From High-Level Types to Low-Level Monitors: Synthesizing Verified Runtime Checkers for MAVLink

Abstract: Standard communication protocols for Unmanned Aerial Vehicles (UAVs), such as MAVLink, lack the capability to enforce the contextual validity of message sequences. Autopilots therefore remain vulnerable to stealthy attacks, where syntactically correct but semantically ill-timed commands induce unsafe states without triggering physical anomaly detectors. Prior work (DATUM) demonstrated that global Refined Multiparty Session Types (RMPSTs) are an effective specification language for centralized MAVLink protocol enforcement, but suffered from two engineering failures: manual proof terms interleaved with protocol definitions, and an OCaml extraction backend whose managed runtime is incompatible with resource-constrained UAV hardware. We present Platum, a framework that addresses both failures with a minimal DSL requiring only the five semantic components of a global session type (sender, receiver, label, payload variable, refinement predicate), whose structural well-formedness conditions are confirmed via reflective decision procedures in Meta-F*. Confirmed specifications are compiled directly into flat, allocation-free C Finite State Machines (FSMs), deployed as centralized proxy monitors at the GCS/UAV communication boundary. Our evaluation demonstrates a 4x reduction in total monitor latency and lower memory overhead compared to DATUM, measured via ArduPilot SITL simulation.

• The paper demonstrates that decoupling protocol specification from verification enables the synthesis of efficient, allocation-free C monitors for MAVLink.
• It employs Meta-F* reflection to automate structural checks and enforce well-formedness conditions such as label uniqueness and guarded recursion.
• Quantitative evaluation shows a fourfold reduction in latency and reduced memory overhead, making the approach viable for real-time UAV applications.

Synthesizing Verified Runtime Checkers for MAVLink with Platum

Introduction and Motivation

The paper addresses a critical gap in runtime enforcement for the MAVLink protocol, a standard in UAV-GCS communication that is structurally sound but semantically underspecified. Prior work, notably the DATUM framework, established that Refined Multiparty Session Types (RMPSTs) can formalize and enforce such protocols, protecting against stealthy, semantically-driven protocol violations that evade physics-based anomaly detectors. However, DATUM’s approach intertwined protocol specification and proof, requiring operationally irrelevant proof terms and an OCaml-based runtime incompatible with resource-constrained embedded deployments. The authors introduce Platum, a framework that decouples specification from verification, automates structural checks via Meta-F* reflection, and synthesizes allocation-free C monitors suitable for real UAV platforms.

Platum Architecture and Workflow

Platum’s workflow is divided into compile-time and runtime phases. The framework is centered around a minimal DSL embedded in F*, where the protocol engineer only provides the five semantic RMPST components: sender, receiver, label, payload variable, and refinement predicate. Algorithmic well-formedness checking is executed extrinsically on the protocol AST using Meta-F* decision procedures. Correctness conditions—label uniqueness, guarded recursion, global progress, and session fidelity—are enforced without burdening the user with proof obligations. Structurally confirmed specifications are then directly compiled into flat C finite state machines (FSMs) for deployment as a centralized proxy at the network boundary.

Figure 1: The Platum workflow divides between F

-based specification and well-formedness checking (top) and deployment of the synthesized C monitor as a protocol-enforcing network proxy (bottom).*

Formalization of Protocol Logic and Well-Formedness Verification

Platum employs a deep embedding of global refined multiparty session types, mapping MAVLink protocol semantics to an inspectable AST. Protocol transitions are precisely parameterized by payload-dependent refinements, which are essential for capturing MAVLink’s semantic constraints (e.g., matching sequence numbers across messages, enforcing buffer limits).

Well-formedness is enforced via four decision procedures operating on the AST:

• Label Uniqueness: Ensures deterministic branching.
• Guarded Recursion: Prevents divergence via productivity analysis.
• Global Progress: Guarantees each state has progress.
• Session Fidelity: Ensures all transitions are well-scoped.

This approach enables extrinsic validation at specification time, decoupling protocol construction from verification, in contrast to the intrinsic (type-driven) strategy of DATUM.

Direct Synthesis of Flat C Monitors

The synthesis pipeline transforms the structurally validated RMPST into a C FSM, stripping refinement predicates from F* types and re-introducing them as explicit guards in C code. The extraction process inspects dependent types and refinement terms via Meta-F* reflection, translating them to C conditionals within the FSM transition logic. All state variables corresponding to protocol parameters are realized as fixed-size fields in a C struct, and recursion through protocol states is compiled to explicit variable updates within the FSM.

The resulting monitors are allocation-free, do not depend on a managed runtime or garbage collection, and maintain deterministic execution and memory profiles—making them suitable for deployment on platforms such as ArduPilot and PX4 on ARM microcontrollers.

Quantitative Evaluation and Comparative Analysis

Platum was evaluated in the context of the MAVLink Mission Upload protocol using ArduPilot SITL and QGroundControl. The synthesized monitor achieved a 4× reduction in end-to-end system latency relative to DATUM (13.33 μs vs. 56.74 μs) and reduced memory overhead by eliminating OCaml’s runtime. The FSM step logic incurs sub-microsecond latency (as low as 123 ns), and the centralized deployment model means this cost is not amortized across protocol participants but paid once at the network boundary.

This result formally establishes that an extrinsic, AST-reflective strategy not only streamlines specification but also yields code compatible with the real-time, resource-aware constraints inherent to UAV middleware.

Implications, Related Work, and Future Directions

The Platum pipeline’s architectural and methodological advances have several important implications:

• Specification/Proof Decoupling: By separating protocol logic from proof scaffolding, adoption for domain engineers is significantly improved, enabling practical enrichment of protocol models with semantic predicates.
• Real-Time Guarantees: Allocation-free C FSMs avoid the unpredictability of GC, aligning with hard real-time requirements in avionics.
• Scalability and Portability: The pipeline supports broader protocol suites and is not bound to Python FFI intermediaries in production.
• Theoretical Grounding: The approach leverages the extrinsic verification paradigm, enabled by reflective systems (Meta-F*, Z3 integration), and builds directly on the theory of global session types with refinements [zhouStaticallyVerifiedRefinements2020, vassorRefinementsMultipartyMessagePassing2024].

Platum advances the state of the art relative to previous session-type-based monitors such as DATUM, RML, and Varanus by coupling expressivity (refinements, global types) with practical deployability and eliminating the limitations of managed or high-level runtime dependencies.

Future avenues include decentralized monitoring (projection of global to local types), formal proofs of monitor soundness with respect to the source type system, and integration with verified C compilers (CompCert, Frama-C) to lift functional correctness of both protocol and monitor to the binary level.

Conclusion

This work delivers a comprehensive solution to the dual challenge of expressively specifying and efficiently enforcing message sequence protocols for UAV communications. By extrinsically verifying global session type well-formedness and synthesizing allocation-free C monitors, Platum eliminates the usability and performance bottlenecks of previous approaches. The framework supports rapid, user-friendly protocol modeling and generates runtime checkers with predictable, minimal overhead, offering a deployable and formally defensible enforcement mechanism directly applicable to contemporary UAV infrastructures.

---

References

• Zhou, F. et al., "Statically verified refinements for multiparty protocols" (Dütting et al., 2020).
• Vassor, M. et al., "Refinements for Multiparty Message-Passing Protocols: Specification-Agnostic Theory and Implementation" (Dudarev et al., 2024).
• Amorim, A. et al., "Enforcing MAVLink Safety & Security Properties via Refined Multiparty Session Types" (Wen et al., 10 Mar 2026).