A vehicle that believes a false position will fly, drive or sail to it
Autonomy has made the sensor-fusion problem physical. A wrong number used to produce a wrong display. Now it produces a wrong manoeuvre.
The industry's answer has been more sensors. More sensors is the right instinct and an incomplete answer, because it moves the hard question rather than solving it: when your sensors disagree, which one do you believe — and what do you refuse to do until you know?
Three ways this bites
GNSS interference does not stop at the coastline. The same jamming that grounded a container ship affects aircraft and drones operating in the same airspace. A UAV holding a false position holds it confidently.
Sensor fusion averages. Most fusion is built on the assumption that sources are independent and errors are random. A spoofer is neither. Averaging a deliberate lie with three truths moves the answer toward the lie, in exactly the direction the attacker chose.
The action cannot be recalled. Release a weapon, commit to a landing, brake or do not brake, hand control back to a human — these do not have an undo. Whatever assurance exists has to happen before the release, not in the log afterwards.
What SENTINEL adds to a fusion stack
It is not a replacement for your estimator. It is the layer that decides whether the estimator's output is allowed to cause something.
A plausibility gate per source. Each source is tested against how far it could physically have moved since its own last accepted report. A source that jumps is refused before it reaches the fusion, and the refusal is recorded with its reason.
A participation count. The system knows how many sources are genuinely contributing right now — not how many are installed.
Opinions and numbers on the same footing. Real stacks carry both: a position estimate with a covariance, and a monitor that says position suspect. SENTINEL judges both kinds of source in the same decision, rather than bolting the categorical one onto the end as a flag.
A gate on the actuator path. The irreversible action is held non-releasing by default and released only once the decision record for that interval is committed and verifies. An attacker who wants the machine to move has to defeat the record, not just the sensor.
A record that replays exactly. Same inputs, same record, byte for byte — and a comparator that locates the first point at which two runs diverged.
Why the record is the commercial argument
Ask anyone who has been through an autonomous-vehicle incident review what the hardest part was. It is rarely the physics. It is reconstructing what the machine knew at the moment it decided, from logs that were written for debugging rather than for evidence.
SENTINEL's record is designed as evidence first: sealed, chained, and complete about what it refused as well as what it used.
Who this is for
UAS and counter-UAS developers operating in contested or interference-heavy airspace. Autonomous vehicle and robotics teams who have to explain a decision to a regulator or a court. Avionics and flight-systems integrators working GNSS-degraded navigation. Certification and safety-case engineers who need the argument to be checkable from the record rather than from a document.
What it is not
- Not a sensor, an estimator or a receiver. It does not detect jamming at RF and does not replace your Kalman filter. It decides what to do when the filter's inputs disagree.
- Not flight-qualified. No DO-178C, no airworthiness artefacts, no safety certification.
- Not field-proven. Simulation only. This is the gap we are looking for partners to close.
- Not a granted patent. Four US provisional applications filed; none examined.
What we want from you
A real disagreement. One recorded interval where your sensors contradicted each other and somebody had to decide — that is more useful to us than a specification.
info@rvappliedsystems.com · RV Applied Systems, Inc., Las Vegas, Nevada
Four US provisional patent applications filed. Patent pending; none examined or granted.