From Single Platforms to Coordinated Fleets: Safety- and Security-Bounded Autonomous Multi-Robot Systems for Nuclear Decommissioning in Europe

1. Introduction

Nuclear dismantling and decommissioning (D&D) have become major industrial challenges in the European energy transition. Worldwide decommissioning liabilities are estimated at hundreds of billions of euros over the coming decades [3], while a growing proportion of Europe’s nuclear reactors have exceeded their original design lifetimes [4]. Despite this increasing demand, radiological surveys of contaminated buildings still rely heavily on operators wearing protective equipment and carrying handheld detectors through areas where exposure time must be minimised. Handheld instruments cover a limited area during each pass, dose constraints restrict mission duration, and currently available portable systems rarely provide simultaneous neutron, gamma, alpha and beta measurements [5].

Ground robots improved the safety of radiological surveys following the Fukushima Daiichi accident [6,7], and radiation-informed autonomous navigation has since been demonstrated in unknown nuclear environments [8]. However, most deployed robotic systems remain limited to a single platform and a narrow range of tasks. Moreover, relatively few studies have demonstrated autonomous radiation mapping inside facilities containing nuclear material under representative operational conditions [9,10]. These limitations motivate the development of heterogeneous robotic fleets capable of combining complementary mobility, sensing and autonomy functions within a common operational framework.

Our European Robotics Forum 2025 conference paper [1] reviewed the environmental, material, regulatory and deployment challenges associated with autonomous robotic systems in the nuclear sector. It also examined the state of radiation-detection technology and relevant European research initiatives, including the HADRON concept and laboratory at the Institute for Energy Technology (IFE), which support the transition from individually teleoperated robots towards hazard-aware and digitally integrated fleets. A companion conference paper [2] presented the mid-term technical progress of the project fleet.

The present article extends this earlier work by examining how such a capability can be made safe, secure and auditable, and how it is being validated within the EURATOM Innovation Action XS-ABILITY (Accessing hard-to-reach areas with Advanced and Breakthrough Innovation for reLiable In-situ characterisation of a facility) Grant Agreement No. 101166392. Running from October 2024 to September 2027 under call HORIZON-EURATOM-2023-NRT-01-07, XS-ABILITY is developing an autonomous heterogeneous fleet of ground and aerial robots for the in situ radiological characterisation of nuclear facilities.

This article makes four contributions beyond the two conference papers [1,2]. First, Section 2 traces the relevant EURATOM project lineage and identifies the lessons that influenced platform selection, sensor integration and the XS-ABILITY work package 4 multi-robot deployment strategy. Second, Section 3 presents the integrated capability stack, including the robotic platforms, nuclear instrumentation, ROS 2 coordination architecture, simultaneous localisation and mapping (SLAM), and radiological digital twin. It distinguishes incremental engineering developments from the genuinely novel elements of the system and provides a statement on reproducibility. Third, Section 3.5 introduces a safety and security framework covering radiological protection under the as-low-as-reasonably-achievable (ALARA) principle, runtime assurance, dose budgeting for commercial off-the-shelf (COTS) electronics, decontamination and failure-management procedures, fleet cybersecurity, and the consolidation of five regulatory regimes within a common conformity dossier. Fourth, Section 4 presents initial experimental evidence from the integrated campaign conducted at SCK CEN, Belgium, in April 2026. These results provide a baseline for the subsequent campaign planned at the Ignalina Nuclear Power Plant in Lithuania.

Section 5 discusses the implications and limitations of the work, including threats to validity and the human–robot interaction (HRI) challenges associated with the supervisory control of safety-constrained robotic fleets. Section 6 concludes the article and outlines the remaining steps towards system-level validation.

2. Related Work: The EURATOM Lineage of XS-ABILITY

The design of the EURATOM XS-ABILITY project builds on more than a decade of European research on robotics for nuclear decommissioning and radiological characterisation. Earlier projects investigated remote manipulation, mobile radiation mapping, digital twins and robotic autonomy. Their achievements, together with the limitations encountered during their implementation, progressively shaped the requirements for a coordinated multi-robot characterisation capability. Figure 1 summarises this development and identifies the principal contributions carried forward into XS-ABILITY.

RoMaNS (Robotic Manipulation for Nuclear Sort and Segregation; H2020 Grant Agreement No. 645582, 2015–2018) focused on robotic manipulation for sorting and segregating nuclear waste. The project developed bimanual teleoperation supported by haptic feedback [11] and investigated the associated human-factors challenges [12]. Its results demonstrated the potential of high-dexterity remote manipulation to reduce direct human intervention. However, manipulation systems operating within fixed or spatially constrained work cells do not, by themselves, address the need for facility-scale radiological characterisation. This experience highlighted the importance of combining manipulation with mobile sensing and spatially referenced environmental information when robotic systems are deployed beyond individual workstations.

CLEANDEM (EURATOM Grant Agreement No. 945335, 2021–2024) subsequently addressed mobile radiological characterisation by equipping a Robotnik RB-VOGUI+ unmanned ground vehicle (UGV) with radiation sensors and simultaneous localisation and mapping capabilities [13,14]. The project demonstrated that a mobile robotic platform could support autonomous radiological surveying and mapping in nuclear environments. At the same time, it highlighted the practical limitations of relying on a single ground platform. Such a platform cannot readily access elevated structures or geometrically constrained areas, while the use of a single robot restricts opportunities for parallel coverage and provides limited mission-level redundancy. In parallel, CENTAURO investigated the integration of hybrid locomotion and manipulation for disaster-response operations [15], illustrating both the operational potential and the integration complexity of highly capable individual platforms.

The institutional link between these European initiatives and XS-ABILITY was further developed at the Institute for Energy Technology (IFE). Established in 2019, the HADRON (Hazard Aware Digitalisation and Robotics in Nuclear and other domains) concept and laboratory brought together robotic platforms, three-dimensional building information models and radiological simulation within a hazard-aware digitalisation framework [16]. In parallel, IFE contributed to RoboDecom (Research Council of Norway, BIA programme, Project No. 296079, 2019–2023), an industry-led innovation project coordinated by NLINK AS in partnership with IFE, SINTEF, Createc and other Norwegian and international collaborators, which investigated the deployment of Spot from Boston Dynamics, Jackal from ClearPath and nLink platforms in representative decommissioning scenarios. IFE's contribution centred on three-dimensional mission simulation and digital-twin-based planning support, integrated through a safety framework aligned with standards including ANSI/A3 and ISO 18646 [1,16]; related verification and validation outcomes were reported through the OECD Nuclear Energy Agency's HTOR programme [17,18].

Experience gained through HADRON and RoboDecom informed three aspects of the subsequent XS-ABILITY design. First, commercial off-the-shelf (COTS) platforms can provide a practical basis for nuclear applications when nuclear-specific requirements are addressed through payload integration, operating procedures and appropriate safety measures. Second, digital twins provide greater operational value when they are continuously updated with robot and sensor data rather than used only as static planning models. Third, safety documentation and verification evidence should be developed throughout the system lifecycle instead of being assembled only before deployment. These observations are presented as project-level engineering lessons and should not be interpreted as general conclusions applicable to every nuclear robotic deployment.

XS-ABILITY incorporates these lessons into the design of a heterogeneous robotic fleet. Its platform portfolio includes Boston Dynamics Spot, Clearpath Jackal, Flyability Elios 3, the Sigma Rover and the Sentinel platform (see Figure 2). This selection follows the COTS-platform-plus-specialised-payload approach previously investigated within RoboDecom. Much of the nuclear-specific development is therefore concentrated in compact, ROS-compatible instruments and their integration interfaces, as described in Section 3.2, rather than in the development of entirely bespoke robotic platforms.

The XS-ABILITY work package 4 deployment strategy extends this approach by assigning complementary roles to legged, wheeled, rail-based and aerial robots. This heterogeneity is intended to address the accessibility, coverage and redundancy limitations encountered in earlier single-platform deployments. Rather than requiring one robot to perform every task, XS-ABILITY combines platforms whose mobility and sensing characteristics are suited to different parts of the same characterisation mission.

XS-ABILITY is also linked to the complementary EURATOM project DORADO (Digital Twins and Ontology for Robot-Assisted Decommissioning Operations; Grant Agreement No. 101165990, September 2024–August 2027). DORADO develops a digital-twin, building-information-modelling and ontology ecosystem to support the planning of dismantling and decommissioning operations [17,18]. The relationship between the two projects connects robotic characterisation with downstream planning: three-dimensional facility scans acquired during XS-ABILITY field campaigns are transferred to DORADO, where they feed the digital representations and planning tools developed within that project, establishing continuity between data acquisition, environmental modelling and decommissioning planning.

3. Materials and Methods

3.1. Project Objectives and Quantified Targets

XS-ABILITY is a 36-month Innovation Action coordinated by the French Alternative Energies and Atomic Energy Commission (CEA), gathering eight partners from seven European countries: four research organisations (CEA, IFE, VTT, SCK CEN), two small and medium-sized enterprises (CAEN, Flyability), and one industrial company (Sigma Ingegneria). Work is organised so that sensors specified in work package 2 and developed in work package 3 are integrated onto robotic platforms in work package 4, fused and visualised in work package 5, and demonstrated in work package 6. The project commits to four quantified operational targets relative to current manual practice: a reduction by a factor of five in the dose received by operators carrying out D&D operations; a reduction by a factor of ten in the time required to localise hotspots and contaminated areas; a gain of a factor of two in the time needed to clean a pipe or tank when online monitoring is available; and an average 30% reduction in the cost of a given D&D task [19]. These four figures are contractual project targets recorded in the grant agreement; they are not observed experimental results. None has been measured or verified in a licensed facility at the time of writing, no baseline manual survey has been recorded against which they could be evaluated, and no result reported in Section 4 quantifies operator dose, hotspot-localisation time or cost. They are stated here solely to make the project's declared ambition auditable.

3.2. Heterogeneous Fleet and Nuclear Instrumentation

The fleet integrated under XS-ABILITY work package 4 comprises six platform types, corresponding to eight physical units once the three Elios 3 aerial vehicles are counted individually (Table 1). Ground coverage is provided by the Boston Dynamics Spot legged UGV for stair and debris traversal, the Clearpath Jackal wheeled UGV for repeatable floor-level survey, and the Sigma Ingegneria Rover, a four-wheel-drive, four-wheel-steering UGV undergoing a hardware redesign centred on fully European in-house electronics, a deliberate strategy to ensure component sovereignty and reduce dependence on end-of-life parts; its navigation subsystem fuses three-dimensional LiDAR, inertial and wheel-encoder data for SLAM-based localisation. The Sigma Sentinel, a modular rail-based platform originally developed for industrial gas-leak surveillance, is adapted for autonomous continuous wall-scanning with two to seven degrees of freedom of actuation depending on surface geometry and metrological-grade positioning traceability; it stitches two-dimensional radiometric maps across surfaces up to 6 m high and 3 m wide per module and is deployable by two operators in under three hours [2]. Aerial access to confined and elevated volumes is provided by three collision-tolerant Flyability Elios 3 caged unmanned aerial vehicles (UAVs); a Clearpath Warthog serves as a SLAM benchmarking platform at VTT.

Nuclear instrumentation follows the compact, ROS-compatible pattern inherited from the legacy analysis. The CAEN GAMON instrument, shown in Figure 3, supports gamma spectrometry and, depending on its detector configuration, combined gamma and neutron monitoring using lithium-sensitive scintillation technology, and is being repackaged into a reduced-footprint enclosure with streamlined electronics and upgraded ROS 2 drivers for quadruped and wheeled deployment [2,20]. CEA contributes the miniaturised NanoPix coded-aperture gamma camera (see Figure 3) for three-dimensional hotspot localisation, the Small Multi-Radiation Detector (SMRD) for combined gamma/neutron dose-rate monitoring, and a compact beta/gamma spectrometry chain targeting ⁹⁰Sr and ¹³⁷Cs, the dominant fission products in D&D environments, mounted on the Rover’s Schneider Lexium collaborative arm through a custom bracket equipped with three precision lasers for surface-relative positioning. The chain couples an EJ212 plastic scintillator (0.4 cm thick, 10 cm × 10 cm active area) to a photomultiplier tube and the CAEN Gammastream multichannel analyser, yielding a compact assembly of 35.6 cm × 12 cm and 1.32 kg; calibration, energy-resolution characterisation and background measurements were performed on bare civil-engineering concrete samples and extended by an MCNP6 Monte Carlo model [21] to geometries impractical to reproduce in the laboratory, following the portable beta-spectrometry approach of [22].

3.3. ROS 2 Coordination, SLAM and the Radiological Digital Twin

The integration architecture (Figure 4) is based on ROS 2 Jazzy on Ubuntu 24.04 [23], with platform-specific interfaces exposed through standardised topics, services and actions so that sensors and algorithms can be re-hosted across platforms with minimal rework. Each robot runs its own SLAM solution, FAST-LIO2 for tightly coupled LiDAR-inertial odometry [24], KISS-SLAM for three-dimensional pose estimation [25], SLAM Toolbox for two-dimensional mapping [26], and the proprietary FlyAware engine onboard the UAVs, and local maps and robot states are exchanged to maintain a shared global representation; inaccessible areas identified by the UGVs trigger UAV deployment. In this benchmarking, conducted jointly by IFE and VTT, FAST-LIO2 and the Ouster software development kit both produced accurate three-dimensional maps with complementary strengths on the Jackal platform equipped with an Ouster OS0-128 LiDAR (see Figure 5): the vendor kit offers sensor-specific in-collection filtering, whereas FAST-LIO2 is sensor-agnostic and integrates directly into a ROS 2 pipeline [2]. Except for FlyAware, all these SLAM stacks, together with Nav2, Potree [27] and CloudCompare, are open-source; XS-ABILITY plans to contribute drivers and integration packages back to the ROS 2 ecosystem (Section 3.6).

Fleet-level coordination builds on an energy-aware, relative-rank frontier-assignment strategy in which each robot receives the exploration segment for which it holds the lowest motion-energy rank [28], extending classical frontier exploration [29] with cost-aware motion planning and map sharing for multi-agent SLAM. A complementary risk-aware navigation layer, developed by CEA with IMT Mines Alès and the University of Montpellier, fuses LiDAR occupancy, radiological dose-rate estimates and communication-quality indicators, each normalised against robot and mission constraints, into a unified grid of composite traversal costs [30] of the generic form

$$c\left(x\right)=w_o o\left(x\right)+w_d d\left(x\right)+w_q q\left(x\right), w_o+w_d+w_q=1, w_i \ge 0$$

(1)

where $o\left(x\right)$ is the normalised occupancy or geometric-difficulty cost of cell $x$, $d\left(x\right)$the normalised dose-rate cost, $q\left(x\right)$ the normalised communication-degradation cost, and the weights $w$ encode mission priorities. A cost-minimising extension of A* over this grid penalises high-radiation and communication-degraded zones even at the expense of path length [30]. Mission-level assignment over inspection waypoints is treated as a travelling-salesman problem, solved exactly by the Held–Karp dynamic program [31] for small instances and by the Lin–Kernighan heuristic [32] for larger fleets; continuous inter-robot exchange enables cooperative re-planning under robot failure or communication loss.

Above the fleet, multi-session point-cloud maps are merged by iterative-closest-point alignment in CloudCompare and rendered through Potree, an open-source WebGL viewer enabling browser-based exploration with configurable dose-coded colour overlays. This radiological digital twin is the convergence point with DORADO: characterisation data acquired by the fleet populates the twin, which in turn drives ALARA-informed mission re-planning, the live feedback loop identified as decisive in the legacy analysis, and consistent with recent digital-twin fleet platforms for nuclear environments [33].

3.4. Delimitation of Incremental and Novel Contributions

Incremental elements include the individual platforms (all COTS), the individual SLAM algorithms (state of the art but pre-existing [24,26]), the frontier-exploration principle [29], the travelling-salesman solvers [31,32] and the use of ROS 2 as middleware [23]. Novel or first-of-kind contributions, supported by the cited external literature rather than asserted, are: (i) the integration of simultaneous gamma/neutron detection with radionuclide identification (GAMON) on legged and wheeled UGVs within a single ROS 2 fleet, reviews of ground-based nuclear robotics [9] and of non-destructive characterisation [5] document no comparable fleet-level capability; (ii) the automated tethered-power system co-developed by Flyability and IFE, in which the Jackal transports the caged UAV to the inspection site and a mechanised spool, passive on the outward leg and actively wound on return with winding speed modulated from the FlyAware home-distance estimate, extends continuous flight from under seven minutes with a sensor payload on battery alone to up to 45 minutes, validated under laboratory conditions, with vision-based precision landing demonstrated so far only in simulation [2]; (iii) the beta/gamma chain's minimum measurement times of 0.9 s for surface and 11.3 s for subsurface contamination at one third of the European Commission clearance threshold for a 50/50 ⁹⁰Sr/¹³⁷Cs mixture [34], the longer subsurface time reflecting beta attenuation in the concrete matrix, which robotise a measurement previously confined to portable laboratory instruments [22]; and (iv) the multi-criteria risk-aware traversal-cost formulation unifying dose, occupancy and communication quality [30]. Each of these is at a declared readiness level (Section 5.3) rather than presented as an accomplished product.

3.5. Safety and Security Framework for Nuclear Robotic Deployment

No robotic capability enters a licensed nuclear zone on technical merit alone. Any deployment should proceed only with formal authorisation aligned to the site's safety case and the relevant regulatory requirements, applying defence-in-depth in a graded way. The system's reliability and performance, its interfaces with people and existing procedures, and its cybersecurity and control arrangements must all be demonstrated to meet nuclear safety and security expectations; structured reliability justification is itself an active research topic for robotic systems in decommissioning safety cases [35]. This section presents the integrated safety and security framework developed within XS-ABILITY (Figure 6), synthesising radiological protection, functional safety, cybersecurity and regulatory conformity into a single auditable architecture.

3.5.1. Design Principles

The framework is governed by five design principles adopted from nuclear defence-in-depth and the ISO 12100 machinery-safety hierarchy: defence-in-depth, with at least two independent barriers per consequential hazard; independence of the safety layer from mission software; graceful degradation through verified degraded modes; ALARA and as-low-as-reasonably-practicable convergence, so that mitigations jointly reduce worker dose and residual mechanical or AI risk and never one at the expense of the other; and verifiability, so that an unverifiable mitigation is accounted as residual risk rather than as a barrier.

3.5.2. Regulatory Integration

A heterogeneous fleet in a nuclear facility sits at the intersection of five legal regimes, each with its own conformity route; the framework maps them into a single dossier. Machinery safety is governed by Regulation (EU) 2023/1230 [36] with harmonised standards ISO 13849-1 and IEC 62061 for safety-related control functions. Radiological protection falls under Council Directive 2013/59/Euratom [37] and IAEA GSR Part 6 [38], enforced through national site licensing, for example by the Federal Agency for Nuclear Control in Belgium, the State Nuclear Power Safety Inspectorate in Lithuania and the Autorité de sûreté nucléaire et de radioprotection in France, and through an ALARA programme. Aviation law applies to the caged UAVs through Regulation (EU) 2019/947 [39] in the specific category with the EASA specific-operations risk assessment methodology; operations wholly inside closed structures may in some jurisdictions fall outside the aviation regime, but the framework conservatively applies that discipline regardless, concentrating the assurance burden on geofencing to the cell boundary. Cybersecurity is addressed through the IEC 62443 zones-and-conduits architecture [40] and compatibility with the host facility's obligations under Directive (EU) 2022/2555 (NIS2) [41]. Artificial intelligence is engaged through the product route of Regulation (EU) 2024/1689 [42]: because the learned perception and planning components are safety components of machinery, conformity is assessed within the Machinery Regulation technical file rather than under a parallel stand-alone regime, producing one coherent dossier instead of five compliance narratives.

3.5.3. Radiological Safety: ALARA, Dose Budgeting and Contamination Control

The primary radiological function of the fleet is itself protective: replacing human surveyors in dose fields directly implements ALARA. The framework nevertheless treats robots as radiological objects in their own right. A radiation-aware dose-budgeting method converts component irradiation data into operational service-life limits for COTS electronics. Accumulated total ionising dose is tracked per platform,

$$D_{acc}\left(T\right)={\sum }_i {ḋ}_i \Delta t_i \le (1-m) D_{lim},$$

(2)

where ${ḋ}_i$ is the dose rate is measured by the platform's own dosimetry during mission segment $i$, ${\Delta t}_i$the segment duration, $D_{lim}$ the component-class tolerance and $m$ a design margin; swap policies retire perception and compute modules (cameras, Jetson-class computers) before degradation can corrupt SLAM or dose estimation. This addresses the documented vulnerability of commercial electronics, polymers and sensor optics to cumulative radiation [9,10] without resorting to radiation-hardened components whose cost would be prohibitive for a fleet of this size. Component-level irradiation studies illustrate how strongly this margin depends on the part in question: selected COTS microcontrollers and operational amplifiers have been reported to remain functional at total ionising doses of several hundred krad, although tolerance is strongly component-, condition- and test-dependent [43].

Contamination control and failure protocols complete the radiological picture. Platforms operating in contaminated zones follow pre-egress swab-testing and release-measurement procedures aligned with the clearance criteria of [34]; material selection avoids components without a disposal pathway, mitigating the orphan-waste risk; and every mission plan includes a recovery procedure for an immobilised platform, so that a robot failure never obliges an unplanned human entry, the failure mode that would negate the ALARA benefit the fleet exists to provide. Decontamination-tolerant enclosure design supports wipe-down without ingress.

3.5.4. Functional Safety and Runtime Assurance for AI Components

The framework's structural answer to the AI-verification problem is a runtime-assurance architecture in the Simplex tradition [44]: mission autonomy, SLAM, perception, path planning, mission optimisation, executes as untrusted, high-performance software, while a comparatively simple supervisory safety controller continuously verifies that commanded behaviour remains inside a pre-verified envelope defined over speed, acceleration, geofence containment, separation distances and dose-accumulation rate. Out-of-envelope commands are vetoed; persistent violation forces transition down a degraded-mode ladder, full autonomy (M0), assisted teleoperation (M1), safe-hold (M2), minimal risk condition (M3). Three perception-side mechanisms feed the controller: calibrated uncertainty on perception outputs via deep ensembles [45], out-of-distribution detection scored against the training distribution [46] and routed through the same fault chain as a hardware failure, and localisation-health monitoring. Cyber events are absorbed by the same envelope: a spoofed command that violates the envelope is vetoed identically to a faulty one, giving the safety argument a single choke point.

3.5.5. Fleet Cybersecurity

A networked fleet enlarges the attack surface of the host facility, and ROS 2 security is not a solved problem: the default data distribution service configuration provides neither authentication nor encryption, and the SROS 2 hardening layer, while operationalising the DDS-Security extensions [47], has documented design-level vulnerabilities including certificate-revocation limitations and exploitable default misconfigurations [48]. The framework therefore does not rely on middleware security alone. Fleet communications are segmented into IEC 62443 zones and conduits [40]; radiological telemetry crosses zone boundaries over encrypted, authenticated MQTT; model updates for learned components are delivered as signed container images pulled during pre-mission checklists rather than by on robot reflashing; and anomalous robot behaviour is monitored at the supervisory controller, whose envelope (Section 3.5.4) bounds the physical consequence of any successful intrusion. Digital-twin data paths receive the same treatment, since a compromised twin could misrepresent radiological conditions and induce inappropriate operator responses, a risk analysed in the wider digital-twin security literature [49,50], and assurance of the learned components themselves remains an open research problem [51].

3.5.6. Verification, Validation and the Safety Case

Every mitigation in the framework carries at least one verification activity, organised as a multi-level programme: unit and hardware-in-the-loop tests with fault injection at the HADRON Laboratory; integrated trials in representative facilities (SCK CEN, Section 4.1); and licensed demonstrations (Ignalina, Section 4.3; the G2 graphite reactor at CEA Marcoule in 2027). Evidence from each level feeds an auditable safety case aligned with the mobile-robot performance criteria of ISO 18646 and the documentation practices established in RoboDecom [1]. This continuous evidence approach directly implements the third legacy lesson of Section 2: safety artefacts are produced as the system is built, not reconstructed at licensing time, an approach consistent with the sector's progression from traditional toward assisted robotic deployments [52].

3.6. Reproducibility, Software Versions and Open-Science Status

Because this article reports an integration effort rather than an algorithmic result, reproducibility must be assessed at the level of the configuration rather than of a benchmark score. The reproducible elements are the middleware and operating-system versions given in Section 3.3; the open-source SLAM, navigation and visualisation components, each identified by its primary publication [24,25,26,27,29]; the commercially available platforms and detectors listed in Table 1; and the laboratory calibration procedure of the beta/gamma chain, described in [2] and traceable to the MCNP6 model of [21]. The non-reproducible elements are the FlyAware SLAM engine (proprietary), the project-internal ROS 2 drivers for GAMON, the SMRD and the NanoPix camera, and the datasets acquired inside licensed facilities, which are subject to host-facility security review (see the Data Availability Statement).

4. Results: Experimental Campaigns

4.1. Integrated Validation at SCK CEN, April 2026

The first integrated field campaign took place in April 2026 at SCK CEN in Mol, Belgium, using the BR1 ventilation building and the BR3 decommissioned pressurised-water reactor as representative environments combining confined geometries, residual radiation fields and structural complexity (see Figure 7). The campaign objective was deliberately scoped to system integration and interoperability, the practical bottleneck identified across the nuclear-robotics literature [9,10], rather than to isolated component performance. Three main outcomes were obtained (Table 2). First, end-to-end validation of the GAMON–Jackal integration was achieved across three levels, mechanical mounting, electrical interfacing and ROS 2 data transport, and the radiological and pose streams were shown to remain time-aligned while the platform operated in a residual dose field. Second, inside the BR1 ventilation building the Jackal localised itself from LiDAR measurements alone, with no external positioning aid of any kind, which fixes the GPS-denied navigation baseline for the project. Third, the ROS 2 service interfaces of the beta/gamma chain and of GAMON were both exercised in operational conditions, so middleware behaviour is now characterised for field use rather than assumed from laboratory testing. The three-dimensional reconstructions of the BR1 lower and main levels and of the BR3 reactor environment provide the geometric baseline for radiological data registration in subsequent campaigns [2].

The scope of the campaign must be stated precisely. It validated deployment, GPS-denied navigation and synchronised radiological data acquisition under residual radiation fields. It did not include radiation-endurance testing of the platform electronics, so the dose budgets of Section 3.5.3 remain anchored in component-level literature and manufacturer data; it did not quantify the metrological accuracy of the radiological-to-geometric registration; and it did not exercise multi-robot coordination, since a single ground platform was deployed in the reported configurations.

A follow-up integration cycle at IFE in Halden in late June 2026 extended the tests to the Spot quadruped fitted with its custom perception payload. an Ouster OS0-128 LiDAR in a 3D-printed protective cage on an aluminium top plate, four Stereolabs ZED X stereo cameras, an NVIDIA Jetson AGX Orin with 64 GB of memory and a buck-converter power stage, enclosed in a printed shell with quick-attach mounting guides, completing the WP4 sensor–robot integration cycle [2].

4.2. Methodological Chaining Between Campaigns

The campaign sequence is designed as an evidence chain rather than as a series of independent demonstrations, and the mapping between them is explicit (Table 2). Three artefacts are carried forward from SCK CEN unchanged: the sensor–robot interface definitions, which are frozen and replicated across additional platforms; the GPS-denied navigation baseline, which is transferred to the larger RBMK-scale geometry of Ignalina; and the field-proven middleware configuration, which is reused without modification so that any anomaly observed at Ignalina can be attributed to scale or environment rather than to configuration drift. Two artefacts are deliberately deferred: fleet-level coordination, which requires more than one platform in the field, and metrological registration accuracy, which requires reference measurements on real contaminated surfaces.

4.3. Planned Validation at the Ignalina Nuclear Power Plant, September 2026

The next validation campaign is planned for September 2026 at the Ignalina Nuclear Power Plant, Lithuania, one of Europe's most significant decommissioning sites, where two RBMK-1500 units are being dismantled. This campaign is the direct continuation of the April 2026 SCK CEN deployment. It must be stressed that the campaign is forthcoming: no results exist at the time of writing, and this subsection describes the deployment plan and expected scenarios only.

The IFE team plans to deploy on site together with CAEN and other consortium partners. The fleet comprises two UGVs and one UAV: the Boston Dynamics Spot and the Clearpath Jackal, both contributed from IFE’s HADRON Laboratory, together with a Flyability Elios 3. Both UGVs are equipped with RGB-D cameras and Ouster OS0-128 LiDARs for dense three-dimensional perception. Radiological sensing is distributed across the fleet: the GAMON gamma/neutron detector is mounted on the Spot, while a Thermo Scientific RadEye G20-ER10 extended-range gamma survey meter, integrated through a ROS 2 driver, is carried by the Jackal, providing an independent, industry-standard dose-rate reference alongside the project-developed instrumentation. The Elios 3 caged UAV, fitted with its radiation-sensing payload, is to be deployed to map the volumes unreachable by the ground platforms: elevated galleries, overhead structures and confined penetrations.

The mission objective is twofold: to produce a complete three-dimensional reconstruction of the surveyed area through coordinated multi-robot LiDAR-SLAM, and to generate a registered radiation map by fusing the GAMON, RadEye and UAV dose-rate streams onto the shared point-cloud geometry, the facility-scale instantiation of the digital-twin workflow of Section 3.3. This exercises precisely the capabilities that SCK CEN validated at integration level: multi-robot coordinated survey of large, multi-room contaminated volumes; UGV-triggered UAV deployment; and radiological data registration on real RBMK-era surfaces. Because published datasets of fleet-scale radiological characterisation inside real nuclear facilities remain scarce [5,9], the anticipated results are expected to be of direct interest to the D&D community. In parallel, operational field testing of the Sentinel autonomous wall-scanning system with the CAEN alpha/beta acquisition chain is planned for September 2026, and a full-scale demonstration at the G2 graphite reactor at CEA Marcoule is scheduled for 2027 (Figure 8).

5. Discussion

5.1. Implications for the Field

XS-ABILITY's mid-term evidence supports a specific and bounded claim: a modular, standards-based ROS 2 architecture can bridge nuclear-instrumentation development and robotic integration across a multi-partner consortium, producing an integrated capability stack that no single partner could deliver alone. The evidence for this claim is integration evidence, interfaces, synchronisation and middleware reliability under real radiation, not performance evidence. If the Ignalina and G2 campaigns confirm the approach at facility scale, the practical consequence for the D&D industry would be a shift in procurement logic: from qualifying bespoke robots to qualifying payloads, interfaces and safety envelopes on interchangeable COTS platforms. That shift also relocates the regulatory burden, since a payload-centric qualification argument must be re-established whenever a platform is substituted.

5.2. Human–Robot Interaction in Safety-Bounded Supervision

Within the journal's human–computer interaction scope, the most consequential HRI question raised by our architecture is supervisory rather than manipulative. The runtime-assurance design of Section 3.5.4 changes the operator's role: instead of teleoperating platforms, the human supervises a fleet whose behaviour is bounded by a verified envelope, intervening at degraded-mode transitions. This raises open questions that the D&D literature has begun to examine in the progression from traditional toward assisted deployments [52] and in immersive digital-twin fleet interfaces [33]: how to present envelope state and veto events without inducing alarm fatigue; how much authority the operator should have to override a safety veto; and how a dose-coded digital twin should support ALARA-aware human decisions in real time. Our web-based twin, built on Potree with dose overlays, is the substrate on which these interaction patterns are to be evaluated during the Ignalina campaign. We consider the operator-facing layer, not the autonomy, to be the least mature element of the stack, and we note that no human-factors evaluation has yet been carried out.

5.3. Limitations

Six limitations must be stated explicitly. First, the integrated system is at technology readiness level 4–5; individual payloads span a wider range, GAMON and the Elios 3 being nuclear-qualified while the perception and compute stack is general-industry validated only, and higher readiness remains a target rather than an achievement. Second, the SCK CEN campaign validated integration, not metrological performance: the fusion of radiological measurements with point-cloud geometry has yet to demonstrate the sub-decimetre accuracy that clearance decisions require. Third, radiation hardening of perception components for sustained high-dose operation is managed, not solved, by dose budgeting; sustained operation near high-activity sources would exhaust component budgets quickly, and no platform of the fleet has yet been irradiated. Fourth, simultaneous UGV–UAV operation in confined spaces raises airspace-management and operational-safety questions that the risk-assessment treatment of Section 3.5.2 addresses procedurally but that only the Ignalina and G2 use cases will test operationally. Fifth, the cybersecurity posture inherits the open problems of the ROS 2 ecosystem [47,48], and hardening guidance specific to nuclear safety cases is not yet codified by regulators, which constrains the maturity ceiling of the shared stack. Sixth, the quantified project targets of Section 3.1 remain unverified, and no baseline manual-survey campaign has been reported against which they could be measured.

5.4. Threats to Validity

Three threats to validity qualify the conclusions. The construct validity of “validated integration” rests on qualitative pass criteria, data received, streams synchronised, localisation maintained, rather than on quantitative thresholds, so a stricter definition of validation would not yet be satisfied. Internal validity is limited by the absence of repetition: each reported outcome derives from a single campaign, without repeated trials, and therefore supports no uncertainty statement. External validity is limited by facility specificity: BR1 and BR3 are research-reactor environments, and their transferability to an RBMK-1500 industrial geometry is an assumption that the September 2026 campaign is designed to test rather than a demonstrated property.

6. Conclusions

This article extended our earlier conference reports [1,2] into a full account of how the EURATOM XS-ABILITY project is converting a decade of European lessons into an operational multi-robot characterisation capability. The EURATOM legacy analysis showed that XS-ABILITY's defining choices, COTS platforms carrying nuclear-specific payloads, ROS 2 sensor abstraction, digital-twin feedback and continuous safety evidence, are direct responses to the documented limitations of RoMaNS, CLEANDEM and the HADRON and RoboDecom programmes. The integrated technology stack couples six heterogeneous platform types with compact gamma/neutron and beta/gamma instrumentation, distributed SLAM, energy-and risk-aware coordination and a dose-coded radiological digital twin. The safety and security framework binds five regulatory regimes into a single conformity dossier and bounds AI-based autonomy inside a runtime envelope, with ALARA, dose budgeting, contamination control and IEC 62443 cybersecurity treated as first-class design constraints rather than compliance afterthoughts.

The April 2026 SCK CEN campaign delivered the project's first integrated field evidence, sensor–robot interoperability, GPS-denied navigation and middleware reliability under real radiation, and thereby established the baseline on which the September 2026 Ignalina campaign will attempt facility-scale, fleet-level radiological characterisation of a genuine RBMK decommissioning environment. Three questions define the critical path from here: whether radiological-to-geometric registration can reach clearance-grade accuracy; whether dose budgeting can be instantiated with measured component tolerances rather than literature values; and whether supervisory interfaces can keep a human meaningfully in command of a bounded fleet. Answering them, rather than adding platforms, is what would move coordinated heterogeneous fleets from research promise to a procurable capability for Europe's decommissioning programme.