Dam and landslide instrumentation without a backhaul.
The instruments that watch a dam wall or a creeping slope sit exactly where no network reaches — and the readings that matter most are the ones between the technician’s visits. This mission is about making a scheduled flight the backhaul: the aircraft collects, carries and delivers, so the data arrives weekly instead of quarterly.
Dam and irrigation operators, geological surveys, municipalities with an active landslide to watch.
The sites have no coverage; a permanent uplink per site is uneconomical, and manual collection rounds are rare and slow.
Peer discovery, store-carry-forward and drain-on-contact — a scheduled flight becomes the backhaul. The flight and the sensors stay yours.
The aircraft’s companion computer and a small board at each site — down to a 15-gram single-board computer. One Linux binary, one configuration file.
The mission
A gravity dam sits at the head of a river gorge. Piezometers in the wall and abutments log pore pressure; inclinometers on the slope above the reservoir log the slow creep of a landslide that has been moving for thirty years and must never move faster. The engineering question is always a trend — is this season different from last season? — and the trend lives in readings that accumulate at sites a technician reaches by four-wheel drive and then on foot, a few times a year, weather permitting. The operator wants the same numbers weekly, without building a radio network into a gorge.
What breaks
Nothing propagates out of the sites. The gorge walls shadow every cell; the villages the carriers actually serve are on the other side of the ridge. So the readings sit in dataloggers, and the interval between collections becomes the blind spot: the dangerous scenario for a landslide is precisely the acceleration that happens between visits, discovered months later as a historical fact rather than acted on as a live one.
The classical answers are all versions of “build a permanent uplink per site”, and each is a poor fit. A satellite terminal per instrument cluster is a metered, powered, maintained piece of infrastructure multiplied by every site; a low-power radio network still needs a gateway somewhere with backhaul of its own, which is the original problem restated; and stretching the manual round to more sites makes it rarer still. The sites do not need a link that is always up. They need one that is up on schedule.
The architecture on this mission
Each instrument cluster gets a small node — a board the size of a matchbox wired to the datalogger, running the same software as everything else in the system. The aircraft carries one too. When the aircraft flies the collection route and comes within radio range of a site, the two nodes discover each other, authenticate by key and bring an encrypted link up with no ceremony; the site’s queued readings drain into the aircraft’s store-carry-forward buffer in the seconds or minutes it loiters overhead. When the aircraft returns to coverage — the operations base, or simply the first cell on the way home — the buffer delivers, in priority order, into the monitoring database.
This is the data-mule mechanism run as the routine mode of transport rather than the emergency one. The queue is ordered: an alarm-flagged reading — a threshold crossed since the last round — drains first, in the first second of contact, so even a short pass moves the reading that matters. Everything is encrypted end to end between site and base; the aircraft carries ciphertext it cannot read, and keys rotate automatically underneath. The return leg works too: configuration changes and new sampling schedules ride out to the sites on the next round.
Because every contact is measured, the system also produces something the manual round never did: a record of each site’s health — when it was last heard, how much it had queued, how its battery is trending — refreshed on every flight, for free.
How the collection round unfolds
- Scheduled launch. Tuesday, 08:00: the aircraft lifts from the operations base and flies the programmed route into the gorge. No operator decisions; the round is a calendar entry.
- First contact. Approaching the landslide array, the aircraft’s node and the site node discover each other and authenticate. The week’s inclinometer readings — flagged values first — drain into the aircraft’s buffer during one slow orbit.
- The round. The dam crest station, the abutment gallery logger, the rain gauge on the far slope: contact, drain, continue. Each stop adds seconds, not landings.
- The silent site. One station does not answer — a battery, a lightning strike, an antenna under a rockfall. The round continues; the miss is recorded, and the operator learns about the dead site today rather than at next quarter’s visit.
- Delivery. Climbing out of the gorge, the aircraft meets coverage and the buffer drains — priority readings first, the bulk behind them. By landing, the monitoring database is current to this morning.
- The debrief artefact. The journal shows every contact: which site, when, how long, how much — and the one that stayed silent. The maintenance visit now goes to one known-dead station instead of a speculative tour of all of them.
What each mechanism contributes
- Peer discovery — aircraft and site nodes find each other and authenticate by key on approach; contact requires no ground crew and no ceremony. Shipped.
- Store-carry-forward — readings queue at the site, ride the aircraft, and deliver on reconnection; the mule mechanism as the routine transport, not the fallback. Shipped.
- Priority classes — alarm-flagged readings drain in the first moment of a contact window, so even a shortened pass moves what matters. Shipped, opt-in.
- End-to-end encryption — the same cryptographic family as WireGuard and Signal, keys rotated automatically; the aircraft carries what it cannot read. Shipped.
- External parts — the flight schedule and the sensor-to-node integration are the operator’s; that is what makes this a pattern rather than a boxed capability.
The honest boundary: Atlas contributes the transport — discovery, the queue and the delivery. The flight itself — the aircraft, its endurance, the schedule, the aviation permissions — and the integration between each instrument and its site node are yours, and both are essential to the mission. And the pattern is deliberate about latency: data arrives on the round’s schedule, not in real time. A site whose readings genuinely cannot wait for the next flight needs a permanent uplink at that one site — which simply joins the system as one more node.
What a pilot should prove
- Complete transfer at every site on a real round: queued readings on the site node versus rows in the monitoring database, matched to zero loss.
- Contact economics: seconds of loiter per site against megabytes drained, from the built-in measurement.
- Failure visibility: a deliberately silenced site reported in the same round’s journal, with its last-heard time and queue state.
- Priority behaviour: an alarm-flagged reading delivered from a contact window cut deliberately short.
Three sites, one aircraft, one month of rounds. The evaluation format covers the structure.