Subsea ROV: inspect a structure through a tethered control profile

What to build

Control an owned simulated ROV with depth hold, tether supervision and an inspection task for hulls, dams, pipelines or aquaculture pens.

Acceptance criteria

• Implement modeled 6-DOF thruster allocation, pressure/depth convention, leak detection and buoyancy assumptions.
• Demonstrate modeled tether/link loss, depth limits, emergency behavior and operator takeover.
• Record modeled sonar/camera evidence against a local navigation frame and specify topside/tether hardware.

Blocked by

• #2 Native runtime: run a deterministic sensor-to-actuator bench loop
• #4 Estimation: publish owned attitude and local-position estimates
• #6 Authority: verify arming, manual override and independent failsafes
• #8 Hardware adapters: command and verify the first camera or payload

Scope and evidence

The owned physics simulation is implemented. Native board, HIL and physical vehicle acceptance remain open below. Preserve explicit operator authority and report simulator, bench, HIL and vehicle evidence separately. The owned implementation must remain replaceable behind the shared driver and mission contracts.

Implemented owned ROV slice

Commit e1cb211 adds:

• Eight signed thrusters with full-rank six-axis allocation, saturation accounting, rigid-body added mass/inertia, current-relative drag, restoring moments, positive buoyancy and geometric tether load. Coefficients are fictional fixtures, not measured BlueROV parameters.
• The common raw IMU pipeline plus owned pressure/DVL navigation. Bottom-locked BODY_FRD velocity is rotated using capture-time owned attitude and integrated from an explicit stationary surface alignment. The local water-surface depth datum is distinct from ellipsoid altitude. Actual raw source counters prove zero underwater GNSS observations.
• Estimated depth/position/attitude control through common mission authority and independent output leases. Nominal/current fixtures complete dive, inspect, return and stop. Twelve hazards cover leak, tether load/link, pressure/DVL/IMU/sensor loss, depth limit, emergency, operator takeover, kill and host loss.
• Scoped post-request capture ACKs with no automatic uncertain retry. A forward body ray must hit the declared structure; the separate bottom range is vertical LOCAL_NED clearance. Synthetic 4 by 4 PGM pixels, ranges, estimated capture pose, source epochs and declared uncertainty are retained in an export artifact. These are modeled records, not acquired photographic inspection evidence or imaging sonar.
• Native Stacks subsea:simulate --inspection ..., standalone CLI support and the common stx mission viewer. Playback reveals a capture only after its recorded ACK. Hardware candidates and explicit Pi 5/topside/tether integration limits are documented.

Read the model, hardware path and limits, ADR 15 and shared vehicle runtime.

Validation evidence

• 353 Bun tests, 23,514 assertions, zero failures; 13 Python bridge tests pass.
• Buddy lint, application/runtime/view typechecks, roadmap/parity structural checks and standalone CLI checks outside the checkout pass.
• Nominal/current complete at fixture times 19,820/19,780 ms. A nominal capture occurs at 11,320 ms and is delivered at 11,380 ms. Source counts are 991/989 IMU and zero GNSS. Independent modeled board outputs finish at eight zeros.
• Public tests cover independent six-axis wrenches, coupled attitude recovery, buoyancy/current/tether dynamics, pressure conversion, DVL capture-attitude rotation and drift, once-only integration, sensor/clock/replay faults, independent pressure provenance after DVL loss, exact capture scope and uncertainty, altered evidence, reusable sessions and native artifact export.
• Standards and Spec reviews passed after rejecting malformed uncertainty maps and pressure replay before diagnostic publication. Both original public reproductions now reject correctly.
• Real browser QA: nominal capture/ACK, no image before ACK, 16 exact rendered grayscale pixels, host-loss versus stale-host snapshots, synchronized timeline, no console errors and zero overflow at 320/375 px.
• CI for this pushed commit passed, including the Linux standalone nominal inspection and tether-loss commands, all regression checks and both Pico 2 cross-builds.

Remaining physical and fidelity acceptance

• Identify an actual hull, thruster/ESC allocation, power and cooling system; measure added mass, drag, thrust/current, dead bands, buoyancy trim and stopping behavior.
• Implement and qualify board thruster IO, independent stop/watchdog, physical leak/tether sensing and topside command ownership. Current firmware remains neutral-only.
• Implement actual DVL/pressure/sonar/camera protocols, calibration, underwater optics, clock alignment and source-quality evidence. DVL dead reckoning still drifts and absolute heading is unobserved.
• Measure tether drag, snag/entanglement, penetrator and enclosure behavior; test pressure/leak/power/thermal failure in a controlled tank.
• Qualify persistent restart/recovery, HIL and supervised physical depth/return/takeover campaigns. Neutral thrust plus positive buoyancy does not prove a safe ascent route.
• Validate real hull/dam/pipeline/aquaculture inspection coverage and evidence products. The retained 4 by 4 image and scalar ranges do not implement photographic inspection, imaging sonar, defect detection or photogrammetry.

This issue stays open for those gates. All current evidence is owned physics simulation, not external firmware SITL, HIL, native underwater execution or physical inspection.