The vessel on a white ground, seen from above and off the bow: a long flat working deck carrying an A-frame and cable drum, a folding crane, container modules and a rigid inflatable, mast heads with radomes and whip antennas, and at the bow a caged corridor mouth open at the waterline.
Water · KMM-01

Nobody Aboard.
Not Even a Wheelhouse to Put Them In.

KMM-01 is the Water family's uncrewed clearance workboat and the maritime half of the mine clearance work: a catamaran of the 13–14 m length class with no wheelhouse, no accommodation and six cassettes in a central bay. It surveys submerged ground and lifts benign, inert objects into a flooded corridor between its hulls, and a supervisor ashore approves every one of them.

The Water family → The clearance carrier on ground Start a screened enquiry
The premise

Not a Crewed Boat
With Autonomy Added Later.

KMM-01 is drawn as an uncrewed machine from first principles, and the rules were written before the hull was. Take the crew out before the lines are struck and a different boat appears, because the constraints go out with them.

The vessel from the side and slightly above on a white ground: the full length of the working deck with an A-frame and cable drum at the after end, a folding crane amidships over a container module, the sensor mast and radome forward of it, and the caged corridor mouth at the bow.

Autonomy retrofitted to a crewed boat is a compromise wearing a badge. The wheelhouse is still there, so sightlines still govern the superstructure; the accommodation is still there, so the subdivision, the ventilation and the escape routes are still there; and somewhere in the mission chain there is a step that quietly assumes a hand. Drawing the machine uncrewed from the first line removes all of that at once, and what it removes is not weight so much as constraint. Seven rules were written down before the hull was.

The reference configuration follows from the rules: a catamaran hull, twin independent low-speed-optimized propulsors, hybrid-electric power, a forward submerged intake between the hulls, an enclosed flooded transfer trunk, a six-cassette central bay, an aft service gantry, sensors on the mast, and a remote operator station ashore or aboard a support vessel. Nobody in harm's way is the doctrine the company is built on, and mine clearance is its purest case. The KAOS carrier in its clearance configuration is the same argument on ground.

The boundary

It Surveys, and It Lifts
Objects That Are Inert.

The work is submerged foreign-object survey and benign recovery. Every acquisition, transfer, cassette and material-handling interface in the engineering is defined around inert surrogate objects, built into the mechanism rather than written on top of it.

The mission module handles inert surrogate objects only, and the list of behaviour it is forbidden to produce ends on the same boundary. A candidate outside that envelope is not something the machine argues about. It is something the machine does not touch, and the test register is scoped the same way: benign system verification on inert surrogates.

Specialist work on live ordnance is a different discipline, a different authority and a different document. The package holds a controlled interface for it and defines none of its engineering. What the carrier offers across that boundary is deliberately generic: mechanical hard points, an auxiliary power allocation, isolated status I/O, a pose and time feed, module health logging, a carrier safety inhibit, a service access envelope. Anything on the far side needs its own safety case, competent authority, legal authorization and baseline.

Scope
Survey and benign recovery. Inert objects, by design.

Head, trunk, selector and cassettes are sized, instrumented and interlocked around benign surrogates, and the trials that prove them use the same objects. Live ordnance sits behind a separate specialist interface with its own authority and its own safety case.

The hull form

Two Hulls, and the Reason
Is the Water Between Them.

Twin displacement hulls joined by a deep cross-deck surrounding a central wet mission corridor. The catamaran is not chosen for speed or deck area, but because it is the hull form that owns a sheltered submerged volume down its own centreline.

The vessel from the quarter on a white ground, low to the water: the cable drum and A-frame on the after deck, a folding crane over a container module, a radome and sensor heads on the mast, and the bow's caged corridor mouth lit in the foreground.

Every other way of getting a submerged object onto a boat fights the boat. Over the side is a heeling moment, a swinging load and a working party at the rail. A moonpool is a hole in the middle of a monohull. A catamaran already owns the corridor: the water between the hulls is protected on both sides, open at the bow at working depth, running aft inside the cross-deck to a bay amidships where a change of load does least to the trim. So the vessel carries the object along its own axis instead of across it. The philosophy that follows from that decides where the effort goes: the vessel performs most gross positioning, and the mission module is not designed to pull large alignment errors into itself. The hull aims; the mechanism only has to move.

Principal dimensionDesign basis
Length overall13.0–14.5 m; the length class is 13–14 m
Beam5.0–6.0 m; the beam class is 5–6 m
Transit draft1.0–1.4 m
Hull formTwin displacement hulls, deep cross-deck, central wet corridor
Cassette stations6 nominal
Benign payload4 t class

The principal dimensions, with length and beam carried as classes rather than as points.

The design basis ranks its priorities, and the ranking is the argument for the form: low-speed manoeuvrability first, work-zone stability second, the central mission corridor third, then machinery access, damage tolerance and subdivision, and only sixth, reasonable transit efficiency. This hull is sized by what it does while it is nearly stopped. The weight budget is where that ordering becomes arithmetic.

GroupTargetGrowthAllowance
Hull primary structure4,200 kg10%4,620 kg
Cross-deck and mission corridor1,300 kg12%1,456 kg
Propulsors and drives1,650 kg10%1,815 kg
Battery, genset and fuel3,200 kg15%3,680 kg
Mission head950 kg15%1,092.5 kg
Transfer trunk and selector1,250 kg15%1,437.5 kg
Six empty cassettes900 kg10%990 kg
Benign mission payload4,000 kg0%4,000 kg

Selected groups from the weight and CG budget. The payload line is the only one with no growth on it.

The payload line carries no growth allowance because it is the requirement rather than an estimate of it. Structure carries 10 to 12% and equipment 15%: plate you have drawn moves less than machinery still to be chosen. Mission mechanics carry 15% because head, trunk and selector are sized by test loads rather than by catalogue.

Loading is not left to a crew, because there is no crew. Twelve conditions are carried, out to maximum forward, aft, port and starboard cassette loading, gantry benign lift, one-compartment flooding and tow. Six cells filled in the wrong order is a stability problem, so the rule goes into software: mission software receives load and cassette state, and prohibits further asymmetric loading when the validated stability envelope is approached.

The corridor

Seven Zones.
Nothing Crosses a Boundary on Momentum.

The flooded transfer path is specified zone by zone, from the guide mouth at the bow to the cassette cell itself. A zone is a state the system can be in, not a length of pipe.

ZonePurpose
Z1 · Guide mouthGross alignment and benign capture envelope
Z2 · IntakeEstablish controlled contact and move the surrogate into the trunk
Z3 · Primary transferLow-speed progression with occupancy tracking
Z4 · InspectionVerify track continuity and orientation
Z5 · SelectorRoute to the selected cassette
Z6 · VestibuleIsolate the common trunk from the cassette cell
Z7 · CassetteIndividual flooded containment of one surrogate

The flooded transfer zone specification, mouth to cell.

A transition between zones is not a motion command. It is a permission that six conditions have to grant together: upstream occupancy valid, downstream state valid, gate state known, safety permission, drive health, and vessel motion inside the envelope. Any one missing and the object stays where it is. Occupancy sensing is a requirement of its own: an array in the intake, another in primary transfer, another in the inspection zone, with zone occupancy going out at 20 Hz.

Jams are treated as a normal event with a fixed response. Detection combines motor current and hydraulic pressure, commanded against actual motion, an occupancy timeout, gate state, and what the cameras and sonar can see. Then: stop, freeze the gate sequence, identify which zones are occupied, alert the supervisor, and permit only bounded, predefined benign-object clearing motions. If that does not clear it, the machine retreats and the system is recovered instead of being forced again: propulsion inhibited, stored energy dissipated, gates secured and lockout applied before anyone touches it.

A dark, flat-sided submersible body on a white ground, seen from above and ahead: a caged mouth with lights and camera clusters at the bow, pipework and lifting eyes along its top deck, and ducted thrusters on the flanks and at the stern.
The cassettes

One Object per Cassette.
Identity and State Interlock Separately.

Six nominal stations in a central bay, one surrogate in each. A cassette is an individually removable flooded containment cell with its own identity and state tracking, and identity and state are two interlocks rather than one.

An identity fault and a state fault look nothing alike. Identity is about which cell this is: keyed installation so it only goes in one way, a visible serial a person reads at the cradle, and an electronic ID the selector interrogates before it routes anything anywhere. State is about what is in it: a present switch, latch-closed sensing, a flooded or level sensor, an independent occupancy sensor.

The cell moves through a declared chain: absent, installed, latched, empty and flooded, receiving, occupied, isolated, service lock, removal authorized. Any unexpected transition blocks motion and raises a fault. Routing to an occupied cassette is blocked; removal outside the service state is blocked; routing into an unknown cassette is on the forbidden list rather than on a checklist.

TWO IDENTITIES

One a person reads, one the machine reads

A visible serial on the cell, and an electronic identity device the selector checks before it will route. Neither is trusted alone, and wrong cassette is a named hazard with both against it.

STATE, SENSED

Present, latched, flooded, occupied

A present switch, latch-closed sensing, a flooded or level sensor, an occupancy sensor and a local visual marker, so the state is legible outside the software as well as in it.

THE INVENTORY

What each cell carries in the record

Cassette ID, install time, mission ID, occupancy state, the object track ID, where the acquisition happened, isolation time, alarms and service history. The record is as much the deliverable as the object.

Six is nominal rather than structural: the requirement carries four-to-eight architecture scaling. What does not move is one object per cassette: each cell's state stays a single fact instead of a tally, and a cell that has to be isolated costs one object rather than a bay.

The cassette is also where the stability argument lands. Cassette state feeds the load map, asymmetry monitoring is a requirement in its own right, and ashore the cell comes off on a removable shore cradle through a defined lift interface, with the record beside it.

A split waterline in open sea: above, a low swell under a broken cloud line; below, a dark rectangular hull runs through the sunlit water with its forward cage mouth lit, a translucent CS-320 bell just ahead of it.
The approach

Restricted Speed Means
the Boat Stops Being a Boat.

Between finding a candidate and touching it there is a phase with its own speed limit and its own gates. During approach, vessel speed and acceleration are reduced, and station keeping aligns the mission head.

Restricted-speed approach is not a courtesy. It is what makes the rest of the mechanism tractable. At transit speed a hull's own motion swamps any alignment the mission module could hold; at a crawl, with the propulsors holding station against wind and current, the geometry between the mouth and the object is nearly still, and the mechanism can be built for movement rather than for capture. That is why propulsion is sized twice over: once for acceptable transit performance, and once for low-speed thrust authority in current and wind during mission mode.

Motion is a gate, not a comment. Acquisition requires tighter limits than transit, and the operability logic is three lines long: if measured vessel motion exceeds the validated mission envelope, inhibit acquisition, keep the transfer secured, and hold, retreat or return.

Nine conditions, all true at the same moment, before the approach, alignment and acquisition states open at all. The cassette condition is the one that orders the sequence: the destination is settled before the object moves.

The mission

Eighteen Phases,
and a Person Between Two of Them.

The mission runs to eighteen phases, from preparation through to replenishment. Condensed to the ones that change what the machine may do next, a working day has this shape.

Step 1

Preparation and self-test

The remote supervisor approves the mission plan: a mission polygon, a recovery point, a weather limit, a communications plan and an emergency response plan. The vessel self-tests and reports state before anything is enabled.

Step 2

Launch, transit, navigation confidence

The vessel departs and validates navigation confidence on arrival. Confidence is a monitored quantity, logged with pose and covariance, and it gates what the machine may attempt.

Step 3

Survey the assigned lanes

Imaging sonar, obstacle sonar, cameras and the navigation fit work the lanes, and perception develops candidate-object tracks, each with an identity, a confidence, and provenance back to the sensor.

Step 4

Remote review and approval

A candidate interaction cannot proceed until it satisfies the validated inert-surrogate classification envelope and is explicitly approved by the remote supervisor. Approvals are logged. This is the step the machine cannot take on its own account.

Step 5

Restricted-speed approach and alignment

Speed and acceleration come down, station keeping holds the vessel, and the mission head aligns. The nine gate conditions must hold together before the acquisition states open.

Step 6

Acquisition and flooded transfer

The acquisition system moves the benign surrogate into the flooded corridor. Occupancy is tracked zone by zone, the inspection zone verifies track continuity and orientation, and the selector routes to a verified empty cassette.

Step 7

Receipt, isolation, inventory

Receipt is confirmed, the cassette is isolated, and the inventory is updated with the cell, the track and where the acquisition happened. Then the vessel continues or returns.

Two of the eighteen phases belong to a person, and they are the two that matter: approving the mission, and approving each candidate-object interaction. The rest of the supervisor's list is monitoring safety state, initiating abort or return, coordinating recovery and authorizing maintenance-mode transitions. The machine's own list is short and defensive by comparison: maintain the geofence, maintain collision avoidance, maintain stable vehicle control, track system health, stop unsafe state transitions, provide complete logs, and return or hold on defined degradations.

Functional segregation

The Safety Argument Is a Wiring Diagram,
Not a Policy.

The safety argument here is six statements about what is independent of what, and every one of them is a separation in hardware rather than a rule in software.

NAVIGATION

Independent of perception AI

Navigation safety functions do not run through the perception stack. A classifier having a bad day in turbid water cannot reach the part of the machine that keeps the vessel off a pier.

PROPULSION

Enable independent of the mission computer

Propulsion permission belongs to the safety subsystem. The mission computer can request thrust; it cannot grant itself thrust. Uncommanded thrust is a critical hazard, and an independent enable is the control against it.

ACQUISITION

Actuation independent of classification

What moves the mechanism is not what decides what the object is. Classification informs a supervisor; actuation runs on permissions.

CASSETTES

Routing interlocked with identity and state

Cassette routing is independently interlocked with cassette identity and state, so the selector acts on the cell's own sensing rather than on the mission computer's belief about it.

REMOTE STOP

Independent of the mission GUI

The stop path does not run through the screen the operator is using. Shore holds an independent command interface straight to the safety subsystem, and recovery after a stop is manual by requirement.

MAINTENANCE

Inhibits through the safety controller

Maintenance mode inhibits propulsion and mission actuation through the safety controller rather than through the application that asked for it.

Underneath the six sits the subsystem that owns them. It owns the hardware emergency stop, propulsion permission and mission-motion permission; it monitors the watchdogs and the interlocks the hazard analysis identified; it exposes read-only status to mission software; it defaults to inhibit when safety integrity is uncertain; it requires explicit recovery after a stop; and it logs every trip with synchronized time. The interface between autonomy and safety is written in five words in the interface register: request motion, read inhibits, no bypass. Compute is separated the same way, across six domains under rules that hold on all of them: no service may silently reset safety state, and stale commands are rejected.

The abort philosophy

Eleven Things Cancel
or Pause an Interaction.

Eleven conditions cancel or pause an interaction, and most of them are not failures. The machine stops on doubt as readily as on a fault, and the list is written that way.

Most of that list is uncertainty rather than failure. Ambiguous classification, reduced confidence, sensors that disagree, a cell that cannot prove its own state: none of those is a broken component. Sensor ambiguity from turbidity or fouling is its own hazard entry, and the controls against it are confidence gating, multiple sensors, and halting the interaction. Trying harder is not on the list. Doubt is a stop condition of its own.

Authority
The vessel asks. A named supervisor answers.

Nothing moves on the machine's own word. Transitions are permission-based throughout: mission software requests, and safety and subsystem state must permit. A supervisor who cannot be reached is a stop, never a delegation.

A split waterline in open sea: above, a support vessel with a white superstructure and a deck crane standing off on the horizon under broken cloud; below, a dark rectangular hull runs with its forward cage mouth lit and a translucent CS-320 bell ahead of it.
Degraded modes

A Lost Link Is a Defined State.
It Is Never Permission to Carry On.

No radio and no GPS is the rule everywhere else in the fleet. This vessel carries GNSS, inertial navigation, radar, AIS and a command link, and mine clearance is the one place in the fleet where that fit belongs.

The fleet's guidance tiers carry no radio and no satellite receiver because of where they work. Mine clearance is different work. It is done on water whose perimeter the customer controls and has surveyed, under a named supervisor who is watching, and a surface vessel is required by the rules of the road to be seen and to answer. So this line carries the fit that lawful supervised operation requires: dual-antenna GNSS and inertial navigation, marine radar, AIS, a Doppler velocity log and an altimeter below the waterline, and an encrypted remote command link.

What does not change is where the safety behaviour lives: never on the link. A lost link is a defined degraded state that stops or returns the machine, never one that lets it keep working unsupervised. Blocking new acquisition on lost communications is a mandatory safety requirement, and safe offline operation is a requirement in its own right. The link buys supervision. It does not buy permission.

FailureTransitSurveyApproachAcquisitionRequired response
Primary GNSS lostLimitedLimitedNoNoHold or return using validated aiding
Imaging sonar lostYesLimitedNoNoReturn or wait
One side camera lostYesYesLimitedLimitedSupervisor decision
Both command links lostLimitedNo new taskNoNoHold or return
One propulsor lostLimitedNoNoNoControlled return
Cassette state mismatchYesYesNoNoIsolate fault
Hydraulic overtempYesYesNoNoCool or return
Safety controller faultNoNoNoNoInhibit motion

The degraded mode matrix, in full.

Read down the Acquisition column and every entry is No. Nothing on that list leaves the machine able to touch an object; the only argument is whether it may still transit, still survey, or has to be brought home. Note what a lost link does not do. It does not stop the vessel dead in a traffic lane. It holds or returns and takes no new task, because a vessel that cannot be supervised still has to be one other traffic can predict.

Doctrine
Seen, and answering. Supervised, and never dependent on the link.

A surface vessel in a controlled water area has to be visible and has to respond, so this one carries radar, AIS and a command link and uses them. The safety case is built the other way round: the geofence is enforced independently, propulsion permission sits with the safety subsystem, and every degradation has a written destination. The fleet's four-domain doctrine is on the doctrine page.

Power and propulsion

Two Propulsors, One Bus,
and a Rail That Outlives the Rest.

Hybrid-electric: two independent electric propulsors on independent drives, a high-voltage DC main bus, a battery buffer, genset generation, isolated 48 V and 24 V auxiliary rails, an essential 24 V uninterruptible supply, and shore charging.

The reason for electric drive here is not efficiency, it is control. Fine low-speed torque control is what station keeping is made of; decoupling the generator from the propulsor means the thing that makes power and the thing that makes thrust need not agree about speed; and an autonomous command path is far simpler to write against a drive than against a transmission. It also permits low-noise mission phases, which matters more than it sounds: cooling pumps, fans and hydraulic components have to be evaluated for vibration and acoustic interference with underwater perception, because the machine's own noise competes with the sonar it is trying to hear.

LoadContinuousPeakDutyDomain
Port propulsion35,000 W75,000 W0.55Main HV
Starboard propulsion35,000 W75,000 W0.55Main HV
Mission hydraulic power unit12,000 W30,000 W0.25Mission HV/AC
Mission and perception compute1,800 W2,800 W1.048 V
Sonar suite850 W1,500 W0.948 V
GNSS/INS/DVL/radar/AIS500 W900 W1.024 V essential
Communications450 W900 W1.024 V essential
Growth reserve9,000 W15,000 W1.0Allocated

Selected lines from the power budget. The duty column is why a peak is not a size.

Two lines carry the shape of the budget. The mission hydraulic power unit is 12,000 W continuous at a duty of 0.25: a large consumer that is mostly not consuming, which is what a machine that spends its time holding still and its moments moving looks like. And the growth reserve is 9,000 W carried as a line item, on a budget where the navigation fit draws 500 W and communications 450 W.

The other discipline is physical segregation: high-current motor and inverter wiring is separated from sonar, GNSS, analog sensors, Ethernet and safety I/O. The essential 24 V uninterruptible rail is defined by what has to outlive everything else: the safety controller, essential navigation state, command telemetry, bilge and fire monitoring, the event recorder, and enough left to shut down under control.

A split waterline under a container berth: above, a container ship alongside with quay cranes behind it; below, a forest of barnacled piles over a rubbly seabed with a dozen translucent CS-320 bells standing and hanging among them in the green light.
Around it

The Family Under It,
and the Footprint Behind It.

The vessel is one machine in a family that already works under water, and the near end of a shore arrangement that has to exist before it is ever launched.

The Water family does the swimming. CS-310 is the survey-and-carrier hull, working legs of tens of kilometres with no radio and no GPS because the sea forbids both; CS-320 is the soft-bodied creeper it carries out and releases for the last, quietest leg. KMM-01 is the surface machine that carries the corridor, the cassettes and the lift, and comes home with the objects aboard and the record beside them. All three sit on the Water family page.

Launch and recovery are traded rather than assumed: travel lift, launch cradle, heavy trailer, and crane lift only if a dedicated certified lifting design is provided. That is the right order to put the four in. A disabled vessel is recovered on a written sequence: secure the mission module, secure the cassette latches, isolate propulsion as required, keep essential bilge and telemetry power alive, attach an approved tow bridle, and tow inside a validated speed and sea-state envelope. Essential power stays alive through a tow because a dead tow is a blind tow.

Shore is a footprint rather than an afterthought: a berth or stand, shore power, the remote station, spares, washdown, a mission-module stand, cassette cradles and diagnostic tools. Maintenance runs on three levels: operator and mission support, field service, and depot for propulsor overhaul, structural repair and major battery or genset work. Every mission ends the same way: intake and transfer-path inspection, cassette state reconciliation, a bilge check, sensor-window cleaning, an emergency-stop proof check and a log export.

Fit

Who Buys a Boat
Drawn With Nobody On It.

The vessel suits a customer with a defined water area, a survey problem, and objects that have to come out of it. It suits nobody looking for a machine that decides.

WHO IT IS FOR

Customers with water they control

  • A naval or coastal-security authority clearing a defined water area of foreign objects, with a surveyed perimeter and a named supervisor watching the work
  • A port or harbour authority working piles, berths, channels and approaches, where the survey and the lift are the same job on the same day
  • A mine action or humanitarian program needing submerged survey and benign recovery without putting a person into the area
  • A civil operator clearing foreign objects from an intake, a channel or a dam approach, where the object is inert and the water is the hazard
  • A buyer weighing sovereign uncrewed marine capability, engineered in Canada and supported from a shore footprint they hold themselves
WHAT IT IS NOT

In every configuration, for every customer

  • Not a live-ordnance system. The acquisition, transfer and cassette engineering is defined around inert surrogate objects, and specialist work sits behind a separate interface
  • Not a machine that decides. Each candidate-object interaction is explicitly approved by the remote supervisor
  • Not crewed, and not crewable. There is no wheelhouse and no accommodation, because neither was ever drawn
  • Not link-dependent. Both command links lost is a defined state that holds or returns the vessel and takes no new task
  • Not a munition, and not armed. No warhead, no fuze and no energetic material, in any configuration
  • Not an offer. Nothing on this page is an offer, and no price is quoted anywhere on this site
The conversation

The Water Area Comes First.
Then What Has to Come Out of It.

If you hold a water area with objects in it and no safe way to reach them, the conversation starts with the corridor between the hulls and the person who approves each lift.

A first exchange is a screened enquiry, not a quotation. Bring the water area and its perimeter, the depth band and the bottom, the current and the traffic, and what the objects are; we bring the hull, the corridor, the cassettes and the supervision arrangement between them. Enquiries are screened, counsel comes first on any international transfer, and permits are taken per shipment. The Water family is the two programs and this configuration side by side, the clearance carrier works the same problem on ground, and who it is for is the buyer's view.

Start a screened enquiry → Who it is for Government and ministries

All Water family designs are patent pending; international transfer is export-controlled and subject to Canadian government permits taken per shipment, and nothing on this page is an offer.