Modules2 light AI modules + 1 certified safety controller
CPU16 cores (2 × 8) + 2 lockstep real-time cores per module
AI throughput3,000 TOPS total (2 × 1,500, INT8 / FP4 sparse)
Memory2 × 64 GB LPDDR6, 300 GB/s per module; 4 TB mission log
Power draw70 W compute; ≈ 110 W with the safety controller, 4 cameras and the sonar front-end — 0.7% of the 16 kW average load
Process node2 nm-class SoCs; safety controllers on a mature 16 nm node, 15-year supply
RedundancyEvery sensor is wired to both modules. Each module is primary for its zone (vehicle, or mission and payload) and hot standby for the other, and each restarts from a cold image. A software fault can never drive the vehicle outside its certified safe envelope: the SIL 3 controller, on its own depth gauges, fin encoders, leak detectors and battery monitors, surfaces the vehicle, drops ballast and calls home by itself. Loss of both modules ends the mission safely.
SensorsForward-looking and side-scan sonar, 4 cameras (visible and low-light) on an automotive Ethernet camera switch, inertial navigation with Doppler log, 300 plant sensors
LinkSatellite and radio through the mast when surfaced; acoustic link to other vehicles; the mission plan is carried aboard. The motor drive closes its own current loop at 1 kHz; every safety loop closes aboard.
Service lifeThe vehicle serves 20 years. Compute is a line-replaceable unit, swapped at mid-life.