Autonomous Underwater Vehicle

Rationale: BMS fault detection is the first line of defence against thermal runaway — verification must confirm both detection sensitivity and freedom from false alarms at boundary conditions.

Rationale: Drop weight release is the primary emergency ascent mechanism — the 2-second budget derives from the 5-second total emergency response time in SYS-FUNC-003.

Rationale: Pressure hull is single-point-of-failure for vehicle survival. Proof testing at 1.5x validates the safety factor in SYS-FUNC-010 and confirms weld quality and material properties.

Rationale: Command encryption prevents spoofed abort or mission modification commands — a vehicle accepting forged commands in open ocean is a loss scenario.

Rationale: Leak detection is the earliest warning of pressure hull compromise — the 0.5 ml threshold must be validated at every sensing point, not just as a system-level test.

Rationale: Integration test at component level to verify interface compliance before hull integration where access is limited.

Rationale: CRC integrity is safety-relevant — corrupt velocity data can cause position error accumulation without detection.

Rationale: Latency and uncertainty propagation are both critical — late fixes degrade position accuracy and incorrect uncertainty weighting causes filter inconsistency.

Rationale: This is the primary navigation output interface. Latency exceedances directly impact vehicle control stability. 99.9th percentile used because deterministic real-time performance is required.

Rationale: Sequence counter reliability directly supports data integrity for the vertical navigation channel. False positives would trigger unnecessary fault responses.

Rationale: System-level integration test exercises the complete sensor-to-output chain including EKF tuning, sensor timing, and cross-sensor consistency. 4-hour subset of 24-hour mission provides statistical confidence while keeping test duration practical.

Rationale: BMS-VMC interface is safety-relevant for mission abort decisions. 24-hour test matches full mission endurance.

Rationale: Load shedding timing and channel isolation are critical for preventing cascading power failures during emergency energy management.

Rationale: Integration test at the most critical internal propulsion interface. Validates both power delivery quality and feedback signal integrity under realistic operating conditions.

Rationale: CAN bus reliability between VMC and motor drive is critical for propulsion control. Frame loss or excessive latency would cause speed oscillations affecting survey quality.

Rationale: Control surface interface accuracy directly affects trajectory tracking. This test validates the complete command chain from VMC through CAN to actuator and back.

Rationale: Buoyancy trim interface validation ensures the VMC can monitor and control depth trim. The 30-minute test duration covers multiple full trim cycles.

Rationale: System-level integration test exercises the complete propulsion chain from VMC command through motor drive, motor, propeller thrust generation, and control surface steering. Validates that component-level specifications compose into compliant system-level performance.

Rationale: Integration test to verify leak detection interface operates correctly at both the interrupt-driven and polling paths, and that condensation discrimination prevents false emergency surfacing.

Rationale: Confirms the watchdog timeout mechanism works end-to-end from heartbeat cessation through GPIO transition to ESC interrupt, verifying the fail-safe active-low open-drain topology.

Rationale: Full-path test of both release mechanisms and the escalation logic, verifying the diverse redundancy architecture. Tests both the nominal path and the failure escalation path.

Rationale: Confirms the latching activation and power-independent operation that enables 90-day seabed localisation even after complete vehicle power loss.

Rationale: End-to-end verification of the two-stage arming/activation architecture that prevents premature beacon activation at depth while ensuring autonomous surface activation.

Rationale: Confirms the separation between telemetry (UART) and safety-critical watchdog reset (GPIO) paths, ensuring that a UART failure cannot mask a genuine VMC hang.

Rationale: Confirms the hardwired battery critical signal operates independently of the CAN bus data link, ensuring the ESC receives battery critical notification even during a CAN bus or VMC failure.

Rationale: System-level integration test exercising the complete emergency chain from fault detection through recovery aid activation, verifying that the independent safety architecture functions as designed under simulated conditions.

Rationale: Integration test verifying the highest-bandwidth sensor interface can sustain peak data rate without packet loss over mission-representative duration.

Rationale: Validates hardware trigger synchronisation path which is critical for georeferencing accuracy. 100-frame burst at max rate exercises the sustained transfer capability.

Rationale: RS-232 link verification confirms both electrical connectivity and telegram parsing. 1-hour duration proves sustained operation without serial buffer overrun.

Rationale: Validates the real-time SVP correction path. Step-change test is the clearest way to confirm the MBES is actively using the CTD-provided sound velocity rather than a stale value.

Rationale: Most critical storage path test. 1-hour duration at peak rate confirms no thermal throttling or firmware write amplification degrades throughput during sustained operation.

Rationale: Dual-purpose test validates both real-time telemetry path and post-mission offload capability. 10 GB dataset is representative of a partial offload scenario.

Rationale: System-level integration test exercising the full stimulus-to-storage chain under realistic concurrent load. 30-minute duration validates thermal and buffer stability.

Rationale: Exercises the full packet size range and validates CRC-16 error detection on the serial link.

Rationale: Validates MO/MT message handling at maximum payload size through the AT command protocol.

Rationale: Validates concurrent protocol operation under load — the primary failure mode for Wi-Fi offload is telemetry dropping during bulk transfer.

Rationale: Validates the most critical command path and the store-and-forward resilience across VMC restart, which is the key architectural differentiator of the centralised controller design.

Rationale: The ESC must operate independently of the main power system. This test verifies the dedicated emergency battery provides 48-hour endurance, the minimum time for a surface vessel to locate and recover a surfaced AUV in remote ocean areas.

Rationale: The majority voting logic is the primary defence against false emergency surfacing events which abort the mission. Testing must verify both correct rejection of transients and correct assertion of genuine multi-channel faults across all three safety input types.

Rationale: A navigation processor that incorporates faulty sensor data generates erroneous position estimates leading to off-track survey or seabed collision. The 500 ms detection window must be verified for each sensor with realistic fault signatures.

Rationale: The burn-wire is the last-resort recovery mechanism. Temperature directly affects nichrome wire heating rate. Testing at extremes verifies the 15-second budget under worst-case thermal conditions.