perf(cascade): measure the flight cascade — 1.2413 µs/tick, estimator is 91% (PERF-P01)

[avrabe]

Verify-Filter: (has-tag "performance")

Performance was the one axis on which this project could make no claim at all. engine-throughput has guarded the cFS engines since v1.56; the control path that actually flies had no timing baseline of any kind. The examples/*-bench binaries measure estimator accuracy, not time. A compositional WCET proof has existed in Lean and had never been confronted with a measurement.

Measured

cargo bench, Apple-silicon dev host, release profile:

stage	median	share
iekf_propagate	1.1256 µs	91.0 %
position_tick	73.40 ns	5.9 %
attitude_tick	15.47 ns	1.2 %
rate_tick	10.25 ns	0.8 %
mixer_mix	9.45 ns	0.8 %
full_cascade_tick	1.2413 µs	per-tick control loop

CI spread < 0.1 % — stable, not noise.

Two findings

The estimator is the cascade. IEKF is 91 %; the other four together are ~108 ns. Any cascade performance work that isn't estimator work is rounding error.

Independently corroborated: jess's scry static stack bounds put iekf at 4192 B against 16–112 B for the others. Dynamic timing here, static analysis there, neither derived from the other, same conclusion about which stage carries the mass.

The 1 kHz budget is not close. 1.2413 µs against a 1 ms period is 0.12 % of budget, ~806× margin on this host. Even allowing an order of magnitude for a Cortex-M7 at a fraction of the clock, the control math will not bound the loop — the HAL, scheduler and sensor I/O will.

full_cascade_tick is the honest per-tick figure rather than a synthetic sum: the cascade is single-rate, cascade.step() runs every stage once per tick with no divider.

What this does NOT establish

The limits are the point, so they are in the artifact and the baseline file:

• Not on-silicon. aarch64 host, warm cache, a branch predictor an M7 does not have.
• Not a comparison. The PX4 head-to-head on the same board is criterion (d) and is not done. We can say what our cascade costs, not that it costs less than the alternative — and the second half is the claim worth having.
• Not a tight SLA. No persisted history, so ceilings are coarse ~10× catastrophic guards — the same limitation FV-FALCON-PERF-001 records.

PERF-P01 and FV-FALCON-PERF-002 land at implemented, not verified. Criterion (d) is what would promote them.

One honesty note

The cargo bench step is deliberately not marked # bench-only. cargo bench is not in BENCH_PATTERNS, so that marker would claim something untrue — it genuinely runs in the gate (62 s), which is better evidence than a skip.

Evidence: gate (has-tag "performance") → 7 steps PASS, 0 FAIL. rivet validate PASS, exit 0.

Refs #8.

🤖 Generated with Claude Code