The Cross-Sensor Intelligence Architecture (CSIA) is a working demonstration built at SWORT. It replaces naive weighted-average sensor fusion with a Dynamic Trust Graph: each node is a sensor, each edge encodes a physical relationship between two sensors, and every sensor carries a Trust Coefficient that is updated continuously as the aircraft flies.
When something goes wrong, CSIA does not raise a single fault flag. Its output is a probability distribution over likely causes, so an operator sees which channel is probably lying, not only that something is.
How it runs
The deployable path is a 25 Hz causal runtime:
SourcePlugin → OnlineTrustLayer → FailsafePolicy → Actuators
(MAVLink | simulator) (trust + diagnosis) (state machine) (log | MAVLink)- OnlineTrustLayer ingests one sample at a time and emits eight trust coefficients, evidence sub-scores and the diagnosis posterior every tick.
- FailsafePolicy is a deterministic state machine, NORMAL → CAUTION → CRITICAL → EMERGENCY, with dwell times and hysteresis so it never flaps on a single tick.
- Raw-sensor monitoring. The GPS node reads the raw receiver stream, not the autopilot's fused estimate. In SITL a GPS glitch was invisible in the fused output and caught from the raw stream.
- Every failsafe output is advisory by default; nothing commands the vehicle unless that is separately enabled.
The same logic also runs as a zero-allocation C runtime on the STM32H743, with under 100 µs maximum observed execution time.
Evidence
| Test | Result |
|---|---|
| ArduPilot SITL, full autonomous mission over live MAVLink | Pass: 6 sensors monitored, minimum trust 0.78, zero false alarms, landed |
| SITL fault injection into the real autopilot mid-flight | Pass: GPS glitch and fix loss detected live (GPS trust 0.99 → 0.70) |
| Held-out tests | 95% fault-event detection; fewer than 1 false alert per 10 nominal hours |
| Log evaluation | 1,500 logs, 60 hours |
| STM32H743 target | Under 100 µs maximum observed execution time |
| Soak test through the reset path | 277,500 ticks over 3.1 flight-equivalent hours, 0 errors |
| C runtime against the Python reference | Zero-allocation; agrees within 1e-12 |
Status and limits
Deployable advisory software. It has been validated in simulation, against a live SITL autopilot, on held-out logs and on STM32H743 hardware. It is not certified flight-critical software, and it is given no command authority until that is separately enabled and validated.