Big Auto One / Capabilities

What the system does

A vehicle that can be driven, supervised or left to finish a job it was authorized to do — and a ground segment, a network and a safety architecture designed around the assumption that some of it will be missing at the moment it matters.

Control

Three ways to work it

Driving and autonomy are not separate products. They are positions on one dial, and an operator moves along it inside a single mission without stopping the vehicle.

Remote driving

The operator drives from a station on the mesh with live video and a terrain picture the vehicle has built for itself. They see what the vehicle has decided about the ground in front of it, not only the raw view its sensors return.

The envelope is enforced regardless of the stick. Speed is limited for slope, surface and proximity; ground the vehicle has assessed as untraversable is refused; an obstacle inside the stopping distance stops it. A driver cannot command the vehicle into something the vehicle can already see.

Supervised autonomy

The operator designates a goal on the map and issues an authorization: a corridor it must stay inside, a time limit, and the vehicle health conditions under which it must stop and wait rather than press on.

The vehicle plans a route, drives it, and replans continuously against what it observes. It prefers passable, sensible ground — a road over the field beside it — without being told which is which. The authorization is a contract, not a suggestion: it is enforced on the safety core, independently of the software that plans.

Pause, redirect or cancel at any moment you are in contact. Nothing about the autonomy requires the operator to give up the ability to take the controls.

The console on a ridge: the vehicle has capped its own speed and says so on screen — **The envelope, visible.** Climbing a ridge under an authorization, the vehicle has capped its own speed for the slope and told the operator why. The margin at the top of the screen is how much stopping distance it believes it has. Regions blurred: compute supplier, link and radio detail

Group dispatch

Several vehicles sit on one mesh as peers. A crew can hold them idle, then send a group to one objective with a separation between them so each has its own lane, or work each vehicle independently on its own mission and its own authorization.

Adding a vehicle adds a node on the network. It does not add a ground installation, and it does not require a second crew.

Seeing the ground

A terrain picture,
not a video feed

The vehicle continuously builds a model of the ground around it — contour, slope, surface, obstacles, and the things that move — and both the operator and the planner work from that same model.

Traversability, rendered

The operator sees the vehicle's own assessment of what it can and cannot cross, overlaid on the map. When it refuses a line, the reason is on the screen.

People are a category, not an obstacle

A person on the route is treated differently from a rock on the route: the vehicle can be configured to hold a standoff and go around rather than simply stop and wait to be rescued by an operator.

Positioning that does not assume satellites

Between buildings, under terrain or against interference, the vehicle keeps its position from what it can measure onboard. When it can no longer vouch for where it is inside its corridor, it says so and pauses the mission rather than guessing.

Cross-checked against somebody else

Where a second vehicle or a sensor on a relay can see the same ground, their pictures are compared. Two independent views disagreeing is information, and it is surfaced to the operator rather than averaged away.

Engineering dashboard: vehicle state, a traversability map over imagery, controls, and the perception grid — **The same drive, from the engineering side.** The traversability map is the vehicle's own assessment of the ground, drawn over the imagery it was built against. Green is passable, red is not, and the route is planned on that rather than on a line somebody drew. Regions blurred: compute supplier, powertrain and energy, comms detail

The console showing a second point of view, and a panel reporting that the two maps disagree — **Two views, disagreeing.** A sensor watching the same ground from elsewhere is compared against what the vehicle believes. Where the surfaces do not agree, the operator is told the map may be registered wrong — rather than the two being averaged into a confident mistake. Regions blurred: compute supplier, link and radio detail

Resilience

Designed to arrive
in worse shape

The question is never whether something fails. It is what the vehicle is still able to do afterwards, and whether the crew was told.

Compute

Two independent computing units on separate power, one active and one in hot standby, both receiving every sensor stream. A failure of the active unit is a handover measured in a fraction of a second, and the operator keeps driving.

Ground

Primary and backup command centers are identical builds holding the same mission state. The backup can assume control automatically when the primary is lost, or on request when a crew simply wants to hand over. The vehicle is not involved in that decision and does not need to be reachable for it to happen.

Network

Every radio is a peer on a self-forming mesh. There is no base station to lose. The vehicle will use whatever paths exist — a direct hop, another vehicle as a relay, a long-haul backhaul — and it degrades deliberately: full video, then reduced video, then telemetry only, then an authorized mission carrying on alone.

Interference is handled the same way. The link monitor reports what it actually has rather than what it was configured to expect, and the operator sees the ladder they are standing on.

Sensing

Sensors are lost in the real world — by damage, by dirt, by weather. The vehicle drops to what it can still trust, lowers its own speed ceiling to match its remaining sensing range, and continues. It arrives slower rather than stopping where it stood.

Loss of contact

Detected in well under a second, and handled by the safety core rather than by the software that was driving. Under an authorization, the mission continues within its corridor and its time limit. Without one, the vehicle executes a single defined behavior that the crew set before it moved.

Safety architecture

The part that
cannot be talked
into it

Autonomy earns trust by being contained. The safety core is separate hardware running a small, deterministic program that owns the motion output — and it has no ability to plan, choose a route, or decide where the vehicle should go.

Fail operational, then fail safe Any single failure degrades capability but never control. Two independent failures result in a controlled stop.

The safety core never plans; it only checks Every command that could move the vehicle passes through it and is checked against limits it holds independently.

Every threshold is configuration, and it is signed No limit is a number buried in logic. The safety core verifies the signature on its own limits before it will allow motion.

Observable by default Every component publishes its health, and every decision that affects motion is logged and recoverable afterwards.

Emergency stop — local and remote, owned by the safety core and unaffected by the state of the autonomy.
Watchdog — the autonomy proves it is alive on a hard schedule or loses the ability to command motion.
Geofence — the authorized corridor is enforced here, not in the planner.
Speed ceiling — imposed for terrain, health, degraded sensing and proximity, and never exceeded by any control source.
Arbitration — exactly one control source has authority at a time, and the transfer is explicit and signed.
Loss-of-link behavior — one defined action, set before the mission, enforced without reference to the software that was driving.
Black box — a day of telemetry and hours of full-rate sensor data kept onboard for the review afterwards.
Signed, atomic updates — software is replaced as a whole and can be rolled back; a half-installed vehicle is not a state that exists.

Then make it yours

None of the above assumes a particular sensor, radio or payload. That is the point of the next page.

Flexibility Mission set