Modules4 AI modules (navigation & patrol plan; sonar classification; ship control & plant; verifier) + 2 certified safety controllers; the weapons system is separate and under human control ashore
CPU64 cores (4 × 16) + 4 lockstep real-time cores per module
AI throughput20,000 TOPS total (4 × 5,000, INT8 / FP4 sparse)
Memory4 × 128 GB LPDDR6, 600 GB/s per module
Power draw400 W compute; ≈ 0.7 kW with sonar front-ends and 4 mast cameras — 0.002% of the 36 MWe plant
Process node2 nm-class SoCs; safety controllers on a mature 16 nm node, 15-year supply
RedundancyEvery sensor is wired to both module pairs. Each module is primary for its own job and hot standby for its partner; the verifier must agree before any change of depth, speed or course, and any one module can hold the boat safe. A software fault can never drive the submarine outside its certified safe envelope: two SIL 3 controllers own reactor protection, depth and ballast on their own depth gauges, plane and rudder angle sensors, shaft encoder and reactor instruments. Weapons release is never an onboard software decision.
SensorsSpherical bow array, flank and towed arrays, 4 mast cameras on an automotive Ethernet camera switch, inertial navigation, 2,400 plant sensors
LinkVery-low-frequency receive on patrol; satellite at communication depth; the patrol plan is carried aboard. Motor drives close their own current loop at 1 kHz; every safety loop closes aboard.
Service lifeThe boat serves 42 years on one core. Compute is a line-replaceable unit, swapped at mid-life.