Modules4 AI modules (navigation & mission; sonar classification; ship control & plant; verifier) + 2 certified safety controllers
CPU64 cores (4 × 16) + 4 lockstep real-time cores per module
AI throughput20,000 TOPS total (4 × 5,000, INT8 / FP4 sparse)
Memory4 × 128 GB LPDDR6, 600 GB/s per module
Power draw400 W compute; ≈ 0.7 kW with sonar processing front-ends and 4 mast cameras — 0.002% of the 33 MWe plant
Process node2 nm-class SoCs; safety controllers on a mature 16 nm node, 15-year supply
RedundancyEvery sensor is wired to both module pairs. Each module is primary for its own job and hot standby for its partner, and any one can bring the boat to a safe depth and speed. The verifier checks every manoeuvre independently. A software fault can never drive the submarine outside its certified safe envelope: two SIL 3 controllers hold reactor protection, depth and ballast on their own depth gauges, plane and rudder angle sensors, shaft encoder and reactor instruments.
SensorsSpherical bow array, flank and towed arrays, 4 mast cameras (visible and thermal) on an automotive Ethernet camera switch, navigation radar at the surface, inertial navigation, 2,000 plant sensors
LinkVery-low-frequency and satellite when at communication depth; the boat carries its mission plan and rules and follows them between contacts. Motor drives close their own current loop at 1 kHz; every safety loop closes aboard.
Service lifeThe boat serves 33 years on one core. Compute is a line-replaceable unit, swapped at mid-life.