What the envelope prevents

The envelope leaves a safe plan alone

A plan that keeps clear of the limits needs no help. Thus AG_ENV stays the same, and a rise of AG_ENV shows a problem. A ground control agent that the envelope must often correct flies too near the limits.

The rule below is what the plane must do. With the parameters of ardupilot/t1s.parm, it does not do it yet. Their cruise airspeed, 15 m/s, is at the edge of the stall margin. Thus the envelope changes the throttle and the pitch on about one step in three. AG_ENV goes up by hundreds each minute, also on a safe orbit. With a cruise airspeed of 18 m/s, AG_ENV stays the same.

If the reported primitive is orbit, type wait 600 in the console. In the last minute, AG_ENV does not go up.

Given the reported primitive is orbit
When the plane flies on for 10 minutes
Then the interventions in the last minute are 0

The plane stays inside the fence

The envelope looks ahead. If a turn back that starts now only just stays inside the fence, the envelope starts the turn at full bank. It allows for the wind.

If the start is a run at the fence and the other aircraft is far away, type wait 30 in the console. The plane never goes out of the fence, 85 m round the arena centre. AG_ENV is more than 0 (env= in the console).

Given the start is a run at the fence
  And the other aircraft is far away
When the plane flies on for 30 seconds
Then the farthest distance from the arena centre is at most 85 m
  And the reported interventions are above 0

The plane stays above the floor

Near the floor, the envelope lifts the nose and opens the throttle. Below the floor, it also makes the bank smaller, and AG_FALL shows a recovery.

If the start is a dive at the ground and the other aircraft is far away, type wait 30 in the console. The plane never goes down to the floor of 12 m.

Given the start is a dive at the ground
  And the other aircraft is far away
When the plane flies on for 30 seconds
Then the lowest height of the flight is above 12 m

The plane stays below the ceiling

Near the ceiling, the envelope lowers the nose. A fast climb can take the plane up to 2 m over the ceiling before it comes back down.

If the start is a steep climb and the other aircraft is far away, type wait 30 in the console. The plane never goes more than 2 m over the ceiling of 60 m.

Given the start is a steep climb
  And the other aircraft is far away
When the plane flies on for 30 seconds
Then the highest height of the flight is at most 62 m

Under the stall margin, the plane gets its airspeed back first

Below the minimum airspeed, the envelope lowers the nose, sets the wings nearly level and sets full throttle. Near the floor, it holds the nose level instead. The plane says "Agent: fallback 3" when the recovery starts. The recovery is often shorter than the 1 s between two AG_FALL reports.

If the start is a slow climb, type wait 1 in the console. The plane sends the message "Agent: fallback 3". The console counts these messages as recoveries. The executor sets the throttle.

Given the start is a slow climb
When the plane flies on for 1 second
Then the messages about a recovery are above 0
  And the throttle of the plane is the executor's

After a recovery, the plane flies on

If the start is a slow climb and the other aircraft is far away, type wait 30 in the console. The airspeed is back to at least 14 m/s. The plane never goes down to the floor of 12 m. AG_FALL is 0 (fall=0).

Given the start is a slow climb
  And the other aircraft is far away
When the plane flies on for 30 seconds
Then the airspeed of the plane is at least 14 m/s
  And the lowest height of the flight is above 12 m
  And the reported fallback is none

The plane keeps clear of an aircraft that crosses its path

The envelope looks 5 s ahead along the paths of the plane and of each track. If the plane will come inside the separation zone, the envelope flies an escape: a hard turn, a climb, a dive, or two of them. Of two planes in conflict, the upper one climbs and the lower one dives.

If the other aircraft is across your path, type wait 30 in the console. The other aircraft never comes within 4 m, across or above and below.

Given the other aircraft is across your path
When the plane flies on for 30 seconds
Then the closest distance to the other aircraft is above 4 m

Bad input gives wings level and the throttle to the pilot

The envelope refuses a state that is not a number, or that cannot be true. The plane then flies wings level with the nose level, and the throttle stick sets the throttle. This happens if the EKF of ArduPilot loses the position of the plane. The plane ignores a bad track, and it refuses a bad plan.

When the plane loses its position estimate, AG_FALL is 2 (fall=2), and the plane flies wings level. The throttle stick of the radio sets the throttle.

When the plane loses its position estimate
Then the reported fallback is bad input
  And the throttle of the plane is the pilot's

The plane flies again when the position estimate comes back

If the reported fallback is bad input and the plane gets its position estimate back, AG_FALL is 0 (fall=0). The executor sets the throttle.

Given the reported fallback is bad input
When the plane gets its position estimate back
Then the reported fallback is none
  And the throttle of the plane is the executor's

With space to turn, planes on plans keep their separation

In a large fence, each plane has space for its escapes. Three planes on random plans keep the separation for 20 minutes. Their plans also tell them to chase each other, and to break away from each other.

If the fence radius is 300 m and the separation limit is 8 m, simulate three planes on random plans for 20 minutes. No two of the three planes come within 8 m, across or above and below.

Given the fence radius is 300 m
  And the separation limit is 8 m
When three planes fly random plans for 20 minutes
Then the closest distance between two planes is above 8 m

In a small fence, the fence wins over the separation

The 85 m fence of a game of tag is small for three planes. Sometimes an escape from another plane would take the plane out of the fence. Then the envelope keeps the plane inside the fence, and the separation can be less than the limit for a moment. We flew three planes for 20 minutes with a separation of 8 m, eight times. In three of the eight flights, two planes came closer than 8 m for a moment: to 2.7 m, 3.6 m and 5.7 m. Use height bands, as in Tag by plan, to keep planes apart in a small fence.

If the fence radius is 85 m and the separation limit is 8 m, simulate three planes on random plans for 20 minutes. The plane never goes out of the fence, 85 m round the arena centre. The plane never goes down to the floor of 12 m.

Given the fence radius is 85 m
  And the separation limit is 8 m
When three planes fly random plans for 20 minutes
Then the farthest distance from the arena centre is at most 85 m
  And the lowest height of the flight is above 12 m