The product
From four log files
to one verified sequence.
Import, align, reconstruct and hand off. Every step is recorded, and every result can be rerun to the same answer.
- Deterministic rules
- Order unknown inside the error
- Seven export formats
- No invented confidence scores
01 Import
Drop in four files, or point at your bucket.
Foxborne recognizes each file by its content, hashes it on arrival and never writes to it again. The import job lists every step it ran, so nothing happens out of sight.
- RecognizeEach file identified by its content: the ULog header, journal fields and the collector and receiver schemas.
- HashSHA-256 of every original, stored write-once before anything reads it.
- Parse the flight log11 of 13 expected topics present. Not logged: distance_sensor and vehicle_imu_status.
- Parse the journalRealtime and monotonic timestamps kept, with the boot ID that ties the collector samples to it.
- AlignFlight log ±40 ms, journal ±6 ms, ground receive ±15 ms plus latency. Aligned ±46 ms.
- Run the rules12 deterministic rules, each finding stamped with its rule version and threshold.
- PX4 ULog
- journalctl JSON
- Collector JSONL
- Receiver JSONL
- IRIG 106 Chapter 10
- Range records
02 Align
Every source on UTC, with its error drawn in.
GPS time anchors the flight log, chrony vouches for the companion clock and range control stamps every arrival. Each source keeps its own error bound, and no line of the report claims an order the bounds cannot support.
- Error bound per source
- 2 s alignment limit
03 Reconstruct
Rules catch what changed. You decide what it means.
12 deterministic rules run on every import. Each finding records the rule, its version and the threshold that fired, so the same files always give the same findings.
| Rule | Detects | Threshold | In the report |
|---|---|---|---|
| Service exitprocess_exit v1.2 | An allowlisted systemd unit leaves the active state. | 6 units on the allowlist | Observed: process exited |
| Service restartservice_restart v1.0 | systemd schedules a restart of an allowlisted unit. | Any restart | Observed: service restarted |
| Memory pressurememory_pressure v1.1 | A watched process stays above its memory threshold. | RSS at or above 6,144 MiB for 3 samples | Observed: memory rose above threshold |
| Telemetry gaptelemetry_gap v1.3 | No HEARTBEAT arrives at the ground receiver beyond the expected interval. | More than 3 s without a HEARTBEAT | Observed: telemetry receive gap, not necessarily radio failure |
| Device disconnectdevice_disconnect v1.0 | The kernel reports that a USB device on the allowlist disconnected. | Any disconnect on an allowlisted port | Observed: device disconnected |
| Vibrationvibration_high v1.0 | accel_vibration_metric in vehicle_imu_status stays above the platform threshold. | Above 24 m/s² for 1 s (T4), 12 m/s² (Q4) | Observed: vibration above threshold |
| Failsafefailsafe_entered v1.0 | vehicle_status reports a failsafe, with the cause from failsafe_flags. | Any failsafe | Observed: failsafe entered, with its cause |
| Topic stalltopic_stall v1.0 | A logged uORB topic stops updating at its expected rate. | No sample for 5 times the median period | Observed: topic stopped updating |
| GNSS jamminggnss_jamming v1.0 | sensor_gps reports jamming_state 3 (detected) from the receiver. | jamming_state 3 for 1 s | Observed: the receiver reported jamming |
| GPS quality dropgps_quality_drop v1.0 | Horizontal accuracy or satellite count crosses the vehicle threshold. | eph above 2.5 m or fewer than 8 satellites for 2 s | Observed: GPS quality degraded |
| Logger dropoutlog_dropout v1.0 | The flight log records a dropout marker. | Dropout of 50 ms or longer | Observed: flight log has a dropout |
| Clock uncertainclock_uncertain v1.0 | A source has no trustworthy anchor, or its estimated error exceeds the ordering bound. | Anchor missing or error above 2 s | Warning: ordering between sources is uncertain |
04 Map and vehicle
Where it happened, and which part saw it.
Maps are drawn from the elevation data you load, with the MGRS grid, the track and every stretch the ground heard nothing. No tile service is ever called, so an air-gapped network shows the same map.
- 115:41:00.912Vibration above 24 m/s² for 1 s in the obstacle belt
- 215:41:02.604Kernel: USB device 1-2.3 disconnected (mesh radio)
- 315:41:02.790mavlink-routerd cannot reach range control
- 415:41:03.713Heartbeat due and not received. Nothing for 31.0 s
- 515:41:05.286No ground station heartbeat on TELEM2
- 615:41:14.293GCS connection loss: switching to Hold
- 715:41:32.214Kernel: usb0 registered again
- 815:42:10.511Mission resumed from range control
05 Evidence levels
Measured, inferred or unknown.
Every line carries one of four levels, and two events inside each other’s error bars stay unordered. Move along the timeline: the detail below it is 140 ms of the example, drawn 100 times closer.
A value, event or log line captured directly.
perception.service exited at 14:32:04.133.
Events that line up inside a known error bound.
The next heartbeat was due 0.76 s after the router stopped.
An explanation that still needs a check.
The router unit may be bound to the perception unit.
Sources are missing, partial, or disagree on time.
Nothing supports an order between the stall and the kill.
- 14:32:01.204±6 msperception_node memory passed 6,144 MiBObserved
- 14:32:04.079±40 msLast obstacle_distance sample before a 7.5 s stallOrder unknown
- 14:32:04.118±6 msKernel killed perception_node, out of memoryOrder unknown
- 14:32:04.152±6 msmavlink-router.service stoppedObserved
- 14:32:04.912±15 msHeartbeat due and not received. Nothing for 6.96 s
- 14:32:09.214±6 msperception.service restartedObserved
- 14:32:10.874±15 msTelemetry received againObserved
06 Hand off
A report another engineer can check.
Findings, sequence, evidence, limitations and open questions, on pages that carry your marking. Every excerpt names its file, its line or byte offset and the SHA-256 of the file.
- CUI banner and designation indicator
- File, line and byte offset
- Open questions travel with the report
- Controlled by
- Harrow Field Robotics
- Controlled by
- Reliability Engineering
- CUI category
- EXPT
- Dissemination
- FEDCON
- POC
- [email protected]
Telemetry gap after perception.service was killed
Telemetry stopped reaching range control within one second of the kernel killing perception_node. The router unit may be bound to the perception unit.
| Time, UTC | Event | Level | Ref |
|---|---|---|---|
| 14:32:04.079±40 ms | Last obstacle_distance sample Order against E3 is unknown: 39 ms apart, inside ±46 ms. | Order unknown | E2 |
| 14:32:04.118±6 ms | Kernel killed perception_node | Order unknown | E3 |
| 14:32:04.152±6 ms | mavlink-router.service stopped | Observed | E5 |
| 14:32:04.912±15 ms | Heartbeat due and not received 0.76 s after the router stopped. | E6 |
- 1The engineer’s conclusion, labeledA finding says whether it is an observation, a hypothesis or unknown, and who wrote it. Everything below it is extracted from the sources.
- 2Uncertainty stays visibleTwo events inside each other’s clock error are marked order unknown in the report, exactly as on screen.
- 3Every line points at bytesThe file, the line or byte offset, and the SHA-256 of the file. Anyone holding the original can check each line.
- 4Your marking on every pageThe banner marking at the top and bottom of every page, and the CUI designation indicator on the first, set once by your administrator.
07 AI models
AI where a rule cannot reach. Never where it would decide.
Six jobs that a fixed rule or a hand-written parser does badly. Every proposal is checked by code before anything changes, and none of them writes evidence, a finding or an order between events.
- Runs inside your boundary
- Ships in the signed bundle
- Nothing sent to a model provider
- Proposes, never concludes
| Where | What the model does | What checks it |
|---|---|---|
| Read a log nobody wrote a parser for | Reads the first lines of an unfamiliar text log, such as a radio’s status export, and proposes the time column, its clock and what each column holds. | The parser runs over every line before an admin saves it. Lines it cannot read are listed, never guessed. |
| Find one moment on two clocks | Finds events on an unsynchronized companion clock that have a counterpart in the flight log, so the clock can be aligned by hand. | The delay between them is learned from aligned runs, and a pair seen too rarely cannot be used. The offset and its bound are arithmetic. |
| Check a finding against the records | Lists every time, time difference, value and parameter an engineer’s finding states, and every word that claims a cause. | Each claim is matched to a record and to the clock bounds. The text is marked, never changed. |
| Turn an investigation into a rule | Reads incident findings for two rules that fire in order on one vehicle, such as a disconnect seconds after a vibration spike. | The runs where both fired are counted, and the rule runs nowhere until an admin creates it. |
| Explain a raw record | Reads a flight log message or a journal entry field by field, and says what the record cannot tell you. | The record stays on screen as the evidence. The reading never enters a report. |
| Search by meaning | Finds evidence that says the same thing in other words: a search for radio finds USB disconnects and heartbeat losses. | Every result is an event with its ID and its original record. |
08 Boundaries
Read-only by design.
No command channel, no open port on the vehicle, no data sent to us. It is how Foxborne is built, not a setting someone can change.
The collector never sends MAVLink to the flight controller. Foxborne cannot fly, command or reconfigure a vehicle.
Collectors connect outbound over mutual TLS and spool on board while the link is down.
Rules report what they observed. The engineer writes the conclusion, and the report keeps the two apart.
A figure like 91% needs a calibrated model and labeled incidents. Reviewers get the evidence itself, which is what they sign off on.
Files are hashed on arrival and never rewritten. Reviewers annotate beside the evidence, never on top of it.
A self-hosted deployment has no telemetry, no crash reporting and no license call home.
A pilot on your own data
Bring your hardest incident.
Send one failure you have already investigated. We rebuild it on your data, beside your current tools, and show where the evidence agrees with your conclusion and where it doesn’t.
- 1Send one incidentA failure you have already investigated, with the flight log and whatever companion or ground evidence you kept.
- 2We reconstruct itBeside your current tools, on your data, with every claim traced to its source.
- 3Compare the answersWhere the evidence agrees with your conclusion, where it does not, and what it cannot decide.