Sea · Mk 58 Mod 0 / Mk 72 Mod 0 · Autonomous Undersea Effector
Deadfall
A hundred and eighty days on the seabed at 105 milliwatts — and it cannot arm without a signed authorization that expires on a date certain.
Mission
Revenant LedgerHold a strait, a chokepoint or an approach with an effector that costs a fraction of a ship, needs no crew, no power and no attention for six months — and, this is the part that matters, can be laid without ending a career.
The United States has a naval mine inventory it is politically unable to use. So does most of NATO. The reason is not that the weapons do not work. It is that no combatant commander wants the headline, no ally wants an autonomous weapon in their exclusive economic zone that somebody else controls and nobody can audit, and no lawyer has ever been given an answer to the question of who decided, at the moment a six-month-dormant weapon woke up and fired.
DEADFALL is two variants of one architecture — a mobile heavyweight effector and an encapsulated seabed effector — built around the answer to that question.
Parameters
| Diameter / length | 533 mm / 6.12 m |
|---|---|
| Mass | 1,540 kg |
| Warhead | 190 kg PBXN-103, contact and influence |
| Launch | LEVIATHAN magazine by swim-out, submarine tube, STYX deck cell, or air drop |
| Transit / attack speed | 18 kt / 42 kt |
| Range | 32 nm at 18 kt; 6.4 nm at 42 kt |
| Guidance | Passive and active seeker, wake-homing, optional fibre-optic guidance wire to 24 km |
| Dormancy | 40 days bottomed — a larger propulsion pack costs more state-of-charge maintenance |
| Dormant power | 190 mW measured |
| Unit cost target | $1.4M |
| Capsule | 533 mm × 3.90 m, titanium Grade 5 |
|---|---|
| Mass | 780 kg |
| Effector | 324 mm swim-out vehicle, 44 kg shaped charge |
| Emplacement depth | To 480 m bottomed |
| Lay methods | LEVIATHAN conveyor (40 per payload fit), STYX chute, submarine tube, or by hand from a fishing boat |
| Terminal | 6.2 nm at 40 kt from the emplacement |
| Dormancy | 180 days at 105 mW — 454 Wh on a 1.10 kWh lithium thionyl chloride bus |
| Sensor head | Buoyant, on a 2.4 m tether above the sediment plane; burial depth inferred from tether tension |
| Arming | Rotary out-of-line safe-and-arm. No software path arms this weapon. |
| Post-expiry | 900 mW acoustic responder for 90 days off a reserved cell, so clearance is a survey and not a search |
| Unit cost target | $310k |
The 180-day power budget, done honestly
The requirement says under two watts. Two watts for 180 days is 8.64 kWh — roughly twelve kilograms of lithium thionyl chloride. It is a generous requirement, and meeting it is not the achievement. The interesting question is where the milliwatts actually go, and the answer is not where you would guess.
A classifying receiver cannot be always on, so the wake is tiered. Tier 0 is a mechanically resonant piezo stack tuned to the 40–400 Hz band where ship machinery lines live, rectified into a supercapacitor. It draws nothing — it harvests — and it trips a latching relay above roughly 96 dB re 1 µPa. It is also a dumb detector with a mechanical threshold: a whale, a seismic airgun and a container ship all trip it, and on a busy shelf we expect eight to twenty false wakes a day. The budget below assumes sixty, because building margin into the trigger model is cheaper than being right about it.
| Tier 0 · resonant detector | Always on, energy-harvesting, mechanical threshold — 0.00 mW |
|---|---|
| Tier 1 · line tracker | 2.5 s wake, 2 channels at 4 kHz, 2,048-point FFT, DEMON and LOFAR line extraction. 310 mW × 60/day — 0.54 mW |
| Tier 2 · classifier | 12 s, narrowband line set and blade cadence against the onboard library. 900 mW × 22/day — 2.75 mW |
| Tier 3 · track and decide | 120 s, array processing, track formation, modem in receive, ledger write. 6.4 W × 3/day — 26.7 mW |
| Housekeeping | MCU deep sleep at 65 µW, pressure/tilt/leak at one sample per minute, tamper accelerometer — 0.32 mW |
| Command window | One 40 s receive-only listen per day for a REVENANT MESH order — 0.51 mW |
| Commanded transmit | 6 s at 178 dB, 42 W electrical, limited to four per deployment — 0.07 mW |
| Sensing subtotal | 30.9 mW |
| Propulsion-pack SOC maintenance | 74.0 mW — and this is the line that dominates |
| Total average | 105 mW · 454 Wh over 180 days · 19× margin against the requirement |
The dormancy bus runs on lithium thionyl chloride, which self-discharges at about 0.7% per year at 20 °C and less on a 4 °C seabed. Over 180 days that is negligible. But the effector's propulsion pack is lithium-ion, and lithium-ion self-discharges at two to three per cent per month. Left alone for six months a terminal-run battery arrives at the fight at 82% state of charge, which is eighteen per cent off the terminal range, which is the difference between a hit and a miss. So the primary bus trickle-maintains it: 1.78 kWh × 18% over 4,320 hours is 74 mW — 2.4 times the entire sensing budget.
That is the finding. What makes a 180-day undersea dormancy hard is not listening. It is holding a battery at charge in the cold and the dark for half a year. It does not belong in a brochure, because it is not an achievement, it is an admission — and it is the number that governs the design.
And the power budget is not what actually kills a 180-day emplacement. In descending order of what has ended real seabed deployments: seal and connector life, which is why the capsule is titanium with no dissimilar-metal couples, anodes sized for 400 days, and a 40 µW conductivity cell watching the O-ring interspace so the weapon knows it is leaking before the leak reaches anything; sediment burial, which costs 6 to 14 dB of aperture and is why the sensor head sits on a tether above the mud; biofouling on the transducer face, about 3 dB by day 120 in warm shallow water; and the three-year magazine life before the weapon ever gets wet, which is a surveillance-lot problem and not a mission one.
Wake on signature — and both numbers, not one
Classification runs on three independent features, fused: narrowband tonals — shaft rate, blade rate, gear mesh, diesel firing rate, turbo-alternator lines, where shaft rate multiplied by blade count is close to a hull-specific pair; DEMON cadence, which recovers shaft rate and blade count directly and survives at lower signal-to-noise than the tonals do; and broadband spectral shape, which separates a diesel merchant from a gas-turbine combatant from an electric-drive vessel.
| Warship vs. merchant, SNR ≥ 6 dB | 94 % |
|---|---|
| Warship vs. merchant, SNR ≈ 0 dB | 71 % — the 94 % is the number that sells; this is the number that gets people killed, and it is why the authorization architecture below is not dressing |
| Classification range, merchant | 4–18 km at a 165 dB source level |
| Classification range, quieted combatant | 1.5–7 km |
| Why the spread | Sea state, sound-speed profile, bottom type and burial depth. This is a probability distribution, not a specification, and any vendor quoting a single number is quoting the best day they ever had. |
The legal unlock: why this one can actually be laid
Hague Convention VIII of 1907 is the only treaty written specifically about naval mines. It is 119 years old, it addresses automatic contact mines, and it requires that a mine become harmless when it breaks its moorings or when control over it is lost, and that belligerents record where they laid their fields. It has nothing coherent to say about a weapon that classifies its own target. The San Remo Manual of 1994 adds that mines must be recorded, must not cut neutral shipping off from the high seas, and must have a mechanism to render them harmless when they no longer serve a military purpose. DoD Directive 3000.09 requires appropriate levels of human judgment over the use of force — which, for a weapon dormant on a seabed for six months, is close to unanswerable by conventional design, because the human is not there when the decision happens.
Fantom's answer is to separate the decision from the authority, and to make the authority a cryptographic object with an expiry date.
01 · The interlock is metal
There is no code path that arms this weapon
DEADFALL ships, transits and lays with its initiation train mechanically interrupted — a rotary out-of-line safe-and-arm device physically misaligns the detonator from the booster. Moving it in-line requires a torque the arming actuator cannot produce unless the arm authorization validator releases a hard interlock.
Software cannot arm it. A corrupted mission plan cannot arm it. An adversary who owns the autonomy stack cannot arm it. The cryptography's only job is to permit a solenoid. That is deliberate, and it is why this argument is not vapour: the guarantee is a piece of metal.
02 · The authorization
A signed capability token, not a setting
A REVENANT LEDGER arm authorization carries the identity and delegated command chain of
every signing human; a 2-of-3 threshold signature, so no single person can
arm a minefield; the engagement polygon to 30 m; hard not_before and
not_after bounds; the target predicate the classifier must satisfy — for
example surface combatant, displacement over 2,000 t, not squawking an authorized
IFF, classifier confidence at least 0.92; a consumable maximum engagement count; and
the behaviour on expiry.
The token is loaded before lay, or delivered in-mission over acoustic mesh by an authenticated node. With no valid token the weapon is a sensor. It still listens, classifies, tracks, records and reports when interrogated — and it physically cannot fire.
03 · Expiry
A minefield that expires on a date certain is one an ally will let you lay
When not_after passes, the validator revokes the interlock, the safe-and-arm
rotates back out of line, and the weapon is permanently and mechanically a sensor. It then
reports, scuttles, or waits for recovery according to the token.
That is Hague VIII's render-harmless obligation and San Remo's no-longer-serves-a-military-purpose requirement satisfied by construction rather than by promise. It is the whole product. Everything above it is plumbing.
04 · Fail-disarmed
On every fault, always, in that direction
Expiry depends on the weapon knowing what time it is, six months in, on a
temperature-compensated oscillator. A clock running fast expires the field early, which is
annoying. A clock running slow leaves live weapons in the water past their authorization,
which is unacceptable. So the design fails toward expiry: the validator treats the token as
expired at not_after minus three sigma of accumulated clock uncertainty — for a
0.5 ppm oscillator over 180 days, a worst case of 7.8 seconds — and it re-disciplines the
clock at every authenticated contact.
And loss of the housekeeping clock's integrity counter for more than six hours forces disarm, full stop, irrespective of the token. A weapon that does not know the time is a weapon that disarms.
05 · The chart
The minefield record is a by-product of laying the field
Hague VIII Article 3 and San Remo both require belligerents to record where they laid mines. Historically those records are appalling, which is why clearance in the Baltic and the Gulf has taken decades.
Each DEADFALL-M knows its own emplaced position to about 30 m — from the laying platform's inertial solution at release plus an acoustic self-survey against its neighbours after settling — and signs that position into the ledger at emplacement. The field produces a tamper-evident, machine-readable minefield record as a side effect of being laid, and at the end of hostilities it is handed to a clearance authority as a file. To a mine-warfare officer that is worth more than any performance parameter on this page.
06 · The record
The minefield can be audited after the war
Every observation, every classification and its confidence, the token presented, the humans who signed it, the moment the safe-and-arm rotated in-line, the moment it rotated out, and — if it fires — the complete track and the classifier's confidence at the instant of release, are hash-chained inside the weapon and exfiltrated on recovery or on authenticated interrogation.
By a board of inquiry, by a treaty body, by a Congressional committee, by a plaintiff. A weapon that wakes up six months after the last human touched it should be able to say exactly what it saw, who authorized it and when that authority expired. This one can, and the record is signed where it cannot be quietly edited.
CONOPS
Phase 01 · Authorize
Before the weapon goes anywhere
Two of three named humans in the delegated command chain sign an arm authorization defining the polygon, the window, the target predicate and the engagement count. The token is loaded. Nothing about the weapon's hardware changes — it is still mechanically safe.
Phase 02 · Lay
Phase 03 · Dormant
Up to 180 days at 105 milliwatts
Tier 0 harvesting, Tiers 1 to 3 gated, one 40-second command window a day, and no transmissions at all. A mine that phones home is a mine you can find.
Phase 04 · Wake and classify
Four tiers, and every step written down
Tier 0 trips, Tier 1 confirms a propeller, Tier 2 classifies, Tier 3 forms a track. Every step is hash-chained whether or not anything follows it — including the ones where the weapon decided to do nothing, which are the entries an inquiry will care about most.
Phase 05 · Decide
Two tests, and both must pass
The classifier's output is tested against the token's target predicate, and the contact's position against the engagement polygon. If either fails, the weapon records and stays safe. If both pass and engagements remain, the validator releases the interlock and the safe-and-arm rotates in-line — for this engagement only.
Phase 06 · Engage
Swim out, ascend, run the terminal
The 324 mm effector runs 6.2 nautical miles at 40 knots. The full track and the classifier's confidence at the instant of release are signed into the chain before the effector leaves the capsule.
Phase 07 · Expire and clear
Then it becomes a survey problem
At not_after minus the clock margin the interlock is revoked, the safe-and-arm
rotates out of line permanently, and the unit becomes a sensor. Every expired unit runs a
900 mW acoustic responder for 90 days off a reserved cell, which turns clearance from
a search into a survey.
Why it is built this way
Every design decision on this weapon was made twice: once by an engineer and once by a lawyer, and the lawyer went first. That is not how ordnance is normally developed and it is the reason DEADFALL exists while a great deal of technically excellent mine warfare sits in a magazine in Yorktown.
The mechanical interlock is the clearest example. It would have been far simpler, lighter and cheaper to inhibit the firing circuit in software and audit the software. We did not, because a software inhibit is a claim about code and a rotary out-of-line safe-and-arm is a claim about geometry, and only one of those can be demonstrated to a sceptical reviewer in a room with the weapon on the table.
What is hard, stated plainly
| The catastrophic failure | A false positive against a neutral merchant. No architecture makes it zero. It is stated in the legal section above and it is stated again here because it deserves to be said twice. |
|---|---|
| Recovery of unexpended units | Four hundred expired DEADFALLs on a seabed are a clearance problem even when every one is mechanically safe. The 90-day responder is the mitigation; after 90 days it is a side-scan survey and a lot of ship time. |
| Shelf life before immersion | A three-year magazine life on a primary bus, in a weapon that must then work for 180 days, is a surveillance-lot problem we have not fully retired. |
| Sediment and fouling | Both degrade the acoustic aperture across the deployment. The detection ranges quoted above are day-one numbers and we say so. |
| In-mission token delivery | A 200 bps channel with a five-second latency and a probability of delivery well under one. If a token has to arrive after the field is laid, plan for it not to. Pre-loading is the primary path; mesh delivery is the exception. |
| Wartime key infrastructure | The token architecture requires a functioning signing authority. If it is destroyed, every laid field runs to expiry and disarms. Correct failure direction, real operational constraint. |
Related systems
All sea systemsGovernment & Primes
Request a DEADFALL briefing
The arm-authorization architecture, the safe-and-arm design disclosure, and the legal-review package prepared for weapons-review counsel are available to US government customers and allied ministries of defence under an executed agreement.
Request a briefing programs@fantom.aero
Every figure on this page is a design target derived from first-principles analysis. No test article exists and no design review has been held. No operational employment is implied. No export-controlled information is published on this site.