Pith. sign in

REVIEW 4 major objections 6 minor 24 references

Hybrid Autonomy Framework for a Future Mars Science Helicopter

T0 review · 4 major / 6 minor · reviewed 2026-08-05 · deepseek-v4-flash

Pith's one-line read This paper claims that combining a finite state machine with behavior trees gives a Mars science helicopter deterministic, low-cost autonomy that can react to health and environmental events without human intervention.

desk verdict Competent engineering paper with a clean FSM-BT architecture for Mars helicopter autonomy; the 100% robustness claims outrun the evidence because all test events come from the predefined set the FSM was authored to handle. read the letter →

arxiv 2509.01980 v1 pith:BY3LGXK5 submitted 2025-09-02 cs.RO cs.SYeess.SY

classification cs.ROcs.SYeess.SY
keywords finitestatemachinebehaviortreesMarsScienceHelicopterautonomousaerialexplorationfault-tolerantautonomyhealthmonitoringlandingsitedetectionplanetaryrotorcraft
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that a future Mars Science Helicopter, unlike the human-planned Ingenuity, needs onboard autonomy that can adapt to terrain, battery state, and sensor health while Earth is tens of minutes away. To get that, the authors propose a hybrid controller: a finite state machine (FSM) decides which mission phase the vehicle is in, and behavior trees (BTs) execute the tasks inside each phase. The FSM gives deterministic, verifiable transitions; the BTs give flexible, reactive responses to live conditions. The central claim is that this combination is scalable, computationally cheap, and safe enough for deep-space use, backed by 270 Monte Carlo simulations and 30 field flights in which every injected fault was handled and no mission ended in a crash. If the claim holds, it offers a practical blueprint for onboard mission autonomy on planetary rotorcraft and other robots that must act without ground intervention.

What carries the argument

The load-bearing object is the event-driven FSM-BT hybrid. The FSM is a deterministic state machine with a transition table: every state declares explicit transitions for a subset of predefined events, and events without a defined transition revert to a self-transition that keeps execution in the current state. The BTs are modular control trees (Sequence, Fallback, and Parallel control nodes; retry, timeout, and inverse decorators; action and condition leaves) that execute the behavior of each state when ticked asynchronously, and their root status becomes an internal event for the FSM. The division of labor is what carries the argument: the FSM enforces mission structure and safety, while B

What would settle it

Run the same Monte Carlo harness but inject an event that is not in any state's transition table—for example, a battery reading that jumps from nominal to critical in one step, or a sensor fault that contradicts the Healthguard's own status—and observe whether the self-transition keeps the vehicle flying in Mission with a critically low battery instead of forcing an emergency landing. A single such outcome, or a real-flight anomaly outside the paper's event table that ends in a crash or unsafe state, would settle whether the completeness-and-safety claim holds.

Watch

Extended reading notes

Core claim

The paper's central contribution is a two-tier autonomy architecture. At the top tier, a Finite State Machine with states Idle, Init, PreChecks, Takeoff, Mission, Land, EmergencyLand, and Terminate manages mission phases through a deterministic state-transition table; events—BT completion or failure, battery thresholds, estimator faults, landing-site search results—trigger transitions. Inside each state, a Behavior Tree encodes the tasks for that phase, and its root status (Success, Failure, or Running) is one of the events feeding the FSM. A Healthguard module monitors battery, actuators, and estimator confidence and emits external events that can force an emergency landing or mission recon

Load-bearing premise

The framework's safety rests on the assumption that every contingency that can actually occur is covered by the predefined event set and transition table; any unmodeled event is silently treated as 'stay in the current state,' which could leave the vehicle in an unsafe state.

Editorial extensions

If this is right

  • A future Mars Science Helicopter could run the entire mission—takeoff, waypoint science, landing-site search, and emergency landing—without ground intervention, on a small flight computer.
  • Because the Connector isolates middleware, the same autonomy logic can be prototyped in ROS and redeployed on F-Prime without rewriting mission decisions.
  • Health monitoring becomes a discrete event source, so adding a new fault response means adding a row in the transition table rather than editing behavior logic.
  • Every modeled failure path converges to a safe terminal state (Land or Terminate), which is the property that makes the offline reachability check meaningful.
  • The low per-tick cost (2.2 ms control loop, 1.1 ms event-to-transition latency) leaves onboard compute for perception and science payloads.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The reported 100% figures are conditional on the injected event set; a fair stress test would inject novel or composite faults—such as simultaneous battery and estimator failure—that do not appear in the paper's event table.
  • The self-transition policy on undefined events is a deliberate simplicity-versus-safety trade-off; adversarially generating events absent from every state's transition table would reveal whether that policy keeps the vehicle in a state compatible with its current health.
  • The same FSM-BT skeleton and Healthguard event scheme could transfer to ground rovers or surface robots with little change, since only the leaf actions and the PX4 command layer are platform-specific.
  • A natural next step the authors do not develop is automatic synthesis of the transition table from a mission specification, which would make completeness claims checkable rather than hand-authored.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a hybrid autonomy framework for a future Mars Science Helicopter, combining a Finite State Machine for deterministic mission-level state management with Behavior Trees for reactive task execution. A Healthguard module monitors system health and emits discrete events (e.g., BatteryLow, StateEstimatorFailure) that drive FSM transitions. The authors validate the framework with 170 Monte Carlo simulations of the Autonomy module, 100 simulations of the Healthguard module, 30 tethered flight tests with manually injected health events, and an untethered autonomous field flight at Arroyo Seco. They report low computational overhead (2.2 ms control loop, 6.5% CPU load, 24 MB memory) and claim '100% correctness in state transitions,' '100% mission completion,' and stability when encountering undefined events.

Significance. If the robustness claims are fully supported, the framework would be a useful contribution to planetary rotorcraft autonomy: it is middleware-agnostic, modular, and computationally lightweight, and the combination of FSM and BT is a sensible engineering choice for explainable, deterministic mission execution with reactive task-level behavior. The authors should be credited for an unusually extensive validation campaign for a concept architecture, including realistic Gazebo terrain, Monte Carlo event injection, tethered hardware tests, and performance measurements on embedded hardware. However, the central safety claim depends on how the FSM handles events outside the predefined transition set, and the evidence presented does not establish safety for unmodeled contingencies. The 100% figures also overstate what can be concluded from the reported sample sizes and outcome definitions.

major comments (4)
  1. [IV-C and Fig. 6] The self-transition rule for undefined events is load-bearing for the paper's safety claims, but the validation exercises only the predefined event set. Section III-B states that an event without a defined transition is treated as a self-transition 'maintaining execution flow,' and Section IV-C claims the framework 'maintained stability when encountering undefined events.' Yet every injected event in Table I (StateEstimatorFailure, BatteryLow, BatteryCritical, EmergencyBattery, NoLandingSitesFound, LandingSiteChecks) is one of the events used to author the transition table. No experiment injects an out-of-distribution event, a corrupted event payload, or an event in a state for which no transition is defined. Therefore, the paper provides no evidence that an unmodeled contingency would not leave the current BT executing with corrupt or stale inputs. Please either (a) define the complete
  2. [IV-C and Fig. 6] The '100% correctness' and '100% mission completion' claims are not supported at the reported sample size. Across 270 Monte Carlo simulations and 30 tethered flights, if zero failures are observed, the upper 95% binomial confidence bound on the failure probability is approximately 1%, not 0%. Moreover, Figure 6 distinguishes 'Completed' from 'Emergency Landing', so it is unclear whether an emergency landing counts as 'mission completion' in the 100% claim. Please report per-outcome counts, define the completion metric precisely, and provide confidence intervals for the success probability. This is not pedantic: the central robustness result is the 100% figure, and the current reporting conflates tested-event handling with universal mission success.
  3. [III-B and IV] The actual FSM transition table that defines the framework is not included in the manuscript. The text refers to a 'state transition table' and states that the FSM is validated offline to guarantee reachability and a path to a final state, but Figure 4 is only a schematic and explicitly says arrows 'summarize such cases rather than depicting each trigger individually.' Without the full transition relation and the complete event alphabet, a reader cannot verify which events have defined transitions in which states, what the priority order is, or what self-transition means for each state. Given that this architecture is the paper's main contribution, the transition table and event set should be included as a table or machine-readable artifact.
  4. [IV-A] The Healthguard validation reports 'over 98.5% detection accuracy' but does not define what is counted as a true/false positive or negative, how ground truth was established, or how latency was measured. Since Healthguard events are the primary trigger for fail-safe transitions, a missed or delayed BatteryCritical or StateEstimatorFailure event could invalidate the safety argument. Please provide an operational definition of detection accuracy, a confusion matrix or per-event detection rates, and statistics on event detection latency, including worst-case values.
minor comments (6)
  1. Typo: 'dessert-like terrain' should be 'desert-like terrain.'
  2. Typo: 'MA VROS' should be 'MAVROS.'
  3. The caption references 'Figure 1 provides an overview' and 'Figure 2 presents the recorded flight data,' but the correct references appear to be to Figure 7 and possibly Figure 1/2 in the same figure. Please fix the cross-references.
  4. 'Chapter IV' should be 'Section IV' for consistency with IEEE format.
  5. The table header says '170 successful simulation results,' but some trials ended in emergency landing. The term 'successful' is ambiguous; clarify whether it means 'no crash' or 'reached Terminate.'
  6. The conclusion mentions '400 development flights and competition runs' without any methodological detail. This claim should be either removed or supported with a reference to a dataset or appendix.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the FSM-BT framework validation is implementation conformance testing, not a derivation equivalent to its inputs.

full rationale

The paper's central artifact is a deterministic FSM-BT controller whose transition table and BT definitions are the specification, not fitted parameters. The Monte Carlo trials and flight tests verify that the implemented system follows this specification (e.g., BatteryCritical triggers EmergencyLand as authored). This is standard engineering verification and does not reduce a prediction to an input by construction. The self-citations to xVIO [20], MBL [21], and landing-site-detection work [22]-[24] are calls to previously validated component modules and are not used to justify the hybrid architecture's validity. The claim that the system 'maintained stability when encountering undefined events' (Sec. IV-C) is a possible overgeneralization if 'undefined' means unmodeled contingency types — the reported injections in Table I all come from the predefined event vocabulary. But that is an evidence/coverage limitation, not a circular step: the self-transition rule (Sec. III-B) defines what happens for an undefined event, and testing whether the actual vehicle remains stable is an empirical check. No equation, fitted parameter, or author-uniqueness theorem is reused as its own conclusion.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The paper introduces no physical entities; its contributions are software modules (FSM-BT hybrid, Healthguard, Connector). The main epistemic cost is the self-defined event set and hand-chosen thresholds, which are the parameters that the central robustness claim rests on. No independent, externally grounded benchmarks are used.

free parameters (3)
  • Healthguard event thresholds (battery voltage, estimator confidence) = not specified
    The framework's safety behavior depends on when events fire; the exact thresholds and hysteresis for BatteryLow, BatteryCritical, and StateEstimatorFailure are not reported.
  • Takeoff timeout constants = not specified
    Section III-B says the takeoff timeout is dynamically calculated from vehicle velocity and distance to waypoint, but the constants in that calculation are not given.
  • Monte Carlo event injection distributions = not specified
    The randomized trials inject health events, but the probability distributions and scheduling of these injections are not specified, limiting independent replication.
assumptions (3)
  • ad hoc to paper The set of predefined events is complete and sufficient for mission safety.
    Section III-B treats undefined events as self-transitions, which presumes that all safety-relevant contingencies are captured in the predefined event set. No evidence is provided for this completeness.
  • domain assumption Healthguard detects anomalies accurately and timely.
    The Healthguard is reported to achieve 98.5% detection accuracy in the second Monte Carlo series, but this is only a self-assessment and no independent evaluation is provided.
  • standard math Standard behavior tree and FSM execution semantics are used.
    The framework assumes the standard tick/status semantics of behavior trees and the transition-table semantics of FSMs as established in the cited literature (refs [5]-[10]).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Hybrid Autonomy Framework for a Future Mars Science Helicopter." pith.science (2026). https://pith.science/paper/BY3LGXK5

@misc{pith2026250901980,
  author       = {Pith},
  title        = {Pith review of: Hybrid Autonomy Framework for a Future Mars Science Helicopter},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BY3LGXK5}},
  note         = {Machine review of arXiv:2509.01980}
}
read the original abstract

Autonomous aerial vehicles, such as NASA's Ingenuity, enable rapid planetary surface exploration beyond the reach of ground-based robots. Thus, NASA is studying a Mars Science Helicopter (MSH), an advanced concept capable of performing long-range science missions and autonomously navigating challenging Martian terrain. Given significant Earth-Mars communication delays and mission complexity, an advanced autonomy framework is required to ensure safe and efficient operation by continuously adapting behavior based on mission objectives and real-time conditions, without human intervention. This study presents a deterministic high-level control framework for aerial exploration, integrating a Finite State Machine (FSM) with Behavior Trees (BTs) to achieve a scalable, robust, and computationally efficient autonomy solution for critical scenarios like deep space exploration. In this paper we outline key capabilities of a possible MSH and detail the FSM-BT hybrid autonomy framework which orchestrates them to achieve the desired objectives. Monte Carlo simulations and real field tests validate the framework, demonstrating its robustness and adaptability to both discrete events and real-time system feedback. These inputs trigger state transitions or dynamically adjust behavior execution, enabling reactive and context-aware responses. The framework is middleware-agnostic, supporting integration with systems like F-Prime and extending beyond aerial robotics.

Figures

Figures reproduced from arXiv: 2509.01980 by the authors.

Figure 1
Figure 1. A notional MSH mission plan with structured task execution. The [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. System architecture for autonomous mission execution. The Auton [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Mission autonomy framework with core software components [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: High-level FSM governing mission phases (top) and integrated BTs managing task execution within each phase (bottom). The FSM is shown [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 6
Figure 6. Figure 6: Distribution of various mission outcomes across different distance [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: Autonomy and xVIO test flight in the Arroyo Seco, Pasadena, [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

24 extracted references · 23 canonical work pages

  1. [10]

    A survey of behavior trees in robotics and ai.Robotics and Autonomous Systems , 154:104096, 2022

    Matteo Iovino, Edvards Scukins, Jonathan Styrud, Petter ¨Ogren, and Christian Smith. A survey of behavior trees in robotics and ai.Robotics and Autonomous Systems , 154:104096, 2022

  2. [12]

    Aerostack2: A software framework for developing multi-robot aerial systems, 2024

    Miguel Fernandez-Cortizas, Martin Molina, Pedro Arias-Perez, Rafael Perez-Segui, David Perez-Saura, and Pascual Campoy. Aerostack2: A software framework for developing multi-robot aerial systems, 2024

  3. [13]

    Zutell, David C

    Joshua M. Zutell, David C. Conner, and Philipp Schillinger. Flexible behavior trees: In search of the mythical hfsmbth for collaborative autonomy in robotics, 2022

  4. [1]

    Balaram, MiMi Aung, and Matthew P

    J. Balaram, MiMi Aung, and Matthew P. Golombek. The Ingenuity Helicopter on the Perseverance Rover. Space Science Reviews , 217(4):56, May 2021

  5. [2]

    The mars helicopter, ingenuity: Operations and initial results

    Matthew Golombek, Nathan Williams, Havard Grip, Theodore Tzane- tos, J Balaram, Justin Maki, Robert Deen, Francois Ayoub, Michael Mischna, Carrie Brooks, et al. The mars helicopter, ingenuity: Operations and initial results. 44th COSPAR Scientific Assembly. Held 16-24 July, 44:362, 2022

  6. [3]

    Ros: an open-source robot operating system

    Morgan Quigley, Ken Conley, Brian Gerkey, Josh Faust, Tully Foote, Jeremy Leibs, Rob Wheeler, Andrew Y Ng, et al. Ros: an open-source robot operating system. In ICRA workshop on open source software , volume 3, page 5. Kobe, 2009

  7. [4]

    Bocchino Jr., Jeffrey W

    Robert L. Bocchino Jr., Jeffrey W. Levison, and Michael D. Starch. Fpp: A modeling language for f prime. In 2022 IEEE Aerospace Conference (AERO), pages 1–15, 2022

  8. [5]

    Extending the jade agent behaviour model with jbehaviourtrees framework

    Iva Bojic, Tomislav Lipic, Mario Kusek, and Gordan Jezic. Extending the jade agent behaviour model with jbehaviourtrees framework. In Agent and Multi-Agent Systems: Technologies and Applications: 5th KES International Conference, KES-AMSTA 2011, Manchester, UK, June 29–July 1, 2011. Proceedings 5 , pages 159–168. Springer, 2011

Show all 24 references
  1. [6]

    Behavior trees and state machines in robotics applications

    Razan Ghzouli, Thorsten Berger, Einar Broch Johnsen, Andrzej Wa- sowski, and Swaib Dragule. Behavior trees and state machines in robotics applications. IEEE Transactions on Software Engineering , 49(9):4243–4267, 2023

  2. [7]

    Comparison between behavior trees and finite state machines

    Matteo Iovino, Julian F ¨orster, Pietro Falco, Jen Jen Chung, Roland Siegwart, and Christian Smith. Comparison between behavior trees and finite state machines. arXiv preprint arXiv:2405.16137 , 2024

  3. [8]

    Behavior trees in robotics and ai, July 2018

    Michele Colledanchise and Petter ¨Ogren. Behavior trees in robotics and ai, July 2018

  4. [9]

    On the programming effort required to generate behavior trees and finite state machines for robotic appli- cations, 2022

    Matteo Iovino, Julian F ¨orster, Pietro Falco, Jen Jen Chung, Roland Siegwart, and Christian Smith. On the programming effort required to generate behavior trees and finite state machines for robotic appli- cations, 2022

  5. [11]

    Development and composition of robot architecture in dynamic environment

    Juan Chen and DianXi Shi. Development and composition of robot architecture in dynamic environment. In Proceedings of the 2018 International Conference on Robotics, Control and Automation Engi- neering, pages 96–101, 2018

  6. [14]

    Fast, autonomous flight in gps-denied and cluttered environments

    Kartik Mohta, Michael Watterson, Yash Mulgaonkar, Sikang Liu, Chao Qu, Anurag Makineni, Kelsey Saulnier, Ke Sun, Alex Zhu, Jeffrey Delmerico, et al. Fast, autonomous flight in gps-denied and cluttered environments. Journal of Field Robotics , 35(1):101–120, 2018

  7. [15]

    Agilicious: Open-source and open- hardware agile quadrotor for vision-based flight

    Philipp Foehn, Elia Kaufmann, Angel Romero, Robert Penicka, Sihao Sun, Leonard Bauersfeld, Thomas Laengle, Giovanni Cioffi, Yunlong Song, Antonio Loquercio, et al. Agilicious: Open-source and open- hardware agile quadrotor for vision-based flight. Science robotics , 7(67):eabl...

  8. [16]

    Wuthier, F

    D. Wuthier, F. Rovida, M. Fumagalli, and V . Kr ¨uger. Productive multitasking for industrial robots, 2021

  9. [17]

    Event-driven modeling and execution of robotic activities and contingencies in the europa lander mission concept using bpmn

    Jean-Pierre de la Croix and Grace Lim. Event-driven modeling and execution of robotic activities and contingencies in the europa lander mission concept using bpmn. Pasadena, CA: Jet Propulsion Laboratory, National Aeronautics and Space Agency , 2020

  10. [18]

    Autonomous science restart for the planned europa mission with lightweight planning and execution

    Vandi Verma, Dan Gaines, Gregg Rabideau, Steve Schaffer, and Rajeev Joshi. Autonomous science restart for the planned europa mission with lightweight planning and execution. Pasadena, CA: Jet Propulsion Laboratory, National Aeronautics and Space Agency , 2017

  11. [19]

    Onboard planning and execution of mobility and telecommunications for the endurance lunar rover

    Michel D Ingham, Zaki Hasnain, Rashied Amini, Steven Ardito, Saptarshi Bandyopadhyay, Robert Bocchino, Aaron Gaut, Lini Mestar, Gregg Rabideau, and Nicolas Rouquette. Onboard planning and execution of mobility and telecommunications for the endurance lunar rover. In AIAA AVIAT...

  12. [20]

    Bayard, and Roland Brockers

    Jeff Delaune, David S. Bayard, and Roland Brockers. xvio: A range- visual-inertial odometry framework, 2020

  13. [21]

    On-board absolute localization based on orbital imagery for a future mars science helicopter

    Roland Brockers, Pedro Proenc ¸a, Jeff Delaune, Jessica Todd, Larry Matthies, Theodore Tzanetos, and J Bob Balaram. On-board absolute localization based on orbital imagery for a future mars science helicopter. In 2022 IEEE Aerospace Conference (AERO) , pages 1–

  14. [22]

    Optimizing terrain mapping and landing site detection for autonomous uavs

    Pedro F Proenc ¸a, Jeff Delaune, et al. Optimizing terrain mapping and landing site detection for autonomous uavs. In 2022 International Conference on Robotics and Automation (ICRA) , pages 9668–9674. IEEE, 2022

  15. [23]

    Proenc ¸a, Jeff Delaune, Michael Pantic, Timo Hinzmann, Larry Matthies, Roland Siegwart, and Roland Brock- ers

    Pascal Schoppmann, Pedro F. Proenc ¸a, Jeff Delaune, Michael Pantic, Timo Hinzmann, Larry Matthies, Roland Siegwart, and Roland Brock- ers. Multi-resolution elevation mapping and safe landing site detection with applications to planetary rotorcraft, 2021

  16. [24]

    Au- tonomous safe landing site detection for a future mars science he- licopter

    Roland Brockers, Jeff Delaune, Pedro Proenc ¸a, Pascal Schoppmann, Matthias Domnik, Gerik Kubiak, and Theodore Tzanetos. Au- tonomous safe landing site detection for a future mars science he- licopter. In 2021 IEEE Aerospace Conference (50100) , pages 1–8. IEEE, 2021

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.