Engineering · Sheet 01 of 05
Technology
Five subsystems decide whether an autonomous platform survives contact with real ground and real air. These are ours.
01 · Ground contact
Articulated suspension
A fixed axle transfers the ground into the deck. An independent corner absorbs it. With six corners, the vehicle can lose contact at one and lose nothing that matters.
Each corner is a trailing arm carrying its own hub drive, sprung and damped on its own coil-over, with ground clearance adjustable from 90 to 260 mm on self-locking lift actuators that hold position unpowered. Because the drive is in the hub there is no propshaft, no differential and no single mechanical path whose failure stops the vehicle. Losing one corner derates the envelope, it does not end the mission.
Six contact patches also mean the load per patch is low. On soft ground that is the difference between crossing and sinking, and it is what lets the platform hold a 30° slope requirement (up, down and across) at full gross vehicle weight, on surfaces a four-wheel platform of the same mass cannot use.
02 · Position without a fix
Optical-flow navigation
Satellite fix is a convenience, not a foundation. Between buildings, under structure and inside plant it is simply not there.
A downward sensor tracks features on the ground frame to frame. The displacement of those features, scaled by measured height above surface, is a direct velocity measurement. Integrated, it is position, computed onboard, at rate, with nothing external in the loop.
Drift is the honest limitation of any dead-reckoned solution. It is bounded by folding in every other observation available (inertial, barometric, LiDAR structure, and GNSS when it returns) in one estimator that weights each by its current confidence rather than by a fixed hierarchy.
03 · Partitioned by design
Onboard compute
One sealed module carries two computers that do not trust each other equally, and that is the point.
The AI compute runs perception and planning. Alongside it, electrically and temporally independent, a real-time safety MCU holds the envelope, the geofence and the stop condition. Separate supply, separate clock, separate sensing for the few quantities it must never be wrong about.
The module is conduction-cooled into the chassis liquid loop, so there is no filter to service and no air path to block with dust. It is the same module on both platforms: one thermal design, one software target, two vehicles.
04 · Links, arbitrated
Multi-radio stack
Four independent links, arbitrated live by what is actually working. No single radio is load-bearing, and none of them sit inside the control loop. Losing every link degrades supervision, not control.
-
01
Cellular
Fleet link: telemetry, dispatch, OTA
Carrier-diverse. Not in the control loop.
-
02
GNSS
Absolute position cross-check
An input to the estimator, never the sole source.
-
03
C2 link
Direct command and control
Licensed link for supervised operation and takeover.
-
04
Local mesh
Unit-to-unit and unit-to-dock
Works with no infrastructure present.
Switch links off to see the effect
05 · The real limit
Power and thermal
Autonomy is a thermal problem wearing a software costume. Compute that throttles is compute that is not perceiving.
Pack, drive units and compute share one liquid loop with a single controller that knows the mission profile, not just the current temperature. It pre-cools ahead of a known climb rather than reacting after the fact.
On the ground platform, the deck bus supplies mission modules directly, enough for an actively held cold-chain pod to maintain setpoint through the whole route including dwell, which is the only way a thermal record is worth anything.
In the air the constraint is mass, so the same thinking runs the other way: the thermal path is structural, and the airframe is the heatsink.
06 · Next step
Go deeper.
Detailed subsystem documentation is available under NDA for evaluating organisations.