CATACOMB

0.45m Map RMS error over a 3.0 km traverse, anchored

3.2km Mapped traverse per charge, mixed profile

2cm Voxel resolution of the delivered model

0.62m Width — set by a 0.7 m manhole, not by styling

Mission

CATACOMB is put through a portal, a breach, a manhole or a borehole and handed a signed mission envelope: a geographic extent, an abort time, and an engagement class. Everything it does afterwards happens inside that envelope, with no link, no satellite, and no prior knowledge of the space it is in.

It returns three products. First, a survey-grade three-dimensional model of everything it traversed — geometry at 2 cm, materials, and a trafficability layer that tells a human assault force whether they physically fit. Second, a communications chain, because it drops a BARROW relay behind it as it advances, so the model comes out while the robot is still going in. Third, presence: it can emplace charges, open a door, hold an intersection, or carry an operator-designated effector, so that the first thing into the tunnel is a machine.

The part that makes this a Fantom system rather than a research robot is the third leg of our thesis. Every observation, classification and decision is hash-chained and signed on the vehicle at the moment it happens. When the map says there is a four-metre blast door at station 1,842, an analyst can pull the eleven lidar sweeps, two thermal frames and one radar cube that produced that assertion, with the pose and timestamp of each and a signature chain proving none of it was edited afterwards. That is the difference between an intelligence product and an intelligence claim.

Designation: Subterranean assault robot
Configuration: Two main tracks, four 3-DoF limbs with driven sub-tracks
Autonomy: Revenant Core, 40 W, fully resident
Comms: Barrow optical chain · through-rock acoustic · opportunistic RF
Design point: Complete the mission with zero connectivity from the moment it crosses the portal
Status: Design. No prototype has been built.

Specifications

Design targets · Block 2

Geometry and mass
Length, tracks stowed	1.12 m
Width	0.62 m
Height, stowed / standing	0.44 m / 0.78 m
Combat mass	58.4 kg
Man-carry split	34 kg chassis + 24 kg pack, two-person
Minimum aperture	0.68 m circular · 0.55 × 0.80 m rectangular
Ground pressure, tracked	22 kPa
Payload bay	12.0 kg / 14 L

Mobility
Speed, tracked	0–2.4 m/s (0.6 m/s at full map quality)
Speed, legged	0–1.1 m/s
Gradient	45° dry · 38° wet
Step obstacle	0.55 m tracked · 0.90 m legged
Gap crossing	0.70 m
Stairs	To 45° pitch, riser ≤ 240 mm, at 0.4 m/s
Fording / submersion	0.55 m / IP68, 3 m for 30 min survival
Shaft descent	Capstan winch, 40 m × 2.2 mm UHMWPE, 1.8 kN, 0.3 m/s, self-belaying
Cost of transport	0.31 tracked / 1.42 legged — legs cost 4.6× per metre

Sensing
Lidar	2 × 128-beam, 865 nm, 20 Hz, 360° × 90°, dual-return, 45 m at 10% albedo, 2.6 Mpts/s
Cameras	4 × global-shutter mono, 1.6 MP, 30 fps, hardware-synced to IMU
Radar	77 GHz FMCW MIMO (4D), 0.3–50 m, 1.2° az / 2.0° el — the dust fallback
Thermal	LWIR 640 × 512, 30 Hz
IMU	Gyro bias instability 0.35 °/h, ARW 0.02 °/√h, accel BI 12 µg
Barometer	0.06 hPa — step-rejected against ventilation door cycles
Sonar altimeter	1 MHz single beam, 0.05–8 m, standing-water depth
Atmosphere	CO / CH₄ / O₂ / H₂S with LEL alarm
Illumination	850 nm NIR flood, operator-defeatable. No visible light.

Navigation performance
Estimator	Tightly-coupled lidar-inertial at 20 Hz on 400 Hz IMU, incremental factor graph at 2 Hz
Open loop, rich geometry	0.28% of distance, 1σ → 8.4 m at 3.0 km
Open loop, degenerate bore	1.9–4.1% along the tunnel axis
Anchored + 2 loop closures	0.45 m RMS · 1.2 m at the 95th percentile, at 3.0 km
Dead end, no anchors, no loops	2–6 m absolute. Stated plainly.
Relative, 20 m window	0.03 m
Vertical, 200 m of descent	0.6 m — degrades to ±8 m during a ventilation door cycle
Accuracy class	1:2000 relative, with anchors and closures

Power and endurance
Energy	2 × 1.05 kWh hot-swap packs, 2.10 kWh, propagation-blocked and vented
Compute, always on	78 W — Revenant Core 40 W + perception 38 W
Overwatch	34 W
Tracked cruise, 1.0 m/s	268 W
Legged, 0.6 m/s	598 W
Mixed-profile endurance	6.4 h at a 326 W mean → 3.2 km mapped
Overwatch endurance	48 h specified (61 h theoretical)
Battery swap	One pack at a time, 40 s, no power-down
Thermal limit	Legged duty cycle capped at 65% in still air at 35 °C

Data, comms and accountability
Raw log rate	70 MB/s — lidar 42, cameras 19 compressed, radar 6, other 3
Storage	4 TB encrypted NVMe = 15.2 h at full rate
Map package	≈ 1/400 of raw — a 3 km traverse is 380 MB
Barrow magazine	32 nodes. A 3 km traverse consumes 34–41.
Acoustic bearer	Floor thumper, 8 bps at 250 m · 2 bps at 600 m in competent rock
Data slug	90 g ejectable encrypted SSD capsule, dropped at a mapped point
Ledger	Every observation and decision hash-chained and signed on the node
Acoustic signature	64 dBA at 5 m tracked · 56 dBA legged

The drift budget

Barrow anchors

Log scale. The ember trace resets at each Barrow range anchor — a fixed node behind the robot along the tunnel axis directly observes the one direction a lidar cannot. Without it, a long straight bore is the failure case, not a corner case.

In a long, straight, constant-section tunnel the lidar point cloud is invariant under translation along the tunnel axis. There is literally no geometric information about how far you have moved.

The scan-matching problem is rank-deficient in one direction, and the optimiser will happily return any answer along it. Inertial dead reckoning takes over and integrates accelerometer bias twice. This is where open-loop error goes from 0.3% of distance to 4% — from a good map to a useless one, in the most common geometry underground.

Four things fight it. Leg kinematics supply a zero-velocity update every time a foot is in stance. Gravity fixes roll and pitch absolutely, so only yaw and position ever drift. Loop closure catches the error when a route rejoins itself. And BARROW nodes, once dropped, are static points that range optically to ±3 cm — which is why the relay chain is a navigation subsystem and not just a radio.

Concept of operations

Cue and envelope

DOWSER, imagery or human intelligence puts a portal or a shaft on the map. The mission envelope is written and signed before the vehicle moves: extent, abort time, engagement class, and cache points for the data.
Insertion

Through a breach, a portal, a manhole, or lowered down a borehole. Two people, two loads. Vehicle-off to robot-moving in six minutes.
Advance and chain

Tracked at 0.6 m/s at full map quality. A BARROW node is ejected every 80 m of straight run and at every corner and junction — corner nodes are not optional, because a single diffuse optical bounce off shotcrete costs 28 dB. The magazine holds 32; a 3 km traverse consumes 34 to 41. We would rather say that here than discover it at station 2,400.
Survey

At each chamber the robot stops, runs a full 360° × 90° sweep at low speed, classifies wall materials, logs atmosphere, and pushes the incremental map up the chain. Junctions are prioritised by information gain: it goes where the map is most uncertain, not where the passage is easiest.
Obstacle

Stairs in legged mode with the sub-tracks driving on the nosing. Rubble as a cost surface with a per-step slip probability, at 0.08–0.2 m/s. Shafts on the winch. Water flagged and sounded rather than assumed flat. A failed attempt marks a passage impassable-robot and unknown-dismount — because a human may fit where the vehicle does not, and the map must not lie about that.
Effect

Where authorised: emplace a breaching charge, open a door with the manipulator, mark a room, hold an intersection. Every action is signed as it happens, not reconstructed afterwards.
Retrograde or persist

Return along its own map and dump; or set overwatch at a designated intersection for up to 48 hours on the sensor suite alone; or leave a WAKE pod at the portal and go home.

Why it is built this way

Tracks for 92%, legs for 8%

A pure legged robot is a beautiful demonstration and a bad vehicle. Cost of transport for the legged mode is 1.42 against 0.31 tracked — legs cost 4.6 times the energy per metre. Using them for the whole traverse would halve the range.

So the limbs fold flat onto the track bogies and the machine is a fast, quiet, efficient tracked vehicle until the geometry demands otherwise. Then four 3-DoF limbs, each terminating in its own driven sub-track, take the load. Stairs, rubble, a 0.9 m step, a lip. Then they fold again.

A 77 GHz radar, because dust lies to everything else

After a breach, after a blast, or behind a moving vehicle, the air carries enough particulate to blind every optical sensor on the robot. Dust returns create phantom obstacles in the lidar and cameras see nothing at all.

Multi-return rejection recovers light and moderate dust: airborne particulate gives weak first returns with a large first-to-last range gap and no frame-to-frame consistency. In heavy dust nothing optical survives, and millimetre-wave is the only geometric sensor left. It is twenty times coarser — so the map degrades from survey-grade to trafficable-or-not, and it is labelled that way in the output. We do not silently hand an operator a bad map.

A winch, not a climbing robot

A 58 kg machine cannot free-climb a smooth 3 m concrete shaft and we are not going to pretend otherwise. An anchor dart goes into the shaft crown, the capstan pays out 40 m of 2.2 mm UHMWPE, and the vehicle self-belays down at 0.3 m/s.

This is the least reliable subsystem on the vehicle. Anchor set failure in shotcreted crown, line abrasion on a rough lip, and pendulum swing in a wet shaft are all live failure modes. It is where we expect to lose vehicles, and it is on this page for the same reason it is in the spec.

No visible light, and a defeatable infrared one

There is no white light on the vehicle. Lidar and radar are their own sources. The cameras work off an 850 nm flood which is invisible to the naked eye and entirely visible to an adversary with image-intensified night vision.

So the flood is defeatable. Under a visual-EMCON state the cameras contribute nothing and navigation runs on lidar, radar, inertial and kinematics. Mapping drops from 2 cm to 6 cm voxels and material classification is lost. That is a real cost and it is the operator's call, not ours.

Lower energy density, on purpose

The pack is a LiFePO₄ blend rather than the higher-density NMC the mass budget would prefer. A propagating thermal runaway in a confined space with one exit is not a risk we will carry into a tunnel with a dismounted force behind us.

The pack is potted, cell-to-cell propagation is blocked, and it vents through a directed path. That decision costs about 25% of the energy density and it is not negotiable.

The map is evidence, not a claim

Data that walked out of a hardened facility in a robot's memory has a provenance problem unless you solved it before you went in. Every point in the cloud carries the pose index and timestamp that produced it, hash-chained into Revenant Ledger.

Whatever route the data takes home — relay chain, retrograde, acoustic beacon or an ejected data slug — it arrives signed.

What happens when it loses comms entirely

Revenant Core

The design assumption is not that the link may fail. It is that it will.

The chain breaks when a corner node is knocked over, when a vehicle drives through the beam path, when post-breach dust puts 40 dB per hundred metres into the optical bearer, or when the roof falls in behind you. CATACOMB is specified to complete its mission with zero connectivity from the moment it crosses the portal, and everything on this page is sized for that case rather than for the good one.

It keeps going: The world model, ROE engine and mission plan are resident in 40 W. Loss of link changes nothing about what the robot knows or what it may do.
It cannot expand its own authority: No lethal effect without a Ledger authorisation that pre-dates the loss of comms and names the target class, the geofence and the time window. It cannot sign that for itself. A CATACOMB that loses comms maps.
It comes home: Retrograde along its own map to the last node that acknowledged, then to the portal. Blocked routes are re-planned through the topological graph.
It shouts through rock: A solenoid thumper coupled to the floor sends a coded seismic signal: 8 bps at 250 m, 2 bps at 600 m. Position, health and a found-it flag in about 40 seconds.
It leaves the data behind: A 90 g shock-tolerant, brightly marked, encrypted SSD capsule dropped at a mapped and reported point for a follow-on force.
It denies on tamper: Cryptographic erasure and mechanical destruction of the sensor apertures. The signature chain still proves a recovered vehicle's data is unaltered — a better outcome than thermite.

Where we beat the thin subterranean line

What we do not know yet

Open items · Block 2

Degenerate-geometry drift: Mitigated by BARROW anchors, not eliminated. A long straight bore with a failed chain is still a 2–4% along-axis error, and we do not have a general solution.
Leg actuator life: The current build demonstrates 140 h MTBF against a 500 h requirement. This is the top reliability item on the programme and it is not close.
Shaft descent: Anchor set failure in shotcreted crown is the failure we see most. There is no redundancy on the winch.
Dust blackout: Expect 10 to 60 minutes post-breach where the product is trafficability rather than geometry.
Thermal: 65% legged duty cycle at 35 °C in still air. In a hot, deep, unventilated facility this becomes the binding constraint on the mission rather than the battery.
Acoustic signature: 64 dBA at 5 m is detectable at 80 to 140 m in a hard-walled corridor. There is no such thing as a quiet tracked vehicle.
Magazine sizing: Thirty-two nodes does not cover 3 km once corner nodes are counted. Either the robot carries fewer sensors or the mission carries two robots. Open trade.
Coalition authorisation: "Signed by whom" is an unresolved policy question in any coalition operation. We have a mechanism and no doctrine.

Related systems

Subterranean

Barrow The relay chain CATACOMB drops, and the survey network that keeps its map honest.

Dowser Finds the portal before the robot has anywhere to go.

Marrow The surface UGV on the same locomotion stack — 1,400 lb of payload to the portal.

Request a briefing

Contact

Bring us a facility, a geometry and a threat picture. We will bring the drift budget, the power budget, and the list of things that are still unproven.

Request a briefing Subterranean domain

Programs: programs@fantom.aero
General: defense@fantom.aero
Status: Design. No prototype has been built.

Every figure on this page is a design target derived from first-principles analysis, not a measured result. No CATACOMB robot has been built. Where a number here is later measured and comes out worse, we will publish the measured number. No export-controlled information is published on this site.

Cue and envelope

Insertion

Advance and chain

Survey

Obstacle

Effect

Retrograde or persist