\begin{document}

\title{Proofs of Technical Results Justifying an Algorithm of Reactive 3D Navigation of a Mobile Robot through an Unknown Tunnelootnotemark[1]}
\renewcommand{\fnsymbol{footnote}}{\fnsymbol{footnote}}
\footnotetext[1]{This work was supported the Russian Science Foundation 14-21-00041p and by the Australian Research Council.}
\footnotetext[2]{Department of Mathematics and Mechanics, Saint Petersburg State University, St. Petersburg, Russia}
\footnotetext[3]{School of Electrical Engineering and Telecommunications, University of New South Wales, Sydney,  Australia}

\section{Introduction}
 We consider the problem of autonomously driving a mobile robot through an unknown and unstructured 3D tunnel-like environment. This task is elemental for many applications of mobile robotics such as
inspection and servicing of storm runoff networks, channelized aquifers, mines, bypass tunnels for dams, pipelines in sewer networks, power plants, factories, petrochemical, water supply and fluid transportation industries \cite{RohCho02,OnKeBo03,ThBrBe08,WuLiZhShQi08,TurGar10,GaTaTh13,NaPr14},
underwater environmental studies and archeology, exploring flooded cenotes
and ancient cisterns \cite{WHOBGC10full,FaKaJoWe10,MaRiRiCa16full},
indoor and city exploration, rescue, and surveillance by micro air vehicles (MAV) \cite{BaHeRo09,ShBoBeSi09}, to name just a few.
\par
We focus on the case where the robot does not touch the perimeter of the tunnel, should respect a certain safety margin to it, and subject to this limitation, is free to move in all three dimensions. This is typical in aerial and underwater robotics, which are growing fields with ever-extending application possibilities, where they often hold promise
of more effective alternative technology. To acquire this benefit, the robots should be equipped with navigation
algorithms that enable them to operate autonomously through long time and distance scales.
Meanwhile, the studied case does not concern most specialized in-pipe inspection robots manufactured up to now, whose locomotion relies on a firm contact with the tunnel boundary surface \cite{TurGar10,NaPr14}. For them, the proposed navigation solutions substantially benefit from the fact that the workspace is typically structured (is composed of standard element like straight pipe, T-junction, etc.) and may be partly or fully known.
\par
This paper is targeted at another situation of an unstructured and unknown tunnel with a generic local geometry and a robot whose sensory data is confined to a close small patch of tunnel's boundary, whereas the ``opposite patch'' may be out off the sensing distance.
Such confined and overhead unstructured
environments coupled with the lack of an exterior navigation assistance still constitute a real challenge for underwater autonomous navigation so that most respective missions (e.g., in underwater caves or shipwrecks) are performed by human divers or remotely teleoperated robotised vehicles up to now \cite{WHOBGC10full,MaRiRiCa16full}.
Meanwhile, typical approaches to navigation of MAV's\cite{Kendoul12} have
various limitations due to e.g., reliance on known, including pre-installed, landmarks, salient features or environmental patterns \cite{ToVaHoFe06,MoHiKi07,AhLeAnHo09full,LeFrPo11}, maps \cite{TrBuFo05}, a priori image-databases \cite{CoMeGuMa09}, external positioning systems \cite{ScJuRu09full,AhLeAnHo09full}, or a partially structured environment to enable incremental motion planning  \cite{BaPrHeRo11,GrGrBu12full}. Some of these methods, including simultaneous 3D localization and mapping (SLAM), are computationally expensive \cite{AnFiDoMe06}, hardly match capacities of on-board processors and so use extensive off-board computations \cite{BaHeRo09}, which require reliable communication and may cause undesirable feedback delays.
\par
This paper is aimed at showing that
even in the face of nonholonomy, under-actuation, finite control range, poor knowledge of the scene, and limited sensory  capacity, long-distance fully autonomous advancement through a generic tunnel is feasible
at a little computational cost: control signal is generated via a direct reflex-like conversion
of the current observation.
No complex or dubious operations, like building a map or depositing marks in the scene, are employed for navigation.
\par
An extended introduction and discussion of the control law that achieves the stated objective are given in a manuscript submitted by the authors to the IFAC journal {\it Automatica}. The subsequent text basically contains the proofs of the technical facts underlying justification of the convergence and performance of the algorithm proposed in that manuscript, which were not included in it because of the paper length limit.
This text mainly focuses on geometric issues related to the concept of ``tunnel'', its main content may be attributed to the area of differential geometry. The assumptions of the study are borrowed from that manuscript and are partly motivated by navigation and control concerns.
\par
The body of the paper is organized as follows. Sections~\ref{sec1} and \ref{sec.necass} introduce the tunnel environment
and the assumptions of theoretical analysis, respectively.
Section~\ref{sec.recog} presents a particular way of access to local features of tunnel's surface that can be employed for global navigation.
Section~\ref{sec.proper} discusses some properties of tunnels, the main result of Section~\ref{sec.recog} is proved in Section~\ref{app.proofprop}.
\par
Throughout the paper, the following notations are used:
\begin{itemize}
\item $\spr{A}{B}$ and $A\times B$, inner and cross product, respectively;
\item
$\|\cdot\|$, Euclidean norm of a vector and spectral norm of a matrix and linear operator;
\item $\boldsymbol{\pi}(\boldsymbol{r})$, set of all {\it projections} of point $\boldsymbol{r} \in \mathbb{R}^3$ onto a regular surface $S \subset \mathbb{R}^3$, i.e., points $\boldsymbol{s} \in S$ such that
\begin{equation}
\label{def.dist}
\|\boldsymbol{r} - \boldsymbol{s}\| = \dist{\boldsymbol{r}}{S}:=\min_{\boldsymbol{s}^\prime \in S} \|\boldsymbol{s}^\prime - \boldsymbol{r}\|;
\mathpzc{E}nd{equation}
\item  $\mathfrak{T}_{\boldsymbol{s}}(S)$, plane tangent to $S$ at $\boldsymbol{s} \in S$;
\item  $N(\boldsymbol{s})$, unit normal to tunnel $S$ directed inside the tunnel;
\item $D_VW$, derivative of the field $W$ in direction of $V$;
\item  $\mathscr{S}_{\boldsymbol{s}}(V) = - D_{V}N$, shape operator (Weingarten map);
\item  $\ff{\boldsymbol{s}}{V}{W}:= \spr{\mathscr{S}_{\boldsymbol{s}}(V)}{W}, V,W \in \mathfrak{T}_{\boldsymbol{s}}(S)$, second fundamental form (shape tensor);
\item  $\varkappa_-(\boldsymbol{s}) \leq \varkappa_+(\boldsymbol{s})$, principal curvatures, i.e., the eigenvalues of the quadratic form $\ff{\boldsymbol{s}}{\cdot}{\cdot}$;
\item $E_\pm(\boldsymbol{s})$, respective unit eigenvectors (principal eigenvectors) continuously depending on $\boldsymbol{s}\in S$;
\item  $p_\pm(\boldsymbol{s})$, lines spanned by $E_\pm(\boldsymbol{s})$ (principal directions);

\item  $\varepsilonc{\tau}(\boldsymbol{s})\in \mathfrak{T}_{\boldsymbol{s}}(S)$, smooth unit vector-field tangent to the meridian $\mathscr{M}[b(\boldsymbol{s})]$ that passes through $\boldsymbol{s}$;
\item  $\varepsilonc{\tau}_\ast(\boldsymbol{s}_\ast)\in \mathfrak{T}_{\boldsymbol{s}_\ast}[S(d_\ast)]$, similar vector-field on $S(d_\ast)$;
\item $S(d_\ast) := \{\boldsymbol{p} = \boldsymbol{s} + d_\ast N(\boldsymbol{s}), \boldsymbol{s} \in S \setminus \partial S\}$, locus of the desired locations of the robot;
\item  $\mathfrak{T}_{\boldsymbol{s}\ast}[S(d_\ast)]$, plane tangent to $S(d_\ast)$ at $\boldsymbol{s} \in S(d_\ast)$;
\item  $N_\ast(\boldsymbol{s})$, unit normal to $S(d_\ast)$ directed outward $S$;
\item $\mathbf{Pr}_L$, orthogonal projection onto a subspace $L \subset \mathbb{R}^3$;
\item $\nabla_VW$, Levy-Civita covariant derivative, i.e., $\nabla_VW = \mathbf{Pr}_{\mathfrak{T}} D_V W$, where $\mathfrak{T}$ is the tangent plane;
\item $\mathbf{Id}_{\boldsymbol{s}}$, identity operator acting in $\mathfrak{T}_{\boldsymbol{s}}$;
\item $[A,B,C]:= \spr{A}{B \times C}$, triple product;
\item $\sphericalangle(A,B)$, angle from $A$ to $B$, where $A, B \in \mathfrak{T}_{\boldsymbol{s}}(S)$ and positive angles are countered counterclockwise when looking from the side of $N(\boldsymbol{s})$;
\item $\mathscr{R}_{\boldsymbol{s}}(\theta)$, rotation of the plane $\mathfrak{T}_{\boldsymbol{s}}(S)$ through angle $\theta$.
\mathpzc{E}nd{itemize}

\section{Tunnel environment}
\label{sec1}
 We consider a mobile robot that operates in a tunnel-like environment bounded by a regular surface $S \subset \mathbb{R}^3$. It is required to advance the robot through the tunnel and, in the case of a long operation, to eventually approach a certain ``comfortable'' value $d_\ast$ of the distance $d$ to $S$.
A troublemaking trait of the robot is that its sensing capacity is limited.
In its local frame, it identifies the direction $\varepsilonc{d}$ to a minimum-distance point $\boldsymbol{\pi}(\boldsymbol{r})$ of $S$ and the distance to $S$ along any ray emitted from $\boldsymbol{r}$ at an angle $\leq \alpha_s$ with respect to $\varepsilonc{d}$, where $\alpha_s>0$ is a constant. Thus the robot ``sees'' only a small patch of $S$ around $\boldsymbol{\pi}(\boldsymbol{r})$ 
 but has no access to any global direction, including the desired direction of motion that corresponds to ``advancing along the tunnel''. Thus the robot has no other option but to recognize this direction from features of the sensed small patches of $S$.
\par
 As a result, the control objective is realistic not for any surface $S$: ``advancement along the tunnel'' should be of sense and its direction should be recognizable from observing small patches of $S$. A prototypical sample where these are satisfied is a circular cylinder. Then the ``direction of advancement'' is that of its generatrix, it can be determined as that in which any patch of the boundary has zero curvature. Inspired by this sample, we will deal with surfaces for which contortion of any patch is minimal in an acceptable direction of motion.
 \par
 Now we pass to a rigorous definition.
\par
Let $\boldsymbol{B}$ be either a) the real line $\mathbb{R}$, or b) the unit circle $S^1 \subset \mathbb{R}^2$, or c) an interval $[b_-,b_+] \subset \mathbb{R}$.
\begin{define}
\label{def.tun}
A {\mathpzc{E}m tunnel with the basis} $\boldsymbol{B}$ is a $C^3$-smooth regular surface $S$ (with a one-dimensional boundary $\partial S = B^{-1}[b_-] \cup B^{-1}[b_+]$ in the case c)) equipped with a {\mathpzc{E}m projection} $B: S \to \boldsymbol{B}$ such that
\begin{enumerate}[{\bf i)}]
\item The projection is a proper surjective submersion: it is $C^3$-smooth, maps $S$ onto $\boldsymbol{B}$, its differential has rank $1$ everywhere, and the inverse image of any compact subset of $\boldsymbol{B}$ is compact;
\item Any {\mathpzc{E}m meridian} $\mathscr{M}(b):= B^{-1}[b]$ is a simple closed curve and the set $S$ is closed.
\mathpzc{E}nd{enumerate}
\mathpzc{E}nd{define}
\par
If $\boldsymbol{B} = [b_-,b_+]$, the tunnel is said to be {\it open}, and {\it closed} otherwise. The (multivalued in general) {\it basic coordinate} $b(\boldsymbol{r}):=\{B(\boldsymbol{s}):\boldsymbol{s} \in \boldsymbol{\pi}(\boldsymbol{r}) \}$ of $\boldsymbol{r}$ assesses progression of robot $\boldsymbol{r}$ through the tunnel: Progression is associated with evolution of $b$ in a certain direction.
The case of $\boldsymbol{B}=\mathbb{R}$ is a model for a ``very long tunnel''.
\par
A prototypical sample of a tunnel is a right cylindrical surface, where $b$ is the coordinate along the axis of symmetry and the meridians are the perpendicular sections.  A closed compact tunnel is exemplified by a torus that is obtained by revolving a circle about an axis coplanar and disjoint with the circle. Then the meridians are instant snapshots of the moving circle and the coordinate $b = (\cos \varphi, \sin \varphi)\in S^1$ assesses the rotation angle $\varphi$. Another example is a surface of revolution, where the generatrix is a graph of a positive function defined on the axis of revolution $AoR$, the meridians are the paths of the points of the revolved curve, and $b$ is the coordinate along $AoR$.
Any diffeomorphism $J$ of an open vicinity of a tunnel $S$ onto an open subset of $\mathbb{R}^3$ transforms $S$ to a new tunnel with the projection $B \circ J^{-1}$ and meridians $J[\mathscr{M}(b)]$. Meanwhile, there exist tunnels of other origins; for example, they may be obtained by properly moving a planar Jordan curve over a space path.
\par
If the tunnel is open, the robot should reach its {\it end}, i.e., $\boldsymbol{\pi}(\boldsymbol{r})$ must arrive at the $\delta_s$-vicinity of $\partial S$, where $\delta_s>0$ is given. We assume that the robot can recognize this event via presence of the edge $\partial S$ in the sensory data.
For a closed tunnel, it is needed to ensure that the basic coordinate eventually evolves in an altered direction with a speed separated from zero.
Such a behavior is yet realistic only after tolerating a transient.
\par
With these in mind, we denote by $\boldsymbol{r}(t)$ the position of the robot at time $t$ and arrive at the final statement of the control objective.
\begin{define}
\label{def.evadv}
The robot is said to {\mathpzc{E}m solve the tunnel} if
$
d(t) := \dist{\boldsymbol{r}(t)}{S} = \|\varepsilonc{d}(t)\| >0 \; \forall t
$ and there exists time $t_0$ such that
\begin{itemize}
\item For an open tunnel, $\boldsymbol{\pi}[\boldsymbol{r}(t_0)]$ is in the $\delta_s$-vicinity of $\partial S$;
\item In the case of a closed tunnel, the following statements are true whenever $t \geq t_0$:
\begin{enumerate}[{\bf i)}]
\item The robot's basic coordinate $b(t)$ is unique, smoothly depends on time, and $\pm \dot{b}(t) \geq v_b$, where the sign in $\pm$ and $v_b>0$ do not alter with time;
\item The distance $d(t)$ to $S$ smoothly depends on time and monotonically converges to $d_\ast$ as $t \to \infty$.
\mathpzc{E}nd{enumerate}
\mathpzc{E}nd{itemize}
\mathpzc{E}nd{define}
\par
This covers the cases of operation inside the tunnel and outside it.
For the sake of definiteness, we focus on the first case.
If $\boldsymbol{B}= S^1$, the derivative $\dot{b}$ is meant as that of the angular coordinate of $b \in S^1$.
\par
If the tunnel is open, Definition~\ref{def.evadv} sets an objective to run the entire length of the tunnel from an initial location to some end of the tunnel and, thus, to arrive at a position of leaving the tunnel. If the tunnel is closed, an endless progression through the tunnel in a fixed direction is targeted, with the distance $d$ approaching $d_\ast$.
\par
Now we introduce a class of tunnels for which the direction of motion is recognizable from any its small patch.
\begin{define}
\label{def.locdir}
A tunnel is said to be {\mathpzc{E}m regular} if for any $\boldsymbol{s} \in S$, the normal curvature of $S$ in the meridian direction $\varepsilonc{\tau}(\boldsymbol{s})$ is not minimal, moreover, it is separated from $\varkappa_-(\boldsymbol{s})$ by a gap $\Delta_{\tau}>0$ that does not depend on $\boldsymbol{s}$:
\begin{equation}
\label{basic.ineq}
\ff{\boldsymbol{s}}{\varepsilonc{\tau}(\boldsymbol{s})}{\varepsilonc{\tau}(\boldsymbol{s})} \geq \varkappa_-(\boldsymbol{s}) + \Delta_\tau .
\mathpzc{E}nd{equation}
\mathpzc{E}nd{define}
The second claim follows from the first one if $S$ is compact. Due to \mathpzc{E}qref{basic.ineq}, $\varkappa_-(\boldsymbol{s}) < \varkappa_+(\boldsymbol{s})$ and so the principal directions $p_\pm(\boldsymbol{s})$ and vector-fields $E_\pm$ are well-defined.
\par
The right cylindrical surface is a regular tunnel since $\varkappa_-=0$ and the meridian curvatures are positive.
For the torus, the curvature of any meridian is $r^{-1}$ and $\varkappa_-=\frac{\cos u}{R+r\cos u}$ \cite[p.~157]{Carmo76}, where $R>r$ and the torus is parametrized by $[(R+r\cos u)\cos v, (R+r\cos u)\sin v, r \sin u], u,v \in [0, 2\pi)$. Hence the torus is a regular tunnel since $ r^{-1}>\varkappa_-$.
\par
From now on, we deal with a regular tunnel.
\par
In conclusion of the section, we discover a geometric sense of i) in Definition~\ref{def.evadv} by using
the map
\begin{equation}
\label{map.j}
\boldsymbol{s} \in S \setminus \partial S \mapsto J(\boldsymbol{s}):=\boldsymbol{s} + d_\ast N(\boldsymbol{s}) \in S(d_\ast),
\mathpzc{E}nd{equation}
which diffeomorphically maps $S \setminus \partial S$ onto $S(d_\ast)$ (under the assumptions of this paper, see Corollary~\ref{cor.smooth}). This map gives rise to the {\it meridians $\mathscr{M}_\ast(b) = J[\mathscr{M}(b)]$ on} $S(d_\ast)$. Their tangents can be arranged into the smooth unit vector-field $\varepsilonc{\tau}_\ast$ on $S(d_\ast)$:
\begin{equation}
\label{tau.ast}
\varepsilonc{\tau}_\ast(\boldsymbol{r}) := \frac{J^\prime(\boldsymbol{s}) \varepsilonc{\tau}(\boldsymbol{s})}{\|J^\prime(\boldsymbol{s}) \varepsilonc{\tau}(\boldsymbol{s})\|}, \quad \text{where} \; \boldsymbol{s} := J^{-1}(\boldsymbol{r}).
\mathpzc{E}nd{equation}
\par
In Definition~\ref{def.evadv}, i) means that while moving nearly over $S(d_\ast)$, the robot transverses the meridians in an unaltered direction at angles that are separated from zero and eventually crosses any meridian that lies in the direction of motion with respect to the initial one.

\section{Assumptions of theoretical analysis}
\label{sec.necass}
\setcounter{equation}{0}
\begin{assumption}
\label{ass.unique}
For any $\boldsymbol{r} \in S(d_\ast)$, the set $\boldsymbol{\pi}(\boldsymbol{r})$ of projections of $\boldsymbol{r}$ onto $S$ contains a unique point $\boldsymbol{s}(\boldsymbol{r})$.
\mathpzc{E}nd{assumption}
For convenience's sake, we define the operational zone $Z_{\text{op}}$ of the robot in terms of the extreme values $d_- < d_+$ that are assumed by the distance $d$ to the surface $S$ in this zone:
\begin{equation}
\label{dop}
Z_{\text{op}} := \{\boldsymbol{r} = \boldsymbol{s} + d N(\boldsymbol{s}): \boldsymbol{s} \in S \setminus \partial S, d \in (d_-,d_+)\},
\qquad
\text{where} \quad 0 < d_- < d_\ast < d_+.
\mathpzc{E}nd{equation}
\begin{assumption}
\label{as.cum}
Assumption~{\rm \ref{ass.unique}} is valid with any $d_\ast$ from $[0,d_+]$ and there exists $\Delta_\varkappa \in (0,1]$ such that
\begin{equation}
\label{ineq.cur2}
 1- d_+ \varkappa_+(\boldsymbol{s}) \geq \Delta_\varkappa \qquad \forall \boldsymbol{s} \in S.
\mathpzc{E}nd{equation}
\mathpzc{E}nd{assumption}
Whenever $\varkappa_+(\boldsymbol{s}) \leq 0$, \mathpzc{E}qref{ineq.cur2} is certainly true.
\par
The last assumption is purely technical.
\begin{assumption}
\label{ass.lipsch}
The maps $N, \varkappa_\pm, E_\pm,\nabla B$ are Lipschitz:
there exist constants $L_N,L_\varkappa, L_E, L_B>0$ such that
\begin{gather}
\label{lip.const}
\| N(\boldsymbol{s}_1)-  N(\boldsymbol{s}_2)\| \leq L_N \|\boldsymbol{s}_1- \boldsymbol{s}_2\|,
\\
\nonumber
| \varkappa_\pm(\boldsymbol{s}_1)-  \varkappa_\pm (\boldsymbol{s}_2)| \leq L_\varkappa \|\boldsymbol{s}_1- \boldsymbol{s}_2\|,
\\
\nonumber
\| E_\pm(\boldsymbol{s}_1)-  E_\pm (\boldsymbol{s}_2)\| \leq L_E \|\boldsymbol{s}_1- \boldsymbol{s}_2\|,
\\
\nonumber
\| \nabla B(\boldsymbol{s}_1)-  \nabla B(\boldsymbol{s}_2)\| \leq L_B \|\boldsymbol{s}_1- \boldsymbol{s}_2\| \; \forall \boldsymbol{s}_1, \boldsymbol{s}_2 \in S.
\mathpzc{E}nd{gather}
Furthermore, there exist $\Delta_B^\pm>0$ such that $\Delta_B^- \leq \|\nabla B(\boldsymbol{s})\| \leq \Delta_B^+ \; \forall \boldsymbol{s} \in S$.
\mathpzc{E}nd{assumption}
\par
For a compact tunnel, this assumption necessarily holds.

\section{Direction estimator}
\label{sec.recog}
\setcounter{equation}{0}
Its role is to generate the direction of motion along the tunnel: This direction should be transversal to the meridian passing through $\boldsymbol{s}$ to meet i) in Definition~\ref{def.evadv}. The premise is the sensory data, i.e., the direction $\varepsilonc{d}$ from robot's location $\boldsymbol{r}$ to its projection $\boldsymbol{s}:=\boldsymbol{\pi}(\boldsymbol{r})$ onto $S$ and the distance $d(\alpha,\varphi)$ to $S$ along any ray $\mathfrak{R}$ emitted from $\boldsymbol{r}$ at an angle $\alpha \in [0, \alpha_s]$ to $\varepsilonc{d}$. Here $\varphi$ is the angle giving the direction of $\mathfrak{R}$ in projection onto the plane $\varepsilonc{d}^{\,\bot}$ normal to $\varepsilonc{d}$.
\par
As a basic choice, the principal direction $p_-(\boldsymbol{s})$ might be used since it transverses the respective meridian due to \mathpzc{E}qref{basic.ineq}.
However, computation of $p_-(\boldsymbol{s})$ involves second-order differentiation of the sensory data, which is a highly unstable procedure. So we employ differentiation-free and simpler methods. We do not confine ourselves to $p_-(\boldsymbol{s})$ and a particular method but adopt a whole class of them that is delineated in the following definition. It takes into account that the direction of motion in needed only in the {\it active operational zone} $Z_{\text{op}}^a :=\{\boldsymbol{r} \in Z_{\text{op}}: \boldsymbol{\pi}(\boldsymbol{r})\,\text{is not in the $\delta_s$-vicinity of} \, \partial S\}$ since the mission is terminated as soon as $\boldsymbol{\pi}(\boldsymbol{r})$ enters this vicinity. For closed tunnels, $\partial S = \mathpzc{E}mptyset$ and so $Z_{\text{op}}^a =Z_{\text{op}} $.
\begin{define}
\label{dir.estdef}
{\mathpzc{E}m Direction estimator (DE)} maps location dependent $O=O(\boldsymbol{r})$ sensory data into a straight line $p(\boldsymbol{r}) \subset \mathfrak{T}_{\boldsymbol{\pi}(\boldsymbol{r})}(S)$ such that the associated map $\boldsymbol{r} \in Z_{\text{\rm op}}^a \mapsto p(\boldsymbol{r}) \in \mathbf{Gr}(1,3)$ is continuous. Its {\mathpzc{E}m exactness} is an upper estimate $\beta>0$ of the angle between the lines $p(\boldsymbol{r})$ and $p_-[\boldsymbol{\pi}(\boldsymbol{r})]$ that holds for any $\boldsymbol{r} \in Z_{\text{\rm op}}^a$.
\mathpzc{E}nd{define}
Here $\mathbf{Gr}(1,3)$ is the smooth Grassmanian manifold of all one-dimensional linear subspaces of $\mathbb{R}^3$ \cite[pp.~42-44]{Shaf94}.
We assume that the output $p(O)$ of DE is given in the local frame of the robot.
For a DE to be useful, its exactness $\beta$ should be less than the minimal angular discrepancy between $p_-[\boldsymbol{\pi}(\boldsymbol{r})]$ and the meridian direction at point $\boldsymbol{\pi}(\boldsymbol{r})$ since then $p(\boldsymbol{r})$ is transversal to the meridian, as is required.
\par
Now we discuss a particular design of DE under which arbitrarily high exactness can be achieved.
\par
{\bf Most-distant-point-based estimator} (MDPBE) with parameter $\alpha_{e} \in (0,\alpha_s]$ finds the tangential directions (given by $\varphi$) of the ray $\mathfrak{R}$ that are
associated with the local maxima of the distance $d(\alpha_e,\varphi)$, shifts every of the found $\varphi$'s into $(-\pi/2,\pi/2]$ by adding, if necessary, an integer multiple of $\pi$, computes the arithmetic mean $\varphi_{\to}$ of the resultant angles, and returns the straight line $p$ that goes in the normal plane $\varepsilonc{d}^{\,\bot}$ in the direction of $\varphi_{\to}$. MDPBE is well-posed if the number of local maxima is finite.
\begin{proposition}
\label{prop.de}
Let Assumptions~{\rm \ref{as.cum}} and {\rm \ref{ass.lipsch}} hold.
For any $\beta>0$, there is $\ov{\alpha} \in (0,\alpha_s]$ such that
MDPBE is well-posed (with two local maxima) in the active operational zone and is a direction estimator with exactness $\beta$ whenever $\alpha_e \in (0,\ov{\alpha})$.
\mathpzc{E}nd{proposition}
\par
The proof of this proposition is given in Section~\ref{app.proofprop}.
\section{General properties of tunnels and technical facts}
\label{sec.proper}
Let Assumptions~\ref{as.cum}---\ref{lip.const} hold and let $L_N$ be taken from \mathpzc{E}qref{lip.const}.
\begin{lemma}
\label{lem.cuvb}
The norm of the operator $\mathscr{S}_{\boldsymbol{s}}: \mathfrak{T}_{\boldsymbol{s}}(S) \to \mathfrak{T}_{\boldsymbol{s}}(S)$ and the principal curvatures obey the estimates
\begin{equation}
  \label{est.norm}
  \|\mathscr{S}_{\boldsymbol{s}}\| \leq L_N \quad \text{\rm and} \quad |\varkappa_\pm(\boldsymbol{s})| \leq L_N \quad \forall \boldsymbol{s} \in S .
\mathpzc{E}nd{equation}
There exists $\varepsilon>0$ such that $(d,\boldsymbol{s}) \mapsto h(d,\boldsymbol{s}):=\boldsymbol{s}+d N(\boldsymbol{s})$ is a $C^2$-diffeomorphism of $T:=(-\varepsilon,d_+) \times (S\setminus \partial S)$ onto an open neighborhood of \mathpzc{E}qref{dop}, and $h^{-1}(\boldsymbol{p}) = \{\dist{
\boldsymbol{p}}{S},\boldsymbol{\pi}(\boldsymbol{p})\} , \boldsymbol{\pi}(\boldsymbol{p}) \not \in \partial S \; \forall \boldsymbol{p} \in Z_{\text{\rm op}}$.
\mathpzc{E}nd{lemma}
\par {\bf Proof:}\;
Inequalities \mathpzc{E}qref{est.norm} hold since $\|\mathscr{S}_{\boldsymbol{s}} V\|=\|D_V N\| \leq L_N \|V\|$ for all $V \in \mathfrak{T}_{\boldsymbol{s}}(S)$ by \mathpzc{E}qref{lip.const} and $\varkappa_\pm$ are the eigenvalues of $\mathscr{S}_{\boldsymbol{s}}$.
By \mathpzc{E}qref{ineq.cur2} and \mathpzc{E}qref{est.norm}, there exists $\varepsilon\in (0, d_+/2)$ such that $1-d \varkappa_+(\boldsymbol{s}) \geq \Delta_\varkappa \; \forall \boldsymbol{s} \in S, d \in [0,d_+]$ and $1-d \varkappa_-(\boldsymbol{s}) \geq \Delta_\varkappa \; \forall \boldsymbol{s} \in S, d \in [-\varepsilon,0]$. Hence for $d \in [-\varepsilon, d_+]$ and $\boldsymbol{s} \in S$, the symmetric operator $\mathbf{Id}_{\boldsymbol{s}} - d\cdot \mathscr{S}_{\boldsymbol{s}}: \mathfrak{T}_{\boldsymbol{s}}(S) \to \mathfrak{T}_{\boldsymbol{s}}(S)$ is positively definite, its least eigenvalue is no less than $\Delta_\varkappa$ and so
\begin{equation}
\label{norm.inv}
\left\| (\mathbf{Id}_{\boldsymbol{s}} - d\cdot \mathscr{S}_{\boldsymbol{s}})^{-1} \right\| \leq \Delta_\varkappa^{-1}.
\mathpzc{E}nd{equation}
The differential of $h$ maps $(\mathpzc{E}ta,V) \in \mathbb{R} \times \mathfrak{T}_{\boldsymbol{s}}(S)$ into $ W =  \mathpzc{E}ta N + (\mathbf{Id}_{\boldsymbol{s}} - d\mathscr{S}_{\boldsymbol{s}}) V \in \mathbb{R}^3$ and is invertible:
\begin{equation}
\label{form.inv}
\mathpzc{E}ta = \spr{W}{N}, \quad V = (\mathbf{Id} - d\mathscr{S}_{\boldsymbol{s}})^{-1} [W - \mathpzc{E}ta N].
\mathpzc{E}nd{equation}
Hence $h$ is a local diffeomorphism. So the image $h(T)$ is open and the inverse image $h^{-1}(\boldsymbol{p})$ is a discrete set for any point $\boldsymbol{p} \in h(T)$. For any $(d,\boldsymbol{s}) \in h^{-1}(\boldsymbol{p})$, we have $\boldsymbol{p} = h(d,\boldsymbol{s})= \boldsymbol{s} + d N(\boldsymbol{s}), |d| \leq d_+ \Rightarrow \|\boldsymbol{s}\| \leq \|\boldsymbol{p}\| + d_+$ and so the inverse image $h^{-1}(\boldsymbol{p})$ is bounded.
Suppose that it is infinite. Then there exists an infinite sequence $\{(d_j,\boldsymbol{s}_j)\} \subset h^{-1}(\boldsymbol{p})$ such that $d_j \to d, \boldsymbol{s}_j \to \boldsymbol{s}$ as $j\to \infty$ and $\zeta_j:=(d_j,\boldsymbol{s}_j) \neq \zeta:=(d,\boldsymbol{s})\; \forall j$. Here $d \in [-\varepsilon,d_+]$ and $\boldsymbol{s} \in S$ and so the differential $h^\prime(d,\boldsymbol{s})$ is invertible by the foregoing. Meanwhile for any limit point $V$ of the bounded sequence $(\zeta_j-\zeta)/\|\zeta_j-\zeta\|$, we have $\|V\| =1$ and $h^\prime(d,\boldsymbol{s}) V=0 \Rightarrow V=0 \Rightarrow \|V\|=0$. The contradiction obtained proves that the set $h^{-1}(\boldsymbol{p})$ is finite.
\par
This and local diffeomorphic property of $h(\cdot)$ imply that
$h(\cdot)$ is a covering map \cite[p.~67]{BER88}.
Definition~\ref{def.tun} and Assumption~\ref{ass.lipsch} imply that $S, S \setminus \partial S$ and so $T$ are arcwise connected. Hence all fibres $F_{\boldsymbol{p}}:= h^{-1}(\boldsymbol{p}), \boldsymbol{p} \in h(T)$ have the same size $M$ (the multiplicity of the covering)
\cite[Th.~2.4.4]{BER88}. We are going to show that $M=1$, possibly after properly decreasing $\varepsilon$.
\par
To this end, we first show this for the restriction $h|_{(-\varepsilon,\varepsilon) \times (S\setminus \partial S)}$, which evidently also is a local diffeomorphism and a covering map. Suppose to the contrary that its multiplicity is greater than $1$ for $\varepsilon = \varepsilon_j \; \forall j$, where $\varepsilon_j\in (0, \varepsilon)$ and $\varepsilon_j \to 0$ as $j \to \infty$. We also pick $\boldsymbol{s} \in S\setminus \partial S$. For any $j$, the fibre $F_{\boldsymbol{s}}$ contains $(0,\boldsymbol{s})$ and some other point $(\mathpzc{E}ta_j,\boldsymbol{s}_j) \in (-\varepsilon_j,\varepsilon_j)\times (S \setminus \partial S)$, where $\boldsymbol{s} = h(0,\boldsymbol{s}) = h(\mathpzc{E}ta_j,\boldsymbol{s}_j) = \boldsymbol{s}_j + \mathpzc{E}ta_j N[\boldsymbol{s}_j]$ and so $\mathpzc{E}ta_j \neq 0$. Hence
$$
\|\boldsymbol{s}_j - \boldsymbol{s}\| = \mathpzc{E}ta_j \leq \varepsilon_j, \quad \spr{\mathpzc{E}ta_j^{-1}(\boldsymbol{s}-\boldsymbol{s}_j)}{N(\boldsymbol{s})} =  \spr{ N[\boldsymbol{s}_j]}{N[\boldsymbol{s}]}.
$$
As $j \to \infty$, the unit vector $\mathpzc{E}ta_j^{-1}(\boldsymbol{s}-\boldsymbol{s}_j)$ converges to the tangent plane $\mathfrak{T}_{\boldsymbol{s}}(S)$ and so the left hand side of the last equation goes to zero, whereas its right hand side goes to $1$. This contradiction proves that for all small enough $\varepsilon>0$, the multiplicity of the map $h|_{(-\varepsilon,\varepsilon) \times (S\setminus \partial S)}$ is $1$ and so this map is a diffeomorphism onto its image. We assume that $\varepsilon$ is decreased (if necessary) to this range.
\par
Now suppose that that the multiplicity $M$ of $h(\cdot)$ on $T$ is greater than $1$, pick $\boldsymbol{s}_1 \in S\setminus \partial S \subset h(T)$, and enumerate $(d_1=0,\boldsymbol{s}_1), (d_2,\boldsymbol{s}_2), \ldots, (d_M,\boldsymbol{s}_M)$ the elements of the fibre $F_{\boldsymbol{p}}$, where $\boldsymbol{p} := h(0,\boldsymbol{s}_1) = \boldsymbol{s}_1$. Here
\begin{equation}
\label{rome}
\boldsymbol{s}_1 = h(d_i, \boldsymbol{s}_i) = \boldsymbol{s}_i+d_i N(\boldsymbol{s}_i)
\mathpzc{E}nd{equation}
and $d_i \in [\varepsilon ,d_+)\; \forall i \geq 2$ since $d_i \in (-\varepsilon, \varepsilon)$ is excluded by the just established property of $h|_{(-\varepsilon,\varepsilon) \times (S\setminus \partial S)}$. For $i \geq 2$, the straight-line segment connecting $\boldsymbol{s}_i$ and $\boldsymbol{s}_1$ is a subset of $h([0,d_i]\times \{\boldsymbol{s}_i\}) \subset h(T)$ and so
 the point $(d_i,\boldsymbol{s}_i) \in F_{\boldsymbol{p}}$ gives rise to a lift of the path $\mathfrak{p}(\theta) = (1-\theta)\boldsymbol{s}_1 + \theta \boldsymbol{s}_2 \in h(T), \theta \in [0,1]$ that starts from this point, i.e., to a continuous map $L_i(\cdot) = [d_i(\cdot), \boldsymbol{s}_i(\cdot)]: [0,1] \to T$ such that
\begin{equation}
\label{lift}
h[L_i(\theta)] = \mathfrak{p}(\theta)\qquad \forall \theta
\mathpzc{E}nd{equation}
and $[d_i(0),\boldsymbol{s}_i(0)] = [d_i,\boldsymbol{s}_i]\; \forall i$. Since the path $\mathfrak{p}(\cdot)$ is smooth and $h(\cdot)$ is locally diffeomorphic, any lift $L_i(\cdot)$ is also smooth. For $\theta \in [0,1]$, the points $L_1(\theta), \ldots, L_M(\theta)$ are pair-wise distinct and exhaust the fibre $h^{-1}[\mathfrak{p}(\theta)] = F_{\mathfrak{p}(\theta)}$.
 \par
By Assumption~\ref{as.cum} (in the part that refers to Assumption~\ref{ass.unique}), the projection $\boldsymbol{s}(\theta)$ of $\mathfrak{p}(\theta)$ onto $S$ is unique for all $\theta \in [0,1]$. So not only $\dist{\mathfrak{p}(\theta)}{S}$ but also $\boldsymbol{s}(\theta)$ continuously depend on $\theta$. Furthermore,
\begin{equation}
\label{norm.dist}
\boldsymbol{s}(0) = \boldsymbol{s}_1, \quad \boldsymbol{s}(1) = \boldsymbol{s}_2, \qquad \text{and} \quad
\mathfrak{p}(\theta) = \boldsymbol{s}(\theta) \pm \dist{\mathfrak{p}(\theta)}{S} N[\boldsymbol{s}(\theta)] \quad \text{whenever} \; \boldsymbol{s}(\theta) \not\in \partial S.
\mathpzc{E}nd{equation}
Since $0\leq \dist{\mathfrak{p}(\theta)}{S}<\varepsilon$, $-\varepsilon< d_1(\theta) < \varepsilon$, and $\boldsymbol{s}(\theta) \approx \boldsymbol{s}_1 \in S \setminus \partial S \Rightarrow \boldsymbol{s}(\theta) \in S \setminus \partial S$ for $\theta \approx 0$, the diffeomorphic property of $h|_{(-\varepsilon,\varepsilon)\times (S\setminus \partial S)}$ and \mathpzc{E}qref{lift} (with $i:=1$) yield that
\begin{equation}
\label{fhglg}
d_1(\theta) = \dist{\mathfrak{p}(\theta)}{S}, \quad \boldsymbol{s}_1(\theta) = \boldsymbol{s}(\theta) \qquad \forall \theta \in [0,\tau]
\mathpzc{E}nd{equation}
with sufficiently small $\tau \in (0,1]$. We are going to show that in fact this is true with $\tau=1$.
\par
Suppose to the contrary that the maximal such $\tau$ is less than $1$. Then $[\dist{\mathfrak{p}(\theta)}{S}, \boldsymbol{s}(\theta)] \neq [d_1(\theta), \boldsymbol{s}_1(\theta)]$ for $\theta = \theta_j \; \forall j$, where $\theta_j \in (\tau,1)$ and $\theta_j \to \tau$ as $j \to \infty$. So \mathpzc{E}qref{lift}, \mathpzc{E}qref{norm.dist} and the diffeomorphic property of $h|_{(-\varepsilon,\varepsilon)\times (S\setminus \partial S)}$ exclude the case where $\dist{\mathfrak{p}(\tau)}{S}=0$. Thus
\begin{equation}
\label{positive}
d_1(\tau)=\dist{\mathfrak{p}(\tau)}{S} >0
\mathpzc{E}nd{equation} and so
$\dist{\mathfrak{p}(\theta_j)}{S}, d_i(\theta_j) \in (0, d_+)$ and $\boldsymbol{s}(\theta_j) \not\in \partial S$ for $j \approx \infty$. From now on, we focus on only such $j$'s.
\par
Suppose that there are arbitrarily large $j$'s for which \mathpzc{E}qref{norm.dist} with $\theta:=\theta_j$ holds with the sign $+$. Then passing to a proper subsequence ensures that this is true for all $j$. In this case,  $[\dist{\mathfrak{p}(\theta_j)}{S}, \boldsymbol{s}(\theta_j)] \in T, h [\dist{\mathfrak{p}(\theta_j)}{S}, \boldsymbol{s}(\theta_j)] = \mathfrak{p}(\theta_j)$, i.e., $[\dist{\mathfrak{p}(\theta_j)}{S}, \boldsymbol{s}(\theta_j)] \in F_{\mathfrak{p}(\theta_j)}$. Hence
$[\dist{\mathfrak{p}(\theta_j)}{S}, \boldsymbol{s}(\theta_j)] = [d_i(\theta_j),\boldsymbol{s}_i(\theta_j)]$ for some $i=i(j) =1,\ldots,M$. Here $i(j) \neq 1$ since
$[\dist{\mathfrak{p}(\theta_j)}{S}, \boldsymbol{s}(\theta_j)] = [d_1(\theta_j),\boldsymbol{s}_1(\theta_j)]$.
Then by passing to a subsequence once more, it can be ensured that $i(j)$ does not alter with $j$, i.e., $i(j) \mathpzc{E}quiv i \geq 2 \; \forall j$. Then passing to the limit as $j\to \infty$ in the equation $\dist{\mathfrak{p}(\theta_j)}{S} = d_i(\theta_j)$ yields $\dist{\mathfrak{p}(\tau)}{S} = d_i(\tau)$. It follows that the distance $\dist{\mathfrak{p}(\tau)}{S}$ from the point $\mathfrak{p}(\tau)$ to the surface $S$ is attained at both $\boldsymbol{s}_1(\tau)$ and $\boldsymbol{s}_i(\tau)$, where $[d_1(\tau), \boldsymbol{s}_1(\tau)] \neq [d_i(\tau), \boldsymbol{s}_i(\tau)]$ and $d_1(\tau) = d_i(\tau) = \dist{\mathfrak{p}(\tau)}{S}$ imply that  $\boldsymbol{s}_1(\tau) \neq \boldsymbol{s}_i(\tau)$, in violation of Assumption~\ref{as.cum}. The contradiction obtained proves that \mathpzc{E}qref{norm.dist} with $\theta:=\theta_j$ holds with the sign $-$ for all large enough $j$'s. Then by \mathpzc{E}qref{lift} and \mathpzc{E}qref{norm.dist}, we have
\begin{gather*}
\boldsymbol{s}(\theta_j) - \dist{\mathfrak{p}(\theta_j)}{S} N[\boldsymbol{s}(\theta_j)] = \mathfrak{p}(\theta_j) =\boldsymbol{s}_1(\theta_j) + d_1(\theta_j) N[\boldsymbol{s}_1(\theta_j)] \\
\Downarrow j \to \infty
\\
\boldsymbol{s}(\tau) - \dist{\mathfrak{p}(\tau)}{S} N[\boldsymbol{s}(\tau)] = \mathfrak{p}(\tau) =\boldsymbol{s}_1(\tau) + d_1(\tau) N[\boldsymbol{s}_1(\tau)]
\overset{\text{\mathpzc{E}qref{fhglg}}}{\Rightarrow} \dist{\mathfrak{p}(\tau)}{S} =0,
\mathpzc{E}nd{gather*}
in violation of \mathpzc{E}qref{positive}. The contradiction obtained proves that \mathpzc{E}qref{fhglg} holds with $\tau=1$.
\par
It follows that $d_1(1) =0 \Rightarrow \boldsymbol{s}_2= \mathfrak{p}(1) = \boldsymbol{s}_1(1) + d_1(1) N [\boldsymbol{s}_1(1)] = \boldsymbol{s}_1(1)$. Hence
\begin{gather*}
\boldsymbol{s}_1(\theta) + d_1(\theta) N[\boldsymbol{s}_1(\theta)] = h[d_1(\theta), \boldsymbol{s}_1(\theta)] = \mathfrak{p}(\theta) = (1-\theta)\boldsymbol{s}_1 + \theta \boldsymbol{s}_2
\overset{\text{\mathpzc{E}qref{rome}}}{=} (1-\theta)[\boldsymbol{s}_2+d_2 N(\boldsymbol{s}_2)] + \theta \boldsymbol{s}_2
\\
= \boldsymbol{s}_2 +d_2(1-\theta) N (\boldsymbol{s}_2) \qquad \forall \theta \in [0,1]
\\
\Downarrow
\\
d_1^\prime(\theta) N[\boldsymbol{s}_1(\theta)] + \left[ \mathbf{Id}_{\boldsymbol{s}_1(\theta)} - d_1(\theta) \mathscr{S}_{\boldsymbol{s}_1(\theta)} \right] \boldsymbol{s}_1^\prime(\theta) 

= \frac{d}{d \theta} \left\{ \boldsymbol{s}_2 +d_2(1-\theta) N (\boldsymbol{s}_2) \right\} = -d_2 N [\boldsymbol{s}_1(1)] .
\mathpzc{E}nd{gather*}
By putting $\theta:= 1$ here and taking into account that both $\boldsymbol{s}_1^\prime(\theta)$ and $\left[ \mathbf{Id}_{\boldsymbol{s}_1(\theta)} - d_1(\theta) \mathscr{S}_{\boldsymbol{s}_1(\theta)} \right] \boldsymbol{s}_1^\prime(\theta)$ lie in the tangential plane, whereas $N[\boldsymbol{s}_1(\theta)]$ is normal to it, we see that
$d_2=-d_1^\prime(1)$. Thus
\begin{gather*}
\left[ \mathbf{Id}_{\boldsymbol{s}_1(\theta)} - d_1(\theta) \mathscr{S}_{\boldsymbol{s}_1(\theta)} \right] \boldsymbol{s}_1^\prime(\theta) = d_1^\prime(1) N [\boldsymbol{s}_1(1)] - d_1^\prime(\theta) N[\boldsymbol{s}_1(\theta)]
\\
=
d_1^\prime(1) \left\{ N [\boldsymbol{s}_1(1)]- N[\boldsymbol{s}_1(\theta)] \right\} - [d_1^\prime(\theta) - d_1^\prime(1)] N[\boldsymbol{s}_1(\theta)].
\mathpzc{E}nd{gather*}
Then after applying the orthogonal projection onto the tangent plane $\mathfrak{T}_{\boldsymbol{s}_1(\theta)}(S)$, we see that
$$
\left\| \left[ \mathbf{Id}_{\boldsymbol{s}_1(\theta)} - d_1(\theta) \mathscr{S}_{\boldsymbol{s}_1(\theta)} \right] \boldsymbol{s}_1^\prime(\theta) \right\|
\leq d_2 \left\| N [\boldsymbol{s}_1(1)]- N[\boldsymbol{s}_1(\theta)] \right\| \overset{\text{\mathpzc{E}qref{lip.const}}}{\leq} L_N d_2 \left\| \boldsymbol{s}_1(1)- \boldsymbol{s}_1(\theta) \right\|.
$$
On the other hand, \mathpzc{E}qref{norm.inv} implies that the left hand side is no less than $ \| \boldsymbol{s}_1^\prime(\theta)\|/\Delta_\varkappa $.
As a result,
$$
\| \boldsymbol{s}_1^\prime(\theta)\| \leq L_N \Delta_\varkappa d_2 \left\| \boldsymbol{s}_1(1)- \boldsymbol{s}_1(\theta) \right\|
$$
and so $\boldsymbol{s}_1(\theta) = \boldsymbol{s}_1(1)\; \forall \theta$ by Gr\"{o}wall's inequality. Putting $\theta:= 0$ here yields $\boldsymbol{s}_1=\boldsymbol{s}_1(0) = \boldsymbol{s}_1(1) = \boldsymbol{s}_2$, in violation of the foregoing. This contradiction proves that the multiplicity $M=1$ and so $h(\cdot)$ is a diffeomorphism.
\par
To prove the last claim of the lemma, we consider $\boldsymbol{p} \in Z_{\text{op}}$. By \mathpzc{E}qref{dop}, $\boldsymbol{p} = \boldsymbol{s} + d N(\boldsymbol{s})$, where $\boldsymbol{s} \in S \setminus \partial S, d \in (d_-,d_+)$. We put
\begin{equation}
\label{defpnew}
\mathfrak{p}(\theta) := \boldsymbol{s} + d \theta N(\boldsymbol{s})\qquad \theta \in [0,1]
 \mathpzc{E}nd{equation}
 and partly retrace the foregoing arguments. Specifically, we first establish that $\boldsymbol{s}(\theta) = \boldsymbol{s}$ and $\dist{\mathfrak{p}(\theta)}{S}=d \theta$ for all small enough $\theta$ by using the diffeomorphic property of the restriction $h|_{(-\varepsilon,\varepsilon) \times (S\setminus \partial S)}$. As before, we then introduce the maximal interval $[0,\tau], \tau \leq 1$ on which \mathpzc{E}qref{fhglg} holds with
$d_1(\theta) := \theta d$ and $\boldsymbol{s}_1(\theta) := \boldsymbol{s}$:
\begin{equation}
\label{dfkg}
\theta d = \dist{\mathfrak{p}(\theta)}{S}, \quad \boldsymbol{s} = \boldsymbol{s}(\theta) \qquad \forall \theta \in [0,\tau].
\mathpzc{E}nd{equation}
It remains to show that $\tau=1$. Suppose to the contrary that $\tau <1$. Then there there exists an infinite sequence $\{\theta_j\} \subset (\tau,1]$ such that
\begin{equation}
 \label{nefh}
 [\dist{\mathfrak{p}(\theta_j)}{S}, \boldsymbol{s}(\theta_j)] \neq [\theta_j d, \boldsymbol{s}], \quad \dist{\mathfrak{p}(\theta_j)}{S} \in [0,d_+), \quad \boldsymbol{s}(\theta_j) \not\in \partial S \qquad \forall j
 \mathpzc{E}nd{equation}
 and $\theta_j \to \tau$ as $j \to \infty$. By passing to a subsequence, if necessary, it can be ensured that \mathpzc{E}qref{norm.dist} with $\theta:=\theta_j$ holds either with the sign $+$ for all $j$ or with the sign $-$ for all $j$. However in the first case, we have $h [\dist{\mathfrak{p}(\theta_j)}{S}, \boldsymbol{s}(\theta_j)]= h[\theta_j d, \boldsymbol{s}]$, in violation of the first inequality from \mathpzc{E}qref{nefh} thanks to the established diffeomorphic property of $h(\cdot)$. So the second option holds: $\mathfrak{p}(\theta_j) = \boldsymbol{s}(\theta_j) - \dist{\mathfrak{p}(\theta_j)}{S} N[\boldsymbol{s}(\theta_j)]$. Letting $j \to \infty$ yields that
 $$
 \boldsymbol{s} + d \tau N(\boldsymbol{s}) \overset{\mathpzc{E}qref{defpnew}}{=}\mathfrak{p}(\tau) = \boldsymbol{s}(\tau) - \dist{\mathfrak{p}(\tau)}{S} N[\boldsymbol{s}(\tau)] \overset{\text{\mathpzc{E}qref{dfkg}}}{=} \boldsymbol{s} - \tau d N[\boldsymbol{s}] \Rightarrow d =0,
 $$
in violation of $d \in (d_-,d_+)$. This contradiction completes the proof.
\mathpzc{E}pf
\begin{corr}
\label{cor.smooth}
The map \mathpzc{E}qref{map.j} is diffeomorphic, the norms of the differentials of $J$ and $J_{-1}:=J^{-1}$ do not exceed $1+d_\ast L_N$ and  $1/\Delta_\varkappa$, respectively, and  $S(d_\ast)$ is a smooth surface.
\mathpzc{E}nd{corr}

\begin{lemma}
\label{lem.angles}
Let $Q : \mathfrak{T}_{\boldsymbol{s}}(S) \to \mathfrak{T}_{\boldsymbol{s}}(S) $ be a linear symmetric positively definite operator with the eigenvalues $0 < q_- \leq q_+ $. Then
$$
\sin \sphericalangle(QA,QB) = \zeta \sin \sphericalangle(A,B), \; \text{\rm where}\; \zeta \in \left[ q_-/q_+, q_+/q_-\right].
$$
\mathpzc{E}nd{lemma}
\par {\bf Proof:}\; For all tangent vectors $C,D \in \mathfrak{T}_{\boldsymbol{s}}(S)$, we have
\begin{equation}
\label{sin.angle}
\sin \sphericalangle(C,D)=[N,C,D]/(\|C\|\|D\|) .
\mathpzc{E}nd{equation}
Let $\mathpzc{E}_-$ and $\mathpzc{E}_+$ be orthonormal eigenvectors of $Q$ associated with $q_-$ and $q_+$, respectively. Since $QC = q_-\spr{C}{\mathpzc{E}_-} \mathpzc{E}_- + q_+\spr{C}{\mathpzc{E}_+}\mathpzc{E}_+$, we have
\begin{gather*}
\sin \sphericalangle(QA,QB) =  \frac{[N,QA,QB]}{\|QA\| \|QB\|}
\\
= \frac{\spr{N}{QA \times QB}}{\|QA\| \|QB\|} = \frac{\spr{N}{[q_-\spr{A}{\mathpzc{E}_-} \mathpzc{E}_- + q_+\spr{A}{\mathpzc{E}_+}\mathpzc{E}_+] \times [q_-\spr{B}{\mathpzc{E}_-} \mathpzc{E}_- + q_+\spr{B}{\mathpzc{E}_+}\mathpzc{E}_+]}}{\|QA\| \|QB\|}
\\
=
\frac{\spr{N}{[q_-\spr{A}{\mathpzc{E}_-} \mathpzc{E}_-] \times [q_-\spr{B}{\mathpzc{E}_-} \mathpzc{E}_-]}}{\|QA\| \|QB\|}
+
\frac{\spr{N}{[q_-\spr{A}{\mathpzc{E}_-} \mathpzc{E}_- ] \times [q_+\spr{B}{\mathpzc{E}_+}\mathpzc{E}_+]}}{\|QA\| \|QB\|}
\\
+
\frac{\spr{N}{[q_+\spr{A}{\mathpzc{E}_+}\mathpzc{E}_+] \times [q_-\spr{B}{\mathpzc{E}_-} \mathpzc{E}_- ]}}{\|QA\| \|QB\|}
+
\frac{\spr{N}{[q_+\spr{A}{\mathpzc{E}_+}\mathpzc{E}_+] \times [q_+\spr{B}{\mathpzc{E}_+}\mathpzc{E}_+]}}{\|QA\| \|QB\|}
\\
= q_-q_+\frac{\spr{N}{[\spr{A}{\mathpzc{E}_-} \mathpzc{E}_- ] \times [\spr{B}{\mathpzc{E}_+}\mathpzc{E}_+]}}{\|QA\| \|QB\|} + q_-q_+\frac{\spr{N}{[\spr{A}{\mathpzc{E}_+}\mathpzc{E}_+] \times [\spr{B}{\mathpzc{E}_-} \mathpzc{E}_- ]}}{\|QA\| \|QB\|}
\\
= q_-q_+\frac{\spr{N}{[\spr{A}{\mathpzc{E}_-} \mathpzc{E}_- + \spr{A}{\mathpzc{E}_+} \mathpzc{E}_+] \times [\spr{B}{\mathpzc{E}_+}\mathpzc{E}_+]}}{\|QA\| \|QB\|} + q_-q_+\frac{\spr{N}{[\spr{A}{\mathpzc{E}_-}\mathpzc{E}_-+ \spr{A}{\mathpzc{E}_+}\mathpzc{E}_+] \times [\spr{B}{\mathpzc{E}_-} \mathpzc{E}_- ]}}{\|QA\| \|QB\|}
\\
= q_-q_+\frac{\spr{N}{[A \times [\spr{B}{\mathpzc{E}_-}\mathpzc{E}_-+\spr{B}{\mathpzc{E}_+}\mathpzc{E}_+]}}{\|QA\| \|QB\|} = q_-q_+\frac{\spr{N}{A \times B}}{\|QA\| \|QB\|}
\\
=q_-q_+ \frac{[N,A,B]}{\|QA\| \|QB\|} = q_-q_+ \frac{\sin \sphericalangle(A,B)}{\|QA\| \|QB\|} \|A\|\|B\|.
\mathpzc{E}nd{gather*}
It remains to note that $q_- \|C\|\leq \|QC\| \leq q_+\|C\|$. \mathpzc{E}pf
\par
For any two vectors $A,B$, we denote by $B_{A^\bot} := B - \spr{B}{A}A/\|A\|^2$ the orthogonal projection of $B$ onto the plane normal to $A$.
We also note that if $A,B \in \mathfrak{T}_{\boldsymbol{r}\ast}[S(d_\ast)] (\boldsymbol{r} \in S(d_\ast))$, then $B_{A^\bot} \in \mathfrak{T}_{\boldsymbol{r}\ast}[S(d_\ast)]$ is the orthogonal projection in the tangent plane $\mathfrak{T}_{\boldsymbol{r}\ast}[S(d_\ast)]$ of vector $B$ onto the line normal to $A$.

\begin{lemma}
\label{lem.rotat}
Let a point $\boldsymbol{r} = \boldsymbol{r}(t)$ smoothly move over $S(d_\ast)$ and let $V(t),W(t) \in \mathfrak{T}_{\boldsymbol{r}(t)\ast}[S(d_\ast)]$ be smooth non-vanishing vector-fields defined on its trajectory. For $\phi:= \sphericalangle (V,W)$, we have
\begin{equation*}

\dot{\phi}\cos \phi = \frac{\spr{(\nabla_{\dot{\boldsymbol{r}}} V)_{V^\bot}}{\mathscr{R}(-\frac{\pi}{2})W} - \spr{(\nabla_{\dot{\boldsymbol{r}}} W)_{W^\bot}}{\mathscr{R}(-\frac{\pi}{2})V}}{\|V\|\|W\|}.
\mathpzc{E}nd{equation*}
\mathpzc{E}nd{lemma}
\par {\bf Proof:}\;
We put $V_0=V/\|V\|, W_0=W/\|W\|$.
By \mathpzc{E}qref{sin.angle},
\begin{gather*}
 \dot{\phi}\cos \phi = \frac{d}{dt}[N_\ast,V_0,W_0]
= [\dot{N}_\ast,V_0,W_0] + [N_\ast,\dot{V}_0,W_0] + [N_\ast,V_0,\dot{W}_0].
\mathpzc{E}nd{gather*}
Here $\|N_\ast\| \mathpzc{E}quiv 1 \Rightarrow \spr{\dot{N}_\ast}{N_\ast}=0 \Rightarrow \dot{N}_\ast\in \mathfrak{T}_\ast[S(d_\ast)]$.
 Hence the three vectors $\dot{N}_\ast,V_0,W_0$ lie in a common (tangent) plane. Thus they are linearly dependent and so $[\dot{N}_\ast,V_0,W_0]=0$. Meanwhile,
 $$
 \nabla_{\dot{\boldsymbol{r}}} V = \mathbf{Pr}_{\mathfrak{T}_\ast[S(d_\ast)]}\dot{V} = \dot{V} - \xi N_\ast
 $$
 with a properly chosen $\xi \in \mathbb{R}$, whereas
$$
\|V\|\dot{V}_0 = \dot{V}_{V^\bot} = (\nabla_{\dot{\boldsymbol{r}}} V + \xi N^\ast)_{V^\bot} \overset{\text{(a)}}{=} (\nabla_{\dot{\boldsymbol{r}}} V )_{V^\bot} + \xi N^\ast,
$$
where (a) holds since $N_\ast$ is perpendicular to $V$.
Therefore,
\begin{gather*}
\|V\|\|W\|[N_\ast,\dot{V}_0,W_0] = [N_\ast,(\nabla_{\dot{\boldsymbol{r}}} V)_{V^\bot},W]
= \spr{(\nabla_{\dot{\boldsymbol{r}}} V)_{V^\bot}}{\mathscr{R}(-\pi/2)W}.
\mathpzc{E}nd{gather*}
The proof is completed by handling $[N_\ast,V_0,\dot{W}_0]$ likewise. \mathpzc{E}pf
\begin{lemma}
\label{lem.merid}
Let $\boldsymbol{s} \in S$ and let $\vartheta\in (0,\pi/2]$ be the angle between the principal line $p_-(\boldsymbol{s})$ and the line $l_{\boldsymbol{s}} = \{g \varepsilonc{\tau}(\boldsymbol{s}) + \boldsymbol{s}: g \in \mathbb{R}\}$ tangent to the meridian. The following inequalities hold:
\begin{equation}
\label{vartheta.ineq}
\Delta_\tau \leq 2L_N \quad \text{\rm and} \quad
\vartheta \geq \arcsin \sqrt{\frac{\Delta_{\tau}}{2L_N}},
\mathpzc{E}nd{equation}
where $\Delta_\tau$ and $L_N$ are taken from \mathpzc{E}qref{basic.ineq} and \mathpzc{E}qref{lip.const}, respectively.
\mathpzc{E}nd{lemma}
\par {\bf Proof:}\;
It suffices to note that
\begin{gather}
\label{ff.decom}
\ff{\boldsymbol{s}}{V}{V} = \varkappa_- \spr{V}{E_-}^2 + \varkappa_+ \spr{V}{E_+}^2,
\\
\nonumber
\varkappa_- + \Delta_\tau \overset{\text{\mathpzc{E}qref{basic.ineq}}}{\leq} \varkappa_- \spr{\varepsilonc{\tau}}{E_-}^2 + \varkappa_+ \spr{\varepsilonc{\tau}}{E_+}^2
= \varkappa_- \cos^2 \vartheta + \varkappa_+ \sin^2 \vartheta
\\
\nonumber
\Rightarrow \Delta_\tau \leq (\varkappa_+ - \varkappa_-)\sin^2 \vartheta \overset{\text{\mathpzc{E}qref{est.norm}}}{\leq} 2 L_N \sin^2 \vartheta \Rightarrow \text{\mathpzc{E}qref{vartheta.ineq}. \mathpzc{E}pf}
\mathpzc{E}nd{gather}
\begin{lemma}
\label{lem.liptau}
There exists $L_\tau >0$ such that
$\|\nabla_V\tau_\ast\| \leq L_\tau \|V\|$ for any vector $V \in \mathfrak{T}_{\boldsymbol{s}_\ast}[S(d_\ast)]$ and $\boldsymbol{s}_\ast \in S(d_\ast)$.
\mathpzc{E}nd{lemma}
\par {\bf Proof:}\;
By \mathpzc{E}qref{tau.ast}, $\varepsilonc{\tau}_\ast(\boldsymbol{r})= \varepsilonc{\tau}_\lozenge[J_{-1}(\boldsymbol{r})]$ for $\varepsilonc{\tau}_\lozenge(\boldsymbol{s}):= \frac{\varepsilonc{\tau}_\dagger(\boldsymbol{s})}{\|\varepsilonc{\tau}_\dagger(\boldsymbol{s})\|}$ and $\varepsilonc{\tau}_\dagger(\boldsymbol{s}):= J^\prime(\boldsymbol{s}) \varepsilonc{\tau}(\boldsymbol{s})$. Hence
by Corollary~\ref{cor.smooth},
\begin{gather}
\label{est.n1}
\|\nabla_V \varepsilonc{\tau}_\ast\| \leq \|D_V  \varepsilonc{\tau}_\ast\| =\|D_{W}  \varepsilonc{\tau}_\lozenge\|,
\quad
\text{where}
\quad
W:= J_{-1}^\prime V \; \text{and} \;\|W\| \leq  \|V\|/\Delta_\varkappa;
\\
 1 = \|\varepsilonc{\tau}\| = \left\| J_{-1}^\prime \varepsilonc{\tau}_\dagger\right\| \leq \|\varepsilonc{\tau}_\dagger\|/\Delta_\varkappa,\quad \|D_{W}  \varepsilonc{\tau}_\lozenge\|
 \label{est.n2}
  = \frac{1}{\|\varepsilonc{\tau}_\dagger\|} \left\| D_W \varepsilonc{\tau}_\dagger - \spr{D_W \varepsilonc{\tau}_\dagger}{\varepsilonc{\tau}_\lozenge}\varepsilonc{\tau}_\lozenge\right\|

 \leq \frac{\|D_W \varepsilonc{\tau}_\dagger\|}{\Delta_\varkappa}.
 \mathpzc{E}nd{gather}
 Now we invoke Assumption~\ref{ass.lipsch} and similarly see that $\|D_W \varepsilonc{b}\| \leq L_B \|W\|/\Delta_B^-$ for $\varepsilonc{b}:= \nabla B/\|\nabla B\|$. Since $\varepsilonc{\tau} = \pm \Big[E_- \spr{\varepsilonc{b}}{E_+} - E_+ \spr{\varepsilonc{b}}{E_-}\Big] $, we also get the following
\begin{gather}
\nonumber
\|D_W E_\pm\| \leq L_E \|W\|, \quad \|D_W \varkappa_\pm\| \leq L_\varkappa \|W\|,
\\
\nonumber
\Big\|D_WE_\pm \spr{\varepsilonc{b}}{E_\mp}\Big\| \leq \|D_W \varepsilonc{b}\| + \|D_W E_-\| + \|D_W E_+\|
\leq  (L_B/\Delta_B^- + 2 L_E)\|W\|,
\\
\nonumber
\|D_W \varepsilonc{\tau}\| \leq 2 (L_B/\Delta_B^- + 2 L_E)\|W\|,
\\
\nonumber
\|D_W(\varkappa_\pm \spr{E_\pm}{\varepsilonc{\tau}})\| \leq \{ L_\varkappa + |\varkappa_\pm| [L_E +  2 (L_B/\Delta_B^- + 2 L_E)]\} \|W\|
\\
\nonumber
\overset{\text{\mathpzc{E}qref{est.norm}}}{\leq} [ L_\varkappa + L_N (5 L_E +  2 L_B/\Delta_B^-) ] \|W\|;
 \\
 \nonumber
 \varepsilonc{\tau}_\dagger := \varepsilonc{\tau} + d_\ast \mathscr{S}_{\boldsymbol{s}}\varepsilonc{\tau}
 =  \varepsilonc{\tau} + d_\ast \left[ \varkappa_- \spr{E_-}{\varepsilonc{\tau}}E_-+ \varkappa_+ \spr{E_+}{\varepsilonc{\tau}} E_+\right]
 \\
 \Rightarrow
\|D_W \varepsilonc{\tau}_\dagger\| \leq 2 (L_B/\Delta_B^- + 2 L_E)\|W\|
\label{est.n3}
+ 2 d_\ast [ L_\varkappa + L_N (6 L_E +  2 L_B/\Delta_B^-) ] \|W\|.
\mathpzc{E}nd{gather}
The proof is completed by gathering \mathpzc{E}qref{est.n1}---\mathpzc{E}qref{est.n3}. \mathpzc{E}pf

\section{Proof of Proposition~\ref{prop.de}.}
\label{app.proofprop}
\setcounter{equation}{0}
Let $D_{\boldsymbol{C}s}^\mathpzc{E}ta \subset \mathfrak{T}_{\boldsymbol{C}s}(S)$ stands for the disc in the tangent plane $ \mathfrak{T}_{\boldsymbol{C}s}(S)$ with a radius of $\mathpzc{E}ta>0$ centered at $\boldsymbol{C}s$.
Formula \mathpzc{E}qref{ff.decom} makes sense for any vector $V \in \mathbb{R}^3$. By using this, we extend the quadratic form $\ff{\boldsymbol{s}}{\cdot}{\cdot}$ and the associated symmetric bilinear form from the tangential plane to the entire space $\mathbb{R}^3$. If the tunnel is open, we put $S^0:= \{\boldsymbol{s} \in S: \boldsymbol{s} \,\text{is not in the $\delta_s$-vicinity of}\, \partial S\}$; otherwise, $S^0:=S$.

\begin{lemma}
\label{lemfform}
There exists $\mathpzc{E}ta>0$ such that for any point $\boldsymbol{C}s \in S^0 $,
a patch $\mathscr{P}_{\boldsymbol{C}s}(S)$ of $S$ around $\boldsymbol{C}s$ is a graph of a $C^2$-smooth function $g_{\boldsymbol{C}s}: D_{\boldsymbol{C}s}^\mathpzc{E}ta \to \mathbb{R}$:
    \begin{equation}
    \label{patch}
    \mathscr{P}_{\boldsymbol{C}s}(S) = \{\boldsymbol{s} = \Gamma_{\boldsymbol{C}s}(\boldsymbol{p}):= \boldsymbol{p} + g_{\boldsymbol{C}s}(\boldsymbol{p}) N(\boldsymbol{C}s) : \boldsymbol{p} \in D_{\boldsymbol{C}s}^\mathpzc{E}ta \}.
    \mathpzc{E}nd{equation}

\mathpzc{E}nd{lemma}
\par {\bf Proof:}\;
Let $\gamma$ be the normal section of $S$ by the plane $\mathpzc{P}$ that contains $\boldsymbol{C}s$ and is coplanar with $N:= N(\boldsymbol{C}s)$ and a unit vector $V \in \mathfrak{T}_{\boldsymbol{C}s}(S)$.

There is a smooth function $f(\theta):\mathscr{E} \to \mathbb{R}, \mathscr{E}:=(-\varepsilon_-,\varepsilon_+), \varepsilon_\pm >0$ such that its graph is a part of $\gamma$, i.e., $\gamma(\theta):=\boldsymbol{C}s+\theta V + f(\theta) N \in \gamma, \theta \in \mathscr{E}$.
Since $f^\prime(0)=0$, reducing $\varepsilon_\pm$, if necessary, ensures that for $L_N$ from \mathpzc{E}qref{lip.const},
\begin{equation}
\label{def.dom}
L_N \|\gamma(\theta) - \gamma(0)\| + |f^\prime(\theta)|^2 < 1/2, \quad \|\gamma(\theta) - \gamma(0)\| < \delta_s/2 \qquad \forall \theta \in \mathscr{E}.
\mathpzc{E}nd{equation}
From now on, we consider the maximal such an interval $\mathscr{E}$.
\par
The signed curvature $\varkappa(\theta)$ of $\gamma$ at point $\gamma(\theta)$ is
\begin{equation}
\label{Meusnier}
\varkappa(\theta) = \frac{f^{\prime\prime}(\theta)}{(1+|f^\prime(\theta)|^2)^{3/2}} \overset{\text{(a)}}{=}  \frac{\varkappa_{n}^S(\theta)}{\cos \beta}.
\mathpzc{E}nd{equation}
Here $\beta$ is the angle between $V \times N$ and $V(\theta) \times N[\gamma(\theta)]$, whereas $\varkappa_{n}^S(\theta)$ is the normal curvature of $S$ at $\gamma(\theta)$ in direction of
\begin{equation}
\label{form.v}
V(\theta):=\gamma^\prime(\theta) = V+f^\prime(\theta)N,
\mathpzc{E}nd{equation}
 and (a) holds by Meusnier's theorem \cite[p.~142]{Carmo76}. Here $\|V \times N\|=1$ and $\|V(\theta) \times N[\gamma(\theta)]\|=\|V(\theta)\| = \sqrt{1+|f^\prime(\theta)|^2}$. So $\|V(\theta)\|\cos \beta$ is the quadruple product of $V , N, V(\theta), N[\gamma(\theta)]$. By using formula (25) in \cite[p.~76]{GiWil01}
 $$
 \spr{A \times B}{C \times D} = \spr{A}{C} \spr{B}{D} - \spr{A}{D}\spr{B}{C},
 $$
 we see that
\begin{gather}
\sqrt{1+|f^\prime(\theta)|^2} \cos \beta
\nonumber
 = \spr{V}{V(\theta)}\spr{N}{N[\gamma(\theta)]} - \spr{V}{N[\gamma(\theta)]}\spr{V(\theta)}{N}
 \\
 \label{ugol.beta}
 \overset{\text{\mathpzc{E}qref{form.v}}}{=} \spr{N}{N[\gamma(\theta)]} - f^\prime(\theta)\spr{V}{N[\gamma(\theta)]}
 \\
 \nonumber
 = 1 + \spr{N}{N[\gamma(\theta)]-N} - f^\prime(\theta)\spr{V-V(\theta)}{N[\gamma(\theta)]}
 \geq 1 - \|N[\gamma(\theta)]-N\| - |f^\prime(\theta)| \|V-V(\theta)\|
 \\
 \label{geq.half}
 \overset{\text{\mathpzc{E}qref{lip.const},\mathpzc{E}qref{form.v}}}{\geq} 1 - L_N \|\gamma(\theta) - \gamma(0)\| - |f^\prime(\theta)|^2 \overset{\text{\mathpzc{E}qref{def.dom}}}{\geq} 1/2;
\\
\label{norm.curv}
\varkappa_{n}^S(\theta) = \frac{\ff{\gamma(\theta)}{\gamma^\prime(\theta)}{\gamma^\prime(\theta)}}{\|\gamma^\prime(\theta)\|^2}.
\mathpzc{E}nd{gather}
Hence due to \mathpzc{E}qref{Meusnier}, \mathpzc{E}qref{form.v}, \mathpzc{E}qref{geq.half}, and \mathpzc{E}qref{norm.curv}
\begin{gather}
\frac{|f^{\prime\prime}(\theta)|}{(1+|f^\prime(\theta)|^2)^{3/2}} = |\varkappa(\theta)|
\leq 2 \frac{|\ff{\gamma(\theta)}{\gamma^\prime(\theta)}{\gamma^\prime(\theta)}|}{\|\gamma^\prime(\theta)\|^{3/2}}
\label{ddot.estimn}
\Rightarrow |f^{\prime\prime}(\theta)| \leq 2 |\ff{\gamma(\theta)}{\gamma^\prime(\theta)}{\gamma^\prime(\theta)}|.

\mathpzc{E}nd{gather}
So thanks to \mathpzc{E}qref{est.norm}, \mathpzc{E}qref{ff.decom}, \mathpzc{E}qref{ddot.estimn}, and Assumption~\ref{ass.lipsch},
\begin{gather}
\label{diff.ff}
|\ff{\boldsymbol{s}_2}{V}{V} - \ff{\boldsymbol{s}_1}{V}{V}|
\leq 2 (L_\varkappa + 2 L_E L_N) \|\boldsymbol{s}_2-\boldsymbol{s}_1\|\|V\|^2;
\\
\label{vikladka}
|f^{\prime\prime}(\theta)| \leq  2L_N \|\gamma^\prime(\theta)\|^2
=  2 L_N (1+|f^\prime(\theta)|^2).
\mathpzc{E}nd{gather}
For some $\theta_+ =\theta_+(L_N)>0$,
the solution $q(\theta) = \tan (2 L_N \theta)$ of the Cauchy problem $q(0) =0$ for the ode
$
q^\prime = \lambda(q):= 2 L_N (1+q^2)
$
is defined on $[0,\theta_+]$ and
\begin{equation}
\label{q.ineq}
\int_0^{\theta_+} \sqrt{1+q(\varsigma)^2} \; d \varsigma \leq \delta_s/3, \quad
L_N \int_0^{\theta_+} \sqrt{1+q(\varsigma)^2} \; d \varsigma + q(\theta_+)^2 \leq 1/3.
\mathpzc{E}nd{equation}
By \mathpzc{E}qref{vikladka}, $q_\ast^\prime \leq \lambda(q_\ast)$ and $q_\ast(0)=0$ for $q_\ast(\theta):= \pm f^\prime(\theta), \pm f^\prime(-\theta)$. Hence by \cite[Th.~4.1, p.~26]{Hart82}, every of these $q_\ast(\theta)$'s does not exceed $q(\theta)$ whenever  $|\theta| < \min \{\varepsilon_-,\varepsilon_+\}$ and $|\theta| \leq \theta_+$, For such $\theta$, we thus have
\begin{equation}
\label{oc.g}
|f^\prime(\theta)| \leq q(|\theta|), \;
\|\gamma^\prime(\theta)\| \leq \sqrt{1+|q(|\theta|)|^2},
\;
\|\gamma^{\prime\prime}(\theta)\| \leq \lambda[q(|\theta|)],
\;
\|\gamma(\theta) - \gamma(0)\| \leq \int_0^{|\theta|} \sqrt{1+|q(|\varsigma|)|^2} \; d \varsigma.
\mathpzc{E}nd{equation}
\par
We are going to show that $\min \{\varepsilon_-,\varepsilon_+\} > \theta_+$. Suppose to the contrary that $ \varepsilon_\sigma=\min \{\varepsilon_-,\varepsilon_+\} \leq \theta_+$, where $\sigma = \pm$. Let $\sigma =+$, the case $\sigma=-$ is treated likewise.
For $\theta \in [0,\varepsilon_+)$, we have
\begin{gather}
L_N\|\gamma(\theta) - \gamma(0)\| + |f^\prime(\theta)|^2
\overset{\text{\mathpzc{E}qref{oc.g}}}{\leq} L_N \int_0^\theta \sqrt{1+q(\varsigma)^2}\;d \varsigma + q(\theta)^2
\label{fin.lim}
\overset{\text{\mathpzc{E}qref{q.ineq}}}{\leq}  1/3 ,
\\
\label{partil.dal}
\|\gamma(\theta) - \gamma(0)\|
\overset{\text{\mathpzc{E}qref{oc.g}}}{\leq} \int_0^\theta \sqrt{1+q(\varsigma)^2}\;d \varsigma \overset{\text{\mathpzc{E}qref{q.ineq}}}{\leq}  \delta_s/3.
\mathpzc{E}nd{gather}
Since $\|\gamma^\prime(\theta)\|$ and $\|\gamma^{\prime\prime}(\theta)\|$ stay bounded
as $\theta \to \varepsilon_+-$ by \mathpzc{E}qref{oc.g}, there exist $\boldsymbol{s}_{\lim} := \lim_{\theta \to \varepsilon_+-}\gamma(\theta)$ and $W:= \lim_{\theta \to \varepsilon_+-}\gamma^\prime(\theta)$ and the vector $W$ is not aligned with $N$. Meanwhile, $\boldsymbol{s}_{\lim} \not\in \partial S$ thanks to \mathpzc{E}qref{partil.dal} since $\gamma(0) = \boldsymbol{c}$ is not in the $\delta_s$-vicinity of $\partial S$. It follows that the normal section $\gamma$ extends as a graph of a smooth function to the right of $\varepsilon_+$. Meanwhile, \mathpzc{E}qref{fin.lim} and \mathpzc{E}qref{partil.dal} imply that
\mathpzc{E}qref{def.dom} holds for $\theta=\varepsilon_+$ and so
for $\theta > \varepsilon_+, \theta \approx \varepsilon_+$. These violate the definition of $\varepsilon_+$ as an end of the maximal interval. The contradiction obtained proves that $\min \{\varepsilon_-,\varepsilon_+\} > \theta_+$.
\par
Now we put $\mathpzc{E}ta:=\theta_+, V_{\boldsymbol{p}} := \frac{\boldsymbol{p} - \boldsymbol{C}s}{\|\boldsymbol{p} - \boldsymbol{C}s\|}\; \forall \boldsymbol{p} \in D_{\boldsymbol{C}s}^\mathpzc{E}ta, \boldsymbol{p} \neq \boldsymbol{C}s$ and emphasize the dependence of $f(\cdot)$ on $V$ by adding the index $_V$ to $f$, thus obtaining $f_V(\cdot)$. Then the function
$$
g_{\boldsymbol{C}s}(\boldsymbol{p}) :=
\begin{cases}
f_{V_{\boldsymbol{p}}}(\|\boldsymbol{p} - \boldsymbol{C}s\|) & \text{whenever}\; \boldsymbol{p} \neq \boldsymbol{C}s,
\\
0 & \text{if}\; \boldsymbol{p} = \boldsymbol{C}s
\mathpzc{E}nd{cases}
\qquad \forall \boldsymbol{p} \in D_{\boldsymbol{C}s}^\mathpzc{E}ta
$$
is well-defined and meets \mathpzc{E}qref{patch}. Since $\|N[\gamma(\theta)] - N\| \leq L_N \|\gamma(\theta) - \gamma(0)\| <1/2$ by \mathpzc{E}qref{lip.const} and \mathpzc{E}qref{def.dom}, the vectors $N$ and $N[\gamma(\theta)]$ are not aligned. It follows that the function $g_{\boldsymbol{C}s}(\cdot)$ is $C^2$-smooth on $D_{\boldsymbol{C}s}^\mathpzc{E}ta$. \mathpzc{E}pf

\begin{lemma}
\label{lem.grad}
After properly reducing $\mathpzc{E}ta>0$, if necessary, the following inequalities hold for any $\boldsymbol{p} \in D_{\boldsymbol{C}s}^\mathpzc{E}ta, \boldsymbol{C}s \in S^0$:
\begin{gather}
\label{ner.gradient}
\|\nabla g_{\boldsymbol{C}s}(\boldsymbol{p})\| \leq 2 L_N \|\boldsymbol{p} - \boldsymbol{C}s\|,
\\
\label{ner.sama}
|g_{\boldsymbol{C}s}(\boldsymbol{p})| \leq  L_N \|\boldsymbol{p} - \boldsymbol{C}s\|^2.
\mathpzc{E}nd{gather}
\mathpzc{E}nd{lemma}
\par {\bf Proof:}\;
For any unit vector $V \in \mathfrak{T}_{\boldsymbol{C}s}(S)$ and $\boldsymbol{p} \in D_{\boldsymbol{C}s}^\mathpzc{E}ta$, we have $\zeta(\theta) := \Gamma_{\boldsymbol{C}s}[\boldsymbol{p} + \theta V] \in S \; \forall \theta \approx 0 \Rightarrow \mathfrak{T}_{\boldsymbol{p}}(S) \ni \zeta^\prime(0) = V + \spr{\nabla g_{\boldsymbol{C}s}(\boldsymbol{p})}{V}N(\boldsymbol{C}s)$. So $\zeta^\prime(0)$ is normal to $N(\boldsymbol{p})$ and
\begin{equation}
\label{start.from}
\spr{V}{N(\boldsymbol{p})} = - \spr{N(\boldsymbol{C}s)}{N(\boldsymbol{p})} \spr{\nabla g_{\boldsymbol{C}s}(\boldsymbol{p})}{V}.
\mathpzc{E}nd{equation}
Here $|\spr{V}{N(\boldsymbol{p})}| = |\spr{V}{N(\boldsymbol{p})-N(\boldsymbol{C}s)}| \leq \|N(\boldsymbol{p})-N(\boldsymbol{C}s)\|\leq L_N \|\boldsymbol{p} - \boldsymbol{C}s\|$ by \mathpzc{E}qref{lip.const}. Meanwhile, $\spr{N(\boldsymbol{C}s)}{N(\boldsymbol{p})} = 1+\spr{N(\boldsymbol{C}s)}{N(\boldsymbol{p})-N(\boldsymbol{C}s)}$, where $|\spr{N(\boldsymbol{C}s)}{N(\boldsymbol{p})-N(\boldsymbol{C}s)}| \leq \|N(\boldsymbol{p})-N(\boldsymbol{C}s)\| \leq L_N \|\boldsymbol{p} - \boldsymbol{C}s\|$. So by properly reducing $\mathpzc{E}ta>0$, if necessary, we can ensure that
$\spr{N(\boldsymbol{C}s)}{N(\boldsymbol{p})} \geq 1/2$. Then \mathpzc{E}qref{start.from} implies that $|\spr{\nabla g_{\boldsymbol{C}s}(\boldsymbol{p})}{V}| \leq 2 L_N \|\boldsymbol{p} - \boldsymbol{C}s\|$. Maximization over $V \in \mathfrak{T}_{\boldsymbol{C}s}, \|V\|=1$ yields \mathpzc{E}qref{ner.gradient}.
Also,
\begin{gather*}
|g_{\boldsymbol{C}s}(\boldsymbol{p})| = \left| \int_0^1 \spr{\nabla g_{\boldsymbol{C}s}[\theta\boldsymbol{p} + (1-\theta)\boldsymbol{C}s]}{\boldsymbol{p} - \boldsymbol{C}s} \; d \theta \right|
\overset{\text{\mathpzc{E}qref{ner.gradient}}}{\leq} 2 L_N \|\boldsymbol{p} - \boldsymbol{C}s\|^2 \int_0^1 \theta \; d \theta \Rightarrow \text{\mathpzc{E}qref{ner.sama} . \mathpzc{E}pf}
\mathpzc{E}nd{gather*}
\par
Based on \mathpzc{E}qref{patch} and \mathpzc{E}qref{ner.sama}, we see that
\begin{equation}
\label{sama1}
\|\Gamma_{\boldsymbol{C}s}(\boldsymbol{p}) - \boldsymbol{C}s\| \leq \|\boldsymbol{p} - \boldsymbol{C}s\| + L_N \|\boldsymbol{p} - \boldsymbol{C}s\|^2.
\mathpzc{E}nd{equation}
\begin{lemma}
\label{lem.secondder}
There is a non-decaying function $\zeta(\cdot)$ such that $\zeta(\varrho) \to 0$ as $\varrho \to 0+$ and
the Hessian $g^{\prime\prime}_{\boldsymbol{C}s}$ obeys the estimate
$$
\|g^{\prime\prime}_{\boldsymbol{C}s}(\boldsymbol{p}) - g^{\prime\prime}_{\boldsymbol{C}s}(\boldsymbol{C}s)\| \leq \zeta(\|\boldsymbol{p} - \boldsymbol{C}s\|) \qquad \forall \boldsymbol{p} \in D_{\boldsymbol{C}s}^\mathpzc{E}ta, \boldsymbol{C}s \in S^0.
$$
\mathpzc{E}nd{lemma}
\par {\bf Proof:}\;
In $\mathbb{R}^3$, we pick a Cartesian coordinate system centered at $\boldsymbol{C}s$ so that its $x$- and $y$-axes lie in the tangent plane $\mathfrak{T}_{\boldsymbol{C}s}(S)$ and the $z$-axis is co-directed with $N(\boldsymbol{C}s)$.
We also identify any point $\boldsymbol{p} \in \mathfrak{T}_{\boldsymbol{C}s}(S)$ with the pair $(x,y)$ of its coordinates.
Since the map $\Gamma:=\Gamma_{\boldsymbol{C}s} =[x,y,z(x,y)], z(x,y) := g_{\boldsymbol{C}s}(x,y)$ is a coordinate chart on $S$, we have \cite[p.~154]{Carmo76}
\begin{gather}
\label{dopil}
\ff{\Gamma(\boldsymbol{p})}{V_{\boldsymbol{p}}}{V_{\boldsymbol{p}}} = A(\boldsymbol{p}) (dx)^2 + 2 B(\boldsymbol{p}) dx dy + C(\boldsymbol{p}) (dy)^2,
\\
\nonumber
\text{where}\quad V_{\boldsymbol{p}}:=  \Gamma_x^\prime(\boldsymbol{p}) dx + \Gamma_y^\prime(\boldsymbol{p}) dy = [dx, dy, z^\prime_x dx + z^\prime_y dy],
\\
\nonumber
A(\boldsymbol{p})= \spr{N_{\Gamma(\boldsymbol{p})}}{\Gamma^{\prime\prime}_{xx}(\boldsymbol{p})} = \spr{N_{\Gamma(\boldsymbol{p})}}{N_{\boldsymbol{C}s}} z^{\prime\prime}_{xx}(\boldsymbol{p}),
\\
\nonumber
B(\boldsymbol{p})= \spr{N_{\Gamma(\boldsymbol{p})}}{\Gamma^{\prime\prime}_{xy}(\boldsymbol{p})}= \spr{N_{\Gamma(\boldsymbol{p})}}{N_{\boldsymbol{C}s}} z^{\prime\prime}_{xy}(\boldsymbol{p}),
\\
\nonumber
C(\boldsymbol{p})= \spr{N_{\Gamma(\boldsymbol{p})}}{\Gamma^{\prime\prime}_{yy}(\boldsymbol{p})} = \spr{N_{\Gamma(\boldsymbol{p})}}{N_{\boldsymbol{C}s}} z^{\prime\prime}_{yy}(\boldsymbol{p}).
\mathpzc{E}nd{gather}
After reducing $\mathpzc{E}ta$ so that $\mathpzc{E}ta <1$, we have for $\boldsymbol{p} \in D_{\boldsymbol{C}s}^\mathpzc{E}ta$,
\begin{gather*}
|\ff{\Gamma(\boldsymbol{p})}{V_{\boldsymbol{p}}}{V_{\boldsymbol{p}}} - \ff{\Gamma(\boldsymbol{C}s)}{V_{\boldsymbol{C}s}}{V_{\boldsymbol{C}s}}|
\leq |\ff{\Gamma(\boldsymbol{p})}{V_{\boldsymbol{p}}}{V_{\boldsymbol{p}}} - \ff{\Gamma(\boldsymbol{C}s)}{V_{\boldsymbol{p}}}{V_{\boldsymbol{p}}}|
+
|\ff{\Gamma(\boldsymbol{C}s)}{V_{\boldsymbol{p}}}{V_{\boldsymbol{p}}} - \ff{\Gamma(\boldsymbol{C}s)}{V_{\boldsymbol{C}s}}{V_{\boldsymbol{C}s}}|
\\
\overset{\text{\mathpzc{E}qref{diff.ff}}}{\leq} 2 (L_\varkappa + 2 L_E L_N) \|\Gamma(\boldsymbol{p})-\Gamma(\boldsymbol{C}s)\|\|V_{\boldsymbol{p}}\|^2
+ |\ff{\Gamma(\boldsymbol{C}s)}{V_{\boldsymbol{p}}- V_{\boldsymbol{C}s}}{V_{\boldsymbol{p}}- V_{\boldsymbol{C}s}}| + 2 |\ff{\Gamma(\boldsymbol{C}s)}{V_{\boldsymbol{p}}- V_{\boldsymbol{C}s}}{V_{\boldsymbol{C}s}}|

\\
\overset{\text{\mathpzc{E}qref{est.norm},\mathpzc{E}qref{ff.decom},\mathpzc{E}qref{sama1}}}{\leq}
 2 (L_\varkappa + 2 L_E L_N)\mathpzc{E}ta (1+ L_N \mathpzc{E}ta) \|V_{\boldsymbol{p}}\|^2
 + L_N [\|V_{\boldsymbol{p}} - V_{\boldsymbol{C}s}\|^2 + 2\|V_{\boldsymbol{p}} - V_{\boldsymbol{C}s}\| \|V_{\boldsymbol{C}s}\|].

\mathpzc{E}nd{gather*}
By noting that $\nabla g_{\boldsymbol{C}s}(\boldsymbol{C}s)=0$ due to \mathpzc{E}qref{ner.gradient}, we have $\|V_{\boldsymbol{p}} - V_{\boldsymbol{C}s}\| = |[z^\prime_x(\boldsymbol{p}) - z^\prime_x(\boldsymbol{C}s)]dx + [z^\prime_y(\boldsymbol{p}) - z^\prime_y(\boldsymbol{C}s)] dy|
\leq || \nabla g_{\boldsymbol{C}s}(\boldsymbol{p})\| \xi_d$, where $ \xi_d:= \sqrt{(dx)^2+(dy)^2}$. So by Lemma~\ref{lem.grad}, $\|V_{\boldsymbol{p}} - V_{\boldsymbol{C}s}\| \leq 2 L_N \mathpzc{E}ta \xi_d$. Meanwhile $\|V_{\boldsymbol{C}s}\|=\xi_d$. Thus
\begin{gather*}
|\ff{\Gamma(\boldsymbol{p})}{V_{\boldsymbol{p}}}{V_{\boldsymbol{p}}} - \ff{\Gamma(\boldsymbol{C}s)}{V_{\boldsymbol{C}s}}{V_{\boldsymbol{C}s}}| \leq M_{\mathbf{II}} \mathpzc{E}ta \,\xi_d^2, \qquad \text{where}
\\
M_{\mathbf{II}}:=  2 (L_\varkappa + 2 L_E L_N)(1 +L_N) [1+2 L_N  ]^2
 + 4 L_N^2 (L_N  + 1 )  .
\mathpzc{E}nd{gather*}
 Here $\ff{\Gamma(\boldsymbol{p})}{V_{\boldsymbol{p}}}{V_{\boldsymbol{p}}} - \ff{\Gamma(\boldsymbol{C}s)}{V_{\boldsymbol{C}s}}{V_{\boldsymbol{C}s}}= [A(\boldsymbol{p}) - A(\boldsymbol{C}s)](dx)^2 + 2 [B(\boldsymbol{p}) -B(\boldsymbol{C}s)] dx dy + [C(\boldsymbol{p}) -C(\boldsymbol{C}s)] (dy)^2$. Hence
 \begin{gather*}
 |A(\boldsymbol{p}) - A(\boldsymbol{C}s)| \leq M_{\mathbf{II}} \mathpzc{E}ta, \quad |C(\boldsymbol{p}) - C(\boldsymbol{C}s)| \leq M_{\mathbf{II}} \mathpzc{E}ta,
  \quad
  |B(\boldsymbol{p}) - B(\boldsymbol{C}s)| \leq  M_{\mathbf{II}} \mathpzc{E}ta.
 \mathpzc{E}nd{gather*}
At the same time,
\begin{gather*}
A(\boldsymbol{p}) - A(\boldsymbol{C}s) = \spr{N_{\Gamma(\boldsymbol{p})}}{N_{\boldsymbol{C}s}} z^{\prime\prime}_{xx}(\boldsymbol{p}) -  z^{\prime\prime}_{xx}(\boldsymbol{C}s)
=
 \spr{N_{\Gamma(\boldsymbol{p})}}{N_{\boldsymbol{C}s}} [z^{\prime\prime}_{xx}(\boldsymbol{p}) -  z^{\prime\prime}_{xx}(\boldsymbol{C}s)]
 + [\spr{N_{\Gamma(\boldsymbol{p})}}{N_{\boldsymbol{C}s}}-1] z^{\prime\prime}_{xx}(\boldsymbol{C}s);
 \\
 |\spr{N_{\Gamma(\boldsymbol{p})}}{N_{\boldsymbol{C}s}}-1| = |\spr{N_{\Gamma(\boldsymbol{p})}-N_{\boldsymbol{C}s}}{N_{\boldsymbol{C}s}}|
 \overset{\text{\mathpzc{E}qref{lip.const}}}{\leq} L_N \|\Gamma(\boldsymbol{p}) - \boldsymbol{C}s\| \overset{\text{\mathpzc{E}qref{sama1}}}{\leq}
 L_N [\|\boldsymbol{p} - \boldsymbol{C}s\| + L_N \|\boldsymbol{p} - \boldsymbol{C}s\|^2]
\\
 \leq L_N [1 + L_N \mathpzc{E}ta]\mathpzc{E}ta, \quad  \spr{N_{\Gamma(\boldsymbol{p})}}{N_{\boldsymbol{C}s}}  \geq 1 - L_N \mathpzc{E}ta [1 + L_N \mathpzc{E}ta] \geq 1/2
\mathpzc{E}nd{gather*}
if $\mathpzc{E}ta < (\sqrt{3}-1)/(2L_N)$. Meanwhile \mathpzc{E}qref{dopil} implies that
\begin{equation}
\label{rav.vtor}
\spr{g^{\prime\prime}_{\boldsymbol{C}s}(\boldsymbol{C}s)V}{V}=  \ff{\boldsymbol{C}s}{V}{V}
\mathpzc{E}nd{equation}
and so $|\spr{z^{\prime\prime}(\boldsymbol{C}s)V}{V}|=|\spr{g^{\prime\prime}_{\boldsymbol{C}s}(\boldsymbol{C}s)V}{V}| = |\ff{\boldsymbol{C}s}{V}{V}| = |\spr{\mathscr{S}_{\boldsymbol{C}s}V}{V}| \leq L_N\|V\|^2$ by \mathpzc{E}qref{est.norm}. Hence $|z^{\prime\prime}_{xx}(\boldsymbol{C}s)| \leq L_N,
|z^{\prime\prime}_{yy}(\boldsymbol{C}s)| \leq L_N, |z^{\prime\prime}_{xy}(\boldsymbol{C}s)| \leq L_N$. As a result,
\begin{gather*}
|z^{\prime\prime}_{xx}(\boldsymbol{p}) -  z^{\prime\prime}_{xx}(\boldsymbol{C}s)|
= \frac{|A(\boldsymbol{p})- A(\boldsymbol{C}s) - [\spr{N_{\Gamma(\boldsymbol{p})}}{N_{\boldsymbol{C}s}}-1] z^{\prime\prime}_{xx}(\boldsymbol{C}s)|}{\spr{N_{\Gamma(\boldsymbol{p})}}{N_{\boldsymbol{C}s}}}
\leq 2 (M_{\mathbf{II}} + L_N^2 +L_N^3 \mathpzc{E}ta)\mathpzc{E}ta.
\mathpzc{E}nd{gather*}
Similarly $|z^{\prime\prime}_{yy}(\boldsymbol{p}) -  z^{\prime\prime}_{yy}(\boldsymbol{C}s)| \leq 2 (M_{\mathbf{II}} + L_N^2+L_N^3 \mathpzc{E}ta)\mathpzc{E}ta, |z^{\prime\prime}_{xy}(\boldsymbol{p}) -  z^{\prime\prime}_{xy}(\boldsymbol{C}s)| \leq 2 (M_{\mathbf{II}} + L_N^2+L_N^3 \mathpzc{E}ta)\mathpzc{E}ta$.
It remains to note that for a given $\boldsymbol{p}$ from the basic disk $D_{\boldsymbol{C}s}^\mathpzc{E}ta$, the above estimates remain true with $\mathpzc{E}ta$ being artificially reduced and made arbitrarily close to $\|\boldsymbol{p} - \boldsymbol{C}s\|$. \mathpzc{E}pf
\begin{corr}
\label{cor.basicin}
The following relations hold for any $\boldsymbol{C}s \in S^0$, $\boldsymbol{p} \in D_{\boldsymbol{C}s}^\mathpzc{E}ta$:
\begin{gather*}
g_{\boldsymbol{C}s}(\boldsymbol{p}) = 1/2 \ff{\boldsymbol{C}s}{\boldsymbol{p}-\boldsymbol{C}s}{\boldsymbol{p}-\boldsymbol{C}s} + \omega_{\boldsymbol{C}s}(\boldsymbol{p}), \quad \text{\rm where}
\\
|\omega_{\boldsymbol{C}s}(\boldsymbol{p})| \leq \zeta(\|\boldsymbol{p} - \boldsymbol{C}s\|) \|\boldsymbol{p} - \boldsymbol{C}s\|^2/2, \\ \|\nabla \omega_{\boldsymbol{C}s}(\boldsymbol{p})\|
\leq \zeta(\|\boldsymbol{p} - \boldsymbol{C}s\|) \|\boldsymbol{p} - \boldsymbol{C}s\|,
\\
\|\omega_{\boldsymbol{C}s}^{\prime\prime}(\boldsymbol{p})\|
\leq \zeta(\|\boldsymbol{p} - \boldsymbol{C}s\|).
\mathpzc{E}nd{gather*}
\mathpzc{E}nd{corr}
The last inequality is immediate from Lemma~\ref{lem.secondder} and \mathpzc{E}qref{rav.vtor}. Then putting $\boldsymbol{p}(\theta):= (\boldsymbol{p}-\boldsymbol{C}s)\theta + \boldsymbol{C}s$, we have
\begin{gather*}
\left\| \nabla \omega_{\boldsymbol{C}s}(\boldsymbol{p}) \right\| = \left\| \int_0^1 \omega_{\boldsymbol{C}s}^{\prime\prime}[\boldsymbol{p}(\theta)][\boldsymbol{p} - \boldsymbol{C}s]\; d \theta \right\|
\leq \|\boldsymbol{p} - \boldsymbol{C}s\|\int_0^1 \|\omega_{\boldsymbol{C}s}^{\prime\prime}[\boldsymbol{p}(\theta)]\| \; d \theta \leq \zeta(\|\boldsymbol{p} - \boldsymbol{C}s\|)\|\boldsymbol{p} - \boldsymbol{C}s\|;
\\
\left|\omega_{\boldsymbol{C}s}(\boldsymbol{p}) \right| = \left| \int_0^1 \spr{\nabla \omega_{\boldsymbol{C}s}[\boldsymbol{p}(\theta)]}{\boldsymbol{p} - \boldsymbol{C}s}\; d \theta \right|
\leq \|\boldsymbol{p} - \boldsymbol{C}s\| \int_0^1 \|\nabla \omega_{\boldsymbol{C}s}[\boldsymbol{p}(\theta)]\|\; d \theta \leq \frac{\zeta(\|\boldsymbol{p} - \boldsymbol{C}s\|)}{2}\|\boldsymbol{p} - \boldsymbol{C}s\|^2 .
\mathpzc{E}nd{gather*}
\par
\begin{figure}
\centering
\scalebox{0.3}{\includegraphics{definx.eps}}
\caption{}
\label{definx.fig}
\mathpzc{E}nd{figure}
Now we consider a point $\boldsymbol{r} \in Z_{\text{op}}^a$ and its projection $\boldsymbol{C}s = \boldsymbol{C}s(\boldsymbol{r}):= \boldsymbol{\pi}(\boldsymbol{r})$ onto $S$; then $\boldsymbol{C}s \in S^0$ by the definition of $Z_{\text{op}}^a$. The rays $R$ emitted from $\boldsymbol{r}$ at a given angle $\alpha \in [0, \alpha_s]$ to $\varepsilonc{d} = \boldsymbol{C}s - \boldsymbol{r}$ are parametrized $\mathfrak{R}=\mathfrak{R}(\varphi)$ by angle $\varphi$ so that $\mathfrak{R}(\varphi)$ passes through the point $\boldsymbol{C}s+ d \varepsilonc{e}(\varphi) \tan \alpha $, where $d = \|\varepsilonc{d}\|$ is the distance from $\boldsymbol{r}$ to $S$ and $\varepsilonc{e}(\varphi) := E_-(\boldsymbol{C}s) \cos \varphi +  E_+(\boldsymbol{C}s)\sin \varphi$; see Fig.~\ref{definx.fig}.
The distance $d(\alpha,\varphi)$ from $\boldsymbol{r}$ to the point $\boldsymbol{p}$ of intersection of $\mathfrak{R}(\varphi)$ with the surface $S$
is given by $d(\alpha,\varphi) = (d+x \sin^2\alpha )/\cos \alpha$, where $x=x(\alpha,\varphi)$ is defined in Fig.~\ref{definx.fig} and scaling of the distance from $\boldsymbol{p}$ to the tangent plane by the factor $\sin^2 \alpha$ is introduced for further convenience. It follows that maximization of $d(\alpha,\varphi)$ over $\varphi$ is equivalent to maximization of $x$. Meanwhile, $x$ is the root
of the equation
\begin{equation}
\label{definition.x}
x = \lambda(x,\varphi|\alpha) := - \frac{g_{\boldsymbol{C}s}[\boldsymbol{C}s+ (d+x\sin^2\alpha) \varepsilonc{e}(\varphi) \tan \alpha]}{\sin^2\alpha}.
\mathpzc{E}nd{equation}
For this equation to be well-posed, the argument of $g_{\boldsymbol{C}s}(\cdot)$ should be in the domain $D_{\boldsymbol{C}s}^\mathpzc{E}ta$ of definition of $g_{\boldsymbol{C}s}(\cdot)$, which is equivalent to
\begin{equation}
\label{x.interval}
x \in I:=\left[ - \mathpzc{E}ta \frac{\cos\alpha}{\sin^3\alpha} - \frac{d}{\sin^2\alpha}; \mathpzc{E}ta \frac{\cos\alpha}{\sin^3\alpha} - \frac{d}{\sin^2\alpha}\right].
\mathpzc{E}nd{equation}
\begin{lemma}
\label{lemma.smooths}
There is $\alpha_1 = \alpha_1(\mathpzc{E}ta) \in (0,\alpha_s]$ such that whenever $\alpha \leq \alpha_1$, equation \mathpzc{E}qref{definition.x} has an unique root on the interval \mathpzc{E}qref{x.interval} and this root smoothly depends on $\varphi$ and $\boldsymbol{r} \in Z_{\text{op}}^a$.
\mathpzc{E}nd{lemma}
\par {\bf Proof:}\;
We first note that for $x \in I$,
\begin{gather*}
 |\lambda^\prime_x| \cos \alpha = |\spr{\nabla g_{\boldsymbol{C}s}[\boldsymbol{C}s+ (d+x\sin^2\alpha) \varepsilonc{e}(\varphi) \tan \alpha]}{ \varepsilonc{e}(\varphi)}\sin\alpha|
 \\
 \overset{\text{\mathpzc{E}qref{ner.gradient}}}{\leq} 2L_N  |d+x\sin^2\alpha| \tan \alpha \sin\alpha
 \overset{\text{\mathpzc{E}qref{x.interval}}}{\leq} 2L_N \mathpzc{E}ta \sin\alpha.
\mathpzc{E}nd{gather*}

So $|\lambda^\prime_x| \leq 1/2\; \forall x \in I, \alpha \in (0,\alpha_1]$ if $\alpha_1$ is chosen small enough. This implies that the root $x \in I$ of \mathpzc{E}qref{definition.x} (if exists) is unique. At the right end of $I$, the r.h.s. of \mathpzc{E}qref{definition.x} equals $-g_{\boldsymbol{C}s}[\boldsymbol{C}s+\mathpzc{E}ta \varepsilonc{e}(\varphi)]\sin^{-2}\alpha$ and is bounded over $\varphi$ due to \mathpzc{E}qref{ner.sama}, whereas the l.h.s. is
$[\mathpzc{E}ta \frac{\cos\alpha}{\sin\alpha} - d] \sin^{-2}\alpha \geq [\mathpzc{E}ta \frac{\cos\alpha}{\sin\alpha} - d_+] \sin^{-2}\alpha$, where $\mathpzc{E}ta \frac{\cos\alpha}{\sin\alpha} - d_+ \to \infty$ as $\alpha \to 0+$.
So by reducing $\alpha_1>0$, if necessary, it can be ensured that r.h.s. $<$  l.h.s. at the right end of $I$ for all $\varphi$ and $\boldsymbol{r} \in Z_{\text{op}}^a$. Similarly, it can be ensured that r.h.s. $>$ l.h.s. at the left end. Hence the root $x \in I$ of equation \mathpzc{E}qref{definition.x} does exist. By the implicit function theorem (applied to the function $x-\lambda(x,\varphi|\alpha)$) and Lemma~\ref{lem.cuvb}, this root smoothly depends on $\varphi$ and $\boldsymbol{r} \in Z_{\text{op}}^a$. \mathpzc{E}pf
\begin{lemma}
\label{lem.unifcon}
As $\alpha \to 0+$, the function $\lambda(x,\varphi|\alpha)$ and its first and second derivatives in $x$ and $\varphi$ converge to
the function $\lambda(x,\varphi|0)= - d^2 \ff{\boldsymbol{C}s}{\varepsilonc{e}(\varphi)}{\varepsilonc{e}(\varphi)} /2$ and its respective derivatives uniformly over $\boldsymbol{r} \in Z_{\text{op}}^a, \varphi \in \mathbb{R}$, and $x \in [-\ov{x}, \ov{x}]$ for any $\ov{x}>0$.
\mathpzc{E}nd{lemma}
\par {\bf Proof:}\;
For $\boldsymbol{p} := \boldsymbol{C}s+ (d+x\sin^2\alpha) \varepsilonc{e}(\varphi) \tan \alpha, x \in [-\ov{x}, \ov{x}]$, and $k:= d_+ +\ov{x}$, we have $\|\boldsymbol{p} - \boldsymbol{C}s\|=|x \sin^2\alpha +d| \tan \alpha \leq k \tan \alpha$.
Thanks to Corollary~\ref{cor.basicin},
\begin{gather*}
\lambda(x,\varphi|\alpha) = A+B, \quad \text{where}
\\
A:=-\frac{\ff{\boldsymbol{C}s}{(d+x\sin^2\alpha) \varepsilonc{e}(\varphi) }{(d+x\sin^2\alpha) \varepsilonc{e}(\varphi) }}{2\cos^2\alpha},
\\
B:= -\frac{\omega_{\boldsymbol{C}s}(\boldsymbol{p})}{\sin^2\alpha};
 \quad
|B| \leq  \zeta ( k \tan \alpha) \frac{k^2 }{2 \cos^2\alpha},
\\
|B^\prime_x| \leq \left|\spr{\nabla \omega_{\boldsymbol{C}s}(\boldsymbol{p})}{ \varepsilonc{e}(\varphi)} \right| \tan \alpha
\leq k \zeta ( k \tan \alpha)  \tan^2 \alpha,
\\
|B^\prime_\varphi| \leq \frac{|\spr{\nabla \omega_{\boldsymbol{C}s}(\boldsymbol{p})}{ \varepsilonc{e}^{\,\prime}(\varphi)}||d+x\sin^2\alpha|}{\sin\alpha\cos \alpha}
\leq k \zeta ( k \tan \alpha)/ \cos^2 \alpha,
\\
|B^{\prime\prime}_{xx}| \leq |\spr{\omega_{\boldsymbol{C}s}^{\prime\prime}(\boldsymbol{p})\varepsilonc{e}(\varphi)}{\varepsilonc{e}(\varphi)}| \tan^2 \alpha \sin^2\alpha
\leq \zeta ( k \tan \alpha)  \tan^2 \alpha \sin^2\alpha ,
\\
|B^{\prime\prime}_{x\varphi}| \leq |\spr{\nabla \omega_{\boldsymbol{C}s}(\boldsymbol{p})}{\varepsilonc{e}^{\,\prime}(\varphi)}|\tan \alpha
+ |\spr{\omega_{\boldsymbol{C}s}^{\prime\prime}(\boldsymbol{p})\varepsilonc{e}(\varphi)}{\varepsilonc{e}^{\,\prime}(\varphi)}|  |d+x \sin^2\alpha|  \tan^2\alpha
\leq
2 k \zeta ( k \tan \alpha) \tan^2 \alpha ,
\\
|B^{\prime\prime}_{\varphi\varphi}| \leq \frac{|\spr{\nabla \omega_{\boldsymbol{C}s}(\boldsymbol{p})}{\varepsilonc{e}^{\,\prime\prime}(\varphi)}||d+x\sin^2\alpha|}{\sin \alpha \cos \alpha}
+ \frac{|\spr{\omega_{\boldsymbol{C}s}^{\prime\prime}(\boldsymbol{p}) \varepsilonc{e}^{\, \prime}(\varphi)}{\varepsilonc{e}^{\, \prime}(\varphi)}|(d+x\sin^2\alpha)^2 }{\cos^2\alpha}
\leq 2 \frac{k^2 \zeta ( k \tan \alpha)}{\cos^2 \alpha}.
 \mathpzc{E}nd{gather*}
Thus $B$ and its first and second derivatives uniformly converge to $0$ as $\alpha \to 0+$. It remains to note that $A$ and its first and second derivatives uniformly converge to the function
$\lambda(x,\varphi|0)$ and its respective derivatives since $\ff{\boldsymbol{C}s}{\cdot}{\cdot}$ is a quadratic form. \mathpzc{E}pf
\par
In the light of Lemmas~\ref{lemma.smooths} and \ref{lem.unifcon}, the implicit function theorem applied to the function $x - \lambda(x,\varphi|\alpha)$ yields the following properties of the root $x=x(\varphi)$ of equation \mathpzc{E}qref{definition.x} (which also depends on $\boldsymbol{r}$ through $d$ and $\boldsymbol{C}s$).
\begin{corr}
\label{corr.final}
The function $x(\varphi)$ is $C^2$-smooth. This function and its first and second derivatives are continuous in $\boldsymbol{r}$ and converge to the root $y(\varphi) = - d^2 \ff{\boldsymbol{C}s}{\varepsilonc{e}(\varphi)}{\varepsilonc{e}(\varphi)} /2$ of the equation $y = \lambda(y,\varphi|0)$ and its respective derivatives uniformly over $\varphi \in \mathbb{R}, \boldsymbol{r} \in Z_{\text{op}}^a$ as $\alpha \to 0+$.
\mathpzc{E}nd{corr}
\par
{\bf PROOF OF PROPOSITION~\ref{prop.de}.}
Due to the definition of $\varepsilonc{e}(\varphi)$ (see Fig.~\ref{definx.fig}) and \mathpzc{E}qref{ff.decom},
\begin{gather*}
4 y(\varphi) = - 2 d^2 [\varkappa_-(\boldsymbol{C}s) \cos^2\varphi + \varkappa_+(\boldsymbol{C}s) \sin^2\varphi]
= - d^2 [\varkappa_-(\boldsymbol{C}s)+\varkappa_+(\boldsymbol{C}s)]   + d^2 [\varkappa_+(\boldsymbol{C}s) - \varkappa_-(\boldsymbol{C}s)]\cos(2 \varphi) .
\mathpzc{E}nd{gather*}
Since $\Delta_\tau \leq \varkappa_+ - \varkappa_- \leq 2L_N$ due to \mathpzc{E}qref{basic.ineq} and \mathpzc{E}qref{est.norm}, we have

\begin{gather*}

y^\prime(\varphi) = 0 \Leftrightarrow \varphi =0,  \pm \pi/2, \pi \mod  2 \pi,
\\
y^{\prime\prime}(\varphi) \leq - d_-^2 \Delta_\tau <0 \;\text{for}\; \varphi = 0, \pi  \mod 2 \pi,
\\
y^{\prime\prime}(\varphi) \geq  d_-^2 \Delta_\tau > 0 \;\text{for}\; \varphi =  \pm \pi/2  \mod  2 \pi ,
\\
|y^{\prime\prime}(\varphi)| \leq  d^2 |\varkappa_+-\varkappa_-| \leq 2 d_+^2 L_N,
\quad
|y^{\prime\prime\prime}(\varphi)| \leq 4 d_+^2 L_N.
\mathpzc{E}nd{gather*}
So putting $\delta:= \frac{d_-^2 \Delta_\tau}{8d_+^2 L_N}$, we have $y(0)=y(\pi)$,
\begin{gather*}
y^{\prime\prime}(\varphi) \leq - d_-^2 \Delta_\tau/2 <0 \;
\forall \varphi \in (-\delta, \delta)\cup (\pi-\delta,\pi+\delta)  \mod 2 \pi,
\\
y^{\prime\prime}(\varphi) \geq  d_-^2 \Delta_\tau/2 > 0 \; \forall \varphi \in (\pm \pi/2 - \delta, \pm \pi/2+\delta)  \mod 2 \pi,
\\
|y^\prime(\varphi)| \geq d_-^2 \delta \Delta_\tau/2 \quad \text{whenever $\varphi$ is outside all of the listed intervals}.
\mathpzc{E}nd{gather*}
Corollary~\ref{corr.final} ensures that the following relation hold for all small enough $\alpha$:
\begin{gather*}
x^{\prime\prime}(\varphi) \leq - d_-^2 \Delta_\tau/4 <0 \;
\forall \varphi \in (-\delta, \delta)\cup (\pi-\delta,\pi+\delta)  \mod 2 \pi,
\\
x^{\prime\prime}(\varphi) \geq  d_-^2 \Delta_\tau/4 > 0 \; \forall \varphi \in (\pm \pi/2 - \delta, \pm \pi/2+\delta)  \mod 2 \pi,
\\
\text{and}\quad |x^\prime(\varphi)| \geq d_-^2 \delta \Delta_\tau/4 \quad \text{whenever $\varphi$ is outside all of the listed intervals}.
\mathpzc{E}nd{gather*}
By applying the implicit function theorem to the equation $x^\prime(\varphi)=0$ and reducing $\delta$, if necessary, we see that
this equation has a single root on every of the following $(\mathrm{mod}\, 2\pi)$-intervals $(-\delta, \delta), (\pi-\delta,\pi+\delta), (- \pi/2 - \delta, - \pi/2+\delta), (\pi/2 - \delta, \pi/2+\delta)$, this root continuously depends on $\boldsymbol{r} \in Z_{\text{op}}^a$ and uniformly goes to the center of the respective interval as $\alpha \to 0+$. Meanwhile, the last displayed formulas assure that there are no other roots and $x(\varphi)$ attains its local maxima at two points: at the roots $\varphi_0 \in (-\delta,\delta)$ and $\varphi_\pi \in (\pi -\delta,\pi+\delta)$. So MDPBE is well posed. It remains to note that it returns the line that goes in the direction of $\varphi_\ast:=1/2(\varphi_0 + \varphi_\pi - \pi)$, where $\varphi_\ast \to 0$ as $\alpha \to 0+$ uniformly over $\boldsymbol{r} \in Z_{\text{op}}^a$ and $\varphi=0$ corresponds to the principal direction $p_-(\boldsymbol{C}s)$. \mathpzc{E}pf

\begin{thebibliography}{10}

\bibitem{AhLeAnHo09full}
S.~Ahrens, D.~Levine, G.~Andrews, and J.P. How.
\newblock Vision-based guidance and control of a hovering vehicle in unknown,
  \uppercase{gps}-denied environments.
\newblock In {\mathpzc{E}m Proceedings of the IEEE International Conference on Robotics
  and Automation}, pages 2643–--2648, Kobe, Japan, 2009.

\bibitem{AnFiDoMe06}
A.~Angeli, D.~Filliat, S.~Doncieux, and J.~Meyer.
\newblock 2\uppercase{D} simultaneous localization and mapping for micro aerial
  vehicles.
\newblock In {\mathpzc{E}m Proceedings of the European Micro Aerial Vehicles
  conference}, Braunschweig, Germany, July 2006.

\bibitem{BaHeRo09}
A.~Bachrach, R.~He, and N.~Roy.
\newblock Autonomous flight in unknown indoor environments.
\newblock {\mathpzc{E}m International Journal of Micro Air Vehicles}, 1(4):217--–228,
  2009.

\bibitem{BaPrHeRo11}
A.~Bachrach, S.~Prentice, R.~He, and N.~Roy.
\newblock Range-robust autonomous navigation in \uppercase{gps}-denied
  environments.
\newblock {\mathpzc{E}m Journal of Field Robotics}, 28(5):644--666, 2011.

\bibitem{BER88}
M.~Bereger and B.~Gostvaux.
\newblock {\mathpzc{E}m Differential Geometry: Manifolds, Curves, and Surfaces}.
\newblock Springer-Verlag, Berlin, 1988.

\bibitem{CoMeGuMa09}
J.~Courbon, Y.~Mezouar, N.~Guenard, and P.~Martinet.
\newblock Visual navigation of a quadrotor aerial vehicle.
\newblock In {\mathpzc{E}m Proceedings of the International Conference on Intelligent
  Robots and Systems}, pages 5315--5320, St. Louis, MO, October 2009.

\bibitem{FaKaJoWe10}
N.~Fairfield, G.~Kantor, D.~Jonak, and D.~Wettergreen.
\newblock Autonomous exploration and mapping of flooded sinkholes.
\newblock {\mathpzc{E}m Int. Journal of Robotics Research}, 29(6):748–--774, 2010.

\bibitem{GaTaTh13}
A.~Gargade, D.~Tambuskar, and G.~Thokal.
\newblock Modeling and analysis of pipe inspection robot.
\newblock {\mathpzc{E}m Int. Journal of Emerging Technology and Advanced Engineering},
  3(5):120--126, 2013.

\bibitem{GiWil01}
J.~Gibbs and E.~Wilson.
\newblock {\mathpzc{E}m Vector Analysis}.
\newblock Scribner's Sons, NY, 1901.

\bibitem{GrGrBu12full}
S.~Grzonka, G.~Grisetti, and W.~Burgard.
\newblock A fully autonomous indoor quadrotor.
\newblock {\mathpzc{E}m IEEE Transactions on Robotics}, 28(1):90--100, 2012.

\bibitem{Hart82}
P.~Hartman.
\newblock {\mathpzc{E}m Ordinary Differential Equations}.
\newblock Birkh\"{a}uzer, Boston, second edition, 1982.

\bibitem{Kendoul12}
F.~Kendoul.
\newblock Survey of advances in guidance, navigation, and control of unmanned
  rotorcraft systems.
\newblock {\mathpzc{E}m Journal of Field Robotics}, 29(2):315--378, 2012.

\bibitem{LeFrPo11}
G.~Lee, F.~Fraundorfer, and M.~Pollefeys.
\newblock \uppercase{MAV} visual \uppercase{SLAM} with plane constraint.
\newblock In {\mathpzc{E}m Proceedings of the IEEE International Conference on Robotics
  and Automation}, pages 3139--3144, Shanghai, China, May 2011.

\bibitem{MaRiRiCa16full}
A.~Mallios, P.~Ridao, D.~Ribas, and M.~Carreras.
\newblock Toward autonomous exploration in confined underwater environments.
\newblock {\mathpzc{E}m Journal of Field Robotics}, 33(7):994--1012, 2016.

\bibitem{Carmo76}
M.~\mbox{do Carmo}.
\newblock {\mathpzc{E}m Differential Geometry of Curves and Surfaces}.
\newblock Prentice-Hall, Englewood Cliffs, NJ, 1976.

\bibitem{TurGar10}
J.~\mbox{Mirats Tur} and W.~Garthwaite.
\newblock Robotic devices for water main in-pipe inspection: \uppercase{a}
  survey.
\newblock {\mathpzc{E}m Journal of Field Robotics}, 27(4):491--508, 2010.

\bibitem{MoHiKi07}
R.~Mori, K.~Hirata, and T.~Kinoshita.
\newblock Vision-based guidance control of a small-scale unmanned helicopter.
\newblock In {\mathpzc{E}m Proceedings of the IEEE/RSJ International Conference on
  Intelligent Robots and Systems}, pages 2648--2653, San Diego, CA, October
  2007.

\bibitem{NaPr14}
A.~Nayak and S.~Pradhan.
\newblock Design of a new in-pipe inspection robot.
\newblock {\mathpzc{E}m Procedia Engineering}, 97:2081--2091, 2014.

\bibitem{OnKeBo03}
J.~Ong, D.~Kerr, and K.~Bouazza-Marouf.
\newblock Design of a semi-autonomous modular robotic vehicle for gas pipeline
  inspection.
\newblock {\mathpzc{E}m Proc. Institution of Mechanical Engineers: \uppercase{J}. of
  Systems and Control Engineers}, 217(2):109--122, 2003.

\bibitem{RohCho02}
S.~Roh and H.~Choi.
\newblock Strategy for navigation inside pipelines with differential-drive
  inpipe robot.
\newblock In {\mathpzc{E}m Proceedings of the IEEE International Conference on Robotics
  and Automation}, pages 2575–--2580, Washington, DC, 2002.

\bibitem{ShBoBeSi09}
D.~Schafroth, S.~Bouabdallah, C.~Bermes, and R.~Siegwart.
\newblock From the test benches to the first prototype of the mufly micro
  helicopter.
\newblock {\mathpzc{E}m Journal of Intelligent and Robotic Systems}, 54(1--3):245–--260,
  2009.

\bibitem{ScJuRu09full}
M.~Schwager, B.~Julian, and D.~Rus.
\newblock Optimal coverage for multiple hovering robots with downward facing
  cameras.
\newblock In {\mathpzc{E}m Proceedings of the IEEE International Conference on Robotics
  and Automation}, pages 4016--4023, Kobe, Japan, May 2009.

\bibitem{Shaf94}
I.R. Shafarevich.
\newblock {\mathpzc{E}m Basic Algebraic Geometry}, volume~1.
\newblock Springer-Verlag, Berlin, 2nd edition, 1994.

\bibitem{ThBrBe08}
J.~Thielemann, G.~Breivik, and A.~Berge.
\newblock Pipeline landmark detection for autonomous robot navigation using
  time-of-flight imagery.
\newblock In {\mathpzc{E}m Proceedings of the IEEE Computer Sosiety Conference on
  Computer Vision and Pattern Recognition}, Anchorage, USA, June 2008.

\bibitem{TrBuFo05}
S.~Thrun, W.~Burgard, and D.~Fox.
\newblock {\mathpzc{E}m Probabilistic robotics}.
\newblock MIT Press, Cambridge, MA, 2005.

\bibitem{ToVaHoFe06}
G.~Tournier, M.~Valenti, J.~How, and E.~Fero.
\newblock Estimation and control of a quadrotor vehicle using monocular vision
  and moire patterns.
\newblock In {\mathpzc{E}m Proceedings of the AIAA Guidance, Navigation, and Control
  Conference and Exhibit, Guidance, Navigation, and Control and Co-located
  Conferences}, Keystone, CO, 2006.

\bibitem{WHOBGC10full}
C.~White, D.~Hiranandani, C.~Olstad, K.~Buhagiar, T.~Gambin, and C.~Clark.
\newblock The \uppercase{M}alta cistern mapping project: Underwater robot
  mapping and localization within ancient tunnel systems.
\newblock {\mathpzc{E}m Journal of Field Robotics}, 27:399--411, 2010.

\bibitem{WuLiZhShQi08}
S.~Wu, Q.~Li, E.~Zhu, J.~She, and M.~Qin.
\newblock A hybrid intelligent system for pipeline robot navigation in unknown
  environment.
\newblock In {\mathpzc{E}m Proceedings of the International Conference on Intelligent
  Robotics and Applications}, pages 189--198, Wuhan, China, October 2008.

\mathpzc{E}nd{thebibliography}

\mathpzc{E}nd{document}