The software is being rebuilt from scratch together with the 2026 control architecture. This page describes the architecture and the interfaces — what sits between the vehicle, the operator position and your own systems.
Which functions are available at which point, we will tell you for your project. We do without a feature list that has to be qualified in the first conversation.
The control concept is built in levels. The separation is not a matter of tidiness but the precondition for a learning function at the top not determining the conformity route of the entire vehicle.
Vehicle control and motor control — driving, steering, emergency stop, condition monitoring. Deterministic, with no learning components. This is where the functions run that safety actually depends on.
Creating and running routes, waypoints, tasks, repeat runs, connecting the payload. This is the layer on which a patrol or an inspection round comes into being.
Perception of the surroundings, mapping, evaluation of sensor data, anomaly detection. There is room here for your own methods — including yours, if you work in research.
Live image, sensor readings and mission planning at one workstation — for one vehicle or several. Plus the evaluation of whatever comes back from the rounds.
The EU Machinery Regulation 2023/1230, which applies on a mandatory basis from 20 January 2027, sets out a list of high-risk machinery in Annex I. Part A expressly covers safety components and machinery with fully or partially self-evolving behaviour based on machine learning approaches that ensure safety functions.
For those categories the regulation prescribes the specific conformity assessment procedures of Article 25(2). And the term safety component expressly includes software: Article 3(3) defines it as a “physical or digital component, including software” intended to fulfil a safety function, whose failure or malfunction endangers the safety of persons.
The architecture follows from that: safety-related functions stay deterministic on the vehicle layer. Learning methods work above it, on a layer that cannot make the vehicle unsafe. Whether a planned function crosses that line belongs at the start of a project — that is what engineering and conformity sorts out.
An island solution would be the worst outcome for you: a vehicle that talks only to one manufacturer’s software. Two ecosystems matter here, and we align with both.
The point behind it is simple: an operator who entrusts us with a fleet should be able to keep running it later without us.