Autonomy stack

One perception, planning and fleet stack. Two vehicle domains. The world model does not know whether the actuators underneath it are six hub drives or four rotors, and it does not need to.

01 · Sensors to fleet

Architecture

Safety partition

Real-time safety MCU, independent of AI compute

01 / 05

Sensors

LiDAR, camera, radar, IMU, wheel and flow odometry, time-synchronised at the driver and stamped from a single clock.

02 / 05

Perception

Fusion into one metric world model: occupancy, tracked objects, traversability, and a calibrated confidence on each.

03 / 05

Planning

Route, behaviour and trajectory, solved against the world model and the vehicle envelope of whichever platform it is running on.

04 / 05

Control

Platform-specific actuation behind one interface: six hub drives on the ground, four rotors in the air.

05 / 05

Fleet

Assignment, telemetry, health and intervention across every unit in the deployment.

02 · Separate lane

Safety partition

A real-time safety MCU runs alongside the AI compute, not inside it. It holds the envelope, the geofence and the stop condition on its own power and its own clock. If the AI compute stops answering, the MCU is already in control of the outcome.

Partitioning is the whole argument. An AI compute module running learned perception is not a component you can argue to a safety case on its own, so it does not carry the safety case. It proposes; the MCU disposes.

The MCU has its own supply, its own clock, its own sensing for the handful of quantities it must never be wrong about, and no dependency on the network.

ENVELOPE · GEOFENCE CLAMPED AI COMPUTE · PROPOSESPERCEPTION · PLANNING SAFETY MCU · DISPOSESOWN SUPPLY · OWN CLOCK
It proposes; the MCU disposes.

03 · Defined behaviour

Deterministic failsafe

Select a fault to see how each part of the system responds.

The command link is not in the control loop. On loss, the platform continues the authorised plan or executes its return behaviour. It does not stop dead in a traffic lane, and it does not improvise.

System state

  • C2 link
  • AI compute
  • Perception confidence
  • Safety MCU
  • Geofence

Outcome

04 · OTA · Telemetry · Sim

Operating a fleet

OTA

Staged, signed, reversible

  1. Simulation
  2. Shadow fleet
  3. Canary cohort
  4. General rollout

Releases move through simulation, a shadow fleet and a canary cohort before general rollout. Every artefact is signed; every unit can roll back to the previous known-good image without a site visit. Updates never apply mid-mission. The unit takes them at a defined idle state, on a charger, inside a maintenance window.

Telemetry

Health before it is a failure

  • Pose
  • Power
  • Thermal
  • Module state
  • Planner decisions

Pose, power, thermal, module state and planner decisions stream to the fleet layer continuously, with a full-rate local log retained on the unit for post-incident work.

Drive-unit current signatures and pack behaviour drive maintenance scheduling rather than a fixed calendar.

Simulation

Every field failure becomes a test

  • Sensor dropout
  • Adversarial occlusion
  • Degraded traction

Logs replay against the stack bit-exact, so a fault seen once on a site is a regression case forever. Synthetic scenarios cover the cases we cannot safely stage (sensor dropout, adversarial occlusion, degraded traction) and gate every release.

05 · Fleet API

Developer interface

Fleet operations are addressable from your own systems. Dispatch a mission, subscribe to its event stream, and read back every planner decision that produced the result. This is the same stream the operations console is built on.

Platform selection is a constraint, not a commitment. Ask for "any" and the assignment layer picks the unit that can actually serve the route.

Interface preview. The endpoint contract is not yet frozen.

omegamtl · fleet dispatchTypeScript
import { Fleet } from "@ateon/omegamtl";

const fleet = await Fleet.connect({
  siteId: "blr-campus-01",
  token: process.env.OMEGA_TOKEN,
});

// Assign a multi-drop route to whichever unit can serve it.
const mission = await fleet.dispatch({
  platform: "any", // "agms-x1" | "aams-x1" | "any"
  stops: [
    { id: "dock-a", action: "load", module: "parcel-locker" },
    { id: "blk-c",  action: "drop", compartment: 3 },
    { id: "blk-f",  action: "drop", compartment: 7 },
  ],
  constraints: { returnBy: "17:30", minReserve: 0.25 },
});

for await (const event of mission.stream()) {
  // pose, health, module state, and every planner decision
  console.log(event.t, event.type, event.payload);
}

06 · Next step

Run it on your fleet.

OmegaMTL ships with the platforms. If you are evaluating autonomy across mixed ground and air operations, start here.

Talk to engineering