Physical Intelligence · Marine
Steady in the deep.
Jean held a 6-DOF underwater vehicle on station — within ±0.5 m depth and 1.0 m horizontal drift — for 363 s against a 120 s criterion. Median drift 0.042 m. Five of five designed fails correct. No training, no learned policy.
New · September 2026 · Inspection mission
A full inspection, no human in the loop.
A BlueROV2-class vehicle, in a simulation of a tidal current at the west end of Carquinez Strait, descends, measures the water's density from its own rate of rise, transits to a structure, holds station against the current, sweeps 8.871 m up the structure face, refuses to go below its floor margin and records what it therefore did not inspect, then returns home and surfaces. Ten phases. 328 seconds. Clean exit.
Every number is scored against simulator ground truth, not against what the vehicle believes. Five predictions are printed above every flight; two failed in the final run, and both failures are in the report. Getting here surfaced over a hundred defects — among them a decision layer that, for the life of the project, scored every option identically while a stale regulator flew the vehicle. It is published in full, because underwater no one is watching to notice.
Before moving the autonomy onto the vehicle, we measured the control path over a wide-area link: p99 latency was 152% of the 100 ms loop budget. The loop cannot close remotely. Autonomy has to live on the vehicle — the local-first thesis, measured rather than asserted.
Gazebo + ROS 2 · BlueROV2-class vehicle · site from USGS WRI 92-4064. This is a SIL. No physical hardware. It does not claim real-hardware performance.
Methodology & Results v1.0 · August 2026
The same engine, pointed at the deep.
Jean's reasoning layer ran inside the loop. Vehicle dynamics, hydrodynamics, sensor simulation and rigid-body physics were provided by Gazebo Harmonic and the DAVE/REXROV model — none of which Jean authored.
ROS 2 Jazzy + Gazebo Harmonic · AWS EC2 x86-64 · independent physics. This is a SIL. No physical hardware. It does not claim real-hardware performance.
What this evaluation tests
One engine. A new substrate.
Jean was built to close the educational achievement gap. Its architecture is a deterministic mathematical reasoning stack, not a trained model. The architectural claim — validated across education, cybersecurity, clinical reasoning, sensor fusion and robotic manipulation — is that the same engine generalises across substrates without being rebuilt for each.
This SIL tests that claim in a substrate with properties the robotics work did not have: a continuously acting disturbance, a plant that must be characterised before it can be controlled, and a task where the correct answer is sometimes to do nothing.
The edge of a SIL
What it can prove is whether the decision and control logic is sound against an independent world. What it cannot prove is real-hardware performance — a separate, later category.
Architecture under test
Jean retained only the decision layer.
Everything she reasoned about was provided by independent, non-authored software.
Independent — not authored by Jean
- Physics and hydrodynamics: Gazebo Harmonic, with the DAVE/REXROV work-class ROV model. Jean never received ground truth about forces.
- Sensors: simulated DVL, depth, pressure and IMU, published through a ROS 2 bridge Jean did not write.
- Actuation: the vehicle's own wrench interface.
Jean's layer
- POWELL — fusion quality
- CFADS — authority assessment
- BARCA — response selection
- RANDOLPH — intervention timing
The regulator is deterministic and stays deterministic. Jean decides whether to intervene, at what authority, and at what moment; a PID executes. This mirrors the robotics SIL, where CARVER selects the grasp and MoveIt executes it. Jean does not compute inverse kinematics there and does not compute PID arithmetic here.
Method
No layer built above an unverified one.
| Phase | Scope | Exit criterion |
|---|---|---|
| 0 | Actuation verified, vertical plant measured | Commanded force produces its intended effect |
| 1 | Depth axis alone | ±0.5 m for 120 s, three runs |
| 2 | Horizontal plant, then both axes | Depth AND drift simultaneously, 120 s |
| 3 | Jean's decision layer replaces the fixed policy | Performance comparable, decisions logged |
| 4 | Designed fails | Zero false attempts, zero false refusals |
This structure was not the original plan. It was created after four days of Gate 2 work established that the plant had never been characterised.
Honest verdict logic
Verdicts are decoupled from whether an action was taken.
Pass
RefusedCorrectly
Impossible task, refused, reason matches.
Flagged
RefusedWrongReason
Refused, but for a reason that was not the true one.
Fail
FalseAttempt
Impossible task attempted. The marine equivalent of a false success.
Pass / Fail
HeldStation / FalseRefusal
Achievable task accepted, or wrongly declined.
A pass requires zero FalseAttempt and zero FalseRefusal. Refusing everything is not a pass; neither is attempting everything.
Independence and determinism
Physics is Gazebo's, not Jean's. Sensors are simulated by software Jean did not write. Success is measured from vehicle position observed through the simulator's own odometry, not computed by Jean. The same inputs produce the same decision — a design property of a deterministic engine.
Statistical discipline
Every result is reported as N ≥ 3 runs with spread. This is not a convention; it was forced by measurement. Three runs of an identical binary once produced a 354% spread in drift and 398% in hold time.
The results · Phases 0–2
Three runs. Reported with spread.
Phase 0 — actuation and plant
# vertical plant — measured net buoyancy (trim) -7 422 N measured by bisection heave drag |F| = 3519|v| + 280412 v² residual 1109 N (~3%)
F_net/v|v| held between 263 000 and 307 000 across a 65 000 N range.
Phase 1 — Depth control on measured constants only.
Jean held an underwater vehicle at depth within ±0.5 m for three times the required duration — three runs agreeing within 1%, every constant measured on the plant, not assumed. The exit criterion was to hold depth within ±0.5 m for 120 continuous seconds across three settled runs, no saturation, every constant traceable. Here's what happened.
| Run | Samples | Median error | Within ±0.5 m | Continuous hold |
|---|---|---|---|---|
| 1 | 10,621 | 0.216 m | 94.3% | 376.7 s |
| 2 | 10,606 | 0.212 m | 94.0% | 355.2 s |
| 3 | 10,643 | 0.216 m | 92.0% | 352.6 s |
No saturation in any run. KD = 0 because the water itself supplies the damping — at 0.2 m/s the quadratic drag term alone opposes motion with nearly 12,000 N. No gain was chosen to make a test pass.
"The three runs agreeing to within 1% is itself the finding. Earlier in this programme, identical configurations produced 354% spread in the same measurement. The bench is now an instrument."
Phase 2 — horizontal plant and full station keeping
# horizontal plant — measured surge drag |F| = 14080|v| + 61718 v² residual 1458 N (~5%) sway drag |F| = 29895|v| + 43659 v² residual 3902 N (~13%) current ~0.014 m/s steady, ~616 N to null
The quadratic term is 4.5× lower in surge than heave; the linear term is 4× higher. The axes could not have been assumed alike.
| Run | Samples | Depth median | Drift median | Drift max | Hold |
|---|---|---|---|---|---|
| 1 | 9,412 | 0.146 m | 0.336 m | 0.779 m | 363.7 s |
| 2 | 10,077 | 0.266 m | 0.096 m | 0.231 m | 357.5 s |
| 3 | 10,299 | 0.250 m | 0.042 m | 0.080 m | 356.8 s |
Criterion: ±0.5 m depth and 1.0 m horizontal drift, 120 s.
Phase 2 · Run 3
Run 3 held maximum drift to 8 centimetres against a 1.0 m tolerance, and a current that would have carried the vehicle 4.2 m over the same window.
The results · Phases 3–4
Jean deciding — and refusing the impossible.
Phase 3 — Jean deciding
| Run | Samples | Decision changes | Depth median | In band | Hold |
|---|---|---|---|---|---|
| 1 | 9,441 | 68 | 0.221 m | 88.6% | 313.5 s |
| 2 | 9,456 | 72 | 0.208 m | 92.6% | 351.3 s |
| 3 | 10,057 | 67 | 0.225 m | 92.3% | 350.9 s |
Against the fixed-policy baseline of 363.7 / 357.5 / 356.8 s: statistically indistinguishable.
That is the correct result. Jean's reasoning does not outperform a tuned PID at a task tuned PIDs are good at; it matches it while producing an auditable record. A claim that reasoning beat tuned control here would have been the suspicious outcome.
Decisions were distributed, not degenerate — depth: CorrectSoft ~6 500, Hold ~2 650, CorrectHard ~365; drift: CorrectHard ~6 700, CorrectSoft ~1 700, Hold ~1 100. Zero Aborts, correctly: nothing in these runs was unachievable.
Phase 4 — designed fails
| Case | Expected | Verdict | Reason |
|---|---|---|---|
| C1 | hold | HeldStation | none |
| F1 | refuse | RefusedCorrectly | perception_insufficient |
| F2 | refuse | RefusedCorrectly | authority_insufficient |
| F3 | refuse | RefusedCorrectly | target_unreachable |
| F4 | refuse | RefusedCorrectly | perception_stale |
Every refusal came before acting, not as a mid-task abort — the stronger behaviour, since refusing at pre-flight costs nothing and risks nothing. Each carried its evidence:
# refusal evidence, as logged
F1 "position confidence 0.20 below floor 0.45"
F2 "authority 400 N below the 616 N required"
F3 "setpoint 110.0 m is below the seafloor at 94.0 m"
F4 "last fix 4.0 s old, limit 1.0 s"
The integration finding
Formulas need a currency.
The most transferable result of this evaluation is not a number.
Jean's formula stack is deliberately agnostic about units — the formulas are a structure for comparison. But a comparison requires a common currency, and the integration must supply it.
Four successive architectures failed on this point before the fifth worked. Each used dimensionless weights and costs, so their ratios were arbitrary:
- Hold cost 0.02 against CorrectSoft's 0.18 — a 10× denominator advantage chosen by nothing. Hold won from every state: 3 639 of 3 639 samples.
- Decision margins of 0.01 logged as reasoning when they were coin flips.
The fix was to denominate everything in newtons, because that is what the actuator speaks and what the plant model is written in:
value_N = P × (force avoided later) − (force spent now)
Holding is not free — the deviation persists and grows, so the force needed later is larger. Correcting spends force now to avoid spending more later. That is a genuine economic comparison, and its margin means something.
This principle generalises to any application where the formula stack meets a physical system.
The calibration journey
Four days of tuning above an unmeasured plant.
Reported in full, because it is itself evidence that the instrument is honest. Before Phase 0 existed, a station-keeping controller was tuned for four days. When the plant was finally measured:
| Constant | Assumed | Measured | Error |
|---|---|---|---|
| Trim feed-forward | −135 N | −7 422 N | 55× |
| Authority limit | 1 500 N | ~39 000 N | 26× |
| Quadratic drag | ~183 N/(m/s)² | 280 412 | ~1500× |
| Effective mass | 12 954 kg (inferred from an oscillation) | withdrawn | — |
The authority limit was a fifth of the force required merely to hold depth. KP = 250 N/m on a plant needing 26 000 N to move at 0.3 m/s commanded about 1% of what was needed. The loop was not underdamped or mistuned — it was barely coupled to the vehicle.
Why it worked
Every number came from the plant itself.
The controller holds depth because the forces acting on the vehicle were measured, not estimated — buoyancy by bisection, drag fitted to net force across a 65,000 N range with a 3% residual.
The proportional gain follows directly from that measured drag curve: a 1 m error commands ~3,000 N and closes at 0.1 m/s. The derivative gain is zero — the water damps the system better than any tuning could.
One constant, the effective heave mass, could not be separately identified at the achievable sample rate. We say so plainly rather than report the number the optimizer returned when it hit its bound — and the controller doesn't need it, because this plant is governed by drag.
# constants of record — all measured TRIM_N -7 422 bisection DRAG_C1 3 519 fitted DRAG_C2 280 412 fitted KP_N_PER_M 3 000 from drag curve KI_N_PER_MS 80 trim residual KD_NS_PER_M 0 water self-damps FZ_AUTHORITY 39 000 trim + closure m_eff not identified (not required) # prior assumed values, now withdrawn: trim, drag, authority wrong by 55× · 1500× · 26×
Where it actually broke
Every defect was at an interface.
An upstream defect in a published research model
DAVE's REXROV model gives each thruster joint the same <pose> as its child link. Since SDF joint poses are child-relative, each revolute axis sat ~1.1 m from its thruster and the links orbited as the propellers spun. Runtime geometry disagreed with the model by up to 1.64 m and 153°.
Patched, verified to 0.000°, and disclosed in code comments rather than silently worked around.
The actuation interface
The vehicle's persistent-wrench topic accumulates: every message stays applied. A controller publishing each cycle therefore applied the running sum of its entire command history — roughly 8 000 wrenches over a 300 s run. The instantaneous topic applies for one physics step, so at controller rates the force acts for under 1% of the time.
The workable pattern is to publish the delta against a tracked standing value. The accumulation that broke two days of work became the mechanism that made continuous force possible.
Reset transients caused three separate failures
set_pose teleports position and orientation but not velocity. Every run inherited momentum from whatever preceded it. This produced: unexplained Gate 2 variance; a 354% spread across three runs of an identical binary; and, in Phase 3, run 1 having more command updates than run 2 in every trial — 586 vs 81, 1250 vs 456, 920 vs 177.
Recorded in full — the test that lied
Our own harness reported a pass it hadn't earned. We caught it by reading the numbers.
The first version of our Phase 0 test harness printed "PHASE 0 PASSED." It was wrong. The vehicle had reportedly risen under downward force, and the total response across a 1,200 N swing was a rounding error — but the monotonicity check passed on noise that happened to be ordered. Two entirely different transports produced deltas of 0.0564 and 0.0548 — the same artifact.
"A gate that passes when it should not is a more serious defect than the bug it was built to catch."
Three defects: no minimum effect size, a detection threshold below the natural variation in the vehicle's buoyant drift, and a baseline measured at a different depth than the test. None of it was caught by the test. It was caught by a person reading the numbers and asking why a vehicle rose when pushed down.
The second false result
A Phase 1 diagnostic reported drag at 11 272% of applied force, because it differentiated two adjacent samples at 10 Hz. It reported 4.00 m/s where the true average was 0.14 m/s.
Standing consequence: every gate criterion must state a minimum effect size, not only a direction or an ordering.
We record this because it is the whole discipline: an instrument that has never been caught failing has not yet been tested. The constants this program now runs on superseded the earlier assumed values by factors of 55×, 26×, and 1,500×. Every one of those corrections came from refusing to trust a green checkmark.
Read this before anything else you quote
This is a SIL. No physical hardware.
It does not claim real-hardware performance.
What this is
A software-in-the-loop demonstration that Jean's deterministic architecture — with no training and no learned policy — decides whether, how hard, and when to act on a 6-DOF underwater vehicle in an independent simulator it did not author, holding station to 8 cm and refusing the impossible with zero false attempts.
What this is not
It is not a claim of real-hardware station keeping, nor of any platform-specific operational envelope, both of which remain future work with defined paths.
The method transfers; the coefficients do not.
Known boundaries
The operational envelope is REXROV's.
The drag curves were measured on an 1 862 kg work-class vehicle. Applying them to a 17 kg inspection-class ROV would be the same error this programme has already paid for. The method transfers; the coefficients do not.
Effective mass could not be measured.
With quadratic drag at 280 412 N/(m/s)², the vehicle reaches terminal velocity in about one second; mass governs only that window, and at the achievable ~10 Hz sample rate it contains roughly ten points. The estimator was validated on synthetic data and recovered known masses exactly, but railed against its search bound on the real plant. It is recorded as not identifiable and not required — the plant is governed by drag, and drag was measured well.
All refusals were caught at pre-flight.
The in-task abort path exists and is reachable, but Phase 4's faults were detectable before commitment. Mid-run fault injection is specified and unbuilt.
Position is odometry ground truth, not Jean's dead reckoning.
This was deliberate — it isolates the control law. Moving to her own estimate, with the estimate checked against truth every run, is the next step.
The controller was never the problem. It was commanding one percent of the force the vehicle required, through a path that summed its own history, against constants wrong by factors of fifty and fifteen hundred.
Every significant defect found across this evaluation was at an interface — frames, units, clocks, sensor semantics, transport — and every one of them reported success while doing nothing. The reasoning is rarely what breaks. The interface with reality is.
Who this is for
Built for the deep, where you can't send a person to check.
Subsea & Offshore
Control on measured physics
Station-keeping and depth-hold derived from the vehicle's own measured drag and buoyancy — not a policy trained in a pool that may not match your hull.
Defense & Maritime
Deterministic, auditable
Every control decision traces to a measured constant. Three runs within 1% means the behavior is repeatable — the precondition for trust in an environment you can't observe directly.
Researchers
Honest boundaries
We publish what we couldn't measure and why, the harness that lied, and the corrections that followed. The record is built to survive a hostile reader.
Investors
Subsea without the training moat
A second physical domain proven by the same small team, the same architecture — evidence that each new domain costs less than the last.
Start a conversation
The full phase records are available.
Raw per-run telemetry, decision logs, and all five phase records are available for independent review. If you want to verify the constants or the methodology, write to us.
The methodology
Marine Station-Keeping SIL — Methodology & Results v1.0
Substrate-invariant decision architecture applied to underwater station keeping. August 2026. Every phase, every run table, the designed fails, and the calibration journey in full.
Read the methodology (PDF)PDF · no registration
Write to us directly
Tell us your vehicle and your environment.
We respond personally — no sales process, no auto-responder.
Write to us →contactus@myasolutions.org · full phase records available on request
Want the raw data? Request per-run telemetry and decision logs