BoatPlaySafety

Information and convenience. Never propulsion.

BoatPlay is an information and convenience layer. The boat computer can crash, reboot or lose the network and the boat still drives, still steers, and every critical circuit keeps its physical control. That is a design rule, not a disclaimer.

For boat builders Questions answered

BoatPlay is an information and convenience layer. Propulsion, steering and cutoff never depend on it.

The boat computer can crash, reboot or lose the network and the boat still drives, still steers, and every critical circuit still has its physical control. The software earns trust by being honest about what it is.

The phone never commands propulsionNor the main contactor. Those circuits are filtered out before anything renders; biometric failure can never block a hardwired path.
Protection lives in hardwareOver-current trips in the switching node itself, and a node that loses communication goes to a documented failsafe state — agreed with the electrical engineer first.
Charts are not for navigationCharts in BoatPlay are derived from official and community chart data, are not official nautical charts, and are not for navigation. Always navigate with official nautical charts.

Rules for the software

Written down, and tested.

Read-only on the propulsion bus. BoatPlay software may read propulsion data; it never writes to it.
Never software-in-the-loop cutoff. No propulsion cutoff, power cutoff or steering path runs through BoatPlay.
Never block the independent path. No software failure mode — crash, hang, bad update, lost network — can stand between the operator and a hardwired control.
No plausible-but-wrong data. A failed or degraded service shows itself as failed: stale numbers are dimmed and dated, never left looking fresh.
Alarms advise; hardware protects. The alarm engine tells you; the over-current trip in the switching node acts.
Commands are never queued. A switch command that cannot be delivered now is dropped and reported, never held and replayed later when nobody expects it.

Failure hierarchy

Three tiers, and one that must never happen.

01Informational onlyNobody’s convenience is even degraded; the record notes it.
02Degrades convenienceThe operator loses a display, an alarm or a remote view — and knows it.
03Must never happen by our actionAny failure that affects propulsion, steering or a safety cutoff. No BoatPlay software may be capable of producing one.

Immobilise from the app is a logged request with an explicit confirmation on the boat side, never an instant cutoff. A geofence breach is an alarm and a push, not an action.

Read the rest of the design.

The safety architecture, the data model and every product decision are written down in the open BoatPlay repository, and every rule above is pinned by a test.

Safety architecture Register for Helm