Exyn's onboard autonomy makes network loss a design question, not an afterthought

Exyn describes an autonomy system that carries its processing onboard and can map environments without relying on GPS or a continuous communications link. Its current product range includes the modular Nexys mapping system and software offered to integrators. This is a specific architectural response to difficult environments, not a general claim that communication no longer matters. The robot may be able to continue its task while the people responsible for the wider operation lose visibility of what it is doing. Exyn onboard mapping and post-processing; Exyn mapping platforms.

The vehicle and the service can degrade differently

A robot that remains stable and avoids obstacles has preserved one important function. An inspection service also needs to preserve the evidence it gathers, the relationship between that evidence and the mission, and the ability to explain any changes in behavior. A successful return with incomplete or unidentifiable data may still leave the operational question unanswered. Resilience should therefore be described in several layers: immediate control, mission completion, information recovery and the later decision. A single label such as offline-capable does not explain all four.

ANYbotics' Shift FAQ provides a useful comparison. It describes robots continuing missions while buffering data, then synchronizing after connectivity returns and notifying operators when a robot remains unreachable beyond a configured interval. That is a different product and operating context, but it makes the service-level questions explicit. Continuing the mission is one behavior; communicating its status and reconciling records are additional behaviors. The vendor description is not a substitute for testing a customer's actual network and site configuration. It does show which parts of the resilience story can be specified. ANYbotics Shift operational FAQ.

Recovery can create conflicting histories

When a disconnected robot returns, the site may have changed. An operator may have canceled a task, updated a route or sent another machine to inspect the same asset. The recovered data needs to retain the mission conditions under which it was gathered. Otherwise, a later system can interpret an old observation as a response to the new task. Synchronization is therefore not merely transferring files. It is reconciling events that occurred with different views of the world, while preserving enough history to explain the result.

The same issue arises with emergency intervention. If staff decide to retrieve a robot, they need to know what behavior to expect when communication resumes or when the machine encounters them. A vehicle designed for autonomous exploration may not have the same recovery procedure as one following a known inspection route. The procedure should be part of normal training, because an improvised recovery can expose people to the conditions the robot was intended to avoid. This does not diminish the value of onboard autonomy; it defines the surrounding work needed to use it responsibly.

Bad-day operation belongs in the service definition

Exyn's architecture is important because it reduces dependence on external positioning and continuous communication during the mapping task. Its practical limit is that the organization still has to manage uncertainty about mission status and the recovered information. A useful assessment includes interrupted tasks, delayed returns and partial datasets, rather than only a clean successful mission. The best outcome is not always uninterrupted operation. Sometimes it is a predictable stop, a clearly marked gap or a safe return with a precise account of what remains unknown. Infrastructure resilience improves when those outcomes are designed in advance and understood by the people who will rely on them.

An autonomous system designed only for normal conditions can become another dependency during disruption. A resilience plan should describe a smaller, controlled mission for the periods when communications, staffing or sensor information are incomplete. That mission may be less ambitious but easier for operators to understand and trust. EPA provides a resilience assessment checklist with a cybersecurity component. EPA small-system resilience assessment.

Define the smaller mission

The first question is which functions are essential. A monitoring service might preserve basic observations while suspending automatic recommendations. A control system might remain within predefined limits while waiting for supervision. The choice requires knowledge of the process; there is no universal degraded mode suitable for every asset.

Dependency maps help make the decision concrete. They should show the services, accounts and information feeds required for each function. A component that appears local may rely on a remote authentication service or a periodically renewed credential, which changes what can continue during an outage. NIST's Cybersecurity Framework 2.0 explicitly includes governance. NIST Cybersecurity Framework 2.0.

Practice with missing dependencies

Exercises should remove dependencies deliberately in a controlled environment and observe the resulting behavior. The test is not simply whether the machine stays powered. It is whether the remaining service is recognizable, bounded and useful, and whether operators receive a truthful explanation of what has stopped working.

Recovery needs equal attention. Normal service should resume only after the system reconciles stale instructions and confirms the relevant conditions. Resilience is therefore a complete operating cycle: reduce capability predictably, preserve what matters and return in an orderly way. Procurement should ask for evidence of the whole cycle.

An interrupted mission should also retain its original objective. When a robot returns with only part of a survey, the receiving team needs to identify exactly which question remains unanswered. Treating the partial result as a generic failure wastes useful evidence; treating it as complete creates a more serious information error.