ATLAS separates plant truth, sensed state, estimation, control, safety, actuation, execution, hardware normalization, and evaluation. This prevents a controller from using simulation-only information without that assumption being visible and makes both competing methods and competing model revisions run through the same evidence path.
The platform-level model-closure flow is shown in Simulation fidelity platform. The diagram below is the internal reference control loop executed within that larger evidence system.
BenchmarkScenario and seed
│
▼
Reference trajectory ───────────────┐
│ │
▼ │
Plant truth → sensor model → ESKF │
▲ │ │
│ ▼ ▼
rotor thrust ← allocation ← SE(3) geometric controller
▲ ▲
│ │
motor limits acceleration command
▲
│
CBF-QP safety filter
▲
│
baseline control or MPC
Every step → immutable trace → versioned evaluator → metrics
│
experiment spec → seeded rollout workers ────┴→ artifact store → CI / replay
The current benchmark runner can use exact simulated state with declared additive measurement noise. The ESKF is tested independently and is ready for a sensor-driven runner, but the default controller benchmark does not yet close the loop through the ESKF. This is a deliberate limitation, not an implied result.
External orchestrators may eventually submit bounded procedure requests, but they do not enter the internal control loop directly:
human / scheduler / agent
│
▼
protocol adapter (MHS, MCP, CLI, ROS 2, or vendor API)
│ translation only
▼
normalized procedure request
│
▼
ATLAS authorization + evidence supervisor ──denied──> retained decision artifact
│ approved
▼
declared executor → PX4 / device controller → physical system
│
└── independent watchdog, failsafe, and emergency path
ATLAS owns request identity, policy evaluation, human approval binding, experiment identity, attempt state, evidence, and replay. The device controller owns the time-critical control law. A protocol adapter cannot widen the procedure catalog, command envelope, or safety authority. See Agent-to-hardware assurance and ADR 0002.
Owns array types, controller and estimator protocols, quaternion/SO(3) mathematics, validation, RK4, exact zero-order-hold discretization, and Van Loan process-noise discretization. It does not depend on controllers or plants.
Owns physical truth models. QuadrotorModel exposes a continuous derivative, an RK4
step with quaternion projection, actuator allocation, and energy diagnostics.
Owns versioned robot-model manifests and structural QA. It validates model containment, content digest, units, inertias, frame topology, actuator naming/ranges, and optional MuJoCo compilation. Asset validation establishes declared model material, not hardware calibration.
Owns the policy-facing observation/action order, units, frames, step size, seeded reset, termination/truncation, action-clipping semantics, and episode trace. The environment adapts a plant for repeated execution without changing the plant mathematics.
Owns algorithms that produce control or acceleration commands. The SciPy MPC is the portable numerical reference. The acados backend is optional and should be compared against that reference before performance claims are made.
Owns nominal and covariance state. The ESKF uses a 16-element nominal state and a 15-dimensional local error covariance.
Owns hard safety projections. Failure is explicit: an infeasible CBF-QP raises an error instead of issuing an uncertified fallback.
Owns scenario configuration, analytic references, result schemas, metrics, seeded
campaigns, and the atlas-bench CLI. Benchmark code may compose components but does not
redefine their mathematics.
Owns canonical experiment and rollout contracts, content-derived identities, local multi-process execution, attempt state, provenance capture, atomic artifact publication, independent trace evaluation, numerical regression checks, and replay. The filesystem is the evidence plane and SQLite is a single-host query index. The package does not represent a local process pool as a remote scheduler.
Experiment Schema v2 distinguishes the complete experiment identity from a cross-platform case identity. The current runner rejects non-local or non-simulation contracts before publication rather than silently routing them through the reference simulator.
Owns immutable normalized signal traces, hardware manifests, declared CSV mappings, clock alignment, physical-unit divergence metrics, paired block-bootstrap comparison, actuator identification, held-out diagnostics, and checksummed calibration overlays. Raw hardware logs remain external source evidence. The package does not treat synthetic fixtures as hardware results.
These are optional boundaries. Core imports do not require JAX, MuJoCo, Warp, CasADi, acados, ROS 2, or PX4 messages. The MJX benchmark records the actual device and refuses MJX-Warp without a JAX GPU platform. Optional dependency absence is reported with actionable errors.
Future agent or hardware-protocol integrations live under integrations. They must
normalize into the same experiment and evidence contracts used by non-agent clients.
They do not own authorization policy, high-rate control, physical interlocks, or claim
promotion. Read-only telemetry is the first supported integration stage; write-capable
procedures require separate denial, idempotency, approval, timeout, and abort evidence.
The original src/controllers, src/dynamics, and src/estimation directories remain
unchanged for the five legacy demonstrations. New research code uses the installable
atlas_controls package. This avoids silently changing historical results while the
new architecture matures.
The complete execution and evidence contract is documented in Experiment Platform.