Facility-triggered safety stop

SIM-2026-0001·SIM-AMR-01·Robot + facility logs·Integrity verifiedSimulated

Report Verify evidence →

Facility signal → robot stop input

11.8–18.0ms

Facility first. Order proven across both clocks.

Robot reaction

30ms

Stop input to zero-velocity command, same clock

Time to stationary

0.91s

900–925 ms window, from odometry

Reported stop distance

0.56m

From 1.20 m/s, as reported by odometry

Replay

Warehouse W-01 · 00:08.518

Replay · recorded odometry

SIM-AMR-01 · 1.20 m/s

Timeline · shared robot clock00:08.518

Robot log

Facility log

0 s

14.0 s

Split evidence · ±40 ms around E-005

Each bar is where the real instant can lie

E-005 · input sampled by a 200 Hz poll: true arrival within one poll period before the stamp, ± jitter. Interval 11014.950 – 11020.050 ms on the shared clock.

Events

10 recorded events, each linked to its exact bytes

ID	Time (shared clock)	Event	Recorded at
E-001	00:00.150 ±0.05 ms	Navigation goal accepted	/navigate_to_pose/_action/status #0 bytes 21,289–21,352 · chunk 0
E-002	00:00.200 ±0.05 ms	Navigation goal executing	/navigate_to_pose/_action/status #1 bytes 23,125–23,188 · chunk 0
E-003	00:11.000 ±2.56 ms	Facility controller records zone safety input ESTOP-ZONE-B2 open	facility log · line 57 bytes 19,813–20,232 · chunk 0
E-004	00:11.003 ±0.56 ms	Facility controller broadcasts stop request to zone approach group	facility log · line 58 bytes 20,234–20,581 · chunk 0
E-005	00:11.018 ±2.55 ms	Robot safety I/O registers external stop input	/safety/stop_input #0 bytes 1,030,774–1,030,882 · chunk 15
E-006	00:11.020 ±0.05 ms	Robot safety controller starts Category-1 controlled stop	/safety/state #0 bytes 1,032,300–1,032,379 · chunk 15
E-007	00:11.050 ±0.05 ms	Navigation goal aborted	/navigate_to_pose/_action/status #2 bytes 1,033,266–1,033,329 · chunk 15
E-008	00:11.050 ±0.00 ms	Zero velocity command recorded on /cmd_vel	/cmd_vel #217 bytes 1,033,330–1,033,412 · chunk 15
E-009	00:11.930 ±10.05 ms	Odometry reports speed < 0.01 m/s held ≥ 200 ms	/odom #597 bytes 1,113,911–1,114,665 · chunk 16,17
E-010	00:12.140 ±0.05 ms	Robot safety controller reports drive power removed	/safety/state #1 bytes 1,132,024–1,132,109 · chunk 17

Clock alignment · from 56 sync exchanges

Calibrated

Offset at E-005: 40.998 … 42.097 ms (facility ahead of robot)
Skew interval: -66.044 … 144.1 ppm
Least-squares estimate: 41.178 ms @ t_ref, 37.939 ppm (lowest-delay 14)
Declared jitter: robot ±50 µs · facility ±10 µs + 1 µs resolution

A1 One-way network delays are non-negative (messages cannot arrive before they are sent).
A2 The facility clock runs at a constant rate relative to the robot clock within the record window, with |skew| ≤ 200 ppm.
A3 Logged sync timestamps are within each source's declared jitter and resolution of the true send/receive instants.

Key finding · F-002

The facility stop broadcast (E-004) precedes the robot's recorded stop input (E-005) by 11.754 to 17.976 ms on the aligned timeline.

Times are intervals after clock alignment derived from the evidence itself. Event order is not causation.

Findings

Click one to trace its evidence

What the data does not show

What opened the facility zone safety input (a person, a test, an equipment fault): the facility source records the input change, not its cause.
Whether any person or object was in the zone: no camera or person-detection source is present.
Whether physical contact occurred: no contact sensor is present, and a speed drop does not imply a collision.
Whether odometry matches the robot's true motion: there is no external ground-truth tracking source.
The true clock relationship outside assumptions A1–A3.
Cause, fault or responsibility. These are not assessed by KINWIT.