Glacier and volcano observatories.

The mission

A volcano observatory two thousand metres above its valley: a seismometer array, a GNSS monument measuring the edifice’s slow swelling, a camera on the crater rim. Or a glacier tongue instrumented along its length, logging velocity and melt. In both cases the science — and, for a hazard agency, the public-safety product — is a continuous time series, and its value collapses when the series has holes. The mountain offers no coverage, no power, and a maintenance window that opens a few times a year, weather permitting. Everything on it must run for months on batteries and solar, unattended, and somehow get its data down.

What breaks

The uplink is always the weakest instrument on the mountain. A single long radio shot from summit to valley fights terrain, icing on the antenna, and the exact storms during which a volcano observatory matters most; a satellite modem adds a metered bill and its own weather sensitivity, and dies with the same iced antenna. When the one link goes, everything behind it goes silent together — and stays silent until a team can physically reach a site that the weather has just made unreachable. The failure compounds: the data most likely to be lost is the data recorded during the events that make the record valuable.

Classical telemetry treats the outage as an exception to apologise for. On this mountain, the outage is the normal season.

The architecture on this mission

The pattern replaces the one heroic long link with a chain of short, humble ones. Battery-and-solar relay nodes are staged at intermediate sites on the way down — a ridge shelter, a moraine, a spur with line of sight to the valley — and the observatory’s data hops through them as an encrypted mesh. Short hops buy signal margin out of all proportion to transmitter power, which is exactly the currency a solar site can afford; and because the chain is a mesh, not a daisy-chain of bridges, a site with two neighbours in view routes around a failed one on its own.

When the weather takes a hop anyway, store-carry-forward turns the outage into a delay instead of a hole. Readings queue at the last surviving node — for hours or for weeks — and drain automatically, in priority order, the moment the route heals: the seismic event flags and state-of-health first, waveform bulk behind them. The valley station never receives a gap; it receives the missing days, late, complete and timestamped. And when a whole flank of the chain is down, the recovery does not have to wait for a repair visit: a drone flown up on the first clear day joins the same mesh in the air over the summit, drains the observatory’s queue in minutes of loiter, and carries it home — a courier, not a mission.

What makes this a pattern rather than a boxed capability is everything around the software. The relay sites must be chosen for line of sight and survivability; the power budgets must carry the radios through the dark months; the masts must hold under the icing. Atlas’s share — the mesh, the queues, the self-healing routing — is shipped and indifferent to how long the silence lasts. The mountain engineering is a project in its own right, and it is the operator’s.

How the winter unfolds

1. The autumn window. The team stages the relay nodes on the last good weekend: sites surveyed for line of sight, batteries and panels sized for the dark months. Nodes authenticate by key and the chain forms before the team is off the mountain.
2. The quiet weeks. Readings descend the chain continuously; the valley station’s time series is live. Every hop is measured several times a second, and the accumulating link record shows which sites have margin and which are marginal — while there is still time to care.
3. The storm. A front takes the ridge hop out — icing, then nothing. The chain heals where geometry allows; where it does not, the observatory’s readings queue at the last node still standing. Event flags are first in the queue; nobody has to choose.
4. The recovery. The hop thaws and returns three days later. The queues drain on their own, priority first, and the valley’s time series backfills to complete — the storm is a delay in the record, not a hole in it.
5. The clear day. One flank stays dead — a panel buried, a mast down. Rather than wait for spring, the team flies the courier drone up the first calm morning; it drains the summit queue in a few minutes of loiter and lands with the winter’s backlog.
6. The spring debrief. The journal shows the season per hop: uptime, the storms, what queued where and for how long. The next staging window is planned from measurement — which site needs a bigger battery, which needs moving, which was never needed at all.

What each mechanism contributes

• Mesh relaying with short hops — the chain down the mountain: encrypted per hop, up to 8 hops, routing around a failed site where geometry allows. Shipped.
• Store-carry-forward — readings queue at the last surviving node through the storm and drain on recovery, priority first; the drone courier is the same mechanism with wings. Shipped.
• Self-healing routing — a returning hop rejoins and traffic reroutes without a visit or a command. Shipped.
• Continuous measurement — per-hop link records that turn relay-site selection from guesswork into engineering. Shipped.
• The external share — relay-site emplacement, power budgets, masts, icing and the mountain itself are outside the software: this is what makes the mission a Pattern rather than a boxed capability.

The honest boundary: this is a Pattern mission because the software is the smaller half of the deployment. Atlas cannot keep a buried panel charging, hold a mast up under icing, or put line of sight where the mountain refuses it — emplacement, power budgets and the mountain are the operator’s, and the pattern stands or falls on that site engineering. What Atlas guarantees is narrower and testable: while nodes have power, data moves or queues, and nothing that queued is lost.

What a pilot should prove

• A season’s continuity: the valley time series complete across every outage, with delays — not holes — visible in the record.
• Queue survival: a deliberate multi-week hop outage with everything delivered, in priority order, on recovery.
• The courier path: a drone draining the summit queue in one loiter, timestamped end to end, with no site landing.
• Power truth: measured radio duty cycle and per-hop link records against the sites’ real winter power budgets.

One mountain, three relay sites, one winter. The evaluation format covers the structure.