01 — The problem
The data is already there.
Nobody can reach it.
A modern recreational boat carries a live network of depth, engine temperature, oil pressure, fuel, RPM, position and dozens of alarm channels. Almost none of it reaches the person actually steering.
It's behind a menu
Reading any of it means taking your eyes off the water and navigating a proprietary screen, in different units, in different menus.
Connectivity ends at the ramp
Cloud assistants and app dashboards are useless where boating actually happens. Most consumer AI degrades to nothing without a signal.
The answer is in a manual
Oil specification, vessel draft, trim operation, local hazards, tide behaviour — spread across service manuals and local knowledge, none of it searchable at the helm.
One person, four jobs
A solo or family skipper is navigator, engineer, lookout and safety officer at once. Routine checks get skipped because there is no second pair of hands.
Language models confabulate. An assistant that invents a tide time, a depth reassurance or a battery state is not merely unhelpful — it is more dangerous than no assistant at all. AquaPilot was built around that problem rather than in spite of it.
03 — What AquaPilot is
Two computers. Two jobs.
One boundary.
A deterministic safety computer decides — with no AI of any kind on the wired alarm path. An AI co-pilot advises, on a box that is explicitly allowed to be switched off. Nothing that must be heard depends on the AI.
Decides
The deterministic layer. Owns the vessel data hub, the safety kernel and the monitors. Bridges the NMEA 2000 network. Contains no AI of any kind.
Advises
“Skipper” — the conversational co-pilot. Voice, local knowledge, tides, manuals, live readings. Runs entirely offline. Never touches a safety decision.
Accelerates
An optional workshop inference tier answers heavier questions faster when the boat is in range. Never required — the boat stands alone by design.
04 — How it stays honest
Most questions never
reach the model at all.
Every question is tested against a chain of deterministic handlers, cheapest and most certain first. The first one that matches answers from code, and the language model is bypassed entirely. Only genuinely open questions reach it — and even then it phrases facts it was handed, not facts it invented.
What that buys you
Determinism where it matters, and speed as a by-product. A guardrailed answer returns in under a second. It cannot hallucinate, because there is no model in the path to hallucinate with.
No sensor set can support a claim of safety. Skipper says “Mercury reports no engine alarms” — never “the engine is fine”. Every capability with a blind spot states that blind spot each time it speaks.
Detailed routing logic, handler design and the test corpus are available under NDA.
05 — What is built today
This is not a concept deck.
AquaPilot is installed and operating on its proving vessel. The full conversational loop has been validated live and offline aboard. Below is the honest status — including what is not built.
| Capability | Status | Note |
|---|---|---|
| Conversational co-pilot — wake word, speech, knowledge, guardrails | Built | Validated aboard, fully offline |
| NMEA 2000 bridge — 17 devices, twin plotters, engine gateway | Built | Installed aboard |
| Safety Kernel — anchor drag, depth, bilge, battery monitors | Built | Logic complete and tested; validation against live network data pending |
| First-of-day briefing, interactive checklists, catch marks, self-check | Built | Logged and archived |
| Engine, fuel and battery readouts across 26 Mercury alarm channels | Built | With staleness discipline on every reading |
| Trip recorder, maintenance register, barometric history | Built | Archived to private storage |
| Route handoff to the chartplotter | Transport proven | Import validated; the plotter remains the navigational authority |
| Remote inference tier with automatic local fallback | Built | Fallback demonstrated end-to-end |
| Wired Priority-1 alarm actuation | Not built | Awaiting hardware fit — the single step from safety monitor to safety system |
| Emergency workflows (man overboard, medical) | Drafted | Verbatim owner-approved procedures, gated behind full validation |
| Web dashboard suite (helm iPad and shore) | Designed | Six-phase build plan |
A garbled transcript once reached the model and it invented navigational advice. That is logged as the highest-priority open item rather than quietly accepted. A system that records its own failures is one you can trust the rest of. That discipline is the product as much as the software is.
06 — Local-first by architecture
Every rung is a working system.
Safety is identical on all of them.
The kernel never consults a model, so capability degrades gracefully while safety does not degrade at all. This is the property that makes AquaPilot deployable where Australians actually boat.
Nothing leaves the owner's network
Vessel data, voice, logs and position stay on hardware the owner physically possesses. No account, no telemetry, no third-party service in the safety path. In a category where “smart” usually means “sends your location to a vendor”, this is a substantive differentiator — and increasingly, a purchase criterion.
Commodity hardware, no cloud bill
The system runs on commodity computing hardware and open-source components rather than licensed marine software. There is no recurring inference cost per vessel in any safety function — a materially different unit economic to any cloud-dependent alternative.
08 — How it reaches other boats
Built for one boat properly,
before any claim of generality.
AquaPilot was deliberately proven on a single vessel to a real standard rather than demonstrated broadly and finished nowhere. That said, the pattern it establishes is portable — and the portability was designed in, not discovered afterwards.
The architecture is vessel-agnostic
It reads the NMEA 2000 standard that virtually every modern recreational boat already speaks. Adapting it to a new vessel is a configuration exercise, a knowledge-base rebuild from that boat's own manuals, and a curated local destination library — not a re-engineering project.
Installed by people already opening the dash
The natural channel is marine electronics installers and repower workshops. The system taps an existing network through a standard gateway; it does not require the boat to be rewired around it.
No cloud bill, ever
Commodity computing hardware and open-source components rather than licensed marine software. No per-vessel inference cost, no account, and no subscription attached to any safety function — by architecture, not by pricing policy.
Owner-operators first
Solo and family skippers on instrumented recreational vessels, where one person carries the navigator, engineer, lookout and safety-officer load at once.
Fleet, charter and hire-and-drive
Operators handing vessels to people who don't know them, where an assistant that reads the boat aloud and logs every trip answers a duty-of-care need rather than a convenience one.
The pattern generalises
“Deterministic code owns decisions; AI owns language” applies anywhere an assistant is useful but must never be load-bearing — remote industrial sites, agriculture, aged care, emergency services.
Not just the water. Anywhere the signal ends before the work does.
09 — Roadmap
Three horizons.
Each one earns the next.
Nothing ships until the layer beneath it is validated. That sequencing rule is the reason the product is trustworthy, and it is not negotiable for commercial reasons.
Complete the safety system and productise it
Fit the wired Priority-1 alarm path and close the input-quality guard. Verify depth datum and draft to lift the grounding interlock. Ship the helm and shore dashboards. Package the install so a second vessel is a configuration exercise rather than a rebuild.
Sensing, heads-up display and fleet
Bilge and fire detection wired to kernel inputs with named-zone announcements. AIS traffic with closest-point-of-approach — stating its blind spots every time. Fuel endurance and return margin. A heads-up display carrying continuous numeric readouts and hands-free procedures, with blank-on-stale behaviour as a hard requirement. Multi-vessel management for fleet and charter operators.
The boat starts to help you move it
Assisted docking, station-keeping and — under strict conditions — summoned movement within a marina. This is a different product class with a different risk profile and a different regulatory pathway. It is set out in full below, including what has to be true before a single line of control code is written.
11 — Why it is hard to copy
What a competitor
cannot clone in a quarter.
The safety boundary itself
A written, tested, version-controlled separation between what decides and what speaks — arrived at by surviving real failures, not by design review. Copying the diagram is easy; earning the judgement inside it is not.
The decision record
Seven governing records, including rejected proposals and the founder's own refused feature request. This is the artefact that lets a regulator, an underwriter or a partner audit the system — and almost nobody in this category has one.
Vessel and local knowledge
A structured, tiered knowledge base combining vessel documentation, local hydrographic knowledge and operational scenarios. Each new cruising ground is an asset that compounds.
The last mile is physical
Bridging a real vessel network, an engine gateway and a helm audio path is unglamorous integration work that software teams consistently underestimate. It is already done and documented.
Local-first is a wedge, not a constraint
Incumbent marine electronics vendors are structurally committed to cloud accounts and subscriptions. Building genuinely offline is against their business model — which is precisely why the position is available.
The trade-off we accept
Local-first means no fleet-wide telemetry by default. We trade the aggregated-data advantage for trust and sovereignty, and recover what we need through opt-in, owner-controlled sharing. It is a deliberate choice with a real cost, and we would make it again.
12 — What is still open
The list we keep,
and don't quietly shorten.
Every serious system has an open list. Ours is written down, prioritised, and published in the same document as the achievements — because a project that only records its wins is one you cannot calibrate.
| Open item | Position |
|---|---|
| Wired Priority-1 alarm actuation | The kernel decides and reports, but the wired alarm it would drive is not yet fitted. This is the single step that turns a safety monitor into a safety system, and it is the top of the list. |
| Input-quality guard | A garbled transcript once reached the model and it invented navigational advice — the one unsafe behaviour ever observed. Closing that gate so no unclear speech can reach the model is the second priority. |
| Depth datum and draft verification | Grounding and anchor-scope logic remain interlocked until the transducer offset and vessel draft are confirmed by wet test. Interlocked, rather than shipped on an assumption. |
| Kernel validation against live network data | Monitor logic is complete and covered by its own tests. Validation against the running vessel network, under way, is outstanding. |
| Second-vessel portability | Portability is designed in and argued for, but not yet demonstrated. Until a second boat is running it remains a claim rather than a result — and it is described that way. |
| Commercial data licensing | Weather and tide data are used under personal-use terms today. Any commercial deployment requires a registered commercial agreement with the relevant agency. Identified and sequenced, not discovered late. |
| AIS coverage honesty | Most vessels in these waters carry no AIS. Every AIS answer must state that limit each time it speaks. A quiet screen must never be heard as “nothing out there”. |
| Emergency workflows | Verbatim, owner-approved procedures are drafted and frozen, but deliberately gated behind sustained real-world validation of everything beneath them. Releasing them early would defeat their purpose. |
13 — Who is building it
Smart-Tech Enterprise
Solutions Pty Ltd
Satheesh Agatheeswaran — founder and principal engineer. Designed and built the complete system: vessel network integration, deterministic safety kernel, offline voice stack, knowledge layer and the governing decision framework.
Founder background, prior ventures and relevant credentials to confirm.
AquaPilot was built for one real boat, used by the person who built it, in the water it was designed for. Every design rule in this document came from something that went wrong on the water first.