Autonomous Underwater Vehicles and the Quiet Systems Engineering Revolution
The surface is calm. The engineering problems are not.
Autonomous Underwater Vehicles have been research instruments for decades. Institutions like Woods Hole Oceanographic Institution, MBARI, and MIT Sea Grant built AUVs to map the seafloor, sample water columns, and place instruments in places human divers cannot safely reach. Those platforms were engineered for controlled deployments: known transit corridors, planned recovery windows, and research teams willing to accept mission loss as an acceptable outcome.
That calculus is changing. The U.S. Navy’s large unmanned undersea vehicle programs, commercial offshore energy operators deploying inspection AUVs at scale, and defense primes competing for autonomous mine countermeasures contracts are all building platforms where mission loss is not acceptable — and where the operational environments are far more demanding than anything a university research program faced.
The systems engineering challenges that were manageable at research scale are becoming acute. Denied communication environments. Extreme pressure and corrosion constraints. Verification regimes that cannot lean on hardware-in-the-loop testing the way aerospace or automotive programs do. And layered autonomy stacks that must make safety-critical decisions without a human in the loop or even within communication range.
This is the quiet systems engineering revolution in underwater autonomy — and most of the serious work is happening away from the conference presentations.
The Communication Denial Problem Is a Requirements Problem
Underwater radio communication is effectively unavailable beyond very short ranges. Acoustic modems provide low-bandwidth, high-latency links that are sensitive to ocean layer conditions and are frequently interrupted. In practice, an AUV operating in a contested or deep-water environment should be designed assuming it will receive no external input for the duration of its mission.
This creates a systems engineering constraint that has no real equivalent in aerial or ground autonomy: every decision the vehicle will make must be captured in the requirements baseline before deployment.
In aerospace programs, requirements for autonomous behavior typically describe responses to defined failure modes. In underwater autonomy programs at the defense tier — programs like the Navy’s Orca XLUUV or Boeing’s Echo Voyager lineage — the requirements must specify behavior across a far wider decision space: how the vehicle responds to unexpected contacts, how it prioritizes mission objectives when conditions diverge from planned parameters, when and how it initiates abort and recovery, and how it handles onboard system degradation without external diagnosis support.
Writing those requirements well is hard. Writing them in a document-centric tool that doesn’t expose the relationships between mission behavior requirements, sensor requirements, fault detection requirements, and vehicle state requirements is harder. Engineers at several defense programs have described the challenge informally: by the time you trace a behavioral requirement back through sensor coverage, navigation accuracy, and propulsion reliability to a hardware specification, you’ve crossed eight or ten document boundaries in a traditional requirements management environment. Miss a link and you’ve created a safety gap that won’t surface until a mission debrief — if you get the vehicle back.
The implication for requirements tooling is concrete: underwater autonomy programs need tools that model requirements as a connected graph, not as a hierarchy of documents. The interdependencies are not linear. A change to the acoustic modem performance specification has implications for mission abort logic, for collision avoidance behavior, and for the battery budget allocated to emergency recovery. Document-based tools make those connections invisible.
Pressure, Corrosion, and the Constrained Design Space
Underwater vehicles operate in an environment that is actively hostile to every major subsystem category. Pressure increases by one atmosphere every ten meters of depth. Seawater is corrosive to most metals, conductive in ways that create galvanic coupling problems, and biologically active in ways that foul sensors and thruster assemblies. Temperature gradients across the water column create condensation inside housings that are repeatedly opened for maintenance.
The design space for underwater electronics and mechanical systems is therefore much smaller than terrestrial or aerial equivalents. This is not a new observation — it is a foundational constraint that every AUV program has navigated. What is new is the scale at which programs are now trying to navigate it.
A research institution building a single AUV optimizes its design around what it can manufacture and test in-house, accepting constraints as features. A defense prime building a fleet of large UUVs for operational deployment must write procurement specifications that define depth ratings, pressure vessel certification requirements, connector standards, materials restrictions, and corrosion protection requirements — and those specifications must be traceable to every subsystem and component selection the supplier delivers.
The mechanical-electrical-software integration challenge is particularly acute for AUVs because the pressure vessel boundary is also a functional boundary. Electronics that must be inside the pressure hull for protection cannot communicate with external sensors through anything except penetrators designed to specification. Every penetrator is a potential failure point. Every cable routing decision affects the structural analysis of the hull. Software requirements for sensor sampling rates and data storage cannot be written without knowing the connector and cable harness specifications, which cannot be finalized without the structural analysis, which depends on the depth rating requirement.
This is not a theoretical systems engineering challenge. It is the daily reality of AUV development programs, and it is why several programs have reported that their most significant schedule risk is not hardware fabrication but requirements churn: changes that propagate through mechanical, electrical, and software domains faster than document-centric requirement baselines can track.
Verification in an Environment You Cannot Easily Replicate
Aerospace programs verify autonomous systems through hardware-in-the-loop simulation, iron bird testing, and incremental flight test campaigns. Ground vehicle programs use proving grounds and controlled test courses. Underwater programs have fewer options and they are all expensive.
Pressure testing at operational depth requires either a hyperbaric facility or open-water testing at depth — both of which impose significant cost and scheduling constraints. Acoustic environment testing requires open-water conditions that replicate the target operating area, because acoustic propagation in a test tank is not representative of deep-water or littoral environments. Biofouling accumulation takes time that schedule-driven programs don’t have. Current and surge loading in a test tank does not replicate open-ocean dynamics.
The result is that underwater autonomy programs must rely more heavily on analysis and simulation for verification coverage, and the quality of that coverage depends directly on the quality of the requirements that drive the verification cases.
Programs that have written requirements with incomplete specificity — particularly for behavioral requirements governing autonomous decision-making — find that their simulation environments validate the behavior they modeled rather than the behavior they intended. This is the underwater equivalent of a software test suite that validates implementation rather than specification. If the requirement doesn’t clearly define what the vehicle should do when its primary navigation system degrades to below-threshold accuracy at a depth where acoustic positioning is unavailable, neither the simulation nor the eventual open-water test will catch the gap in the right phase of development.
The verification gap is compounding as autonomy stacks become more capable. Early AUVs ran mission scripts. Modern platforms run behavior trees, model-predictive controllers, and in some cases learning-based components that generate emergent behaviors. Verifying those systems against requirements written for scripted mission execution creates a category error that several programs are currently working through.
Research institutions have historically been willing to treat open-water testing as the primary verification environment, accepting mission loss as informative. That approach is incompatible with defense acquisition requirements and commercial operational risk profiles. The programs scaling to operational deployment are being forced to develop verification strategies that don’t exist in mature form yet.
How Different Actors Are Approaching This
The underwater autonomy sector is not monolithic. Defense contractors, ocean tech startups, and research institutions are approaching these challenges with different tools, different risk tolerances, and different engineering cultures — and the differences are instructive.
Defense primes working on XLUUV-class programs and autonomous mine countermeasures platforms are applying aerospace-derived systems engineering process to underwater autonomy. That means model-based systems engineering methodologies, formal requirements management, and safety cases built on established frameworks like ARP4754 adapted for maritime applications. The discipline is appropriate given the safety and security stakes. The challenge is that tools built for aerospace requirements management — structured around document artifacts and hierarchical decomposition — are not well matched to the interdependency density of underwater autonomy systems. Programs are investing significant engineering effort in maintaining traceability manually, which is expensive and error-prone.
Ocean tech startups — companies like Saildrone on the surface, or subsea-focused ventures building inspection AUVs for offshore energy — operate with smaller teams and more compressed schedules. They are more likely to adopt modern SaaS tooling and more willing to experiment with AI-assisted requirements development. The risk is that process discipline can be sacrificed under schedule pressure, and in underwater autonomy programs, the gaps created by informal requirements practices surface during the most expensive phases of development.
Research institutions remain the source of foundational work on autonomy algorithms, novel sensor modalities, and mission planning. Their requirements practices are often informal by commercial standards — which is appropriate when mission loss is acceptable and iteration is the goal. The challenge comes when institutional platforms transition toward operational deployment, as several Woods Hole and MBARI spinout programs are now doing: informal requirements practices don’t scale to the verification rigor that commercial or defense customers require.
Where Modern Tooling Is Making a Difference
The most significant tooling shift in underwater autonomy programs over the past two years is not in simulation or autonomy frameworks. It is in requirements management — specifically, the move toward graph-based, AI-assisted tools that can model the dense interdependencies between subsystem requirements and surface the impact of changes before they propagate into hardware or software.
Flow Engineering, built specifically for hardware and systems engineering teams, has gained traction in several underwater autonomy programs for exactly this reason. Its graph-based requirements model exposes relationships that document-centric tools hide: the link between a depth rating change and its downstream effects on pressure vessel wall thickness, connector specifications, electronics thermal management, and battery chemistry selection. Its AI assistance accelerates the process of drafting behavioral requirements for autonomous systems — a task that is genuinely difficult when the behavior space is large and the communication link is denied.
For underwater autonomy programs, the practical value of this approach is in change management. When a program’s depth rating requirement shifts from 300 meters to 600 meters — a change that has happened in multiple programs as operational requirements evolved during development — the ability to immediately identify every affected requirement, every dependent design decision, and every verification case that must be updated is not a convenience. It is a program survival capability.
The deliberate trade-off in a tool like Flow Engineering is that it is specialized for systems requirements, not for the full PLM or document control ecosystem that large defense primes require. Programs operating under ITAR constraints with established configuration management infrastructure will need to integrate it into a broader toolchain rather than use it as a standalone solution.
An Honest Assessment
Underwater autonomy is scaling faster than the systems engineering practices and tooling that should support it. The gap is most visible in three areas: requirements completeness for autonomous behavior in denied environments, cross-domain traceability for tightly coupled mechanical-electrical-software design spaces, and verification strategies for environments that resist testing.
The programs that are navigating this well share a common characteristic: they are treating requirements engineering as a technical discipline, not an administrative process. They are investing in tools and methods that make interdependencies visible before they become problems, not after. And they are honest about what simulation can and cannot verify before open-water testing.
The programs that are struggling are, in most cases, applying document-based requirements practices to a problem that has outgrown them. The ocean environment does not forgive incomplete specifications. Vehicles that surface with failed missions or — worse — don’t surface at all are the feedback mechanism, and it is an expensive one.
The systems engineering revolution in underwater autonomy is quiet for a reason: the platforms operate in silence, the programs are often classified or competitively sensitive, and the failures are at the bottom of the ocean. But the engineering challenges are real, the consequences are significant, and the gap between current practice and what operational-scale programs require is closing faster than most of the field acknowledges.