Skip to content

Observer Reconstruction

Machines rarely hand an observer complete state.

Reconstruction Path

A passive observer reconstructs state by accumulating evidence, not by receiving truth directly.

flowchart LR raw["Raw traffic<br/>or file artifact"] --> decode["Field decode"] decode --> cadence["Cadence and<br/>freshness"] cadence --> authority["Semantic authority"] authority --> hypothesis["state hypotheses"] hypothesis --> uncertainty["Known<br/>uncertainty"] classDef evidence fill:#eef7ff,stroke:#2563eb,color:#172554 classDef check fill:#f8fafc,stroke:#64748b,color:#0f172a classDef outcome fill:#ecfdf5,stroke:#059669,color:#064e3b class raw evidence class decode,cadence,authority,hypothesis check class uncertainty outcome

What Observers Track

  • Artifact boundaries: frame, word, sentence, transaction, packet, record, or channel sample.
  • Timing: period, gaps, burst shape, latency, jitter, slot, cycle, and timestamp provenance.
  • Authority: sender authority, bus authority, polling authority, scheduler authority, and semantic authority.
  • Freshness: last observation time, expected update rate, stale data, retransmission, and replay risk.
  • Consistency: agreement or disagreement among redundant paths, sources, labels, registers, channels, or sensors.

Example Pattern

flowchart LR traffic["Raw traffic"] --> fields["Decode visible<br/>fields"] fields --> cadence["Compare cadence<br/>with expected shape"] cadence --> dictionary["Apply source-grounded<br/>dictionary"] dictionary --> ambiguity["Record confidence<br/>and ambiguity"] ambiguity --> state["Form state<br/>hypotheses"] classDef evidence fill:#eef7ff,stroke:#2563eb,color:#172554 classDef check fill:#f8fafc,stroke:#64748b,color:#0f172a classDef outcome fill:#ecfdf5,stroke:#059669,color:#064e3b class traffic evidence class fields,cadence,dictionary,ambiguity check class state outcome

A CAN observer may see 0x123 every 20 ms and hypothesize a control-loop signal. A J1939 observer may see an engine PGN stop and hypothesize state change or module loss. An ARINC 429 observer may see SSM transition and hypothesize degraded avionics state. Each remains a hypothesis until authority and context support it.

Ambiguity Discipline

Do not hide uncertainty. State what can be inferred, what remains unknowable, and what would disambiguate the observation: another bus, a source database, a timing reference, an integration document, or a controlled lab reproduction.

Start with Semantic authority, Timing and cadence, and Failure and ambiguity. Then compare CAN, UART, MIL-STD-1553, and DBC.