HAZMAT and industrial-accident reconnaissance.

The mission

A railcar has ruptured at a chemical terminal; a tank fire at a refinery; a white plume nobody can yet name drifting off an industrial estate. The incident commander draws the cordon wide and sends machines in — a ground robot with gas sensors and a camera to the leak itself, a drone overhead to read the plume. The command post outside the fence needs two things from them continuously: the concentration readings that size the evacuation, and enough video to steer by. Every decision of the first hour hangs on a link into the worst radio environment the region has to offer, on a day when nothing about the site is behaving as designed.

What breaks

An industrial plant is a machine for killing radio links. Steel tanks, pipe racks, reinforced concrete and stacked containers carve the site into shadow and multipath — and the robot does not skirt them, it drives into them, because the leak is where the geometry is worst. The plume itself sits between the robot and every antenna outside the fence. The cellular that covers the plant on an ordinary day was planned for the offices at the gate, not the space between the tanks; where it reaches at all, the incident is now loading it.

The classical answers each cost something the first hour does not have. A tether snags on the first pipe rack. A single directional link needs exactly the line of sight this mission is defined by not having. And a robot that loses its link deep in the plant is not a paused sortie — it is either an abandoned machine or a person in a suit walking in to fetch it, which is precisely what the robot exists to prevent.

The architecture on this mission

The robot runs a node on its companion computer, bonding whatever it can reach — the line-of-sight radio back to the command post and whatever cellular penetrates the plant — into one encrypted tunnel with one address. The drive station and the sensor software see a single connection that never resets, whichever physical path is currently carrying it. Every link is probed several times a second; when the steel takes one away, traffic is off it within well under a second, without a switchover event and without the operator noticing.

Where the plant’s geometry kills every direct path, the mesh supplies one that bends. A vehicle at the perimeter fence is a relay node: the robot’s impossible long link becomes two short hops, each its own measured, encrypted session. A hovering aircraft does the same over the plume where the fence line cannot help. Every hop is encrypted, with keys rotated automatically every two minutes and zero packets lost during the swap. And because relays are simply authenticated nodes, moving the vehicle along the fence as the robot works deeper is routine — routes recompute continuously instead of being re-planned.

Traffic is classed by what it is. The drive channel and the sensor readings are small and critical: they hold reserved floors, and as measured loss climbs, adaptive redundancy duplicates them across every available path — in broadcast mode, three independent paths each losing 2% of packets deliver an effective loss of 0.0008%. Video is elastic: it fills whatever capacity remains and sheds quality first when the paths narrow. A camera can never crowd out a gas reading.

How the response unfolds

1. On scene. The cordon goes up and the command post stands off upwind. The robot powers on, the relay vehicle parks at the fence, and the nodes authenticate by key and join — one dashboard shows every link’s measured state before the robot crosses the gate.
2. The approach. Across the open apron both paths are healthy: the direct radio carries video, cellular rides alongside, readings begin streaming to the command post and into the incident log.
3. Behind the steel. The robot turns into the tank farm and the direct link dies against the first row — as expected. Traffic shifts to the relay hop and cellular in under a second; the drive operator, mid-manoeuvre, notices nothing.
4. The reading that matters. Concentrations spike at the leak and every path is now marginal — multipath on the relay hop, the plume loading the rest. Adaptive redundancy duplicates the readings and the drive channel across all of it; video drops to thumbnails; the numbers that size the evacuation keep arriving.
5. The relay moves. The robot works deeper and the vehicle repositions along the fence to follow; a drone lifts to hover as a second relay over the plume. Routes re-form around the moving nodes with no operator action.
6. The debrief. The journal holds a per-link, per-minute record of the sortie and a timestamped trail of every reading’s delivery — evidence for the incident record, the regulator and the next exercise’s planning.

What each mechanism contributes

• Multi-link bonding — line-of-sight radio and cellular as one tunnel with one fixed address; the robot never reconnects, whichever way out of the plant currently works. Shipped.
• Mesh relaying — the perimeter vehicle and the hovering aircraft are authenticated relay nodes; two short hops replace one blocked long one, each hop separately encrypted. Shipped.
• Class floors and adaptive redundancy — readings and the drive channel reserved and duplicated across paths as measured conditions worsen; video sheds quality first, never the reverse. Shipped, opt-in.
• Continuous measurement and the journal — a per-link, per-minute record of the sortie and of every reading’s delivery, usable as evidence afterwards. Shipped.

The honest boundary: Atlas moves the readings; it does not take them, and it does not make the evacuation call. It cannot manufacture propagation where none exists — deep inside a reinforced building the answer is a closer relay node, not more software. The robot, its sensors, the hardware’s suitability for the atmosphere it enters and the doctrine that sends it are the operator’s. And nothing here has been validated against deliberate interference in the field; what the mechanisms demonstrably survive is the structure-driven shadowing and loss this mission is actually made of.

What a pilot should prove

• Drive-channel and reading continuity through defined shadow zones of a real plant, where each single link measurably fails on its own.
• Failover behaviour from the journal: traffic reweighted off a dying path in under a second, with no operator action and no stream reset.
• Reading delivery under duplication through the worst measured interval, side by side with what any single link would have delivered.
• A timestamped per-link journal of the exercise, complete enough to stand in an incident record.

One plant, one robot, one exercise day. The evaluation format covers the structure.