Demining and UXO survey operations.

The mission

A survey team works a suspected hazardous area on the edge of a shelled town: a magnetometer drone flying low, tight swaths over the field, a tracked robot probing the verge of the access road, and a two-person team at the sector’s safe edge. Everything found today becomes tomorrow’s clearance plan — every swath of magnetometer data, every geotagged image, every anomaly. And every platform on that ground must answer to one channel absolutely: the command that says stop.

What breaks

The ground being surveyed is contaminated precisely because it was fought over, and the networks died in the same fight. What remains is scraps: one surviving cell at the edge of town with a shifting footprint, dead masts, shadows behind every treeline and ruin. A survey link built on any single one of those scraps drops exactly the way the sector’s geography dictates — and a dropped link over UXO is not an inconvenience. A robot that loses its control channel mid-lane either stops where it stands, in a lane nobody can walk into to retrieve it, or executes an automated return across ground whose whole problem is that nobody yet knows what is in it.

The data compounds the problem. A day’s magnetometer survey is bulk — far more than a scrap of surviving cellular will carry live — and a swath that arrives incomplete is a swath that must be flown again, over the same hazardous ground, spending the season’s most expensive commodity: time on contaminated terrain.

The architecture on this mission

The team brings the network with it. Every platform runs a node on the compute it already carries — the drone’s companion computer, the robot’s controller, a team-carried box at the sector edge, the base laptop — and together they form one encrypted mesh. The drone relays for the robot when the robot’s direct path is shadowed by a ruin; the team node relays for both; the surviving cell at the edge of town joins the bond whenever its footprint happens to reach, and is never depended upon. Each leg is separately measured, separately encrypted; a relay cannot read the traffic it carries.

The abort channel gets the strongest treatment the system has: broadcast duplication across every available path simultaneously. The arithmetic is the point — three independent paths each losing 2% of packets combine to an effective loss of 0.0008% — and the class system holds that guarantee structurally: abort and control hold reserved floors on every leg, and no volume of survey data can ever contend with them. Degradation is detected within roughly half to three-quarters of a second, and it degrades the video first, the bulk queue second, and the stop command never.

The survey data takes the opposite strategy: patience. Swaths land on the platform’s node at local speed the moment they are captured, then drain toward base store-carry-forward, in priority order, over whatever capacity the mesh currently has. A swath captured during a shadowed stretch arrives minutes late instead of never — and nothing gets flown twice because a link blinked.

How the survey day unfolds

1. Setting up at the safe edge. The base, the team node, the robot and the drone authenticate by key and form the mesh before anything enters the sector. The dashboard shows every path — including the surviving town cell, currently reaching, currently trusted for nothing.
2. First swaths. The drone flies its lanes; the robot starts on the verge. Magnetometer data lands on the platforms’ own nodes instantly and drains to base continuously; the operators watch anomalies appear on the sector map in near-real time.
3. The shadow. Behind the ruined farm the robot’s direct path to the team node dies. Its traffic re-routes through the drone overhead within a second; the lane continues; the operator sees a route change on the dashboard, not an event on the ground.
4. The stop. The drone’s camera catches surface metal in the robot’s next lane, and the operator sends the abort. It leaves base duplicated on every path — mesh, drone relay, the town cell that happens to reach this minute — and the robot stops. This is the packet the whole architecture exists for.
5. The drain. As the platforms return to the edge, the queued remainder of the day’s swaths drains at short range in minutes. Nothing is missing; no lane is reflown.
6. The evening product. The clearance planners work from complete data, and the journal shows link state for every minute of the day — which shadows are real, where a mast node would pay for itself, and evidence for the safety file that the control channel held throughout.

What each mechanism contributes

• Team-carried mesh with per-hop encryption — the network arrives with the team; platforms relay for each other around ruins and treelines; relays cannot read what they carry. Shipped.
• Broadcast duplication for the abort channel — the stop command on every path at once; three paths at 2% loss each combine to 0.0008%. Shipped.
• Class floors and ordered degradation — control reserved on every leg; video and bulk yield first, in enforced order. Shipped, opt-in.
• Store-carry-forward — swaths queue through shadows and deliver complete, in priority order; no re-flying hazardous ground for a dropped packet. Shipped.
• Opportunistic bonding and the journal — surviving scraps of coverage used when present, depended on never; the day’s link record feeds the safety file and the next day’s plan. Shipped.

The honest boundary: Atlas moves the data and the commands; the detectors, the classification of anomalies, the clearance decisions and the safety procedures are the organisation’s, governed by its own standards. And physics keeps its veto — a platform that drives beyond the reach of every path is beyond software’s help, which is why the platform’s own onboard failsafe behaviour, defined by the operator, remains the final layer; Atlas’s contribution is making that layer’s activation as rare as the arithmetic of multiple independent paths allows, and journalling every second of link state so the safety case rests on measurement.

What a pilot should prove

• Abort delivery under induced path loss: stop commands issued while links are deliberately dropped, every delivery timestamped by the journal against the built-in measurement.
• Relay behaviour in real terrain: the robot’s control held through defined shadows via the drone and team node, with per-hop records.
• Complete-data delivery: a full day’s swaths at base by end of day, checksummed complete, with no re-flown lanes.
• The safety-file artefact: a per-minute link record of the sector an external safety auditor can read.

One sector, one team, two survey days. The evaluation format covers the structure.