Expressions. Exactly the same formalism using expression graphs is used as in the task specification section. The syntax of these expressions is explained in appendix A. Measurements and measurement constraints A measurement specifies a measurement model for a given estimator. This measurement model gives a relationship between a sensor measurement and the estimator state (i.e. uncertaintyvariables, and uncertainty feature variables). It has the followingproperties: There can be many measurement models for a given estimator. It is not necessary that a measurement is performed at all sample times. The measurement model is only applied when new sensor values are available. These aspects are not visible at the specification side and completely decided in the estimator implementation. It can give the relationship between one or multiple sensor measurements and the uncertainty state. But all sensor values involved should be simultaneously available. Statistically speaking, conditioned on the estimator state, the sensor measurements within a measurement can be correlated, the sensor measurements between different measurements cannot be correlated. With a typical estimator implementation and a larger number of measurements, it is more efficient to apply the measurements one at the time compared to simultaneously applying all measurements. Explicitlygrouping the sensor values into separate measurements allows an implementation to choose the most efficient strategy of building up the estimator. The above properties explain why the sensors are first grouped in measurements before we specify the totalestimationproblem. The syntax of a measurement declaration is as follows: m = Meas{ name = <string>, typeName = <string>, model = <expression or list of expressions>, cov = <table of values or scalar value> } typeName can have two values, either “constraint” or “measurement” The semantics are as follows: name is a name given to the measurement the typeName specifies the nature of the measurement:

Expressions. A VDMprogramvariable x pairs a name (xn ∈ VarId) with a type (xτ ∈ Tsl). The state of a program σ is a finite partial function from variable names to values Σ ¾ {f : VarId →› › Usl | ∀ x • f (x) : xτ }. A VDM-SL expression of type τ is then modelled as a partial sl function from state bindings to values, that is E τ ¾ {f : Σ → Usl | ∀ σ • f (σ) ∈ ¢τ ¢sl}. This semantic characterisation of expressions means we can give semantics to expression operators by lifting correspondingfunctions of theunderlyinglogic, such as Isabelle/HOL. We thus define combinators for expression liftings. ⊥sl = ∅ lit(v) = {σ ›→ v | σ ∈ Σ} { ›→ | ∈ ∧ ∈ } uop(f , e) = σ f (e(σ)) σ dom(e) e(σ) dom(f ) (e (σ), e (σ)) ∈ dom(f )1 0 xxx(x , x0, x0) = .x ›→ x (x0(x), x0(x)). σ ∈ dom(e1) ∩ dom(e2) ∧ X xxxx(x , x0, x0, e3) = σ ›→ f e2(σ), . (e1(σ), e2(σ), e3(σ)) ∈ dom(f ) e1(σ), . σ ∈ dom(e1) ∩ dom(e2) ∩ dom(e3) ∧ e3(σ) ∈ ⊥ Expression sl is the undefined expression. Expression lit(v) takes a value in the un- derlying logic, v W, and constructs a literal expression; it is constant for every state. Combinators uop(f ), bop(f ), and trop(f ) construct unary, binary, and ternary expressions