Scenario 1 · Yorkshire Flood Response
MET OFFICE + EA + COASTGUARDRESILIENCE FORUM
Trigger: Met Office forecasts 200mm of rain in 24h across North Yorkshire. Environment Agency river-level sensors show River Ouse rising 0.3m above seasonal normal at Skelton. DEFONEOS must correlate forecast, sensor, demographic, and infrastructure data; classify the threat; and pre-position response assets.
Sensor inputs (fused in real time)
| Source | Channel | Update |
|---|
| Met Office | Rainfall forecast (NetCDF) | Hourly |
| Environment Agency | River level (m AOD) | 15-min |
| Ordnance Survey | Terrain, flood plain polygons | Static |
| Companies House | Care home & sheltered housing locations | Weekly |
| OpenStreetMap | Road network + elevation | Daily |
| ONS | IMD decile, vulnerable-person density | Quarterly |
| Sentinel-1 | SAR backscatter — ground saturation | 6h |
| Batear acoustic | Unusual river noise (debris impact) | Real-time |
Timeline (T+0 = forecast issue)
T+00:00 · Met Office issues amber rainfall warning. DEFONEOS noise→intuition pipeline detects convergence pattern across 4 data sources. BFT council auto-convened (quorum 23/33 within 90 sec).
T+00:02 · intuition_engine raises recommendation: pre-position 12 high-volume pumps at Skelton, 6 at Linton-on-Ouse, 8 at York city centre. Confidence 0.91.
T+00:03 · BFT vote: 26 for, 1 against, 6 abstain. Action:DispatchPumps SIGIL-emitted to NYLRF (North Yorkshire Local Resilience Forum).
T+02:15 · First EA river-level data confirms forecast. DEFONEOS recommends second-stage pre-position: 4 rescue boats, 2 Coastguard hovercraft, MEDEVAC helicopter on standby at RAF Topcliffe.
T+06:00 · Sentinel-1 pass. SAR shows 14km² already saturated. BFT escalates from pre-position to active response. Action:ActivateFloodPlan emitted.
T+09:30 · First 999 calls begin. DEFONEOS auto-triages: 47 calls in 15 minutes, 12 categorised as P1 (life risk). Maps against care home + vulnerable-person register. 8 P1 calls map to known vulnerable residents; resilience forum dispatched welfare checks.
T+14:00 · DEFONEOS composes public alert via EA Flood Warning Service + DEFRA. 23,000 households notified. SIGILed.
T+24:00 · Rain tapers. River levels peak 1.8m above normal. Zero fatalities in DEFONEOS-supported response area (3 in non-supported neighbouring area).
Outcomes
Forecast-to-preposition lead time3 minutes (vs 90 min industry avg)
P1 calls triaged automatically47 / 47 (100%)
Vulnerable residents identified312 (vs 47 manually known)
Public alerts sent23,000 households
SIGIL entries written14,302 (every decision + sensor reading)
Post-event report auto-generated17 minutes after T+24
Scenario 2 · Dark Vessel Detection — North Sea
AIS + SATELLITE + RFMARITIME OPS CENTRE
Trigger: AISstream shows a 3-hour gap in tracking for a 290m tanker off the coast of Northumberland. DEFONEOS must determine if this is an AIS equipment fault, a sanctioned vessel attempting to spoof, or a "dark" vessel engaged in illicit activity (sanctions evasion, illegal fishing, smuggling).
Sensor inputs
| Source | Channel | Update |
|---|
| AISstream | Vessel position, heading, speed | Real-time |
| Sentinel-1 (Copernicus) | SAR ship detection | 6h revisit |
| Sentinel-2 | Optical confirmation (clear sky only) | 5-day revisit |
| RF geolocation (PX4 radar) | Marine radar cross-section | Real-time |
| EO/IR gimbal | Visual ID at long range | On-tasking |
| UK Sanctions List | IMO + flag match | Daily |
| OFAC SDN | Beneficial ownership | Daily |
| GDELT | News events in region | 15-min |
Fusion timeline
T+00:00 · AIS gap detected. Track.lastSeen > 3h flagged. DEFONEOS opens incident MOC-2026-07-05-001.
T+00:01 · Predicted position estimated via dead reckoning from last heading + speed + metocean drift. Uncertainty ellipse: 4.2 × 1.8 nm.
T+01:30 · Sentinel-1 pass. SAR detects 1 vessel of compatible size inside the uncertainty ellipse at 55.4N -1.5W. Match probability: 0.74.
T+02:10 · RF geolocation sensor (coastal) detects strong marine radar return at 55.42N -1.52W (range 8 nm). Range ambiguous; cross-bearings needed.
T+02:30 · EO/IR gimbal tasked. Aircraft tasked from RAF Lossiemouth via pre-approved cooperative flight plan. ETA 90 minutes.
T+04:00 · EO/IR imagery returns. Visual classification: oil tanker, dark hull, no name visible. Length 280-300m. Confidence 0.88.
T+04:02 · BFT council session: Promote to "Dark Vessel — High Confidence". 24/33 for, 3 against, 6 abstain. Action:AlertMOC + Action:DispatchNavalTasking.
T+04:15 · Alert reaches UK Maritime Operations Centre + Royal Navy Flag Officer Sea Training. Decision: send surface vessel for positive ID.
T+08:30 · HMS example closes to 1 nm. AIS reactivates under inquiry. Vessel identified as sanctioned shadow fleet tanker. Boarding action initiated.
Outcomes
Detection-to-MOC alert latency4 minutes (vs 4-8 hours industry avg)
Sensor-to-positive-ID8h 30m total
Sanctions match (post-boarding)YES — vessel on OFAC SDN list
BFT quorum reached24/33 (above 23/33 minimum)
SIGIL chain (replayable)142 entries
Scenario 3 · Urban Drone Swarm Defence — Central London
RF + ACOUSTIC + EO/IR + BFT EMERGENCYCOUNTER-SWARM
Trigger: Three unidentified drones detected converging on a Category A government building in central London. DEFONEOS must classify, track, predict trajectory, and recommend response — without escalating to kinetic effectors absent explicit BFT + human authorisation.
Sensor inputs
| Source | Channel | Update |
|---|
| Batear acoustic array | Drone rotor signatures, multiple classes | Real-time |
| PX4 RF radar | Drone control link (2.4/5.8 GHz) | Real-time |
| EO/IR gimbal (multiple) | Visual classification | On-tasking |
| Air traffic (OpenSky) | Manned aircraft exclusion | Real-time |
| GDELT | Coordinated event signals | 15-min |
| NPCC / MET Police | C2 coordination | On-tasking |
Fusion timeline
T+00:00 · Batear array detects 3 simultaneous drone rotor signatures within 800m of target building. Distinct frequency signatures (DJI Mavic class 1, DJI Phantom class 1, custom fixed-wing class 3).
T+00:05 · PX4 RF radar confirms: 3 control links in 2.4 GHz, one also on 5.8 GHz. Bearing correlates with acoustic.
T+00:08 · EO/IR slewed. Visual classification: 2 quadcopters (commercial, possibly DJI), 1 fixed-wing. Confidence 0.92, 0.89, 0.78.
T+00:12 · Trajectory prediction: all 3 converging on building rooftop. Estimated time-to-arrival 4 min 30s.
T+00:15 · EMERGENCY BFT SESSION auto-convened. Reduced quorum (21/33) due to urgency. Recommend: (a) RF jamming authorisation request, (b) alert NPCC + MET, (c) prepare counter-drone swarm.
T+00:18 · BFT vote: 22 for, 2 against, 9 abstain. Action:RequestRFJamAuthority + Action:AlertNPCC.
T+00:30 · Senior Civil Servant (Gold command) approves RF jamming. SIGILed with SCA Ed25519 signature.
T+00:32 · RF jam activated on 2.4 + 5.8 GHz (JSP 440 compliant — non-emergency services frequencies only). All 3 drones enter controlled descent.
T+02:00 · Drones recovered in soft-landing zones. Counter-swarm never deployed (jam sufficient). Post-event forensics: 2 commercial drones modified for longer range; 1 custom built from open-source plans. No explosives. Investigation ongoing.
Defensive design choices
- No kinetic engagement in this iteration — civilian area risk too high
- RF jam limited to non-emergency bands (JSP 440 compliant)
- Human-in-the-loop for jam activation — BFT recommends, human authorises
- EO/IR evidence preserved at every step — admissible in any subsequent court
- SIGIL chain captures full decision lineage — Gold command can defend "why"
Scenario 4 · CBRN Detection — Port of Felixstowe
CHEMICAL + RADIOLOGICAL + BFT EMERGENCYPHE + DSTL
Trigger: Customs container scanner flags anomalous gamma reading on a 40ft container declared as "machine parts" from a high-risk origin. DEFONEOS must triage, escalate, and coordinate with Public Health England + DSTL.
Sensor inputs
| Source | Channel | Update |
|---|
| Port scanner | Gamma spectroscopy, neutron | Per-container |
| Met Office | Wind direction/speed (plume model) | Hourly |
| ONS demographics | Population density within plume radius | Static |
| OS Open Data | Critical infrastructure locations | Quarterly |
| GDACS / ReliefWeb | International event signals | Real-time |
| PHE knowledge base | Substance ID + treatment protocols | Curated |
Fusion timeline
T+00:00 · Gamma reading 0.8 µSv/h above background, consistent with industrial source or low-grade radiological material. DEFONEOS opens CBRN incident.
T+00:30 · Isolation zone auto-defined: 50m radius. Container moved to dedicated isolation pad by remote-controlled straddle carrier.
T+02:00 · PHE specialist team dispatched. DSTL on standby. DEFONEOS plume model: worst-case wind (NNE 15 km/h), 2 km exclusion, 20 km shelter zone.
T+04:00 · Spectroscopy confirms Cs-137 (industrial, sealed source). Confidence 0.96. NOT a dispersal device — likely orphaned medical/industrial source in cargo.
T+04:30 · BFT vote: 27/33 for safe containerisation + return-to-sender per IAEA guidance. Action:ContainmentPlan + Action:AlertIAEA.
T+24:00 · Source containerised in IAEA-compliant Type B(U) package. Origin country notified via HM Customs.
Defensive design choices
- Conservative defaults — treat as dispersal until spectroscopy says otherwise
- Plume modelling + shelter-in-place auto-recommended to PHE
- DSTL escalation path always pre-built into CBRN template
- IAEA notification SIGILed with full evidence pack
Scenario 5 · National Grid Power Outage — Multi-County
SCADA + NETWORK + ECONOMIC IMPACTDSO + NG ESO
Trigger: National Grid ESO loses visibility on 3 grid supply points (GSPs) simultaneously. 240,000 customers across 3 counties lose power. DEFONEOS must triage cause, predict restoration, coordinate with DSO and emergency services.
Sensor inputs
| Source | Channel | Update |
|---|
| NG ESO SCADA | GSP status, frequency, demand | Real-time |
| DSO telemetry | Feeder status, transformer loading | Real-time |
| Telco (BT + Vodafone) | Cell tower power status (battery backup) | 5-min |
| Water utility | Pump station power | 5-min |
| Traffic (National Highways) | Signal blackouts, congestion | Real-time |
| OpenAQ | Backup generator emissions (CO, NOx) | Real-time |
| RTSP cameras (CCTV) | Street lighting + signal visibility | Real-time |
Fusion timeline
T+00:00 · 3 GSPs drop. DEFONEOS opens incident GRID-2026-XX-001. Correlates with NG ESO telemetry.
T+00:02 · Root cause hypothesis: transmission fault on supergrid. Backup routes triggered automatically.
T+00:15 · 40% of customers restored via auto-reclose. 60% remain down (240k → 144k).
T+00:30 · DEFONEOS impact map: 23 care homes without power (auto-paged to DSO priority list), 4 water pump stations on battery, 7 cell towers on backup.
T+01:00 · BFT session: prioritise restoration sequence. 28/33 for proposed order. SIGILed.
T+02:30 · All 23 care homes restored (DSO crews + portable generators). Water utility alerted re: pump station batteries.
T+06:00 · Full restoration. Post-event: cause identified as third-party cable damage during construction. National Grid instructed to inspect similar routes.
Scenario 6 · Mass Casualty Incident — Motorway Pile-Up
AMBULANCE + POLICE + FIRE + AIR AMBULANCEMETHANE + JESIP
Trigger: M6 collision in Cumbria. 17 vehicles involved. Low visibility + ice. Initial 999 calls indicate 30+ casualties. DEFONEOS must implement METHANE (Major Incident Medical Hazard Assessment) + JESIP (Joint Emergency Services Interoperability) protocols automatically.
Sensor inputs
| Source | Channel | Update |
|---|
| 999 CAD | Call text + location + triage category | Real-time |
| National Highways CCTV | Visual confirmation of scene | Real-time |
| Met Office | Weather (visibility, ice, temp) | 15-min |
| Air Ambulance (NWAA + GNAA) | Aircraft availability + ETA | Real-time |
| NHS trusts (UHMB + NCUH + RLI) | ED capacity + trauma team availability | Real-time |
| Blood stock (NHSBT) | O-negative, platelets | Real-time |
| ONS demographics | Vulnerable persons known to be in transit | Static |
Fusion timeline (METHANE)
M — Major Incident declared · 17+ vehicles, 30+ casualties confirmed by 999 calls + CCTV. T+00:01.
E — Exact location · M6 J36-J37 northbound. Lat/lon auto-confirmed via ANPR + 999 cell triangulation.
T — Type of incident · RTC, multi-vehicle, fog + ice. Predicted severity: high (visibility near-zero, pile-up likely expanded).
H — Hazards · Fire risk (fuel), ice, low visibility, traffic build-up approaching. Auto-paged: Fire + Air Ambulance.
A — Access · M6 NB closed; emergency corridor via J36 entry. HETS (Highways England Traffic Officers) dispatched for contraflow.
N — Number of casualties · 47 confirmed by 999 + CCTV (initial 30 was under-estimate). Triage: 8 P1, 22 P2, 17 P3.
E — Emergency services · 12 ambulances, 3 air ambulances, 5 fire engines, 2 HART teams, 1 police helicopter auto-dispatched.
DEFONEOS-specific value-add
- Initial 999 calls under-estimated casualties by 50%; CCTV + ANPR fusion corrected in 4 minutes vs typical 15
- Pre-allocated NHS receiving hospitals: 8 P1 distributed to 3 nearest trauma units (UHMB, RLI, NCUH) — not all to one
- Air ambulance tasking: 2 NWAA + 1 GNAA activated in 90 sec; route pre-cleared with NATS
- Blood products pre-staged at all 3 receiving hospitals (O-neg 30 units + platelets)
- Next-of-kin notification template auto-composed; sent 20 min after first casualty arrived at hospital
- Full SIGIL chain: 4,200+ entries, admissible in any subsequent inquest
Outcomes (illustrative baseline vs DEFONEOS)
Time to all services on scene22 min (vs 35 min baseline)
Casualties to definitive care8 P1 in 47 min (vs 75 min baseline)
Preventable deaths (modelled)0 (vs 2-3 baseline estimate)