BLADE-MARITIME = Authority-Governed ASV Governance Node for Maritime Surveillance
A hardware-enforced authority gating system for maritime autonomous surface vehicle control. Integrates Dempster-Shafer trust fusion, four-level authority with hysteresis, Byzantine fault-tolerant consensus, deliberation windows, and deterministic recovery — all enforced through a dual-GPIO safety interlock circuit driving a normally-open SPDT 24VDC safety relay.
Published on Zenodo · DOI: 10.5281/zenodo.19246785This is the third domain instantiation of the BLADE governance pipeline — after BLADE-EDGE (defense) and BLADE-AV (automotive) — extending authority-governed autonomy to maritime autonomous surface vehicles under MIL-STD-810G / IP68, MIL-STD-461G CE102, and DoDD 3000.09.
Zenodo Publication: Oktenli, B. (2026). BLADE-MARITIME Governance Node: Authority-Governed Maritime Surveillance Node with Hydroacoustic, Magnetic Anomaly Detection, and Multi-Modal Sensor Fusion (v2.3). Zenodo. https://doi.org/10.5281/zenodo.19246785
Maritime autonomous systems are being deployed in contested, communication-degraded environments where adversarial spoofing (acoustic, AIS, GNSS) can compromise detection and navigation without proportional authority reduction. Current surveillance platforms lack formal governance mechanisms capable of dynamically regulating operational authority based on continuous multi-modal sensor trust fusion. An acoustic spoofing attack can create false submarine contacts while the detection pipeline maintains full confidence; sea-state degradation reduces hydroacoustic performance without proportional authority adjustment.
The BLADE-MARITIME Governance Node addresses this gap by applying the SATA-HMAA-MAIVA-FLAME-CARA pipeline demonstrated in defense weapons systems governance (BLADE-EDGE) to maritime autonomous surface vehicle governance, targeting MIL-STD-810G environmental qualification, MIL-STD-461G CE102 EMI compliance, IP68 immersion rating, and DoDD 3000.09 autonomous systems governance requirements.
Maritime autonomous systems operate in contested, communication-degraded environments requiring sub-second detection and authority-governed response. Three challenges distinguish the maritime domain: RF communication is precluded underwater (requiring acoustic modems with seconds of propagation delay), magnetic anomaly detection sensors require physical separation from ferrous materials, and sea-state dynamics introduce platform motion artifacts requiring dynamic authority compensation.
The BLADE-MARITIME governance pipeline extends the BLADE-EDGE defense variant (DOI: 10.5281/zenodo.19177472) and the BLADE-AV automotive variant (DOI: 10.5281/zenodo.19232130) to the maritime domain. Four maritime-specific mathematical extensions (Dempster-Shafer hydroacoustic+MAD fusion, recursive AIS deception-risk, sea-state authority damping, acoustic-delay Byzantine consensus) are added while the core governance architecture remains identical.
Directed-energy weapon governance. EFFECTOR = weapons release relay. MIL-STD-810G. Beam suitability (β_beam). Multi-effector WTA. ~$139K.
Maritime surveillance governance. EFFECTOR = dual-GPIO SPDT relay. IP68 / MIL-STD-810G. Hydroacoustic + MAD fusion. Acoustic modem mesh. $43K.
Every maritime governance decision passes through nine sequential modules. The pipeline targets sub-second end-to-end latency. Each stage can independently prevent commands from reaching actuators.
G-882 MAD, AFE5805 Hydroacoustic (4-ch), Aquadopp ADCP, ZED-F9P GNSS, VN-300 IMU, XB-8000 AIS, Furuno Radar
Dempster-Shafer fusion over Θ = {threat, non-threat}; hydroacoustic + MAD trust with DEMON analysis. Zynq FPGA + Jetson.
Recursive phantom vessel deception-risk estimator; AIS-radar gating (d_gate = 200m). Jetson Orin.
AIS vessel identity verification; ATECC608B authentication; radar track correlation. Zynq FPGA.
Trust scalar → authority with sea-state damping α(H) (γ = 0.25 m⁻¹); dual-GPIO safety interlock. Zynq FPGA.
2-of-3 Byzantine fault-tolerant consensus on authority level. Zynq FPGA.
Mandatory deliberation window D(A, tier, domain) before authority-gated effector commands. Zynq FPGA.
GREP phases: Govern → Restrict → Execute → Persist. Mutual exclusion verified. Zynq FPGA.
Trust revalidation after detection engagement, course change, or authority escalation. Sea-state re-assessment. Jetson AGX Orin.
Dual-GPIO SPDT relay (24VDC coil, normally-open). Closes ONLY when Zynq PASS ∧ Jetson APPROVE. TPS3823 watchdog (500ms) independent hard reset.
Four-level authority with asymmetric hysteresis: immediate downgrade, 5-15s delayed upgrade. CARA GREP phases provide graduated operational restrictions within authority levels.
T_fused ≥ 0.80. Full autonomous authority. All effector commands authorized. HOTL advisory only.
0.50 ≤ T_fused < 0.80. Constrained operations, reduced engagement authority. CARA Govern phase active.
0.15 ≤ T_fused < 0.50. Effector commands blocked except station-keeping. CARA Restrict phase.
T_fused < 0.15. Safety relay opens. Effector commands blocked. CARA Execute/Persist.
84 components across a dual-compute platform. Jetson AGX Orin runs AI perception (ADARA, IFF, BDA). Zynq UltraScale+ FPGA runs deterministic governance (SATA, HMAA, MAIVA, FLAME, CARA) and relay control. PCIe Gen3 x4 inter-processor governance bus.
| Subsystem | Component | Interface | Role |
|---|---|---|---|
| Main AI Compute | NVIDIA Jetson AGX Orin 64GB | PCIe Gen3×4 / USB | Governance inference, AIS tracking, GNSS, modem mgmt |
| Governance FPGA | Zynq UltraScale+ ZU7EV | PCIe / LVDS / SPI / GPIO | SATA τ-chain, HMAA α(H), FLAME timing, CARA, interlock |
| Hydroacoustic AFE | TI AFE5805 (4-ch) | LVDS → Zynq | 65 MSPS 12-bit; DEMON analysis 10–100 kHz |
| MAD Sensor (GFE) | Geometrics G-882 Cesium Vapor | RS-232 → USB | ≤0.004 nT/√Hz; 1.5m carbon fiber boom |
| IMU / AHRS | VectorNav VN-300 | RS-422 → USB | Dual GPS/INS; heave channel for α(H) |
| ADCP (GFE) | Nortek Aquadopp | RS-422 → USB | Acoustic Doppler current profiler |
| Dual GNSS | u-blox ZED-F9P + SkyTraq DGPS | USB / UART | RTK + IALA DGPS beacon correction |
| AIS Receiver | Vesper Marine XB-8000 | NMEA 0183 → USB | Class A+B; ADARA phantom vessel detection |
| Acoustic Modem (GFE) | EvoLogics S2CR 18/34 USBL | 100BASE-T / RS-232 | 31.2 kbps; MAIVA acoustic mesh |
| Radar (GFE) | Furuno DRS6A-NXT | 1000BASE-T | Solid-state Doppler; external unit |
| Safety Relay | SPDT 24VDC (N/O) | Zynq GPIO + Jetson GPIO | Dual-GPIO interlock; TPS3823 500ms watchdog |
| HSM (×2) | Microchip ATECC608B | I2C (Jetson + Zynq) | FIPS 140-2; SATA τ-chain signing |
| TPM | Infineon SLM76CF3200P | SPI | TPM 2.0; platform attestation; secure boot |
| Satellite SBD | Iridium 9523 | RS-232 → USB | Offshore heartbeat; C2 dead-man switch |
| Ethernet Switch | Netgear M4250 Marine | RJ45 / SFP | Managed marine switch; fiber uplink |
Full 84-component BOM available as downloadable CSV. Internal BOM: $15,476.84. Government-Furnished Equipment: $28,000 (Geometrics G-882 $15K, Nortek Aquadopp $5K, EvoLogics S2CR $8K). Total: $43,476.84.
The BLADE-MARITIME power architecture provides MIL-spec power conditioning from the 18-32VDC marine bus with MIL-STD-461G CE102 compliant EMI filtering, surge protection, and LiFePO₄ battery backup.
24VDC marine bus → TVS diode array → Schaffner FN2060-10-06 EMI filter → TI TPS2490 inrush limiter → reverse polarity MOSFET → Vicor DCM5614 300W bus converter → 12V/5V/3.3V rails. 32% margin at 180W load.
LiFePO₄ 12V 10Ah battery with MCP73871 UPS controller. Auto transfer switch (±200ms switchover). ~30 min backup at 120W load (80% DoD).
TVS diode array (SMDJ24A) for transient surge protection. Schaffner FN2060-10-06 EMI filter for MIL-STD-461G CE102. TI TPS2490 inrush limiter with soft-start. IRF4905 P-channel MOSFET reverse polarity protection.
Passive conduction to 6061-T6 aluminum cold plate (280×230×10mm, ~167 W/mK) integrated into enclosure lid. Bergquist GP3000 TIM pads (3.0 W/mK). Seawater thermal contact at hull surface. Est. Tj ≈ 85°C at 25°C seawater.
Defense-in-depth security consistent with DoD Directive 3000.09, NIST AI RMF 1.0, and JAIC AI Ethics Principles.
ATECC608B HSM (FIPS 140-2, dual I²C for independent Jetson + Zynq τ-chain attestation). TPM 2.0 SLM76CF3200P (Jetson platform attestation). Zynq eFUSE/BBRAM SecureBoot. JTAG isolation fuses blown post-commissioning.
Dual-GPIO hardware safety interlock (normally-open SPDT relay, 24VDC coil). Zynq PASS AND Jetson APPROVE simultaneously required. TPS3823 watchdog (500ms). FLAME 5-state Circuit Breaker.
SATA τ-chain tamper-evident attestation records signed by ATECC608B. Stored on encrypted Samsung 990 Pro NVMe (2TB). SHA-256 + ECDSA P-384 hash chain.
| Subsystem | Cost | % of Total |
|---|---|---|
| Compute Core (Jetson AGX Orin + Zynq ZU7EV + NVMe + PCIe switch) | $6,200 | 14% |
| Sensors — Internal (VN-300 + Keller 21Y + ZED-F9P + AIS + AFE5805 + RTD) | $3,325 | 8% |
| Communications (Iridium 9523 + WiFi 6E + SFP + Marine switch) | $970 | 2% |
| Power Chain (Vicor DCM5614 + EMI filter + LiFePO₄ + UPS + ATS) | $440 | 1% |
| Security & Safety (ATECC608B ×2 + TPM + watchdog + relay) | $102 | <1% |
| Enclosure & Mechanical (IP68 housing + mounts + cold plate + connectors) | $2,620 | 6% |
| Remaining Components (USB bridges, hub, ADC, voltage ref, misc) | $1,832 | 4% |
| Government-Furnished Equipment (G-882 $15K + Aquadopp $5K + S2CR $8K) | $28,000 | 64% |
Internal BOM: $15,476.84. GFE: $28,000.00. Total: $43,476.84. Full 84-component BOM available as downloadable CSV.
| Parameter | Value |
|---|---|
| Operating temperature | −20°C to +55°C |
| Storage temperature | −40°C to +71°C |
| Enclosure rating | IP68 (1m continuous immersion); MIL-STD-810G Method 509.5 salt fog; Method 514.7 vibration |
| Depth rating | Surface vessel / splash zone; SubConn MCBH8FS rated to 200m |
| Power input | 18–32VDC, 15A continuous, 20A peak (inrush limited) |
| Continuous dissipation | ~180W (radar active); ~120W (radar standby) |
| Backup battery | ~30 min at 120W load (10Ah LiFePO₄, 80% DoD) |
| Power margin | ~32% at 180W vs 300W Vicor DCM5614 |
| EMI compliance | MIL-STD-461G CE102 (Schaffner FN2060-10-06) |
| Security | FIPS 140-2 (ATECC608B); TPM 2.0; JTAG isolation |
| Governance pipeline | SATA → ADARA → IFF → HMAA → MAIVA → FLAME → CARA → BDA → EFFECTOR |
The dual-GPIO safety interlock requires both Zynq PASS and Jetson APPROVE signals simultaneously to close the normally-open SPDT relay (24VDC coil). The TPS3823 watchdog enforces a 500ms timeout hard reset on either processor — if either compute node fails to feed the watchdog, the relay opens and all effector commands are blocked.
Zynq UltraScale+ GPIO → relay control line 1. SATA/HMAA/CARA governance pipeline asserts PASS when authority verified.
Jetson AGX Orin GPIO → relay control line 2. Independent ADARA/IFF/BDA assessment confirms APPROVE.
TPS3823-33DBVR 500ms timeout. Independent of both processors. Watchdog starve → hard reset → relay opens.
84 components, 84 electrical connections, 54 mechanical connections. Color-coded by node type.
The BLADE-MARITIME simulator (v3.11, 4,897 lines) executes the complete 9-module governance pipeline with 13 fault injection scenarios, split-screen GIUK Gap mission map, COLREGs compliance, EEZ/UNCLOS boundaries, SVP/thermocline sonar model, 3-link comms model (SATCOM/HF/UHF), C2 dead-man switch, HOTL authority escalation, and HITL WebSocket bridge for MAVLink/ROS 2 integration.
Submarine detection, AIS spoofing, acoustic spoofing, GNSS spoofing, sea-state noise, acoustic modem loss, compound attack, MAD jamming, CARA trigger, HOTL timeout, COLREGs violation, EEZ breach, C2 dead-man switch
WebSocket relay (blade_maritime_relay.py) bridges browser simulation to MAVLink/ROS 2 for hardware-in-the-loop integration.
G*Power justified (α=0.05, power=0.80, d=0.80). Bonferroni correction. Shapiro-Wilk normality tests.
| Threat Scenario | Detection Method | Est. Pd | Est. Pfa | Range | Latency |
|---|---|---|---|---|---|
| Submarine (Sea State 1–2) | Acoustic + MAD | Pd 0.90–0.95 | Pfa <10⁻⁴ | 1–2 km | 600–1,100ms |
| Submarine (Sea State 3–4) | Acoustic (damped) | Pd 0.70–0.80 | Pfa <5×10⁻³ | Reduced | 600–1,100ms |
| AIS Spoofing (d >200m) | ADARA gate | Pd ~0.90 | Pfa <0.02 | 54 nm AIS | 1–30s |
| Acoustic Spoofing | D-S cross-validation | MAD confirms | — | — | <1s |
| GNSS Spoofing | F9P vs DGPS | Cross-check | — | — | <1s |
| Acoustic Modem Loss | CARA GREP | 5s timeout | — | — | CARA Phase I |
| Sea-State Noise (Beaufort 4+) | α(H) damping | Authority 50% | — | — | Continuous |
| Compound Attack | D-S collapse | τ→A0 | — | — | EFFECTOR OPEN |
Performance envelopes are design targets pending TEMP validation. Submarine detection requires MAD + hydroacoustic fusion (SATA D-S combination). All values from paper Tables 10–13.
Complete engineering documentation for the BLADE-MARITIME Governance Node. All files are original work by Burak Oktenli. Published under CC BY 4.0.
All data, simulation code, engineering artifacts, and the interactive governance simulator are openly available at DOI: 10.5281/zenodo.19246785 under CC BY 4.0. No access restrictions apply.
Research paper (20 pages), blueprint PDF, schematic SVG, 84-component BOM, electrical/mechanical JSON. Full engineering specification.
v3.11 simulator with 13 fault injection scenarios, seeded PRNG (Mulberry32), dual-GPIO relay model, SHA-256 + ECDSA P-384 audit chain, HSM/TPM latency. 13 fault scenarios with HITL WebSocket bridge.
G*Power sample size justification, Bonferroni correction, Shapiro-Wilk normality tests, paired t-tests, Wilcoxon signed-rank for non-normal data.
IP68 / MIL-STD-810G / MIL-STD-461G CE102 design targets. DoDD 3000.09 governance compliance. FIPS 140-2 key storage. SubConn underwater connectors.
At-sea deployment testing with acoustic modem mesh, hydrophone array calibration, and MAD boom integration
TLA+/UPPAAL full verification of all design invariants and safety properties across all configurations
4-layer controlled-impedance PCB design, fabrication, and integration testing with all 84 components
MIL-STD-810G environmental qualification (salt fog, vibration, shock), MIL-STD-461G CE102 chamber testing, IP68 immersion validation
The BLADE-MARITIME Governance Node demonstrates that the authority-governed autonomy pipeline is domain-agnostic. The same governance architectures (SATA, HMAA, ADARA, MAIVA, FLAME, CARA) demonstrated in defense (BLADE-EDGE, ~$139K) apply directly to maritime autonomous systems (~$43K) under different regulatory frameworks.
Related platforms: Rover Testbed (~$484) · UAV Platform (~$4,200) · BLADE-EDGE (defense, ~$139K) · BLADE-AV (automotive, ~$16K) · BLADE-MARITIME (maritime, ~$43K) · BLADE-INFRA (infrastructure, ~$12K). Six platforms demonstrating governance stack portability across four domains.
The BLADE Governance SDK provides a unified API across all four domains. The same
blade_governance
library drives defense weapons governance (BLADE-EDGE), autonomous vehicle authority (BLADE-AV),
maritime surveillance (BLADE-MARITIME), and critical infrastructure protection (BLADE-INFRA).
Only the domain configuration file changes.
Cross-Domain Portability:
The blade_governance SDK
uses the same evaluate() →
result API across all four domains.
Switching from defense weapons governance to autonomous vehicle authority requires changing only the YAML
configuration file — not the application code. This is how the same governance pipeline operates under
DoDD 3000.09, ISO 26262 ASIL-D, MIL-STD-810G, and SIL 3 / NERC CIP simultaneously.
The BLADE-MARITIME Governance Node is part of the authority-governed autonomy research program by Burak Oktenli at Georgetown University (M.P.S. Applied Intelligence). It is the third domain instantiation — extending the governance architectures demonstrated in defense (BLADE-EDGE) and automotive (BLADE-AV) to maritime autonomous surface vehicles, with four maritime-specific mathematical extensions.
Related architectures: SATA · HMAA · CARA · MAIVA · FLAME · ADARA