A deterministic consensus and integrity engine for navigation you can verify
Ships, aircraft and autonomous vehicles rely on several navigation sources at once. Each source reports its own health, and a spoofed or jammed source can report itself as healthy. SENTINEL checks the sources against each other, identifies the one that disagrees, tells the operator what can still be trusted and what to do next, and keeps a tamper-evident record of every decision.
SENTINEL by industry
- Overview — When an instrument lies, everything downstream inherits the lie
- Maritime & defense — GPS jamming and spoofing at sea, assured position, and the record a casualty investigation needs
- Aviation & autonomous systems — Aircraft, drones and self-driving: many sensors, one irreversible action
- Critical infrastructure — Grid protection, substation timing, water and process control under a regulator's eye
- Cybersecurity & AI agents — Operating safely while an input is already compromised, and consensus across AI systems
The problem
Modern platforms combine satellite navigation, inertial sensors, celestial fixes and backup systems into one position.
No source can detect its own compromise. A receiver being spoofed calculates its health from the same false signal it is reporting.
Sources on one vessel share an environment, so their errors are related. Combining them as if they were independent overstates confidence in the result.
Operators are left to reconcile the sources themselves, across separate displays, under time pressure.
How it works
Four steps, run every decision cycle.
Fuse without assuming independence.
Source estimates are combined with a method that stays consistent when the relationships between their errors are unknown.
Judge each source against the others.
Each source is scored by how far it sits from the agreement of the rest. A source under suspicion is kept out of the baseline it is measured against, so a false input cannot pull the consensus toward itself and make honest sources look wrong.
Resolve to a defined state.
A deterministic state machine maps the result to one of a fixed set of integrity states, each with a stated recovery action. The same inputs always produce the same state. If too few sources agree, the engine fails closed rather than report a position nobody can vouch for.
Record the decision.
Every verdict produces a hash-chained receipt naming the sources that took part, which can be verified later without the engine that produced it.
Four patent applications
Four U.S. provisional patent applications were filed in 2026 by RV Technology Consulting.
1. Consensus and integrity
Deterministic Multi-Source Consensus and Integrity Engine for Assured Positioning, Navigation, and Timing. Checks navigation and timing sources against each other rather than trusting what each reports about itself, identifies the source that disagrees, and resolves the result to a defined integrity state with a stated recovery action. This is the engine described in “How it works” above.
2. Governed transitions and audit receipts
Quorum-Governed Integrity State Transitions and Roster-Bound Audit Receipts for Multi-Source Estimation Systems. Governs when the integrity state is allowed to change, so a single disagreeing source cannot move the system on its own, and binds every decision to a record of exactly which sources took part. The record can be checked later by anyone holding it, without the engine that produced it.
3. Accountable fusion
Accountable Deterministic Fusion of Asynchronous Multi-Source Measurements With Per-Report Disposition Accounting. Extends the same discipline from a handful of navigation sources to high-rate sensor fusion. Every accepted report receives a recorded outcome: fused, deferred, refused or expired, each with its reason, so nothing is dropped silently when the load exceeds what the processor can carry. The fused result is the same whether the work runs on one processing core or many, and a report that arrives late corrects the record going forward without rewriting what was already recorded.
4. Consensus over categorical judgements and multi-agent decision ensembles.
A fourth provisional application, filed 24 September 2026, covering consensus across sources that give a verdict rather than a measurement — including AI systems judging the same question.
Patent pending. U.S. provisional applications 64/144,562, 64/149,078, 64/159,476 and 64/161,448.
Design properties
Deterministic
Reproducible behavior that can be tested, explained and certified.
Fail-closed
Below a declared minimum of agreeing sources, no unadjudicated position is emitted.
Auditable
A tamper-evident decision trail for post-event review.
Software only
Runs above existing sensors and displays; no new hardware.
Embedded-ready
A C11 reference implementation that allocates no memory at run time.
Decision support, not autopilot
The operator keeps decision authority.
Where it applies, and where it extends
The same problem appears wherever a decision depends on several sources that can fail, disagree or arrive faster than they can be processed: a system has to decide what to trust, account for what it did with every input, and show afterwards why it decided what it did.
Naval and defense platforms
Assured positioning, navigation and timing awareness for watch teams in contested or congested electromagnetic environments, and multi-sensor fusion for aircraft and ships where high-rate radar and electro-optical feeds must be fused on multi-core processors without losing tracks under load. This is the current research focus.
Commercial shipping
GNSS interference is a documented hazard on several major trade routes. SENTINEL is designed to be licensed to the companies that supply ship bridge and navigation systems.
Aviation and avionics
Fusion software whose output does not depend on how many processor cores ran it, and which keeps a record of every input, produces the kind of evidence that safety assessment and certification work relies on.
Autonomous vehicles and drones
Navigation trust and perception fusion for vehicles with no operator in the loop, where a dropped or silently discarded sensor report is a safety question, not a performance statistic.
Space
Tracking and warning systems that fuse observations from many satellites in several orbits face the same questions at larger scale: which observations were used, which were set aside, and whether two runs of the same data give the same answer.
Critical infrastructure timing
Evidence that the time sources used by power grids, telecommunications networks and financial systems were trustworthy at the moment they were relied on.
Industrial monitoring and rail
Plants, pipelines and rail networks that vote across redundant sensors to decide whether a reading is real, and need that vote to be reproducible and reviewable after an incident.
Regulated data pipelines
Any system that consolidates records from several asynchronous feeds and must later prove that nothing was lost, duplicated or reordered, such as market-data consolidation or safety event logging.
Applications beyond the naval and maritime focus are directions for licensing and partnership, not current deployments.
Status
Four US provisional patent applications filed 2026. Patent pending; none examined or granted. Company-funded reference implementations of the engine, including a C11 implementation that allocates no memory at run time — demonstrated in simulation; not yet trialled in the field. Two U.S. Navy Small Business Innovation Research (SBIR) Phase I proposals submitted in September 2026. Commercial discovery with bridge-system vendors under way.
Who is behind it
Rajan Vasudevan, Founder & Principal Investigator. 35 years in software architecture and design, including real-time payment validation and fraud detection, distributed data processing and public-sector modernization. Founder and CEO of OceanManager for 12 years, delivering maritime safety and compliance software to more than 1,200 cargo vessels, with type approval of that shipboard software from the Indian Register of Shipping.
Work with us
We are open to conversations with research partners, bridge-system and navigation vendors, and organizations that need navigation integrity they can verify.
Patent pending. Technical details beyond this page are shared under a non-disclosure agreement.