 2026 these models handle impressive tabletop and household manipulation in research and pilot deployments, but reliability, speed and safety guarantees still lag what factory and road deployment require. Most production robots still rely on classical stacks with learned perception.

Autonomous vehicles and SAE driving automation levels

SAE J3016 (latest revision April 2021) defines six levels. The key concepts are the dynamic driving task (DDT), meaning the real-time operational and tactical functions of driving (steering, braking, monitoring the environment and responding to objects and events); the operational design domain (ODD), meaning the conditions a feature is designed for (road types, speeds, weather, geography, time of day); and DDT fallback, meaning who responds when something fails.

LevelNameWho drivesWho is the fallbackODD
0No driving automationHuman (warnings and momentary interventions such as emergency braking only)Humann/a
1Driver assistanceHuman, with the system on steering or speedHumanLimited
2Partial driving automationSystem on steering and speed; the human must supervise at all timesHumanLimited
3Conditional driving automationSystem performs the whole DDT while engagedHuman must take over when the system requestsLimited
4High driving automationSystem performs the whole DDTSystem (no takeover expected)Limited
5Full driving automationSystem, everywhere a human could driveSystemUnlimited

The line that matters legally and practically is between Level 2 and Level 3: at Level 2 the human is driving even with hands off the wheel, while at Level 3 and above the system is driving while engaged. The levels describe features, not whole vehicles, and are not a ranking of quality.

Deployment as of November 2026

  • Level 4 robotaxis are in commercial service. Waymo runs fully driverless paid ride-hailing in multiple US metropolitan areas; TechCrunch counted ten in February 2026 (including Phoenix, the San Francisco Bay Area, Los Angeles, Austin, Atlanta and Miami), and the company has continued to add cities and has announced plans for London. Tesla began offering some robotaxi rides in Austin with no safety monitor in the car in January 2026, starting with a small number of unsupervised vehicles within a larger supervised fleet.
  • Level 3 in consumer cars has stalled. Mercedes-Benz Drive Pilot was the first Level 3 system certified in the US (Nevada and California, 2023), limited to mapped highways at low speeds, and Germany approved it at up to 95 km/h in the right-hand lane. In January 2026, however, Mercedes was reported to be dropping Drive Pilot from the facelifted S-Class in favour of a more capable Level 2 system, and BMW dropped its Level 3 Personal Pilot from the 7 Series facelift. The industry has shifted toward broad "hands-off, eyes-on" Level 2 systems.
  • Level 2 systems, including Tesla's "Full Self-Driving (Supervised)", GM Super Cruise and Ford BlueCruise, are widespread. The driver remains responsible at all times.
  • No Level 5 system exists.

Treat any deployment snapshot as perishable; check operators' and regulators' current publications before citing it.

Safety cases

A safety case is a structured argument, supported by evidence, that a system is acceptably safe for a specific use in a specific environment. It is usually organised as claims, arguments and evidence, often drawn in Goal Structuring Notation. For autonomous systems, evidence combines:

  • Functional safety (ISO 26262 for road vehicles): hazard analysis, safety integrity levels, redundancy, and freedom from faults in hardware and software.
  • Safety of the intended functionality (ISO 21448, SOTIF): hazards that arise even when nothing is broken, such as a perception model misreading an unusual scene. This standard matters most for machine learning.
  • UL 4600: a standard for safety cases of fully autonomous products, requiring coverage of the ODD, of machine-learning limitations and of field monitoring.
  • Testing evidence at scale: simulation of millions of scenarios, closed-course tests of edge cases, and on-road miles with statistical comparison of crash rates against human benchmarks, analysed with confidence intervals because severe events are rare.
  • Operational controls: ODD enforcement (the system refuses to engage outside it), a minimal-risk manoeuvre such as pulling over safely, remote assistance, and incident reporting to regulators.

The safety case is a living document, updated as the ODD expands and as field data arrives.

Common pitfalls

  • Bad calibration and timing. Most "perception bugs" in fused systems are extrinsic calibration or timestamp errors.
  • Overconfident filters. Setting process noise QQ too small makes a Kalman filter ignore measurements and diverge.
  • Testing inside the training distribution only. Rare events (unusual vehicles, construction zones, glare) dominate real-world risk.
  • Behaviour cloning without recovery data. Policies trained only on perfect demonstrations cannot recover from their own mistakes.
  • Trusting simulation results. Policies exploit simulator artefacts; validate on hardware early.
  • Mislabelled autonomy. Calling a Level 2 system "self-driving" encourages misuse; regulators and courts take this seriously.
  • Ignoring latency. A planner that takes 300 ms in a 100 ms control loop is acting on stale data.

In practice

Start with ROS 2, the de facto middleware for robot software, and a simulator (Gazebo, MuJoCo, NVIDIA Isaac Sim, or CARLA for driving). Get calibration, time sync and logging right before any learning. Use proven estimation (robot_localization, a factor-graph SLAM package) and planning stacks (Nav2 for mobile robots, MoveIt for arms), then add learned perception. For manipulation, collect teleoperated demonstrations and train imitation policies, or fine-tune an open VLA when you need language-conditioned generality. Use RL in simulation with domain randomisation for locomotion and contact-rich skills. For any safety-relevant deployment, define the ODD first, build the safety case alongside the system, and log everything so you can learn from the field.

Key takeaways

  • Robots run a continuous perception–planning–control loop, and every stage must handle uncertainty and latency.
  • Sensor fusion works because sensors fail differently; the Kalman filter weights each source by its uncertainty.
  • SLAM builds a map and localises in it at the same time, using loop closures and factor-graph optimisation to remove drift.
  • Classical planners (A*, RRT, MPC) remain the backbone; learning increasingly supplies perception and, through imitation learning and VLAs, manipulation skills.
  • SAE Level 3 and above means the system drives while engaged; Level 4 robotaxis are in commercial service, while consumer Level 3 has largely stalled as of November 2026.
  • Safety is argued, not assumed: a safety case ties the ODD, functional safety, SOTIF, testing evidence and operational controls together.

Terms in this lesson

Perception–planning–control loop
The repeated cycle in which a robot senses its environment, decides on actions and executes them.
Lidar
A sensor that measures distances by timing reflected laser pulses, producing 3-D point clouds.
IMU
An inertial measurement unit measuring linear acceleration and angular velocity at high rate.
Kalman filter
A recursive estimator that alternates prediction with a motion model and correction with measurements, weighting each by its uncertainty.
SLAM
Simultaneous localisation and mapping: estimating a robot's trajectory and a map of its environment at the same time.
Loop closure
Recognising a previously visited place so that accumulated drift in a SLAM estimate can be corrected.
Configuration space
The space of all possible robot configurations, in which planning is performed.
Behaviour cloning
Imitation learning by supervised training of a policy on expert observation–action pairs.
Domain randomisation
Training in simulation with randomised physical and visual parameters so policies transfer to the real world.
Vision-language-action model
A model, typically built on a vision-language model, that maps images and language instructions to robot actions.
Operational design domain (ODD)
The specific conditions under which a driving-automation feature is designed to operate.
Safety case
A structured, evidence-backed argument that a system is acceptably safe for a defined use and environment.

Check your understanding

  1. 1.

    A predicted position has variance 9 m², and a GPS reading has variance 3 m². With H = 1, what is the Kalman gain?

  2. 2.

    A car keeps itself centred in its lane and controls its speed on highways, but the driver must watch the road at all times and is responsible for responding to hazards. What SAE level is this?

  3. 3.

    Why does pure behaviour cloning often fail after a few seconds of autonomous operation?

  4. 4.

    Which sensor most directly provides an object's radial velocity and keeps working in heavy fog?

  5. 5.

    You must plan motions for a 7-joint arm in a cluttered workcell. Which planner family is the most natural first choice?

Exercises

Work each problem before opening the solution.

  1. Exercise 1Core

    A robot's position estimate is 5.0 m with variance 2.0 m². It moves forward by a commanded 1.0 m with motion noise variance 0.5 m², and then a sensor measures 6.4 m with variance 1.0 m². Compute the predicted mean and variance, the Kalman gain, and the updated mean and variance (1-D, F = H = 1).

    Show solution

    Predict: mean = 5.0 + 1.0 = 6.0 m. Variance = 2.0 + 0.5 = 2.5 m².

    Gain: K = 2.5/(2.5 + 1.0) = 0.714 (2.5/3.5).

    Update: mean = 6.0 + 0.714 x (6.4 - 6.0) = 6.0 + 0.286 = 6.286 m. Variance = (1 - 0.714) x 2.5 = 0.2857 x 2.5 = 0.714 m².

    The posterior variance (0.714) is smaller than both the prediction (2.5) and the measurement (1.0): fusing information always reduces uncertainty in the linear-Gaussian case.

  2. Exercise 2Core

    Classify each feature by SAE level and justify it: (a) adaptive cruise control only; (b) a highway system that drives itself in traffic jams below a set speed, lets the driver watch a film, and gives 10 seconds' notice to take over; (c) a driverless shuttle that operates only on a fixed campus route in daylight and pulls over by itself if a sensor fails; (d) a hands-free highway system that monitors the driver's eyes and requires them to watch the road.

    Show solution

    (a) Level 1: the system sustains longitudinal control (speed) only, and the human steers and supervises. (b) Level 3: the system performs the entire DDT within a limited ODD, the user may do other things, but the human is the fallback and must respond to a takeover request. (c) Level 4: the system performs the entire DDT and its own fallback (a minimal-risk manoeuvre) within a limited ODD (campus, daylight). No human takeover is expected. (d) Level 2: steering and speed are automated, but the driver must supervise continuously. Hands-free does not change the level; eyes-on supervision is the defining feature.

  3. Exercise 3Core

    Explain why Manhattan distance is an admissible heuristic for A* on a 4-connected grid with unit step costs, and why it is not admissible on an 8-connected grid where diagonal moves cost sqrt(2). Give an admissible heuristic for the 8-connected case.

    Show solution

    On a 4-connected grid, every move changes either the row or the column by exactly 1 and costs 1. Reaching the goal requires at least |dr| + |dc| moves, so the true cost is at least the Manhattan distance, and the heuristic never overestimates: it is admissible.

    On an 8-connected grid, a diagonal move changes both coordinates at a cost of sqrt(2) (about 1.414), which is less than 2. For a goal at (1, 1), Manhattan distance gives 2, but the true cost is sqrt(2), about 1.414. It overestimates, so A* may return a suboptimal path.

    Admissible alternative: the octile distance, h = max(|dr|, |dc|) + (sqrt(2) - 1) x min(|dr|, |dc|), which is the exact cost on an empty 8-connected grid. Straight-line Euclidean distance is also admissible but less tight.

  4. Exercise 4Challenge

    Extend the lesson's A* code so that cells adjacent to obstacles cost 3 to enter instead of 1 (to keep a safety margin). Keep the Manhattan heuristic. Is it still admissible? Show the code change and explain how the path changes.

    Show solution
    def near_wall(p):
        r, c = p
        for dr, dc in [(1,0),(-1,0),(0,1),(0,-1)]:
            rr, cc = r + dr, c + dc
            if 0 <= rr < ROWS and 0 <= cc < COLS and GRID[rr][cc] == '#':
                return True
        return False
    
    def cost(p):
        return 3 if near_wall(p) else 1
    
    # inside astar(), replace the neighbour update with:
    #     ng = g + cost(nb)
    #     if ng < g_best.get(nb, float('inf')):
    #         g_best[nb], came_from[nb] = ng, node
    #         heapq.heappush(heap, (ng + h(nb), ng, nb))
    

    Admissibility: every step still costs at least 1, so the true remaining cost is at least the number of steps, which is at least the Manhattan distance. The heuristic remains admissible, so A* still returns the minimum-cost path, though it may expand more nodes because the heuristic is now less tight.

    Effect: the planner prefers routes that stay one cell away from walls when the detour costs less than the penalties avoided. Through narrow gaps (one cell wide between walls) it must still pay the penalty, because no alternative exists. The reported cost rises above 12 for this map, since the only corridors pass beside walls. This is a discrete version of the costmap inflation used in Nav2.

  5. Exercise 5Challenge

    You lead a team deploying a delivery robot on university sidewalks. Draft the top-level structure of its safety case: the top claim, four supporting sub-claims, and the kinds of evidence for each. Include at least one claim specific to the machine-learned perception system.

    Show solution

    Top claim (G0): The delivery robot is acceptably safe for pedestrians, cyclists and property when operating within its defined ODD (campus sidewalks, daylight and dusk, no snow, at most 6 km/h).

    G1 — The ODD is defined and enforced. Evidence: an ODD specification; geofence and weather-check logic with tests; logs showing the robot refuses to start, or stops safely, outside the ODD.

    G2 — Hardware and software faults are detected and handled (functional safety). Evidence: hazard analysis (HARA/FMEA); redundant emergency stop and bumper; watchdogs; fault-injection test results showing transition to a minimal-risk condition (stop and alert) within a specified time.

    G3 — The ML perception system detects relevant hazards with sufficient reliability within the ODD (SOTIF). Evidence: a dataset coverage analysis across lighting, weather, mobility aids, children, pets and scooters; recall at the required range with confidence intervals; analysis of known triggering conditions (glare, reflective surfaces); a conservative fallback, such as slowing when perception confidence is low; regression tests on every model update.

    G4 — Residual risk is acceptable and is monitored in operation. Evidence: simulation and closed-course scenario testing; a supervised pilot with the incident rate compared against a defined target; remote monitoring and teleoperation procedures; incident reporting and triage; a change-management process that updates the safety case when the ODD or the models change.

    Arguments link each sub-claim to the top claim. The case is reviewed by an independent assessor (UL 4600 expects independent assessment) and maintained as a living document.

Further reading

Go further

Sources

Fact-checked and last reviewed 2026-11-05

Stay in the loop
Prometheus OS™ · Native AI OS · Built for the future © 2025 - 2026