VIGIL Watch
Navigation, silent signals, self-status and critical acknowledgements.
01 / ReframeFrom a watch
to a field system
to a field system
The brief behind the brief
The team asked for a military smartwatch. The field needed less watch.
A conventional smartwatch assumes spare attention, bare fingers, connectivity and a user who wants more information. VIGIL’s user may have none of those.
01
Attention is the scarce resource. Interrupt only when a decision is required—not whenever new data exists.
02
Touch cannot be the primary input. Rain, gloves, darkness and stress turn ordinary gestures into failure points.
03
Health data must become team awareness. A soldier does not need another fitness dashboard; a medic needs an earlier signal.
04
Disconnected is normal. Critical behavior must survive without a phone, cloud account or public map service.
Designing for the worst minute
The product is judged when the user is wet, cold, moving, cognitively loaded and unable to look twice.
1
glance to understand state
2
physical actions for priority tasks
0
required cloud dependencies
02 / Product strategy
One source of truth.
Four levels of attention.
The redesign separates who senses, who decides and who acts. Each surface exposes only the detail its role can use in that moment.
VIGIL Field
Mission setup, squad posture and encrypted local synchronization.
VIGIL Triage
Severity-ranked casualties with trends, location and intervention notes.
VIGIL Link
Store-and-forward communication that keeps the squad useful when the phone is absent.
No public activity feeds · no background cloud sync · mission data expires by policy
03 / Industrial design direction
Built around hands in gloves—not a glass rectangle.
The squircle chassis creates more usable display area than the original round concept, protects impact zones and gives every physical control a distinct shape and position.
Guarded display
Raised corners take the hit before the anti-glare glass does.
Controls by feel
Two paddles, one crown and a protected emergency press.
Skin-side sensing
Optical heart rate and SpO₂, temperature trend and motion build a passive baseline.
Field serviceable
Replaceable strap, sealed contacts and a modular sensor back.
5 ATM
Water-resistance target
72 hr
Mission-mode battery target
2.1 mm
Raised bezel protection
4×
Distinct physical controls
Performance values are design targets for prototyping, not certified production claims.
04 / Interaction model
Four controls. One muscle memory.
Primary tasks never require a precise tap. Each control keeps the same job across navigation, alerts and team signals—so action remains predictable in gloves, darkness or stress.
01
UPPER PADDLE / PRESS
Previous or increase
A raised double ridge distinguishes it by touch. Holding repeats the action.
02
LOWER PADDLE / PRESS
Next or decrease
A concave face makes the lower control unambiguous without looking.
03
AMBER CROWN / PRESS
Confirm the primary action
One short press accepts. A 1.5-second hold returns to the mission face.
04
GUARDED KEY / HOLD 3 SEC
Open emergency reporting
A recessed key prevents accidental use; haptic pulses confirm the hold.
08:42AES
ROUTE 02OBJ LIMA
330N030
GNSS±18 M
▲ PREV024°NEXT ▼
08:42LOCAL
SELF CHECKBODY LOAD
ELEVATED12 MIN
HEART+18%
SKIN TEMP+0.8°
MOTIONHIGH
Hydrate when safe. Recheck in 10 min.
▲ DETAILS● OKLATER ▼
08:42PRIORITY 1
CHECK REQUIRED
ARE YOU OK?
Impact and no motion detected.
Alerting team in 00:12
Alerting team in 00:12
● I'M OKHOLD SOS · HELP
08:42● RECEIVED
FROM A-1 LEADTACTICAL SIGNAL
RALLYPOINT SURYAHAPTIC · — · · —
▼ REPEAT● ACK
08:42ALPHA 06
SQUAD PULSE2 EXCEPTIONS
A-3 · CHECK OVERDUE02:14 · LAST AT WP 04P1
A-5 · LINK WEAKLAST PACKET 38 SECP2
4 MEMBERS NOMINALNO ACTION REQUIREDOK
▲ PREV● OPENNEXT ▼
03CROWN / CONFIRM
04GUARDED / SOS
Interactive watch prototype
One dominant decision. Enough context to trust it.
Directional guidance stays useful under GPS degradation by showing source confidence and switching to heading-plus-distance when map precision is unreliable.
- GLANCE GOAL
- Where next, and how reliable?
- PRIMARY CONTROL
- Paddles cycle route points
- FALLBACK
- Heading + last trusted fix
05 / Watch capability model
The wrist does more—without asking for more attention.
Features are organized by mission moment, not app icons. Most run passively, become haptic before visual, and reveal detail only after the soldier asks.
FLOW 01 / NAVIGATION
3 STATESGraceful degradation
ROUTE 02LINK
287M · TURN
GNSS±18 M
confidence drops
ROUTE 02DEGRADED
301M · ESTIMATE
LAST FIX00:38
fallback
COMPASSLOCAL
024°HOLD HEADING
RALLY2.4 KM
The interface changes the claim it makes—from precise route guidance to an honest heading based on the last trusted fix.
FLOW 02 / SILENT SIGNAL
2 ACTIONSFeel, identify, acknowledge
INCOMINGA-1
— · · —SCREEN OFFHAPTIC
glance
SIGNALVERIFIED
RALLYPOINT SURYA
▼ REPEAT● ACK
crown
RECEIPTQUEUED
✓
ACK SENTDELIVERY PENDING08:42:16LOCAL
The delivery state is explicit: an acknowledgement can be safely queued without pretending the network has delivered it.
FLOW 03 / HEALTH GUARD
3 LEVELSSense, ask, corroborate
PASSIVELOCAL
DRIFT3 SIGNALS · 12 MIN
PRIVATEMONITOR
threshold
SELF CHECKAMBER
?
NEED A PAUSE?● OK ▼ LATER10 MINRECHECK
no response
ESCALATIONP1
!
TEAM ALERTED3 SIGNALS AGREESEALED08:53
No single reading becomes a diagnosis. The system asks privately first and escalates only when evidence and policy agree.
Resilient navigation
Route corridor, bearing, breadcrumb return and growing confidence radius when GNSS becomes unreliable.
- Offline terrain package
- Rally-point guidance
- Jamming confidence state
Silent team language
Pretrained haptic patterns for halt, move, rally, danger and acknowledgement.
- Pattern rehearsal
- Delivery receipt
- No bright-screen requirement
Passive health guard
Looks for combined changes in exertion, temperature, oxygenation, impact and motion.
- Private self-check first
- Medic escalation second
- No diagnosis claims
Glove-safe quick reports
Send “safe,” “need assistance,” “cannot move” or a preconfigured contact report with two physical actions.
- Haptic confirmation
- Store and forward
- Undo window
Mission memory
Locally records route, alerts, acknowledgements and interventions for a controlled debrief.
- Role-based visibility
- Automatic expiry
- Redacted export
Degraded mode
When links fail, the watch keeps the last trusted plan, queues events and makes uncertainty visible.
- No false precision
- Radio silence mode
- Priority battery reserve
06 / Health & safety
Not a fitness score.
An earlier chance to intervene.
VIGIL avoids diagnosing. It watches for meaningful deviation from a soldier’s own baseline, asks for confirmation and escalates only when signals agree.
Cardiovascular strain
Heart-rate trend compared with motion and recent workload.
Heat strain
Temperature drift plus sustained exertion prompts recovery.
Oxygenation risk
Repeated decline raises a private check-in before escalation.
Impact + immobility
A hard event followed by no movement opens a timed self-check.
07 / Secure setup
Touch the phone to the watch.
Trust is established in seconds.
There is no device list, pairing code hunt or permanently discoverable Bluetooth radio. Physical proximity starts enrollment; explicit confirmation and device certificates complete it.
NFC initiates
Touching devices exchanges only signed identity and a single-use setup token. No mission data travels over NFC.
Both humans confirm
The unlocked phone shows the assignee and mission; the wearer presses the amber crown. A matching three-word phrase detects the wrong device.
UWB proves presence
Where supported, short ranging confirms the enrolled devices remain together and later assists final-range teammate finding.
Wi‑Fi transfers, then sleeps
A temporary Wi‑Fi Aware/Direct link moves maps, firmware and encrypted mission packages without an access point or internet connection.
No Bluetooth stack. This is a product-level attack-surface decision, not a claim that Bluetooth cannot be secured. Every remaining radio still uses mutual authentication, encrypted payloads, rotating mission keys and policy-controlled activation.
08 / Connected experience
The phone carries complexity so the wrist doesn’t.
VIGIL Field prepares watches, reveals squad exceptions and preserves a useful mission record—without turning into a surveillance dashboard.
01Encrypted offline package
02Exception-first, never surveillance-first
03Role-gated mission record
09:41VIGIL · OFFLINE82%
Mission package
6 WATCHES READY
Himal Sector
RP / SURYASAFE CORRIDOR± 18 m
Route
8.4 km · 5 points
Offline terrain
248 MB · sealed
Policy
Auto-expire · 18 h
Readiness gate
4 MIN TO GOBravo / 06
92READY
5 OF 6 CLEARED
One issue needs the lead
Everything else stays in the background.
✓
Mission packageMaps, route and haptics verified
6/6✓
Sensor contactBaseline confidence is usable
6/6!
Battery reserveB-4 · Rawat below policy
54%READINESS POLICYHigh-altitude · 18 h
RADIO WINDOWMesh at step-off
Live squad
LOCAL MESH
Bravo team
06
Members
04
Nominal
02
Attention
B-3 · Rawat
Immobility check pending
HR 142
O₂ 91
O₂ 91
B-6 · Singh
Heat strain rising
+1.8°
48 MIN
48 MIN
B-1 · Dorjee
Nominal · last 12 sec
HR 112
O₂ 97
O₂ 97
B-2 · Khan
Nominal · last 18 sec
HR 104
O₂ 98
O₂ 98
Showing exceptions only · precise trails hidden
Priority incident
VERIFYB-3 · Rawat
420 m · last trusted 38 sec ago
IMPACT + IMMOBILITYBuddy check in progress
MotionAbsent · 01:14
Physiology2 signals agree
Every view and action is added to the local incident record.
After action
LOCAL ONLY
Himal Sector
ROUTESTRAINEVENT
Route deviation
Team moved 180 m east
Heat prompt acknowledged
B-6 recovered in 11 minutes
Rally signal issued
All six watches confirmed
Mission closed
Private data expires in 17 h
09 / Mobile operations toolkit
The companion app is the workshop, control room and recovery desk.
Its role starts before a watch is issued and continues after the mission closes. Capability is grouped by operational phase so the app never becomes a drawer of disconnected features.
ON THE WRIST · WEATHER + GLOVES
AT THE FIELD POSTOne product thread links the wearer outside with the lead and medic at the field post—without assuming reliable cloud access.
IDENTITY VERIFIED
Assign & enroll
Tap-pair the device, verify hardware identity, assign wearer and load role-based permissions.
OFFLINE · 248 MB
Build mission packs
Offline maps, routes, boundaries, rally points, haptic vocabulary and expiry policy.
HALTRECOGNISED
Train haptics
Recognition drills make silent patterns learned behavior before they matter in the field.
92READY✓✓!
Pre-mission readiness
Battery, sensor contact, map completeness, radio policy and baseline quality in one gate.
2 NEED ATTENTION
Exception-first squad view
Ranks overdue check-ins, separation, health drift and low-confidence location.
PRIORITY / B-3420 mMEDIC ACK · 02:40
Medic handover
Shares event context, recent trend, interventions and access-controlled medical notes.
KEYS QUEUED
FOR DELETIONDEVICE B-4
FOR DELETIONDEVICE B-4
Revoke a lost device
Invalidate its certificate, queue key deletion and block it from the next mission package.
REDACTED DEBRIEF
After-action review
Correlates route, signals and safety events, then exports a redacted debrief.
Enroll
Configure
Rehearse
Deploy
Respond
Debrief
Revoke
10 / When the soldier cannot respond
Not every silence means the same thing.
VIGIL never equates one sensor reading or a lost link with a casualty. Each state has a different trigger, a different privacy cost and a different escalation path.
CASE 01 / UNCONSCIOUS
AUTO ESCALATION
Impact followed by immobility
A hard event, absent motion and abnormal physiology agree. The wearer does not answer the timed haptic self-check.
Watch
Repeats check-in, preserves battery and marks location confidence.
Buddy
Nearest teammate gets a private verify request first.
Medic
Receives priority packet if nobody confirms safety.
CASE 02 / INJURED
MANUAL SOS
Conscious, but unable to move
A protected hold opens three physical choices: ambulatory, need assistance or urgent—without typing or speaking.
Watch
Confirms the selected status with a unique haptic.
Lead
Sees mobility state, location age and requested response.
Medic
Can acknowledge and send an arrival estimate back.
CASE 03 / SEPARATED
GUIDED RETURN
Lost outside the route corridor
Separation combines time, route deviation and absence of expected peers. A single missed packet is never enough.
Watch
Offers breadcrumb return or bearing to the safe rally point.
Team
Gets last trusted point, its age and a widening uncertainty radius.
Near
Authorized UWB ranging can guide the final approach.
CASE 04 / DEGRADED
STORE + FORWARD
GNSS jammed and mesh unavailable
The product says what it no longer knows. It never freezes an old dot and presents it as current truth.
Watch
Uses heading and dead reckoning with visible confidence decay.
Data
Queues SOS and check-ins by priority, not chronology.
Return
Forwards the smallest critical packet when any trusted peer reappears.
CASE 05 / DURESS
COVERT · MANUAL
Captured or operating under coercion
Capture is never inferred automatically from a lost link. A rehearsed two-control gesture can declare duress without changing the visible screen.
Watch
Returns to an innocuous time-only face; no visible SOS confirmation.
Team
Receives a silent duress state only when a trusted route exists.
Policy
Mission keys can lock or zeroize; emergency medical identity follows separate policy.
CASE 06 / REMOVED
VERIFY FIRST
Watch removed, damaged or abandoned
Loss of skin contact is not proof of injury. VIGIL distinguishes equipment state from human state.
Watch
Locks mission detail and records removal time.
Phone
Asks the buddy or lead to classify intentional, lost or unknown.
Fleet
Unknown devices are revoked and excluded from future enrollment.
Every useful SOS answers:
WHAT HAPPENED
WHO / ROLE
RESPONSE STATUS
LAST TRUSTED LOCATION
LOCATION AGE
CONFIDENCE RADIUS
RECENT VITAL TREND
LINK + BATTERY
11 / One mission, one thread
The system earns trust in the handoffs.
Before movement
The lead downloads an offline area, sets route, rally points and alert policy. Each watch confirms maps, battery and baseline locally.
At the wrist
The soldier feels a turn cue, glances once for bearing and distance, then returns attention to the environment.
When health drifts
VIGIL prompts the wearer privately, then surfaces the trend to the lead only if it persists.
If someone goes down
Impact plus immobility triggers self-check. No response sends identity, confidence, last location and vital trend to the medic.
After return
Route, signals and safety events become a shared debrief. Personal health details remain access-controlled and expire by policy.
12 / What changed through design
We stopped polishing screens and changed the decisions underneath them.
The most meaningful iterations removed assumptions inherited from consumer wearables and turned operational constraints into product rules.
01 / NAVIGATION
From a tiny wrist map to one dependable instruction.
Zoom, pan, inspect
→
Bearing, distance, confidence
02 / HEALTH
From isolated metrics to cautious escalation.
Broadcast every anomaly
→
Sense, ask, corroborate
03 / SQUAD
From monitoring everyone to surfacing exceptions.
Six equal data cards
→
Priority-ranked attention
04 / OPSEC
From a privacy setting to an architectural default.
Cloud sync toggle
→
Local-first, expiring data
13 / Design outcome
A credible product system—not a watch-shaped dashboard.
The direction gives engineering and stakeholders a coherent model to prototype: shared principles, a physical interaction grammar and connected experiences that know when to reveal more.
What we would validate next
The industrial design and performance values shown here are design direction, not production proof. Next we would test control differentiation with winter gloves, haptic recall after delayed training, false-positive tolerance for health escalation and battery behavior under sustained mesh use. Those findings should decide the final hardware—not the beauty of this render.
Final principle