Why this matters now
The UK government has said that artificial intelligence, autonomy and uncrewed systems "are no longer capabilities of the future". The Defence Investment Plan commits £5 billion to drones across the Royal Navy, the Army and the RAF, and creates a new Uncrewed Systems Taskforce (GOV.UK).
Buying the vehicles is the easy part. The harder questions are what a vehicle does when its link drops, how one operator supervises several platforms, how you know an on-board sensor can still be trusted, and how you prove afterwards what the vehicle did and why.
Orders and Actions On, for technology
Every soldier knows the pattern. Before a task, the commander gives orders: the mission, the limits and how it is to be done. The team also rehearses its Actions On: what each person does on contact, on a casualty, on losing comms or on reaching a checkpoint, so they can act at once without waiting to be told.
Espanaro applies the same discipline to uncrewed systems. The orders are the mission and its limits, set in WayForge and Consilium. The Actions On are signed playbooks loaded onto the platform: if this happens, and these conditions are true, do this, and nothing else. The platform acts on them straight away, even when the link is down. The commander stays in command, because every Action On was approved before the mission began.
| Military practice | Espanaro for uncrewed systems |
|---|---|
| Orders: mission, limits and how it is to be done | The mission, routes, areas and limits, set by the operator in WayForge and Consilium |
| Actions On: rehearsed drills for expected events | Signed playbooks on board: a trigger, its conditions and the permitted action |
| Act at once, without waiting to be told | The platform acts within its Actions On, even when comms are lost |
| Anything not covered goes back up the chain | Anything outside the playbook, or any drop in health, is stopped and referred to the operator |
| Post-operation report | A replayable record of every trigger, check, action and refusal |
How playbook-led semi-autonomy works
The platform does not decide what it is allowed to do. The operator does, in advance, in a playbook. The platform then carries out only what that playbook allows, and only while its health and your policy say it is safe to continue.
- DefineAn authorised operator writes or selects a playbook: the triggers, the conditions, the permitted actions and the limits, such as area, speed, time and comms state.
- Sign and loadThe playbook is signed and loaded onto the platform. The Espanaro Edge Runtime checks the signature, and checks the identity of every device on every message.
- MonitorOn board, Pulse Sentinel tracks platform and sensor health as Continue, Degraded, Abort or Recover, alongside comms state and Cognisight detections where fitted.
- Act within limitsWhen a trigger fires and the conditions are met, the platform takes only the permitted action, such as hold, return along an approved route, or continue a survey.
- Refer upAnything outside the playbook, or any drop in health, is stopped and referred to the operator through Consilium.
- RecordEvery trigger, check, action and refusal is logged on board and synced when the link returns, so the mission can be replayed.
What runs on board, and what runs above it
| Where | Component | What it does |
|---|---|---|
| On board | Espanaro Edge Runtime | Runs signed playbooks at the edge and checks device identity on every message |
| On board | Pulse Sentinel | Scores platform and sensor health, and moves the platform between Continue, Degraded, Abort and Recover |
| On board | Cognisight (where fitted) | AI detection on the platform's own cameras and sensors |
| On board | ByteHarbour and HarbourGuard | Protect sensor data with data-centric security and decide who it may be released to |
| On board | RibbonFlow | Lets on-board services find each other and connect over poor or changing links |
| Above | WayForge | Mission planning, routes and tasking for the fleet |
| Above | Consilium | The fleet picture, operator approvals, and sharing with other C2 systems |
| Platform | The vehicle's own control and safety systems | Supplied by the platform owner. Espanaro works alongside them and never bypasses them |
An example Action On: comms lost on a perimeter patrol
This example is illustrative. Every value is set by the operator, not by Espanaro.
| Playbook element | Example setting |
|---|---|
| Trigger | Link to the operator lost for more than 30 seconds |
| Conditions | Pulse Sentinel reports Continue, and the platform is inside the approved patrol area |
| Permitted actions | Hold position for up to five minutes, then return along the last approved route |
| Not permitted | Leaving the patrol area, planning a new route, or any action not listed above |
| If health drops | Stop, and wait for the operator |
| Record | Every step logged on board, then synced to Consilium when the link returns |
Built to keep a person in charge
Espanaro provides software authorisation and the evidence behind it. Physical safety stays with the platform and its owner.
| Espanaro does | Espanaro does not |
|---|---|
| Run only the actions an authorised operator has approved in advance | Make lethal or weapons decisions |
| Stop and refer up when health degrades or a request falls outside the playbook | Replace the vehicle's own safety systems, interlocks or emergency stops |
| Check the identity of every device and message on board | Claim physical safety certification. The platform owner holds the safety case |
| Record every action, check and refusal for replay and assurance | Tie you to one vehicle maker |
What we have already delivered on real platforms
Remote Monitoring of Sensitive Sites. In the Nuclear Decommissioning Authority's RMSS programme, an uncrewed ground vehicle delivered ISR into Espanaro's Consilium perimeter security system for more than 12 months, around the clock and in all weather (Espanaro on LinkedIn). The NDA describes the trial as a 12-month deployment of four companies' systems at its Winfrith site (NDA annual report).
A UK civil nuclear site. WayForge, our mission planning and tasking layer, was built around the needs of a UK civil nuclear site. It has been installed and proven on site, planning and controlling uncrewed ground vehicles through a partner's vehicle control system.
Both deliveries used WayForge and Consilium with an operator in control. Playbook-led semi-autonomy on board is the next step, built on the same stack, and is available for trials now.
Where it is used
Common questions
What do you mean by orders and Actions On for technology?
It is the same discipline a commander uses with people. Orders set the mission and its limits. Actions On are pre-approved drills for expected events, such as losing comms. Espanaro loads them onto the uncrewed platform as signed playbooks, so it can act at once within them and refers anything else back to the operator.
What is playbook-led semi-autonomy?
An authorised operator sets, in advance, what an uncrewed system may do: the triggers, conditions, permitted actions and limits. The Espanaro stack on board carries out only those actions, and only while platform health and policy allow, recording every step for replay.
Does it make weapons or lethal decisions?
No. Espanaro's semi-autonomy is for actions such as holding, returning, re-routing within approved limits and continuing a task. It does not make lethal or weapons decisions.
Which platforms does it work with?
It is platform-neutral and designed for uncrewed ground, air, surface and underwater vehicles. It runs alongside the vehicle's own control and safety systems on compact edge hardware.
What happens when the link to the operator is lost?
The platform follows the playbook the operator approved for that situation, for example hold and then return along an approved route. It never plans new actions of its own, and it logs everything for when the link returns.
Who is responsible for physical safety?
The platform owner holds the safety case, and the vehicle's own safety systems, interlocks and emergency stops stay in place. Espanaro provides software authorisation and the evidence behind each decision.
Has this been delivered?
WayForge and Consilium have been delivered on real uncrewed ground vehicles with an operator in control, including over 12 months in the NDA's RMSS programme and at a UK civil nuclear site. Playbook-led semi-autonomy on board is built on the same stack and is available for trials.
How do we start a trial?
Start with a discovery conversation about your platform, its control system and the situations you want it to handle. We then agree a small set of playbooks and trial them alongside your safety team.