A medical delivery corridor that can prove its link.

The mission

Two hospitals, fifty to eighty kilometres apart, exchange blood products, tissue samples and urgent pharmaceuticals several times a day. Today that is a courier car and ninety minutes of road; the corridor puts it at twenty-odd minutes of flight, on a fixed route flown beyond visual line of sight, every day, in most weather. The payload is small, time-critical and cold-chained — an aborted flight is not a retry, it is a spoiled shipment and a patient waiting.

Everything about the operation is repetitive by design: same route, same altitudes, same procedures. That repetition is also the opportunity — a fixed corridor can be measured, characterised and evidenced in a way an open-ended operation never can.

What breaks

Beyond-visual-range approval stands on continuous command-and-control. On a single cellular carrier, that promise dies by a thousand cuts: a coverage dip behind a hill, a congested cell at commuter hour, a tower maintenance window nobody told you about. Each dip is seconds long — and operationally decisive, because the operations manual says what a link loss means: climb, hold, return. A corridor that aborts one flight in twenty is not a logistics service; it is a demonstration.

The second failure is quieter and comes later: the audit. When the regulator, the insurer or the hospital’s clinical governance asks how the link actually behaved across the winter, an operator with a single modem and no instrumentation has anecdotes. Renewals, route extensions and night approvals all hang on evidence that mostly does not exist.

The architecture on this mission

The aircraft carries two or three cellular modems on different carriers, each an independent measured link, bonded into one encrypted tunnel with a fixed address. The ground side terminates at the operations centre; both ends sit behind ordinary mobile networks, connected through a relay node reachable from anywhere — no port forwarding, no special SIMs, nothing the carriers need to know about.

Command-and-control is duplicated across two carriers for the entire flight: the corridor’s coverage dips stop lining up with aborts, because carriers do not share masts, backhaul or maintenance windows, and a dip on one is routine traffic on the other. Endpoint roaming carries the session across every cell handover and address change in motion — a link that re-addresses is a non-event, not a reconnection. Per-SIM data quotas hold the route’s monthly communications cost to a number the service’s pricing can absorb, with the standing rule that a quota never takes down the last usable path.

The telemetry stream and any onboard video ride lower classes: present when capacity allows, first to yield when it does not, never contending with command.

How the delivery flight unfolds

1. The request. The blood bank books the slot; the cold-chained payload is loaded. Pre-flight, the aircraft’s node brings up its modems, the bonded tunnel to the operations centre confirms, and the journal opens a new sortie record.
2. Departure. The aircraft climbs onto the corridor with command duplicated across both carriers from the first metre. The operations centre watches measured per-carrier state, not signal bars.
3. The dip. Behind the hill at the corridor’s midpoint, one carrier drops out for a handful of seconds — the dip that aborts the single-carrier baseline. The other carrier is already carrying the duplicate, so the operations manual’s lost-link procedure is never invoked. The dip becomes a journal entry instead of an abort.
4. Handover after handover. Along the route the modems cross dozens of cells and one re-addresses mid-flight. Endpoint roaming keeps the session bound to keys rather than addresses — a reconnection that never happens.
5. Delivery. Twenty-odd minutes after departure the aircraft lands at the receiving hospital and the payload goes to the lab — against ninety minutes of road.
6. The record. The flight’s journal files itself: per-carrier round-trip, loss and every dip, timestamped, with what the bond made of them. Two hundred flights later, that file set is the safety case.

The audit trail

Every node keeps a persistent event journal and continuous per-link measurement: round-trip time, loss and jitter per carrier, per flight, with every link state change timestamped. For each sortie the operator holds an auditable record of what the command channel actually did — which carrier carried, where the dips were, how deep, and what the bond made of them. That is the difference between asserting continuity to a regulator and demonstrating it; over a season it is also the dataset from which route extensions and night operations get argued.

The honest boundary: Atlas contributes the link layer and its evidence. The aircraft, the type approvals, the operations manual and the regulatory relationship are the operator’s. And the record documents real network behaviour on the corridor — it is not a claim about resilience to deliberate interference.

What a pilot should prove

• Dropout statistics on the bonded configuration versus each single carrier, measured on the actual corridor across enough flights to be boring.
• Zero command-loss aborts attributable to coverage dips that the single-carrier baseline would have aborted on.
• A complete, per-flight link journal produced automatically, in a form the operator’s safety case can cite.
• Predictable monthly communications cost under quotas, including the duplicated command traffic.

The corridor’s repetitiveness makes this a clean experiment: fly the same route with and without the bond, and let the journal argue. The evaluation format covers how such a trial is structured.