Results from head-to-head benchmarking with aerospace systems safety SMEs, measured against human baselines, on real production fault trees — never on toy examples. Every number below was produced inside a partner's own perimeter.
Node-level connection accuracy and object detection on held-out production pages never seen during development.
Fault trees from more than one hundred production systems that are still flying today, processed end to end.
Hundreds of thousands of fault-tree pages ingested, structurally checked and annotated with SME-verified ground truth.
On NVIDIA AI clusters we operate on our own premises. Partner material is never used to train anything outside the partner's boundary.
We do not benchmark on synthetic trees. Our partners bring production safety archives, their own subject-matter experts and their own perimeters; we bring Ellie and Mia inside and measure.
Ellie and Mia are applied to fault trees for production systems still in service. Boeing safety SMEs set the human baseline: each page Ellie reconstructs and each latent fault Mia surfaces is checked against what an experienced analyst produces, and the discrepancies are traced to their cause — a drawing convention, a detector miss, or a genuine finding the review had not reached.
Gonzaga contributes the academic rigour: evaluation design, annotation protocols and independent measurement of what Ellie and Mia actually achieve. The held-out test sets, the per-node accuracy metric and the review-time studies that show where analyst minutes are really spent come out of this collaboration.
The corpus is not a museum. It covers more than one hundred production systems currently in service, with the drawing conventions, transfer structures and revision histories that real archives accumulate over decades.
Fault-tree pages processed end to end — detected, linked across pages, structurally checked — and annotated with SME-verified ground truth for gates, events, transfers and their connections.
A tree is roughly twenty pages and is analysed as one Boolean structure. Accuracy is reported per node, because a tree with one hundred nodes and one misplaced connection is a wrong tree — and that is the standard we measure against.
Partner archives are export-controlled and proprietary, so the evaluations follow the same three principles as the product. Un-sanitised fault trees are processed only inside the partner's perimeter, on hardware the partner administers, with the uplink severed. Material that reaches our own clusters for training arrives sanitised — probabilities, identifiers and descriptions stripped by the partner before it leaves their boundary — and our clusters are themselves on-premises and air-gapped from the internet.
Nothing in the pipeline calls an external service: no cloud OCR, no hosted language model, no telemetry. Access to partner material is granted per team, denied by default and fully audited. The numbers on this page are therefore also a statement about what can be achieved without compromising on sovereignty — which is the point.
Absolute air-gapping, total containment and data sovereignty govern the product and the way we work with partners alike. The evaluations on this page are the proof that the two are compatible with measured, production-grade results.
Run a controlled trial on your own archives.