Facility-triggered safety stop

2 source perspectives · asset SIM-AMR-01 · scenario s01-stop

01 / Scope of analysis

Case SIM-2026-0001 (scenario s01-stop). Window: 14000.032 ms of robot recording on the ROBOT_ROS_TIME clock.

Sources: 9 robot topics (kinesim/0.1.0) and 72 facility controller records. Both sources are synthetic and were generated by logically separate components; neither is a physically independent witness.

02 / Recorded chronology

Event	Shared-clock time	Observation	Source
E-002	00:00.200 ±0.05 ms	Navigation goal executing	robot-controller-sim
E-003	00:11.000 ±2.56 ms	Facility controller records zone safety input ESTOP-ZONE-B2 open	facility-controller-sim
E-004	00:11.003 ±0.56 ms	Facility controller broadcasts stop request to zone approach group	facility-controller-sim
E-005	00:11.018 ±2.55 ms	Robot safety I/O registers external stop input	robot-controller-sim
E-006	00:11.020 ±0.05 ms	Robot safety controller starts Category-1 controlled stop	robot-controller-sim
E-007	00:11.050 ±0.05 ms	Navigation goal aborted	robot-controller-sim
E-008	00:11.050 ±0.00 ms	Zero velocity command recorded on /cmd_vel	robot-controller-sim
E-009	00:11.930 ±10.05 ms	Odometry reports speed < 0.01 m/s held ≥ 200 ms	robot-controller-sim
E-010	00:12.140 ±0.05 ms	Robot safety controller reports drive power removed	robot-controller-sim

03 / Measured and derived facts

F-001Recorded sequence. E-003 Facility controller records zone safety input ESTOP-ZONE-B2 open → E-004 Facility controller broadcasts stop request to zone approach group → E-005 Robot safety I/O registers external stop input → E-008 Zero velocity command recorded on /cmd_vel → E-009 Odometry reports speed < 0.01 m/s held ≥ 200 ms. Each step is ordered within its stated uncertainty. [E-003, E-004, E-005, E-008, E-009 · bounded interval under assumptions]

F-002Facility stop broadcast vs. robot stop input. The facility stop broadcast (E-004) precedes the robot's recorded stop input (E-005) by 11.754 to 17.976 ms on the aligned timeline. [E-004, E-005 · bounded interval under assumptions]

F-003Facility input change to robot stop input. Between the facility zone input change (E-003) and the robot stop input (E-005): 12.367 to 22.589 ms (before). [E-003, E-005 · bounded interval under assumptions]

F-004Reported speed at stop input. Wheel odometry reports 1.196 m/s when the stop input is registered (E-005), interpolated between /odom samples #550 (1.202 m/s) and #551 (1.196 m/s). [E-005 · derived from recorded values]

F-005Stop input to zero velocity command. The first zero velocity command (E-008) is recorded 30 ms after the stop input (E-005), same robot clock. [E-005, E-008 · derived from recorded values]

F-006Stop input to reported stationary. Odometry reports the robot stationary (E-009) 899.876 to 925.069 ms after the stop input (E-005). Reported travel in that window: 0.561 m; mean reported deceleration 1.3 m/s². [E-005, E-009 · derived from recorded values]

F-007Nearest lidar return when stationary. The /scan message nearest the reported stop (#119) has its closest return at 3.675 m, bearing -135° (robot frame). [E-009 · recorded value]

F-008Robot position relative to the facility zone. At the stop input the odometry pose is (9.243, 5.291) m, 1.957 m outside the mapped boundary of ZONE-B2. [E-005 · derived from recorded values]

F-009Facility-to-robot clock offset (derived from evidence). From 56 logged sync exchanges, the facility clock is 40.998 to 42.097 ms ahead of the robot clock at the stop input (width 1.1 ms); skew -66.044 to 144.1 ppm. [E-005 · bounded interval under assumptions]

F-012Navigation goal outcome. The navigation goal is recorded as ABORTED (E-007); drive power removal is reported at E-010. [E-007, E-010 · recorded value]

04 / Gaps and limitations

F-010Source coverage and evidence gaps. 2 of 2 expected sources present. Not present in this case: camera, physical contact sensor, person detection, and the identity of whatever opened the facility input. [E-003, E-005 · absence of signal]

F-011Record continuity. /odom: 701 messages, largest gap 20.095 ms (nominal 20 ms). Facility log: 72 records, sequence contiguous, hash chain checked separately by the verifier. [no events · recorded value]

What the data cannot show.

What opened the facility zone safety input (a person, a test, an equipment fault): the facility source records the input change, not its cause.
Whether any person or object was in the zone: no camera or person-detection source is present.
Whether physical contact occurred: no contact sensor is present, and a speed drop does not imply a collision.
Whether odometry matches the robot's true motion: there is no external ground-truth tracking source.
The true clock relationship outside assumptions A1–A3.
Cause, fault or responsibility. These are not assessed by KINWIT.

05 / Questions for a human reviewer

Was the zone safety input opened by a person, an automated test, or an equipment fault? A separate source (door sensor, camera, operator log) is needed.
Is the declared PLC scan cycle (and therefore the detection latency bound) correct for the real controller?
Is the safety-link path facility → robot I/O the only path that could have produced the robot's stop input?
Would a measured clock reference (PTP / GNSS) be available on site to tighten the alignment interval?

06 / Non-attribution statement

This report orders and measures recorded events. It does not determine cause, fault, liability, regulatory compliance or the accuracy of the underlying sensors. Event order is not causation.

07 / Integrity

Manifest kinwit.evidence.v1, canonicalized with RFC 8785 (integer profile), signed with Ed25519 by kinwit-demo-signer-01 (fingerprint af1a 9a59 c6fc bd01 9be9 4785 6a3d f3e6 de04 b60d 82c3 93a1 5cd8 204c e0f4 beb5). Files are bound by SHA-256 and an RFC 9162 Merkle tree over 64 KiB chunks. Integrity verification shows that these bytes match what the key signed. It does not show that the simulated sensors are accurate.

File	Bytes	SHA-256
raw/robot_navigation.mcap	1318911	0e004a82c733d98a17adee5725a41cadf2f0dca42a4b8edc6a90c650d27c6a14
raw/facility_controller.jsonl	25543	54bca92202f5abacd9becec3909c5ba10c83cf76d4534254ac1522169fe562db
derived/timeline.json	112629	280483098f9302a45957be94ace8118e5413f7354dcb9b8c44d65c95db9ae910
derived/facts.json	11931	923853643ddccd6eee0365b744cddf2db3d03284c5838235bb0058e1b13849aa
derived/report.json	17550	571308bc0e4e5fb99f44863aa6a1ba716c9664cedab61df61bf99e7d2ebf6f72

kinwit-facts/0.1.0 deterministic template (no AI) · manifest sha256 661cc21301cd9f952e683b0c2321d93611203db6fd4cf01b33ececba548d84a2 · SYNTHETIC DATA