WATCH · CONTROL AUTHORITY AND SOFTWARE INTERLOCKS
Control who can command your vessel
Control must have an owner, and every change of owner must be deliberate. WATCH is the NAUTILUS module for command authority and software interlocks. It checks requests from operators and planners before they reach the equipment interface.
IN DEVELOPMENT · PILOT CONVERSATIONS OPEN
NAUTILUS / FILM
Watch WATCH.
ON THIS PAGE→
Page sections appear in preview
01 / WATCH
Put control ownership beyond doubt
Local manual operation, remote supervision and permitted autonomous modes need explicit ownership and handover. WATCH uses authority modes assigned to a specific vessel, with expiring permissions, acknowledged handover and a tested fallback.
An operator interface must show who holds control and whether that authority remains valid. A second source cannot become the owner merely by sending a new request. Physical emergency arrangements and local manual takeover remain higher priority than remote or autonomous demands.
02 / WATCH
Check the action as well as the identity
An authorised operator can still request an operation that is expired, incompatible or outside the vessel limits. WATCH evaluates identity, scope, target, policy version, deadline, command history and active mode alongside relevant operational conditions.
Those conditions include navigation integrity, sensor freshness, operating area, machinery health, command limits, conflicting demands and the commissioned collision-risk constraints. A planner cannot waive an interlock by presenting a more confident proposal.
03 / WATCH
Preserve a boundary between planning and permission
COURSE proposes a candidate manoeuvre. A local operator or WAVE peer may request an action. WATCH independently decides whether the intent can proceed within the vessel’s policy and current state.
The design requires the decision and its reasons to be stored before dispatch. BRIDGE accepts only a valid authorised channel and applies the capability bounds again at the hardware boundary.
04 / WATCH
A safe response belongs to the vessel
Different hulls, propulsion systems and situations require different contingencies. WATCH uses the builder- and operator-commissioned response for the installed vessel and operating envelope.
A lost heartbeat, failed feedback, expired lease, stale sensor or conflicting owner can trigger a reasoned transition. Clearing a fault requires the appropriate recovery process; old demands must not replay automatically when the condition disappears.
Software authority and interlocks form one part of the whole-vessel safety case. Physical emergency stop, independent manual controls and operating approval remain the responsibility of the relevant vessel parties.
05 / WATCH
Treat ambiguous outcomes honestly
A command may be admitted and dispatched before communication or power is lost. If a durable execution result cannot be established, the journal must preserve an outcome-unknown state.
The operator then needs to reconcile the measured vessel state before requesting another non-idempotent action. A missing reply cannot safely be treated as proof that the vessel did nothing. The operator needs the measured state before deciding what to request next.
06 / WATCH
Keep commercial entitlement separate from emergency response
The design requires local manual override, emergency functions and the defined safe-state capability to remain available during a licence-service outage. Commercial feature admission and vessel control authority serve different purposes and must remain separate.
07 / WATCH
Prove handover, faults and recovery
AIC can help define the handovers, operating modes and fault conditions your installation needs to test. The evaluation must include conflicting owners, expired input, stale state and lost feedback on the actual vessel configuration.
WATCH is in development. Its software boundary does not itself establish a certified safety controller or whole-vessel approval.