One perception, planning and fleet stack. Two vehicle domains. The world model does not know whether the actuators underneath it are six hub drives or four rotors — and it does not need to.
LiDAR, camera, radar, IMU, wheel and flow odometry, time-synchronised at the driver and stamped from a single clock.
Fusion into one metric world model: occupancy, tracked objects, traversability, and a calibrated confidence on each.
Route, behaviour and trajectory, solved against the world model and the vehicle envelope of whichever platform it is running on.
Platform-specific actuation — six hub drives on the ground, four rotors in the air — behind one interface.
Assignment, telemetry, health and intervention across every unit in the deployment.
A real-time safety MCU runs alongside the AI compute, not inside it. It holds the envelope, the geofence and the stop condition on its own power and its own clock. If the AI compute stops answering, the MCU is already in control of the outcome.
Partitioning is the whole argument. An AI compute module running learned perception is not a component you can argue to a safety case on its own — so it does not carry the safety case. It proposes; the MCU disposes.
The MCU has its own supply, its own clock, its own sensing for the handful of quantities it must never be wrong about, and no dependency on the network.
The command link is not in the control loop. On loss, the platform continues the authorised plan or executes its return behaviour — it does not stop dead in a traffic lane, and it does not improvise.
If the AI compute stops answering the watchdog, the safety MCU already holds the envelope. It brings the platform to a defined safe state on its own power and its own clock.
Confidence is a first-class output, not an afterthought. As it falls, the planner derates speed and widens clearance before anything becomes a fault.
Boundaries are enforced on the safety partition, not in the planner. A software fault upstream cannot authorise a breach.
Releases move through simulation, a shadow fleet and a canary cohort before general rollout. Every artefact is signed; every unit can roll back to the previous known-good image without a site visit. Updates never apply mid-mission — the unit takes them at a defined idle state, on a charger, inside a maintenance window.
Pose, power, thermal, module state and planner decisions stream to the fleet layer continuously, with a full-rate local log retained on the unit for post-incident work. Drive-unit current signatures and pack behaviour drive maintenance scheduling rather than a fixed calendar.
Logs replay against the stack bit-exact, so a fault seen once on a site is a regression case forever. Synthetic scenarios cover the cases we cannot safely stage — sensor dropout, adversarial occlusion, degraded traction — and gate every release.
Fleet operations are addressable from your own systems. Dispatch a mission, subscribe to its event stream, and read back every planner decision that produced the result — the same stream the operations console is built on.
Platform selection is a constraint, not a commitment. Ask for
"any" and the assignment layer
picks the unit that can actually serve the route.
Interface preview. The endpoint contract is not yet frozen.
import { Fleet } from "@ateon/omegamtl";
const fleet = await Fleet.connect({
siteId: "blr-campus-01",
token: process.env.OMEGA_TOKEN,
});
// Assign a multi-drop route to whichever unit can serve it.
const mission = await fleet.dispatch({
platform: "any", // "agms-x1" | "aams-x1" | "any"
stops: [
{ id: "dock-a", action: "load", module: "parcel-locker" },
{ id: "blk-c", action: "drop", compartment: 3 },
{ id: "blk-f", action: "drop", compartment: 7 },
],
constraints: { returnBy: "17:30", minReserve: 0.25 },
});
for await (const event of mission.stream()) {
// pose, health, module state, and every planner decision
console.log(event.t, event.type, event.payload);
}OmegaMTL ships with the platforms. If you are evaluating autonomy across mixed ground and air operations, start here.
Talk to engineering