Autonomous Mission Control under Uncertainty: Lost-Link Continuity, Machine Supervision, and an Answerable 3D Experience

Executive Summary

The transition of autonomous unmanned aircraft systems from highly constrained, segregated environments to complex, integrated airspaces demands a fundamental shift in safety verification. Traditional design-time assurance—proving that a system will never fail through exhaustive testing or formal methods—is mathematically intractable for modern machine-learning perception stacks operating within nondeterministic environments. Consequently, the aerospace and robotics industries have adopted Run-Time Assurance (RTA) paradigms, notably formalized in ASTM F3269-21, which decouple complex nominal performance from rigorously verified, deterministic safety bounding1.
Evulgare’s Autonomous Drone Control Assurance Lab and Assurance Simulation Workbench represent a crucial educational and analytical bridge for this paradigm. The intended platform is strictly an assurance demonstration environment designed to render the autonomous decision-making process reconstructable, transparent, and accessible. The architecture must demonstrate the strict segregation of physical reality, machine estimation, and machine intent. It visualizes the application of deterministic safety filters against complex planner requests, models lost-link authority degradation in alignment with STANAG 4586 principles3, and delivers the experience through a high-performance WebGPU/WebXR pipeline wrapped in a WCAG 2.2 AAA compliant accessibility layer5.
This report provides the exhaustive architectural, visual, and conceptual specifications required to build this deterministic workbench safely, ensuring no real-world vehicle control logic, classified signatures, or operational payload data are exposed or utilized, while demonstrating the absolute boundaries of machine supervision and answerable autonomy.

1. World Truth, Autonomy Belief, and Autonomy Intent

In a synthetic assurance environment, the paramount design constraint is avoiding the “omniscient leak”—the accidental or structural injection of the simulation’s absolute knowledge into the autonomous agent’s decision space. The simulation must visually and architecturally enforce a strict boundary between three distinct states of existence. The simulation environment processes deterministic physics and geometries, while the autonomous agent must reconstruct its own internal representation of that reality using simulated, imperfect sensors.
The architectural separation demands rigorous data-structure isolation. World Truth represents the absolute, deterministic state of the simulation environment at any time interval, encompassing the exact position, velocity, geometry, and semantics of all objects, including synthetic intruders, debris, and occlusion boundaries. This data is processed solely by the simulation engine and the visual renderer. Autonomy Belief represents the internalized, latent, and noisy state estimated by the autonomy stack based on synthetic sensor models. Belief encompasses detected tracks, state covariance matrices, occlusion hypotheses, and prediction uncertainty, inherently reflecting delays, false positives, and incomplete data8. Autonomy Intent comprises the sequence of high-level actions, trajectory primitives, or fallback behaviors the autonomy stack intends to execute, subject strictly to runtime safety governance.
To allow observers to distinguish these states instantly without relying solely on color—which violates WCAG 2.2 AAA accessibility guidelines—the visual encoding relies on geometric forms, opacity, animation, and semantic text labels6.

By separating these layers, the observer can visually comprehend a scenario where the Autonomy Belief diverges from World Truth due to an induced sensor failure, resulting in an Autonomy Intent that is nominally unsafe, which is subsequently intercepted by the independent safety governor.

2. Perception and Tracking

Synthetic perception in the Evulgare simulation must model the limitations of real-world sensors without utilizing actual classified or proprietary sensor signatures. The objective is to simulate the effects of perception uncertainty to trigger assurance mechanisms, particularly those associated with the Safety of the Intended Functionality (SOTIF) and Out-of-Distribution (OOD) data detection9.
The simulation engine models visibility and occlusion via ray-casting from the synthetic sensor origin against World Truth geometry. If an object intersects an occlusion mask, it drops from the Belief state, triggering a stale track persistence model where the last known position is extrapolated with an exponentially expanding uncertainty volume. Detection and tracking latency are modeled using a deterministic first-in-first-out (FIFO) queue, ensuring that World Truth events generated at a specific frame are not populated into the Belief state until the simulated processing time has elapsed. The synthetic tracker assigns stable integer IDs to persistent objects. False positives are injected probabilistically based on synthetic environmental noise, appearing as rapidly decaying, highly uncertain tracks that the planner must ignore or cautiously avoid. For moving objects, the simulation generates multiple motion hypotheses, rendered as diverging, translucent funnels representing the reachable set of the intruder over a short prediction horizon8. Sensor and navigation-integrity degradation are modeled as artificial inflations of the covariance matrix of the ownship’s state estimate, leading to wider safety buffers and potential invocation of uncertainty abstention protocols10.

3. Prediction and Option Evaluation

The deterministic simulator must present a bounded set of high-level synthetic candidates. Unlike operational systems that solve complex, non-convex optimization problems for exact aerodynamic control surfaces or actuator deflections, this simulation operates strictly on semantic trajectory primitives and logical states13. This abstraction protects proprietary flight-control gains while exposing the decision-making logic.
The nominal planner generates a discrete set of semantic intents, restricted to high-level maneuvers such as left deviation, right deviation, vertical deviation, speed reduction, position hold, route return, or transition to a predefined minimum-risk state. The evaluation engine compares these candidates against the predicted occupancy volumes of the Autonomy Belief state.

This structure ensures that the logic behind why the machine chose a specific action is fully transparent, answerable, and explainable without revealing proprietary path-planning mathematics or operational tactics.

4. Independent Runtime Assurance

To safely deploy complex, unverified, or machine-learning-based functions, the architecture relies on Run-Time Assurance (RTA) conforming to the principles of ASTM F3269-21 and contract-based design1. The simulation must visually and logically distinguish between the unverified nominal planner request and the formally verified applied safe action.
The Evulgare architecture utilizes a Simplex-style safety governor15. The Complex Function, representing the nominal mission planner, generates optimized requests aimed at fulfilling the primary objective. These requests are intercepted by the Safety Monitor, a deterministic, formally verifiable software component that continuously evaluates the planner’s request against strict safety invariants, frequently utilizing Control Barrier Functions (CBFs) to ensure forward-invariance of safe sets11. If the monitor detects an impending violation—such as a projected trajectory intersecting a geofence or intruder uncertainty volume—it commands the RTA Switch to sever the connection to the Complex Function. Authority is immediately transferred to the Recovery Function, a simple, highly verified controller that commands a deterministic safe state, such as an immediate altitude gain, a loiter pattern, or a controlled descent1.

The simulation explicitly notes that while it models these architectural patterns for public comprehension, synthetic modeling does not constitute or replace the rigorous DO-178C certification processes required for real-world flight control systems.

5. Lost-Link Autonomy: Human vs. Machine Supervision

Unmanned systems operating beyond visual line of sight must mathematically anticipate communication degradation and total link loss. The architecture models this utilizing state machines inspired by the STANAG 4586 Level of Interoperability standards, focusing heavily on the concept of cached authority3.
The system transitions through defined authority states based on heartbeat telemetry and deterministic timers. When communications are healthy, supervisory authority is valid, and the vehicle operates under normal parameters. Upon experiencing high latency or packet loss, the link is classified as degraded; the cached authority remains valid but is flagged as decaying. A complete loss of command and control transitions the system to a coasting state, where it operates under the last valid command for a predefined, expiring temporal window. Once this authority expires, the system engages autonomous continuation under a strictly predeclared, bounded fallback policy, typically navigating to a safe hold or a fictional recovery location. If no feasible safe hold exists, it enters a terminal minimum-risk state18.
A critical philosophical and architectural axiom modeled here is that the loss of communications does not generate new sovereign authority. The machine cannot invent new objectives; it may only execute pre-authorized fallback contracts. A successful autonomous outcome during a lost-link event does not prove the system was legitimately authorized to take those specific actions, hence the necessity of the reconciliation phase. When the link is restored, authority is not instantly granted to the operator. The system remains in its safe state until the supervisor acknowledges the current autonomy state, reconciles the timeline of autonomous events, and explicitly renews authority.

6. Cinematic Terminal Event and Alternative Scenarios

To demonstrate the complete lifecycle of a mission without crossing into operational employment logic—such as weapons release, terminal attack guidance, or classified payload operation—the simulation utilizes highly abstract cinematic terminal events.
The terminal event is fixed entirely by the scenario script and represented in normalized synthetic space. For example, the drone must intersect a specific geometric volume, represented as a translucent docking ring or a data exfiltration node, at a specific timestamp. There is no target search, target selection, target ranking, or payload release mechanism. The event simply acts as a final state transition to trigger the post-run evidence packaging, proving that the system successfully navigated the uncertainty and constraints to reach a defined end state21.
To maximize educational value while maintaining strict public safety boundaries, Evulgare utilizes alternative mission contexts. These include infrastructure inspection, where the vehicle navigates a wind turbine array under severe synthetic wind disturbances; disaster response, involving mapping a dynamically changing wildfire boundary where smoke induces severe sensor degradation; unmanned logistics, requiring high-speed medical supply delivery through a dense urban corridor with sudden dynamic obstacles; and satellite servicing, where an orbital rendezvous is complicated by a simulated thruster failure requiring immediate RTA intervention.

7. Event Timeline and Replay Schema

Accountability in autonomous systems requires that every decision be fully reconstructable and mathematically verifiable23. The simulation utilizes an append-oriented, cryptographically hashed event model. Replay relies entirely on consuming this recorded state array rather than utilizing uncontrolled browser timing mechanisms like requestAnimationFrame deltas, guaranteeing bit-for-bit identical playback across all environments.

8. Visual and Interaction Design Specifications

The user interface must convey extreme technical depth without masquerading as real-world aircraft controls. The design language draws from scientific digital twins, robotics visualization, and spaceflight operations telemetry, explicitly avoiding joysticks, throttle sliders, or weapons-arming symbology6.

8.1 Five-View 3D Camera Plan

The WebGPU rendering engine supports a structured multi-viewport architecture:

1. Primary Drone-Camera Viewport: A simulated gimbal view rendering RGB, synthetic infrared, or depth-map modes. It includes semantic labeling reticles for detected tracks but strictly omits targeting crosshairs.
2. Chase View: A trailing third-person perspective designed to show the drone’s spatial relationship to its projected intent paths and surrounding uncertainty volumes.
3. Tactical Overhead View: A top-down, orthographic map projection displaying World Truth layered beneath Autonomy Belief, clearly highlighting estimation errors.
4. Control-Center View: A multi-panel, 2D dashboard replicating a remote operations center, housing the data tables and timeline controls.
5. Recovery/Flight-Deck View: A fixed camera positioned at the fictional destination or minimum-risk state location, monitoring the terminal approach or abort sequence.

8.2 Ship/Control-Center Interface

The primary analytical interface features a synthetic telemetry tape, providing scrolling historical values of altitude, speed, and link quality. A track inspector panel allows users to click a bounding box in the 3D viewport, immediately populating a side panel with the Track Schema data, including classification confidence and staleness. The candidate comparison matrix provides a live table showing the top evaluated intent candidates, their risk bands, and specific constraint evaluations. A persistent runtime-assurance status indicator provides immediate visual feedback: nominal operation, monitor alert, or active RTA switch override. The authority state timeline visually indicates the health of the C2 link and displays the expiration countdown of cached authority.

8.3 WebXR Experience Plan

For immersive environments, the WebXR Device API implementation allows users to step into the Tactical Overhead View as a volumetric sandtable5. Users can manipulate the timeline using spatial hand-tracking, effectively scrubbing through time to observe how the Autonomy Belief volumes expand and contract. Interaction is restricted to timeline control and viewpoint manipulation; users cannot alter the deterministic outcome or assume direct piloting control in the XR environment.

9. Accessibility and WCAG 2.2 AAA Equivalence

The visually complex 3D simulation must be fundamentally accessible to users who cannot perceive or interact with the WebXR or WebGPU canvas, ensuring compliance with strict accessibility engineering standards6.
The architecture guarantees accessible equivalence through the use of synchronized semantic data tables. Every visual element in the 3D scene—including World Truth coordinates, Belief state covariance, Intent paths, and Candidate evaluations—is synchronously mirrored in highly structured HTML \<table> elements. Critical state transitions, such as runtime assurance interventions or command link losses, are immediately pushed to aria-live=”assertive” regions for instant screen reader announcement.
Bounded supervisory commands are fully navigable via keyboard, utilizing Tab for element traversal and Enter/Space for execution. Focus management is strictly enforced, trapping focus within active modal alerts during critical safety interventions to ensure the user acknowledges the event. To accommodate vestibular sensitivities and visual impairments, the application respects the @media (prefers-reduced-motion: reduce) query by disabling all non-essential camera smoothing and UI animations. Furthermore, the UI supports high-contrast and Windows Forced Colors modes by relying on CSS currentColor inheritance and semantic HTML rather than background images or hardcoded hex values.

10. Performance, Delivery Budgets, and Device Capabilities

To ensure a seamless, high-fidelity experience without relying on external runtimes, heavy frameworks, or Node/npm production dependencies, the architecture utilizes a Python 3.13 Flask backend serving vanilla JavaScript and native ES modules27.
The progressive delivery strategy mandates strict budgets. The first-analytical-state budget requires the initial HTTP response to contain the fully populated HTML table representation of the scenario’s starting state, ensuring a Time-to-First-Meaningful-Paint of under 500 milliseconds. While the user engages with the analytical text, the WebGPU GPUDevice initializes asynchronously in the background.
For the time-to-first-frame budget, the server delivers a highly compressed ArrayBuffer containing the minimum 131 frames of the deterministic run via compact same-origin hydration. This buffer is loaded into a Web Worker, decoupling the heavy physics and state-matrix parsing from the main UI thread. Digest verification ensures the downloaded buffer perfectly matches the server’s cryptographic hash before rendering begins.
Memory management is rigorously enforced. The system explicitly calls .destroy() on WebGPU buffers and textures upon scenario reset or navigation, preventing memory leaks during extended browser sessions. The architecture requires a baseline device capability of a WebGPU-compatible browser (e.g., Chrome 113+, Safari 18+) with fallback logic gracefully presenting the semantic HTML tables and 2D canvas representations if the GPU context cannot be acquired.

11. Detailed Testing and Acceptance Matrix

12. System Architectural Diagrams

Diagram 1: Layered Autonomy & RTA Architecture

Code snippet
graph TD
WT[(World Truth)] -->|Raycast / Occlusion| SM(Synthetic Sensor Model)
SM -->|Noise & Latency| AB[(Autonomy Belief)]
AB --> CF(Complex Function / Nominal Planner)
AB --> SMon(Safety Monitor / Invariant Checker)
CF -->|Nominal Request| RS{RTA Switch}
SMon -->|Violation Trigger| RS
RS -->|If Nominal| A[Actuation / Intent Execution]
RS -->|If Violation| RF(Recovery Function / MRS)
RF --> A

Diagram 2: Lost-Link State Machine

Code snippet
stateDiagram-v2
[*] --> LINK_HEALTHY
LINK_HEALTHY --> LINK_DEGRADED : Packet Loss > Threshold
LINK_DEGRADED --> LINK_HEALTHY : Connection Restored
LINK_DEGRADED --> LINK_LOST : Total Loss of C2
LINK_LOST --> AUTHORITY_EXPIRING : Cached Command Coasting
AUTHORITY_EXPIRING --> AUTONOMOUS_CONTINUATION : Coast Timer Expires
AUTONOMOUS_CONTINUATION --> MINIMUM_RISK_STATE : Safe Hold Infeasible
LINK_LOST --> LINK_RESTORED_RECONCILIATION : Telemetry Returns
LINK_RESTORED_RECONCILIATION --> LINK_HEALTHY : Supervisor Acknowledges State

Diagram 3: Event Hash Chain

Code snippet
graph LR
E1[Event n-1] --> H1[Hash n-1]
H1 --> C[Concatenate]
P[Event n Payload] --> C
C --> H2[SHA-256 Hash n]
H2 --> E2[Event n]

Diagram 4: WebGPU Rendering Pipeline

Code snippet
graph TD
WW[Web Worker / State Buffer] -->|Float32Array| MB[Main Thread Data Buffer]
MB --> WG[WebGPU Command Encoder]
WG --> VS[Vertex Shader: Geometry Position]
WG --> CS[Compute Shader: Uncertainty Volumes]
VS --> FS[Fragment Shader: Semantic Styling]
CS --> FS
FS --> C[HTML5 Canvas Presentation]

Diagram 5: Semantic Accessibility Equivalence

Code snippet
graph LR
State[Deterministic State Engine] -->|Render| 3D[WebGPU Viewport]
State -->|Parse| JSON[Data Model]
JSON --> T[Semantic HTML Table]
JSON --> A[ARIA Live Region Alerts]
3D -.->|Visual Confirmation| User[Sighted User]
T -.->|Screen Reader| User2[Visually Impaired User]
A -.->|Screen Reader| User2

13. Twenty-Five Named Proof Invariants

The Run-Time Assurance framework relies entirely on mathematically proving that specific invariants (rules) are never violated during operation16. The simulation’s safety governor continuously monitors these 25 invariants:

14. Required Scenario Library

The simulation validates the architecture against 25 distinct scenarios, rigorously demonstrating the boundaries of machine reasoning, runtime assurance, and lost-link behavior.

Limitations: Across all scenarios, the simulation explicitly does not model aerodynamic fluid dynamics, real-world wind disturbances, or actual motor-mixing algorithms.

15. Site-Ready Page Copy (Deliverable 21)

Home: Welcome to the Autonomous Drone Control Assurance Lab

Welcome to the frontier of machine trust. As autonomous systems scale beyond visual line of sight and enter our shared airspace, the traditional models of safety testing are no longer sufficient. We cannot simply write hardcoded rules for every possible edge case in a dynamic, unpredictable world.
The Evulgare Assurance Simulation Workbench is a public, deterministic laboratory designed to peel back the layers of autonomous decision-making. This is not a flight simulator designed for pilots to practice their skills. It is a rigorous analytical tool built to demonstrate how machines think, how they fail, and how we mathematically guarantee safety when they do. Here, you will not fly a drone. Instead, you will observe, stress-test, and audit the logic of an autonomous agent operating under extreme uncertainty.

Technology: The Separation of Truth, Belief, and Intent

To understand autonomy, you must first understand its limitations. In our 3D WebGPU environment, you will observe the critical divide between three distinct realities:

• World Truth: The absolute physical reality of the environment.
• Autonomy Belief: What the drone thinks is happening, constructed from noisy, delayed, and imperfect sensor data.
• Autonomy Intent: What the drone plans to do next.

By visualizing the gap between Truth and Belief—such as a delayed detection of an obstacle or an inflating bubble of prediction uncertainty—you can understand exactly why an autonomous system might make a sub-optimal choice, and why we need independent safety mechanisms to catch those errors.

Assurance: The Independent Safety Governor

What happens when the neural network makes a mistake? Enter Run-Time Assurance (RTA). In accordance with industry standards like ASTM F3269, our architecture separates the “smart” mission planner from a “simple, verifiable” safety governor.
In the simulation, watch the Candidate Comparison matrix on your control dashboard. As the complex planner suggests routes, the independent Safety Monitor evaluates them against mathematical boundaries known as Control Barrier Functions. If the planner requests an action that violates minimum separation rules, you will witness the RTA Switch activate. The complex planner is instantly locked out, and the verified Recovery Function takes control to execute a guaranteed safe maneuver.

Lost-Link: Who is in Command?

A defining challenge of modern robotics is the loss of the command-and-control link. When a drone loses contact with its control center, it does not magically gain the authority to do whatever it wants.
Our Lost-Link Scenarios demonstrate the rigorous state-machine logic required to handle these events safely. You will see cached authority expire, watch the system fall back to predefined minimum-risk states, and most importantly, experience the “Reconciliation” phase. When the connection is restored, authority is not automatically handed back to the human. The supervisor must review the timeline of autonomous actions, verify the current state, and explicitly take back control.

Proofs: The Answerable Experience

Trust requires evidence. Every action, perception event, and safety intervention in this workbench is cryptographically hashed and appended to a deterministic timeline. At the end of every scenario, you can inspect the Evidence Package. This is the foundation of accountability in the autonomous age: proving definitively what the machine knew, what it intended, and why it acted, long after the mission is over.

16. Frequently Asked Questions (FAQ)

17. Glossary of Terms

18. Research-to-Implementation Traceability Table

19. Recommended Documentation and .uai Paths

Public Documentation Routes:

• /docs/architecture/world-truth-vs-belief
• /docs/architecture/runtime-assurance-simplex
• /docs/operations/lost-link-state-machine
• /docs/operations/human-vs-machine-supervision
• /docs/engineering/webgpu-progressive-delivery
• /docs/engineering/accessibility-equivalence
• /docs/compliance/astm-f3269-alignment

.uai Memory Nodes (For AI Developer Context):

• .uai/schema_track_belief.json
• .uai/schema_candidate_intent.json
• .uai/schema_rta_intervention.json
• .uai/schema_event_timeline.json
• .uai/sysprompt_accessibility_rules.md
• .uai/sysprompt_webgpu_optimization.md
• .uai/state_machine_stanag4586.json

20. Simulation Boundaries

What the Simulation Demonstrates

The Evulgare workbench exhaustively demonstrates the architectural separation of World Truth, Autonomy Belief, and Intent, proving that an observer can audit the epistemological gap between what a machine knows and what actually exists. It successfully visualizes the application of Run-Time Assurance via the Simplex architecture to deterministically bound unverified complex functions. It strictly models the degradation of authority during communications loss and the necessity of human or machine reconciliation upon link restoration. Furthermore, it demonstrates the generation of a cryptographic, deterministic evidence trail for post-incident auditing, all delivered through a highly performant WebGPU interface with an uncompromising accessible, non-XR equivalence for complex spatial data.

What the Simulation Does Not Demonstrate

The simulation explicitly does not model real flight control physics; there is no calculation of aerodynamics, rotor wash, PID tuning, or physical wind disturbances. It strictly forbids the modeling of weapon or payload logic, including targeting, weapon release, or tactical military employment algorithms. It does not utilize real sensor signatures, relying entirely on semantic abstractions rather than classified radar cross-sections or proprietary optical recognition models. Finally, it uses entirely synthetic, normalized coordinates, never employing real-world GPS coordinates linked to operational facilities or critical infrastructure.

What Would Require Real-System Validation

To transition from this synthetic assurance demonstration to real-world operational deployment, engineers would require extensive Hardware-in-the-Loop (HITL) testing, running the RTA algorithms on actual flight controllers to measure real sensor latency and actuation delay. The Safety Monitor and Recovery Function would require rigorous DO-178C software certification, as synthetic modeling does not replace regulatory compliance. Real-world Operational Design Domain (ODD) evaluation would be mandatory, requiring physical testing in varied weather and lighting conditions to validate the perception stack’s out-of-distribution abstention triggers31. Lastly, the lost-link state machine would require real-world spectrum and RF validation against actual radio frequency interference and signal decay profiles.

Works cited

1. ASTM F3269 - An Industry Standard on Run Time Assurance for Aircraft Systems, https://www.researchgate.net/publication/348242885_ASTM_F3269_-_An_Industry_Standard_on_Run_Time_Assurance_for_Aircraft_Systems
2. F3269 Standard Practice for Methods to Safely Bound Behavior of Aircraft Systems Containing Complex Functions Using Run-Time Assurance - ASTM, https://www.astm.org/f3269-21.html
3. Ground Control Station | UAV Navigation, https://www.uavnavigation.com/taxonomy/term/83
4. STANAG 4586: UAV Control System Standards | PDF | Unmanned Aerial Vehicle - Scribd, https://www.scribd.com/document/814956193/4586eed3draft
5. WebXR Device API Specification - W3C on GitHub, https://w3c.github.io/redesign-mockups/standards/webxr/
6. Rich Screen Reader Experiences for Accessible Data Visualization, https://vis.csail.mit.edu/pubs/rich-screen-reader-vis-experiences/
7. WebGPU Explained: The Browser’s New Graphics and Compute Engine - DEV Community, https://dev.to/biomathcode/webgpu-explained-the-browsers-new-graphics-and-compute-engine-1cld
8. Towards Unified Probabilistic Verification and Validation of Vision-Based Autonomy - arXiv, https://arxiv.org/pdf/2508.14181
9. Fail-Safe Engineering for Autonomous Systems - Embedded, https://www.embedded.com/fail-safe-engineering-for-autonomous-systems/
10. A Survey on an Emerging Safety Challenge for Autonomous Vehicles: Safety of the Intended Functionality | Request PDF - ResearchGate, https://www.researchgate.net/publication/377274864_A_Survey_on_an_Emerging_Safety_Challenge_for_Autonomous_Vehicles_Safety_of_the_Intended_Functionality
11. Control Barrier Functions: Theory and Applications | Request PDF - ResearchGate, https://www.researchgate.net/publication/332366900_Control_Barrier_Functions_Theory_and_Applications
12. Safety assurance of Machine Learning for autonomous systems | Request PDF, https://www.researchgate.net/publication/392692140_Safety_assurance_of_Machine_Learning_for_autonomous_systems
13. Geofence Definition and Deconfliction for UAS Traffic Management - ResearchGate, https://www.researchgate.net/publication/347685540_Geofence_Definition_and_Deconfliction_for_UAS_Traffic_Management
14. Design and Control for Implementation of Simulation-Based Assume-Guarantee Contracts | Request PDF - ResearchGate, https://www.researchgate.net/publication/393593201_Design_and_Control_for_Implementation_of_Simulation-based_Assume-guarantee_Contracts
15. Run-Time Assurance for Learning-Based Aircraft Taxiing - Loonwerks, https://loonwerks.com/publications/pdf/cofer2020dasc.pdf
16. A Verification Framework for Runtime Assurance of Autonomous UAS - NASA Langley Formal Methods, https://shemesh.larc.nasa.gov/fm/papers/DASC2024-SWDMC-draft.pdf
17. Bridging Symmetric Dynamics and Asymmetric Semantic Objectives: Runtime-Assured Predictive Safety Control for Autonomous Surface Vehicles - MDPI, https://www.mdpi.com/2073-8994/18/7/1123
18. Navigation system for the remote management of unmanned aircraft, https://iris.polito.it/retrieve/handle/11583/2507587/e384c42e-23fb-d4b2-e053-9f05fe0a1d67/TESI_PHD_Pacino.pdf
19. AFRL-RI-RS-TR-2017-176 - DTIC, https://apps.dtic.mil/sti/pdfs/AD1039782.pdf
20. Learning Safe-Stoppability Monitors for Humanoid Robots - arXiv, https://arxiv.org/html/2603.22703v1
21. UNMANNED AIRCRAFT SYSTEMS BEYOND VISUAL LINE OF SIGHT AVIATION RULEMAKING COMMITTEE MARCH 10, 2022 FINAL REPORT, https://www.faa.gov/regulations_policies/rulemaking/committees/documents/media/UAS_BVLOS_ARC_FINAL_REPORT_03102022.pdf
22. fdot-standard-operating-guidelines-for-uas_6-30-23.pdf, https://fdotwww.blob.core.windows.net/sitefinity/docs/default-source/geospatial/documentsandpubs/fdot-standard-operating-guidelines-for-uas_6-30-23.pdf?sfvrsn=d2dd0c25_1
23. Cybersecurity Compliance Automation -- NERC CIP, NIST, IEC 62443 | PacketViper, https://packetviper.com/compliance/
24. WebXR Device API - W3C, https://www.w3.org/TR/webxr/
25. Spaces and reference spaces: Spatial tracking in WebXR - Web APIs - MDN Web Docs, https://developer.mozilla.org/en-US/docs/Web/API/WebXR_Device_API/Spatial_tracking
26. Stop Being Static: A Guide to Motion Graphics for Website Design, https://www.motlowpromedia.com/blog/motion-graphics-for-website
27. OffscreenCanvas and Web Workers: Moving Browser Game Logic, https://simplified.media/guides/offscreen-canvas-workers
28. Best performance passing variables to template Flask / Jinja2 - Reddit, https://www.reddit.com/r/flask/comments/v5yjoz/best_performance_passing_variables_to_template/
29. Specifying Monitors for Autonomous Cyber-Physical Systems Forschungsbericht 2026-07 - electronic library -, https://elib.dlr.de/223754/1/DLR-FB-2026-07.pdf
30. A New Approach to Complex Dynamic Geofencing for Unmanned Aerial Vehicles, https://www.researchgate.net/publication/356246130_A_New_Approach_to_Complex_Dynamic_Geofencing_for_Unmanned_Aerial_Vehicles
31. Design of a perception system for the safety of highly automated agricultural machines - mediaTUM, https://mediatum.ub.tum.de/doc/1795132/1795132.pdf
32. ASTM F3269 - An Industry Standard on Run Time Assurance for Aircraft Systems - Aerospace Research Central, https://arc.aiaa.org/doi/pdf/10.2514/6.2021-0525
33. (PDF) Runtime Assurance for Safety-Critical Systems: An Introduction to Safety Filtering Approaches for Complex Control Systems - ResearchGate, https://www.researchgate.net/publication/355141882_Runtime_Assurance_for_Safety-Critical_Systems_An_Introduction_to_Safety_Filtering_Approaches_for_Complex_Control_Systems
34. Connected Vehicle Perception Monitoring: A Runtime Verification Approach for Enhanced Autonomous Driving Safety - SciTePress, https://www.scitepress.org/Papers/2024/126964/126964.pdf
35. ASTM F3548-21 - Standard Specification for UAS Traffic Management (UTM) UAS Service Supplier (USS) Interoperability - ANSI Webstore, https://webstore.ansi.org/standards/astm/astmf354821
36. Runtime monitoring of operational design domain to safeguard machine learning components - electronic library -, https://elib.dlr.de/201363/1/s13272-025-00883-6-2.pdf