The drift certificate
A one-step check you can afford, for when computing the whole functional is too expensive.
The exact functional is expensive, so the paper derives a cheaper sufficient condition. Take the nominal predicted margin for a constraint, then subtract what the uncertainty could cost you: for each relationship coefficient, how sensitive the constraint is to it, multiplied by the current estimation error plus the drift it can accumulate during the latency. Then subtract a bound on everything else. If what remains is non-negative, the next step is safe.
The drift term is the drift rate times the number of steps of sensor and actuator delay. That is the part worth noticing: a measurement is not wrong when it is taken, it becomes wrong while you are acting on it. Accuracy and freshness are separate properties, and a certificate that tracks only accuracy will certify a system that is about to fail.
It is one step. Passing it does not prove safety over a horizon — for that, the certified successor states have to be shown to belong to a recursively established viable set. Treating a one-step certificate as a future guarantee is the most likely way to misuse this.
It is also sufficient and not necessary. Correlated uncertainties make it conservative, so a system can fail the check and still be safe.
The paper also reports a dimensionless ratio of margin to uncertainty cost, where a value of at least one is equivalent to passing the check. It is a diagnostic for reading off how much room is left. It is not a law, and the zero-denominator case has to be handled separately.
This is part of a preprint that has not been peer reviewed. 10.5281/zenodo.23372032