DISCONNECTED MARITIME OPERATIONS
Plan for the places the link cannot reach
A vessel working beyond reliable coverage needs its instructions and required data aboard. NAUTILUS is in development for signed missions that can continue during an outage within their approved limits, with defined actions when the conditions for continuation are no longer met.
IN DEVELOPMENT · PILOT CONVERSATIONS OPEN
NAUTILUS / FILM
See how COURSE assesses a mission.
ON THIS PAGE→
Page sections appear in preview
01 / NAUTILUS
Prepare the mission before the link becomes uncertain
An authorised operator stages a signed, vessel-scoped mission package containing its objective, area, permitted mode, limits, required sensor and data products, validity and contingencies.
The vessel verifies that package against the installed adapter, vessel profile, local clock and available dependencies. WATCH arms the mission after explicit authority handover. The vessel starts with an authorised task and explicit limits, even if the shore link later disappears.
02 / NAUTILUS
Local capability with explicit limits
HORIZON supplies observations, RECKON provides qualified state and COURSE proposes manoeuvres within the active package. WATCH remains the independent software authority boundary and BRIDGE translates only permitted intent.
The control loop is designed to stay aboard, with reserved resources and measured deadlines for the commissioned mode. A shore service is not required solely to keep an already valid offline mission running.
Mission authority, navigation, equipment health, data validity and reserves still determine whether the task can continue.
03 / NAUTILUS
Let changing conditions change the mission state
An expired package, unavailable required chart, excessive navigation uncertainty, failed feedback or low reserve must cause a reasoned transition into the commissioned contingency.
The package defines whether the appropriate response is suspension, abort, a bounded alternative or another vessel-specific action. A return action is valid only where localisation, route and reserve evidence support it.
Operators can plan the task around a stated offline duration and its prerequisites, with the contingency agreed before departure.
04 / NAUTILUS
Bound offline trust as carefully as offline autonomy
The vessel uses installed signed trust and policy material only within its approved validity. A disconnected device cannot receive fresh revocation information, so trust age and expiry are part of the residual-risk assessment.
SHACE key lifecycle and any safe offline rollover must be defined by the reviewed security profile. Expired or unusable trust closes new secure sessions and remote command admission as required, while local authority follows its separately valid mission and contingency rules.
05 / NAUTILUS
Reconnect with a coherent account of events
The mission journal records state transitions, navigation downgrades, planning reasons, WATCH decisions and equipment response during the outage. WAVE sends eligible retained evidence with original times and reports the current onboard mission state after reconnection.
A new mission revision needs fresh authentication, a new signed version and the relevant handover. Old manual samples remain expired, and the shore interface must reconcile with the vessel’s authoritative state.
06 / NAUTILUS
Demonstrate the outage as part of the pilot
Include an outage in the pilot rather than leaving it as an assumption. Cut the link, introduce stale data and low reserve, then reconnect and check the records. This establishes how long the selected mission remains valid and what stops it.
NAUTILUS is in development. Disconnected autonomous operation requires a commissioned mission, complete rehearsal and the relevant vessel approval before physical use.