How Marshall is built
Marshall Labs builds AI for air traffic control. Two research prototypes run today against live traffic at two major US airports: one sequences the arrivals into Dallas/Fort Worth, the other watches the runways at San Francisco. This is the short version of how they are built.
Two prototypes
The rule everything is built around
Every safety-relevant number comes from deterministic code.
Distances, closure rates, separation, wake spacing and runway occupancy are computed by ordinary, testable code that gives the same answer every time, and instructions are phrased to the FAA's controller rulebook, Order JO 7110.65. Nothing in the live loop asks a language model for a number. Today the live prototypes make no model calls at all.
And Marshall only suggests. There is no radio, no datalink and no transmit path to any aircraft or air traffic system. A qualified human decides. That boundary is a rule of the lab, not a missing feature.
Live data, not a demo
Both prototypes run continuously on real feeds:
- Aircraft positions broadcast by the aircraft themselves (ADS-B), including what the crew has dialled into the autopilot.
- Surface weather, runway visibility and a high-resolution winds-aloft model.
- The airport's own runway-in-use broadcast.
- Four FAA SWIM feeds: arrival metering, traffic flow, flight data and airport surface movement.
Measured, not guessed
An air traffic system is full of thresholds: how far out an aircraft can be turned onto final, how long a runway stays occupied, how long to wait before an instruction counts as missed. Ours come from recorded traffic, not judgment. We record reality, derive the number from it, build the instrument that measures a change before making it, and keep the measurement next to the number in the code.
Three times the measurement overturned the plan
Three examples, each of which changed what shipped:
A limit on how far out an aircraft can be turned onto final, set at the 90th percentile of real behaviour, refused 19% of what controllers fly every day. Limits now sit at the tail of a distribution, not on its shoulder.
The obvious detector (low, near the airport, climbing) fired 217 times on departing aircraft. Requiring a descent on an approach first took it to one alert across roughly 1,770 aircraft: a genuine go-around.
Replacing a hand-built wake-turbulence table with the official FAA one showed 9 of its 26 entries were wrong. Nothing had looked broken. That is the failure the lab is built to catch.
By the numbers
ACROSS 184 FILES
GREEN IS THE SHIP BAR
OVER RECORDED TRAFFIC
FOUR OF THEM FAA
29 WORKING DAYS
16 July to 10 November 2026.
What we don't publish
The method is on this page. The tuned values are not: roughly forty measured thresholds, the internal limits of the safety validators and the details of the deployment are not published. A value without its measurement is a recipe with no way to tell when it has stopped being right.
Status and limits
These are research prototypes. They are not certified, not approved, not connected to any operational system, and have never been used to control an aircraft.
- Marshall sees geometry, not authority. It assumes standard separation and independent parallel operations; dependent-approach stagger is not modelled.
- Unknown is never shown as safe. A lost track is drawn as lost, and a runway with no tracked occupant is never shown as clear.
- The safety case is the next major build: an independent validator, formal arming prerequisites and defined shutdown criteria, scored against a controller's ground-truth solution.
Watching the live screens and reporting what looks wrong is still the best source of defects we have. The front page takes reports.