Drifter Nine Goes Quiet: Finding a Lost Robot at Sea

Field Notes are Tidewright's own dispatches from our (fictional) restoration sites. All partners, programs, vessels and figures are Tidewright's own — illustrative of the model.

At 04:12 on a fog-flat Tuesday in August, Drifter Nine — mid-survey off Mendocino, three days into a line-laying reconnaissance run — stopped answering. Forty hours later a nine-metre solar-electric robot was hanging off our workboat's crane in a swell we had no business being out in, and three days after that we had the fault log open on a bench and the slightly sick feeling of people who had been warned. This is the note on how you lose an autonomous vessel, how you get it back, and what the boat told us once we found the shoulder to tap.

The vessel that doesn't call home

First, a sketch of how a Drifter talks. Each hull reports position, health and sensor summaries over satellite on a fixed cadence — every ten minutes at sea, tighter near the lines. A missed report means congestion or a flat spot in coverage; two missed reports makes the ops screen amber; at ninety silent minutes the vessel's own autonomy stack is supposed to execute a "safe-to" behaviour: finish the current survey leg, turn for a pre-agreed rally point, and loiter there transmitting a simplified health ping every minute on a separate low-bandwidth channel.

Drifter Nine missed a report, missed the next, and then the rally-point ping never arrived either. When the autonomy does the right thing, a lost vessel is a logistics problem. When it doesn't, a lost vessel is a search problem. We had the second kind.

The last good position put Nine on the seaward end of a survey grid above the northern barren edge, in forty metres of water, heading into a two-knot-flowing corner of coast where inside an hour a drifting hull can be any one of a hundred places.

The search problem

A solar hull with no drive and no comms drifts like a leaf with opinions: part windage on the freeboard, part tidal current, part whatever the hull last decided to do with its own propulsion before stopping. The ops team's first move is written in the manual and it works — build a drift box.

By 06:00 we had last-known state pulled from the cloud logs into a simple probabilistic drift model: 6-hour and 12-hour ellipses drawn on the chart, weighted toward the northwest-flowing inshore current, and inflated honestly for the fog that had shut down any visual search from the water. The 12-hour ellipse covered thirty-eight square kilometres, most of it kelp canopy and rock garden, which is exactly the kind of water a grey-on-grey hull hides in best.

Two assets turned the search from a lottery into a chore of patience:

• The shore camera network. Two volunteer-run coastal webcams on headlands bracket the survey area; both run a vessel-detection script one of our engineers maintains in his spare time. Cameras can't see through fog, but fog has edges.
• The drone. Once the ceiling lifted enough to fly, a mapping drone on lawnmower lines over the ellipse is worth a dozen binoculars. Canopy Ledger's aerial kit doubles as search kit — the same hardware that flies our annual drone canopy census — a sentence we have now officially added to the program's operations budget.

The break came at hour twenty-one: the northern headland camera caught twelve frames of something low and pale crossing a tidal race, in a one-hour gap in the fog, matching Nine's hull form within the camera's rough confidence. It was two kilometres outside our modelled ellipse — which told us immediately something was still pushing the boat. A drifting hull doesn't outrun current. A hull with live propulsion and a confused navigation stack does.

Recovery day

The catch plan for a vessel you can see but not command is embarrassing in its simplicity: get there before dark, get a line on it, argue about liability later. The workboat took two crew and the long gaff out on a building afternoon swell, on what I will describe only as enthusiastic boating.

Here is what nobody tells you about recovering a robot at sea: it does not help. A well-found boat cooperates because it was built to. An autonomous hull in a faulted state is nine metres of slippery, uncooperative geometry with no handholds, because handholds invite people, and the whole design premise is that people are somewhere else. We got alongside on the third pass, threaded a lifting strop through the bow fairlead with the gaff, and had the crane on it inside twenty minutes. Statistically, recoveries like this take a lot longer on worse water. We were lucky with the window, and I have written lucky in the incident report where it belongs.

Nine came up streaming eelgrass from one prop — a detail that mattered later — with its solar deck grey with salt film and its camera mast filmed green. It looked, honestly, like something the sea had finished with. The sea had been charging its batteries the whole time; the battery state at recovery was 71%. The robot was not stranded. It was lost in a way it could not detect.

What the fault log said

Back on the bench, with the hull jacked and the covers off — the same disassembly ritual as refit day on Drifter 7, but with the emotional register of a post-mortem — the log told the story in order:

1. Entanglement at 03:58. Starboard prop current draw spiked for forty seconds — the eelgrass — then cleared. The thruster did its job and survived. But the event descriptor went to the navigation stack, which conservatively re-planned the leg around a hazard that no longer existed. Harmless on its own.
2. A 4-degree compass offset, logged at 04:01. Probably propagated from the re-plan's heading buffer wrapping during the entanglement wobble. Four degrees is nothing on a short leg. Over forty hours, four degrees is kilometres — that is how a hull outruns its own drift ellipse.
3. The comms brownout at 04:12. The satellite modem, asked to report a growing exception list, hit a retry-loop bug we had seen once in bench testing and dismissed: past a certain queue depth the modem firmware stops transmitting entirely and waits for a power cycle nobody is aboard to give. This is the single item in the log that was ours, plain and simple — a known bug, shipped anyway, because bench incidence was one in thousands of hours.

The autonomy stack was, in a grim way, working perfectly: it knew its own position (GPS was fine), it knew something was wrong (the exception list), and it kept surveying a grid that drifted steadily off the real reef — because the fault design assumed comms as the fallback, and the comms were the fault.

What we changed

Three changes, all live on the fleet now:

• Modem watchdog. A hardware supervisor that power-cycles the comms module on its own after sixty silent minutes, no software permission required. The fix we should have shipped first.
• Dead-reckoning honesty. Navigation now tracks accumulated heading uncertainty and, past a threshold, abandons survey work for the rally point before depending on a comms link to escalate. Lost-quiet beats lost-busy.
• The window plan is a fleet plan. Search assets — headland cameras, the drone, the workboat crane — are now written into survey plans the way spares and weather days are, because the incident taught us the recovery was not improvisation: it was capability we hadn't admitted we were relying on.

Nine is back on the water as of last week, surveying the same grid it left, with a new modem and, I'd like to think, a dented sense of professional pride. The survey it completed while lost produced four square kilometres of beautifully detailed sonar of absolutely the wrong seabed — we kept the data, because the ocean does not care why you were looking, and somewhere in those files is the kind of anomaly that turns into next season's site.

Key takeaways

• An uncommandable autonomous vessel is a search problem, not an engineering problem — drift models, shore cameras and drones found Nine, not better software.
• Small navigation errors (a 4-degree compass offset) compound into kilometres over a day and a half; a drifting hull with live thrusters outruns its own search ellipse.
• The root cause was a known, dismissed bug: a satellite-modem retry loop that silenced comms exactly when comms were the designed fallback.
• The fixes: a hardware comms watchdog, explicit heading-uncertainty limits, and search capability written into every survey plan from now on.
• The lost-hours survey data was kept. Four square kilometres of the wrong seabed is still four square kilometres of mapped seabed.

FAQ

How does a Drifter normally report its position?

Each vessel reports position and health over satellite on a ten-minute cadence at sea, tightening near the lines. Missed reports trigger escalating alerts, and the autonomy stack is supposed to divert to a rally point and loiter with a simplified ping — the behaviour Drifter Nine never executed.

How do you search for a missing autonomous vessel?

Start from the last good state, build a probabilistic drift box from current and windage, then work it with whatever sees the surface: in this case two volunteer-run headland webcams with a detection script, and a mapping drone once the fog lifted enough to fly.

Were you worried about losing the vessel entirely?

Realistically, yes — a fog bank and a rising swell made the second day's search marginal, and a hull that founders unnoticed is both a cost and a navigational hazard. That's why search capability is now budgeted into survey plans instead of improvised.

Does the fleet operate without anyone watching?

Vessels run uncrewed but never unmonitored: a shore ops desk watches every active hull, and the alert ladder from one missed report to a full search response is drilled the same way fire and crew-overboard emergencies are. This incident tightened that ladder considerably.