Onboard computing & cabin intelligence

A 1979 bus can't idle a datacenter. The design answer is a stack of brains that wake each other in tiers — from a microcontroller sipping fractions of a watt to a 122 GB AI computer — so the bus sleeps for weeks on its 12 V battery and still answers the door.

ArchitectureFour tiers, each powering the next

TIER 0 — ALWAYS ON (~0.1–0.5 W · weeks on 12 V)
  gateway microcontroller: relay spine · battery guardian ·
  key detection · mesh hub  |  presence sensors, deep-sleep nodes
        │  authorized key · keypad · ignition
        ▼
TIER 1 — CABIN BRAIN (~7–10 W)
  Raspberry Pi 5 head unit: home-automation core · CAN telemetry ·
  dash touchscreen  |  travel router (LTE / satellite uplink)
        │  voice session · drive mode · cameras
        ▼
TIER 2 — AI BRAIN (~15–60 W)
  Jetson-class computer: local multimodal model · voice agent ·
  camera + mic ingest · SDR host
        │  individually switched
        ▼
TIER 3 — HEAVY PERIPHERALS
  VHF/UHF transceiver · satellite dish + rotator · LED power · screens

Wake semantics. Presence alone is courtesy only — a light, a status glyph — and never unlocks anything. An authorized key or keypad code unlocks and wakes Tier 1. Ignition brings everything up. Higher-tier wake is policy in the automation layer, not hardwired. Shutdown runs the ladder in reverse, gracefully, with the gateway holding a hard timeout as backstop.

The battery guardian. The always-on gateway watches 12 V system voltage and refuses to wake anything expensive below a cutoff — the electronics can never strand the vehicle. Thresholds are enforced locally on the microcontroller regardless of what any upstream computer asks for.

VoiceOffline, fast, and deliberately limited

The AI tier runs a multimodal model that ingests speech directly — no cloud transcription, no network dependency. Hold-to-talk from any phone or the dash; replies land in one to two-and-a-half seconds and are spoken aloud. The agent sees live vehicle state (mode, pack telemetry, satellite passes, radio tuning), so "how warm is the computer?" and "when's the next ISS pass?" get real answers.

Actions pass through a hard allowlist the model cannot amend: lights, LED scenes, operating modes, radio tuning — and the doors lock by voice but never unlock. Unlocking requires the owner's key. The language model proposes; a dumb validator disposes.

TelemetryThe CAN bus, listened to and never spoken on

A dual-channel CAN interface rides the head unit. Channel one listens — strictly listen-only, enforced at the interface level — to the battery-management broadcast bus and decodes pack voltage, current, state of charge, and cell temperatures into the dashboard. Channel two is reserved for the controller/display bus. Nothing transmits onto a vehicle bus until commissioning review signs off.

RadioThe radio suite

element	role
Software-defined radio	Spectrum watch from 10 MHz to 3.5 GHz, rendered live to the dash; tunable by voice. Receive-only by policy until licensing review.
Pass prediction	Onboard orbital almanac computed from public elements — ISS, METEOR weather satellites, polar orbiters — refreshed daily, queryable by voice.
VHF/UHF transceiver	Voice comms and APRS, under the operator's amateur licence. Integration pending.
Dish + rotator	Steerable satellite antenna, slaved to pass predictions. Integration pending.

PrinciplesDesign rules the build follows

The safety-relevant firmware is deliberately dumb. The always-on gateway does relay sequencing, auth checks, and voltage cutoffs — nothing clever. Cleverness lives upstairs where it can crash harmlessly.
One state authority. The automation layer owns canonical state; the AI, the dashboard, and the CLI are peers that request changes through the same audited path.
Preserve before flash. Every microcontroller gets a byte-exact firmware backup before anything is written to it.
Fail toward the vehicle. Any conflict between the computing stack and the bus being drivable resolves in favor of the bus.