From High-Level Types to Low-Level Monitors: Synthesizing Verified Runtime Checkers for MAVLink

TL;DR

This paper introduces Platum, a framework that synthesizes verified runtime checkers from high-level protocol specifications for UAV communication, improving efficiency and resource usage.

Contribution

Platum addresses engineering challenges in protocol enforcement by providing a minimal DSL and compiling specifications into efficient C FSMs for UAVs.

Findings

4x reduction in monitor latency

Lower memory overhead compared to prior work

Effective enforcement of MAVLink protocol constraints

Abstract

Standard communication protocols for Unmanned Aerial Vehicles (UAVs), such as MAVLink, lack the capability to enforce the contextual validity of message sequences. Autopilots therefore remain vulnerable to stealthy attacks, where syntactically correct but semantically ill-timed commands induce unsafe states without triggering physical anomaly detectors. Prior work (DATUM) demonstrated that global Refined Multiparty Session Types (RMPSTs) are an effective specification language for centralized MAVLink protocol enforcement, but suffered from two engineering failures: manual proof terms interleaved with protocol definitions, and an OCaml extraction backend whose managed runtime is incompatible with resource-constrained UAV hardware. We present Platum, a framework that addresses both failures with a minimal DSL requiring only the five semantic components of a global session type (sender, receiver, label, payload variable, refinement predicate), whose structural well-formedness conditions are confirmed via reflective decision procedures in Meta-F*. Confirmed specifications are compiled directly into flat, allocation-free C Finite State Machines (FSMs), deployed as centralized proxy monitors at the GCS/UAV communication boundary. Our evaluation demonstrates a 4x reduction in total monitor latency and lower memory overhead compared to DATUM, measured via ArduPilot SITL simulation.