Attritable Is Not Recoverable

The conclusion is straightforward: price an autonomous machine by the useful work it can deliver after losses, recovery effort and replacement delays. A low acquisition price settles only one part of that calculation. The more consequential question arrives when the machine stops answering and somebody still needs the job completed.

The recent Dive-LD incident makes that question tangible. My ROV/AUV engineering background shapes the lens I bring to it: separate the vehicle, the mission, the support operation and the evidence. This article develops a civilian investment framework from public information. It offers no assessment of classified equipment, operational vulnerabilities or competing national capabilities.

What the public record supports

On September 8, Iran claimed to have captured a US underwater drone. A Pentagon spokesperson acknowledged an older vehicle’s malfunction and said it lacked sensitive data and classified sonar or radar. Reuters could not independently verify Iran’s capture account in that initial report. Its September 9 follow-up discussed the opportunity for technical examination; successful replication was not established. Initial Reuters report, Reuters follow-up.

Anduril advertises approximately ten days of endurance and a maximum depth around 6,000 metres for Dive-LD. Those are manufacturer specifications. They do not establish the configuration, endurance, failure cause or performance of the vehicle involved. Current procurement price, mission success rate and replacement lead time remain UNKNOWN in this analysis. Anduril product information.

That evidence supports a disciplined underwriting question. It cannot support a fleet reliability estimate from one loss. We lack the denominator: comparable attempted missions, operating conditions, successful returns and unsuccessful deployments. Investors should resist filling that blank with either enthusiasm for autonomy or disappointment at a dramatic photograph. A striking incident is a reason to request better records.

Three capabilities need separate accounts

Attrition tolerance means the organization can absorb a vehicle loss within its operational and financial plan. Recoverability means it can restore useful capability after a disruption. Control of post-loss risk means the consequences remain bounded when possession or operation cannot be restored. These are distinct capabilities in my proposed framework. A machine can score well on one and poorly on another.

Consider an illustrative commercial inspection operator. It may afford to lose a low-cost vehicle and still miss a customer’s inspection window because the replacement requires weeks of integration. Another operator may retrieve every vehicle through expensive intervention, preserve its equipment account and destroy its service margin. A third may replace hardware promptly while remaining unable to verify which inspection results were valid before the failure.

Each outcome creates a different investment question. What loss budget has been funded? What restores the contracted service? Which information and obligations survive interruption? A single adjective such as autonomous, resilient or attritable cannot answer all three. The operating model should assign each question an owner, an evidence requirement and an explicit economic consequence.

There is established engineering language behind this distinction. NASA describes fault management as covering prevention, detection, diagnosis, response and recovery around conditions that disrupt mission operations. NIST frames cyber resilience across preparation, endurance, restoration and adaptation. Neither source evaluates this incident or certifies my model. They support treating failure response as a designed system capability. NASA handbook, NIST resilience engineering.

Define the successful mission before counting machines

An investment committee needs a unit of useful output before it needs a fleet target. For a hypothetical infrastructure inspection, that unit might be an accepted survey of a specified area, delivered within a customer window and meeting a documented data-quality threshold. Launching the vehicle, recording operating hours and returning to the dock are intermediate events. None alone proves delivery of that contracted output.

The distinction matters when vendors report scale. More deployed vehicles can increase potential throughput while leaving accepted work unchanged. The comparison becomes especially misleading when one trial covers benign conditions and another includes difficult access, time pressure or a demanding quality threshold. Keep comparable mission classes separate. Record excluded attempts and explain the exclusion before calculating a success rate.

I would ask an operator for an attempt ledger that joins the contract requirement to the launch, interruptions, interventions, accepted result and subsequent customer disposition. Partial work should retain its actual status. A canceled assignment belongs in the capacity record even when it does not belong in a particular technical failure denominator. The investor can then see how a technical metric becomes commercial output.

This also clarifies the human contribution. Remote support, inspection, maintenance and recovery are part of the service. Their cost does not disappear because the vehicle travels alone. Track specialist hours by activity and distinguish planned support from unscheduled intervention. A reduction in onboard labor can be valuable while the total support requirement still needs measurement.

Build a transparent loss-adjusted cost model

For a first screen, I propose cost per accepted mission as a ratio of expected costs to expected accepted outputs across comparable attempts. Let O represent ordinary operating and support cost per attempt. Let L represent expected incremental equipment-loss cost, R expected incremental recovery cost, and D expected interruption cost. Let p represent the probability that an attempt produces an accepted mission. The screening ratio is (O + L + R + D) / p.

Every numerator term must have the same observation window and currency basis. Ordinary maintenance should sit in O; only incremental recovery belongs in R. Equipment depreciation already charged to O must be reconciled before adding replacement exposure to L. D should capture documented interruption costs that are absent elsewhere, such as rescheduling penalties. Counting the same support vessel twice would manufacture a disadvantage.

The ratio is a deliberately limited planning tool. It does not estimate the value of secrets, injuries, environmental harm or irreversible obligations. Those can require independent acceptability limits. It also does not model financing, taxes or a full fleet replacement process. Use a renewal or simulation model when changing availability and repeated losses materially affect the business. Simplicity is useful only while its limits remain visible.

Here is a wholly invented dollar-denominated comparison, unrelated to Dive-LD pricing or observed performance. Suppose O is $10,000, L is $4,000, R is $2,000 and D is $1,000. At p = 0.80, expected cost per accepted mission is $17,000 / 0.80 = $21,250. If p falls to 0.60 with the same numerator, the figure becomes approximately $28,333. The arithmetic shows how the denominator can overwhelm an attractive purchase story.

Now suppose a recovery improvement raises R to $3,000 and p to 0.90, holding the other assumptions fixed. The ratio becomes $18,000 / 0.90 = $20,000. Spending more on recovery can reduce expected cost per accepted output in this hypothetical case. The example establishes no vendor ranking. It specifies what an operator must measure before an investor can compare competing designs.

The visual is an authored calculation, with all inputs disclosed above. It contains no procurement quote or observed fleet result.

Replacement time belongs in the capacity case

A replacement vehicle sitting in a factory is different from a replacement service available to a customer. Delivery, integration, inspection, trained staff and the next usable deployment window can all sit between the two. Underwriting should measure the elapsed time to restored service, including dependencies the vendor does not directly control. A purchase order is an input to that clock.

For another hypothetical sensitivity, suppose an operator has ten equivalent vehicles and one becomes unavailable for thirty days. That is thirty unavailable vehicle-days out of three hundred possible vehicle-days in that thirty-day window, or ten percent. It is not automatically a ten-percent revenue loss. Spare capacity, customer timing, routing and contract terms determine the commercial effect. Keep physical availability and lost revenue as separate quantities.

A spare can be valuable even if it appears idle in an equipment-utilization report. Its value depends on how much disruption it can actually cover. A common component shortage or common software fault can disable both the active fleet and its nominal reserve. Correlated failure belongs in a separate scenario because buying another identical machine may leave the shared dependency untouched.

The investment request should therefore include a replacement chain with dated evidence: what is stocked, what can be supplied, what requires certification, who can operate it and how quickly service has actually resumed. Promised lead times remain promises until observed. Where evidence is missing, retain UNKNOWN and show the sensitivity across a reasonable hypothetical range rather than assigning an invented point estimate.

Recovery must protect the result as well as the asset

Retrieving hardware is only one possible recovery outcome. A commercial inspection business also needs a trustworthy account of which work was completed, which data was validated and which commitments remain open. If an interruption leaves that state ambiguous, a customer may require the work to be repeated even when the equipment returns undamaged.

The operating design should identify an independently inspectable completion record. It should connect the assigned mission, relevant configuration, accepted outputs and unresolved exceptions. This is a general accountability requirement. It does not prescribe particular military communications, protective mechanisms or technical countermeasures. Public analysis gains little by guessing at the contents of a specific vehicle.

Post-loss consequences should have their own review. Ask what categories of information and access were present, who owns the incident decision and what evidence would establish containment. An official statement about configuration has a defined scope. It cannot, by itself, answer every technical, commercial or future consequence. Preserve that distinction instead of assigning zero to an unmeasured risk.

The strongest service organizations should be able to show a recovery record that customers can inspect without disclosing sensitive internals. Investors can assess the existence, completeness and timeliness of those records through a controlled review. Trust becomes more concrete when the operator can explain both what it restored and what remains unresolved.

Carry the same discipline into software agents

A software agent can be inexpensive to restart while the surrounding workflow is expensive to repair. It may have written a partial artifact, consumed a limited resource or left an external action in an uncertain state. Launching a fresh session does not settle those obligations. The relevant unit is the accepted task with its side effects accounted for.

My proposed comparison uses the same three accounts. Attrition tolerance covers disposable sessions and bounded compute expenditure. Recoverability covers restoring the intended workflow from an inspectable state. Post-loss control covers preventing an abandoned session’s unfinished obligations from silently becoming another session’s authority. This is an analogy for operational design, not a claim that underwater vehicles and language models share identical failure physics.

A bounded software exercise could interrupt a harmless local document workflow and require the next session to identify the last verified output, resume within the original scope and produce a checked result. Count completion, duplicate work, recovery time and human intervention. Do not infer a benefit from a plausible architecture diagram. The exercise remains READY until separately executed with recorded outcomes.

The connection to capital allocation is practical. Cheap inference can coexist with expensive operational supervision. A stronger model can deliver value through fewer unresolved handoffs even if its unit price is higher. Compare total accepted-task economics under fixed conditions, then decide what to automate. Evidence from one workflow should retain its scope when informing another.

The scorecard I would take into diligence

Use six evidence rows: accepted mission rate, restoration after communications loss, maintenance and recovery hours, post-loss information exposure, time to restored service, and total cost per accepted mission. Each row needs a definition, numerator, denominator where applicable, time window, source owner and uncertainty note. A vendor slide can start a question; it cannot finish the evidence record.

Keep the decision sequence short. First define the customer outcome and unacceptable consequences. Next request comparable attempt and intervention records. Reconcile cost accounting and replacement dependencies. Then run a bounded sensitivity analysis using observed inputs where available and explicitly hypothetical assumptions elsewhere. Finally identify the one missing measurement most likely to change the investment judgment.

Do not collapse the result into a weighted score that hides an unacceptable condition. A favorable price cannot compensate for an obligation the operator cannot contain. Conversely, missing data is a reason to investigate, not proof that a business is poor. Preserve UNKNOWN, specify the evidence request and give the next review a concrete trigger.

For this article, the completed output is the framework, calculation and diligence template. Fleet results, vendor comparisons and software-experiment outcomes remain UNKNOWN. The next useful step is a bounded evidence request for one civilian mission class. An autonomous machine earns its investment case when the whole operation can repeatedly deliver accepted work, including the days when the machine fails.

Categories and keywords

Categories: Physical AI; Robotics; Capital Allocation; Autonomous Systems.

Keywords: loss-adjusted mission value, recoverability, attrition tolerance, accepted mission cost, replacement time, fault management, agent recovery.

Hashtags: #PhysicalAI #Robotics #AutonomousSystems #CapitalAllocation #Ouroboros