Editions · open core, Pro and custom study

Free to build on. Pro when it has to stand up in review.

The engine is, and stays, open source under the AGPL-3.0 (GNU Affero General Public License, version 3), with no feature gate. Ashforde OÜ sustains it with expertise and a proprietary overlay, not with seat fees on the open engine. There are no prices on this site: every paid route starts with a message.

Launch Kshana Studio See Kshana Pro Talk to us

One engine · kshana v0.29.1 From the repository

The open engine at the centre: one mark per scenario kind (75), filled where the kind has validated ledger rows, hollow where its rows are Modelled, a dash where no ledger module matches it by name. Kshana Pro and the custom study sit around it and connect to the kinds they build on.

Engine v0.29.1 · 75 kinds from src/api.rs · ledger status from web/data/verification-matrix.json · what Pro and a study build on: the site's editions register · no scenario or seedCompare the editions

01Three ways to work with us

Compare the editions.

The same engine sits under all three. Read across a row to compare why it matters, who each one is for, what it includes and how it starts.

Free · AGPL-3.0 or commercial licence

Open core

The whole validated engine and every surface, free with no feature gate. Everything on this site runs on it.

Why everyone needs it

Anyone who takes position or time from GNSS (Global Navigation Satellite Systems) is exposed: jamming, spoofing and signal loss reach vehicles, networks, grids and spacecraft alike. The open core shows how exposed, and says which figures are checked.

Who it is for

Engineers of vehicles, networks, grids and spacecraft that take position or time from GNSS
Researchers, students and reviewers who need figures they can reproduce and cite
Developers wiring the engine into code, a CI (continuous integration) suite or an AI (artificial intelligence) assistant

What is included

All 75 scenario kinds and 132 bundled scenarios: native, Python, JavaScript, in the browser and over MCP (Model Context Protocol)
The full verification matrix: 83 of 223 capabilities validated against independent oracles, the rest labelled Modelled
Every result stamped with scenario hash, seed and engine version, and written as JSON (JavaScript Object Notation), CSV (comma-separated values) tables and SVG (Scalable Vector Graphics) charts
The free kshana --study suite runner

Terms

Free under the AGPL-3.0. The same core is also offered under a commercial licence, for closed integration into proprietary products (below).

Launch Kshana Studio Ask about a commercial licence

Commercial · the same engine, amplified

Kshana Pro

A proprietary overlay that depends on the open core and never forks it: a strict superset of open Kshana. Available under contract.

Why Pro, even more

Open Kshana runs one scenario and tells you what it gives. Kshana Pro answers the questions a programme asks next: which design to fly, how sure the answer is, and whether the mission meets its requirements in a form a review board can check.

Who it is for

Programmes that must hand a mission dossier or an audit-grade evidence pack to a review or procurement board
Architects choosing a design from the Pareto front of a whole design space, or from trade studies ranked on a figure of merit
Timing and hardware teams who need a clock digital twin calibrated to their device

What is included

A design optimiser: the Pareto front of a design space, with every front design as a scenario the free engine re-runs
Uncertainty and sensitivity over thousands of runs
A one-command mission dossier with a verification matrix and a PDF (Portable Document Format) file
Audit-grade, reproducible evidence packs, clock digital twins calibrated to a device's published Allan budget, and architecture trade studies ranked on a figure of merit
Model-based systems-engineering (MBSE) and programme tooling that checks a programme's requirements against runs of the open engine, reading only the outputs the engine publishes

Terms

Kshana Pro is available under contract. It depends on the open core and never forks it, so nothing is taken out of the free engine.

Request an evaluation See it amplified

Paid work · done for you

Custom study

Work done for you, on your system: the paid custom study, not the free kshana --study command.

Why a custom study

When the question is yours but the time, the modelling or the clearance is not: we model your system with the same engine, label every figure Validated or Modelled, and hand back a result you can reproduce.

Who it is for

Programme and procurement teams who need an independent, modelled view of a PNT (positioning, navigation and timing) architecture's resilience
Hardware builders who want models of their own devices
Export-sensitive programmes, and teams who want Kshana in their toolchain

What is included

A Modelled PNT-resilience study, for example an optimism-gap audit. Not a certification.
Sensor and resilience models calibrated to your hardware
Export-controlled resilience work under the appropriate clearance and NDA (non-disclosure agreement)
Commercial support and integration, training and consulting

Terms

Scoped to your question and delivered under contract, reproducible from scenario, seed and engine version.

Request a study How a study runs

Open core licence

One engine, two licences.

Pick the one that fits how you use it. Both cover the same open engine; nothing is held back from either.

Licensing guide contact@ashforde.org

Option A · open source

GNU AGPL-3.0

Use, study, modify and redistribute it free of charge. If you distribute a derivative, or let people use a modified engine over a network, you share its source under the same licence.

Right for academic work, open-source projects, internal evaluation and research.

Option B · from Ashforde OÜ

Commercial licence

Embed the engine in a closed-source product
Run a network service on a modified engine without the source-disclosure obligation
Integrate it into a toolchain whose other parts cannot be AGPL
Get warranty, indemnity or support terms the AGPL disclaims

Ask about a commercial licence

Kshana Pro and the other proprietary overlays are separate products under their own contract, not part of either licence. What the commercial licence covers

Kshana Pro · the same engine, amplified

Free runs one scenario. Pro answers the programme's question.

Open Kshana runs one scenario and tells you what it gives. Kshana Pro answers the questions a programme asks next, over the same engine and the same scenario files: which design to fly, how sure the answer is, and whether the mission meets its requirements in a form a review board can check.

A strict superset of open Kshana.Every open scenario kind runs in Pro unchanged, and an open scenario runs in Pro with no licence at all.
No new physics.Every Pro number comes from runs of the open engine, so a Pro figure is as trustworthy as the open scenario kind it came from, and never more.
Reproducible in the free engine.Anyone with open Kshana can re-run one and get the same figure.
Honest labels carried through.Every Pro result is labelled MODELLED. Every figure keeps the tier the open engine gave it (Validated, Modelled or Partner), never a higher one.

Design optimiser

Which design should we fly?

FreeA free user scores one design they wrote by hand.
ProA Pro user states the design space (each variable a scenario setting with its allowed values), the constraints and two or three objectives, and gets the whole Pareto front: the designs that no other design beats on every objective at once.

The base scenario can be of any open kind, so the same tool designs a constellation around the Earth, the Moon or Mars, or trades a link budget. Every design is one run of the open engine. Each front design is written out as a plain open scenario file, with the Secure Hash Algorithm (SHA-256) hash of the result the free engine gives for it.

What it does not do. It has no cost model, so a variable no objective penalises drifts to the edge of its range. Constellation studies score geometry only: no signal power, satellite health or terrain.

Pareto front · Lunar navigation constellationKshana Pro output

every design runPareto frontkneereference: Bundled lunar relay design (8 + 6 satellites)

Front design 004 · knee · 16 satellites, 85.0404 % availability · 2 planes at 8,000 km, 45° · re-run in the free engine: same SHA-256 89882372…

608 designs, all run (whole moon): a front of 12 designs at 6 points; 12 of 12 re-run in the free engine with the same result hash. MODELLED.

Kshana Pro 0.2.0 on open engine 0.29.0 · kshana-pro design · 609 engine runs · run digest df81aad4…

Uncertainty and sensitivity

How sure are we, and what drives the result?

FreeA free user gets one number, or a spread over random seeds.
ProA Pro user states how uncertain each input is and gets confidence bands, the probability of meeting a limit, and a ranking of the inputs that drive the result.

It works on any open scenario. Inputs are ranked by Sobol' sensitivity indices or by standardised regression coefficients, and a ranking that is not reliable is flagged as such. A long study can be stopped and resumed.

What it does not do. Inputs are treated as independent. More runs narrow the sampling error, not the model error: a MODELLED kind stays MODELLED.

Uncertainty and sensitivityKshana Pro output

5th to 95th percentile of 2,000 runsmedianbase runshare within the limit

After 60 minutes: 1,366 of 2,000 runs within ±20 ns, a probability of 0.683 (95 % interval 0.6623 to 0.703)

Clock holdover with an uncertain noise level · input q_wf (the clock's white-frequency-noise level): uniform(4.5e-20 to 2.7e-19), ASSUMED · MODELLED · Kshana Pro 0.2.0 on open engine 0.29.0 · kshana-pro uncertainty · 2,000 engine runs · run digest abab765e…

Mission dossier

Does the mission meet its requirements, and can we hand that over?

FreeA free user gets one report per run.
ProA Pro user gets one mission dossier in one command: requirements checked against real runs, a verification matrix with its open items, and a PDF (Portable Document Format) in which every number can be re-derived with the free engine.

A requirement met on a MODELLED or PARTNER basis is flagged. Requirements to be verified by test, inspection or demonstration stay open items however the run went.

What it does not do. Simulation evidence counts as analysis and does not replace a test, an inspection or a demonstration. A dossier is not a certification, a qualification or an acceptance by any authority.

Three more answers

Did the last change make a figure we care about worse?

FreeA free user runs a campaign and reads the result.
ProA Pro user names the figures that matter in a set of scenarios, says what worse means for each, and gets a pipeline that fails when a change to a scenario, a model or the engine makes one of them worse, or stops meeting its requirement.

It extends the scenario regression check. A Monte Carlo figure is judged with statistics instead of a tolerance, so a new set of random seeds is not called a regression and a doubled spread is. Every run is appended to a history in which each record carries the hash of the one before, and a check reports whether that chain is intact.

What it does not do. A watch proves that a MODELLED figure stayed stable or moved; it does not prove the figure is true. A figure with no stated direction is reported and never fails a run.

Campaign watch · six revisions, one historyKshana Pro output

Watched figure · revision

carrier-to-noise density ratio (C/N0) at the end of the jamming phase○·▲▼··

largest time error on the mission timeline○····≈

satellites tracking at the end of the jamming phase○··▼··

share of the mission under alarm○··▼·▲

spoofing detected (phase length)○····▲

time error at the end of holdover○····≈

▼regressed▲improved·unchanged≈moved within its tolerance○first run: becomes the baseline

Revision r4-stronger-jammer · jammer raised from -33 to -24 dBW (decibels relative to one watt): C/N0 at the end of the jamming phase 30.60 → 21.82 dB-Hz (decibel-hertz), below the 25 dB-Hz floor, requirement not met; satellites tracking 8 → 0; three watches regressed · fail, exit code 1

The bundled campaign pack, 10 watched figures over three open campaigns, run twice: pass both times, 0 of 125 figures moved, history of 2 records intact.

Kshana Pro 0.2.0 on open engine 0.29.0 · kshana-pro ci · demonstration revisions of campaign-jam-spoof-holdover-integrity.toml · history 6 records, chain intact, last hash bb2f10eb… · MODELLEDOpen in Kshana Studio

Will our signal plan interfere with GNSS, or suffer from it?

FreeA free user checks one satellite's signal against one GNSS signal.
ProA Pro user tests one or more candidate signal plans, each a signal design and a constellation, against every open-service GNSS signal the engine models, with every satellite of the plan in view at once, and gets a verdict per plan and signal against a limit the study states.

Both directions are tested: the loss of C/N0 each plan causes to each GNSS signal, and the loss the GNSS signals cause to the plan. Pro adds only the sum over the satellites in view at each cell of a worldwide grid and the ranking of the plans. The limit and its source are inputs; no limit is built in.

What it does not do. The result is an upper bound: every satellite in view is taken at the maximum received power, with no power that varies with elevation and no receive-antenna pattern. It is not a coordination filing and not a regulatory finding.

Spectrum coexistence · 4 example signal plansKshana Pro output

Plan · signalGPS L1 C/AGalileo E1GPS L5Galileo E5aGalileo E5bGalileo E5 AltBOC

L band, 288 satellites

L band, 144 satellitesranked front

C band, 288 satellites

Wide C band, 288 satellitesranked front

L band, 288 satellites → Galileo E5 AltBOC · worst loss caused 0.00544 dB (decibel), at a cell with 17 of its satellites in view: a margin of 0.0946 dB to the 0.1 dB limit · compatible

4 of 4 plans compatible · the GNSS signals cost the L-band plans at most 0.00908 dB

Kshana Pro 0.2.0 on open engine 0.29.0 · kshana-pro coexist · 10 engine runs (constellation-design, leo-signal) · scenario hash 479364bd… · MODELLED upper bound · the 0.1 dB limit was chosen for the example only, not a regulatory criterion · C/A: coarse/acquisition; AltBOC: alternative binary offset carrier

Can the team queue studies on its own network and prove what was delivered?

FreeA free user runs one scenario at a time on one machine.
ProA Pro team queues studies on its own network, lets them run while no one watches, and can show afterwards exactly which result was delivered for which request.

It extends the on-premises service: Pro can run as a small HTTP (Hypertext Transfer Protocol) service on your own network: it reports its health, its version and the kinds it can run, and runs a scenario posted to it. A job's identifier is the SHA-256 of the operation and the request, so the same request is the same job and is not run twice. After a stop or a crash, every unfinished job is queued again and no finished job is run again. Without a licence it serves the open engine only and refuses every Pro feature.

What it does not do. One request per connection, with no streaming: a client polls. One licence for the whole service and one shared access token, not user management. No cancellation, time limit, priority or retention policy.

On-premises job service · one recorded sessionKshana Pro output

01POST /jobs a link-budget scenario202accepted and queued · job fb6e50ff…
02GET /jobs/{id}200succeeded on its first attempt · kind link-budget
03POST /jobs the same request again200the same job, already finished: nothing run twice
04GET /ledger/verify200verified, chain intact · 3 records · 1 delivered job · no mismatch
05GET /openapi.json200OpenAPI 3.1 · 13 paths, from the service's own route table
06GET / the job board200loads nothing from outside
07restart then GET /jobs/{id}200the finished job still shows one attempt
08kill -9 while a job runs, then restart—the unfinished job ran again and succeeded; the finished job was not run again · ledger 9 records, 3 delivered jobs, verified
09no licence: POST /jobs a Pro scenario403refused on submission: nothing queued
10no licence: POST /jobs an open scenario202accepted and queued

Kshana Pro on open engine 0.29.0 · kshana-pro serve --data-dir, two workers (the restart test: one) · HTTP status codes as the service returned them · a local run on public scenario files with the development entitlement, not a customer deployment

Also in Kshana Pro

Requirements and traceability

Kshana Pro's model-based systems-engineering (MBSE) and programme tooling checks a programme's requirements against runs of the open engine: it imports requirements as comma-separated values (CSV), or as a documented subset of the Requirements Interchange Format (ReqIF) or of Systems Modeling Language version 2 (SysML v2) text, and produces a verification cross-reference matrix (VCRM), a SysML v2 model, a change-impact report and an offline evidence pack. It re-runs and recomputes nothing.

The open engine's outputs it reads

result.jsonthe fields a criterion names, their units, the reproducibility stamp of scenario hash, seed, engine version and schema version, and the run's label and figure tiers
report.jsonkind, reproducibility record and capability labels
scenario fileits hash, kind, seed and parameters
field-units schemaeach field's unit, provenance and evidence tier
verification matrixeach capability's VALIDATED, MODELLED or PARTNER label

Trade studies

A trade study runs every architecture option as an unchanged open-engine scenario, ranks the options on a figure of merit read from each run's result, and writes an evidence pack that records each option's scenario hash, so any figure in it can be reproduced by re-running that scenario.

Clock digital twin

A clock twin is calibrated to a device's published Allan-deviation budget, then checked by estimating the twin's own Allan deviation with the open engine's estimator and comparing the two within a stated tolerance. A twin of your own device needs your characterisation data and is built under contract and a non-disclosure agreement.

Study dossier

One scenario becomes a reproducible technical note in HTML (HyperText Markup Language) and JSON (JavaScript Object Notation): scope, method, results with a tier on every figure, limitations, and the exact scenario text run.

Pro needs a licence. Without one, Pro runs open scenarios only and refuses every Pro feature with a message naming what is required.
Some work needs a signed customer. A twin of your own device needs your characterisation data and is built under contract and a non-disclosure agreement.
Nothing Pro produces is a certification. Every result is modelled, and says so.

Done as a custom study

Models of your hardware. Sensor or resilience models calibrated to your hardware are built only under contract, with your data.
Export-controlled resilience models are not publicly offered. Such work is done only under the appropriate clearance and a non-disclosure agreement.

Request a Pro evaluation Licensing guide

The charts in this section are drawn from the files the Pro commands wrote for the worked examples that ship with Pro: modelled results, not statements about any real mission. The wording is quoted from the public Kshana Pro page of the open repository.

02Custom study · how it runs

When you need an answer, not a tool.

A custom study uses the same engine you can run yourself, so every figure in it can be checked by anyone.

Tell us the question. Mail contact@ashforde.org with the system and the decision it feeds. There is no form.
We scope it. What will be modelled, with which scenarios, and what stays out of scope, under the appropriate clearance and NDA where the work needs it.
We model it with the same engine. Every figure is labelled Validated or Modelled, exactly as on this site.
You get a reproducible result. Reproducible from scenario, seed and engine version. A modelled study, not a certification.

Not the same as kshana --study: that free command runs a suite of scenarios you write into one stamped report (Developers). A custom study is paid work we do for you.

Install the open coreFrom the manifests

For anyone, nothing to install.

Launch Kshana Studio

The engine runs locally as WebAssembly; nothing is uploaded.

Open Kshana Studio Studio guide

For engineers who want the kshana command.

Then check itkshana --version

crates.io: kshana Command-line usage

For analysts and notebooks.

Then check itpython -c "import kshana; print(kshana.version())"

PyPI: kshana Python API guide

For web and Node.js developers.