Corvon AI GCS

Say it. Review it. Run it.

Speak or type in English or Chinese. Copilot maps it to a bounded set of recipes, and the higher the risk, the more it asks first.

From a sentence to an action, with a gate in the middle.

1. Phase 1

   Parse

   Your words become an intent, matched to a bounded, pre-built recipe.

2. Phase 2 · you confirm

   Check & approve

   Preconditions are checked. For high-risk actions, an approval card shows the pending command, its risk tier, and its preconditions, then you confirm.

3. Phase 3

   Execute

   Run, verify against the expected result, and write a local action log for review.

• Two axes of permission: what Copilot can see is separate from what it may run. A tool you have not authorized is not in the model’s schema at all, so the model has no way to call it.
• Three deterministic checks guard every write: authority, data freshness, and safety. A multi-step recipe re-runs all three at each step, not once for the whole flow.
• Write, then read back: an action that reports success is confirmed against the flight controller. An unconfirmed write is marked unverified, never reported as done.
• Phase-aware caution: the more critical the moment, the more conservative Copilot gets, dropping to read-only during an in-air alert.
• A hard cap limits repeated action calls, so there are no runaway loops; when unsure, Copilot stops and asks, and answers cite specific telemetry fields.

17 safety invariants, each enforced by a test · 23 actions across 9 domains · a local action log for audit and replay

Not an open-ended agent loop: Copilot selects from bounded recipes and stops for approval before high-risk actions.

FLIGHT-LOG DIAGNOSIS

Upload a flight log. Get a diagnosis, not a data dump.

After a flight, drag in a PX4 .ulg or ArduPilot .bin, up to 100 MB. Copilot decodes the log and runs deterministic checks, then explains what it found. You can pull the log over MAVLink instead of removing the SD card, and uploads are encrypted at rest.

Enlarge

Segmentation

Splits the flight at each arm and disarm, then classifies how every segment ended: normal, hard landing, manual descent, or crash. Each verdict carries a confidence level, the evidence for it, and the evidence against.

Anomalies

GPS fix loss, voltage sag, high vibration, EKF innovation spikes, and (on PX4) actuator saturation, each with the measured value, the time window, and the threshold it crossed.

Firmware events

On ArduPilot, reads the failsafe, fence, EKF, and thrust-loss events the flight controller itself recorded, with the parameter values at the time.

Honesty

Every finding carries a do-not-conclude guardrail: it will not pin a crash on a cause the data does not support, and it says what it could not check, for example “EKF check skipped: data missing”.

Explanation

Copilot turns the raw findings into a readable explanation with citations, and it carries the same limits forward instead of smoothing them over.

A log viewer shows you the data. This decodes it, checks it against thresholds, and explains what it found, with citations.

Enlarge

MAVLINK WORKBENCH

A MAVLink workbench: live scope, inspector, and a real shell.

For PX4 and ArduPilot developers, four panels for working the link directly.

Inspector

Browse every MAVLink message seen on the link, sorted by rate, name, or count, each with an Hz health badge. Expand fields, filter, pause and resume.

Charts

A real-time plotter, up to 8 signals at once, from a 10-second to a 5-minute window. Gap-aware: it draws a break at a dropout instead of interpolating across it. Send any inspector field to the chart.

Rates

Set per-message intervals live, with named presets. There is no fake success indicator; the measured Hz column is the only ground truth.

Console

A real interactive PX4 NSH shell over WebSocket, with command history. Its input locks the moment the vehicle is armed, and fails closed to locked when the armed state is unknown, so the shell is usable only on a disarmed vehicle. On ArduPilot it shows as unavailable (PX4 only).

It shows “—”, not a comforting lie.

The most useful thing a ground station can do is not lie to you. Each of these came from fixing a real bug.

• A parameter write never reports success until the flight controller echoes it back, and an unconfirmed write does not poison the cache.
• Armed state reads “unknown” until it is proven. The UI never shows a false “safe”.
• Each telemetry value on screen tracks its own freshness: fresh shows nothing, stale shows amber, lost shows red, and a missing number shows “—”, never a zero or a stale frame passed off as live.
• Calibration is complete only when the flight controller says so, with a 120-second watchdog if it stalls, never a client-side guess.
• A disabled command or setup button says why it is disabled, instead of failing silently when you click it.

We treat not misleading the operator as an engineering rule, not a slogan.

A full ground station, with or without the AI.

Enlarge

Enlarge

Enlarge

Built for CORVON flight-controller customers, and any PX4 or ArduPilot MAVLink vehicle. Because we make the hardware, the app carries a spec knowledge base for 21 CORVON boards and a component wiring helper, so Copilot can answer questions about your exact flight controller, GNSS, and ESC. Setting up a flight stack? See our user guides.