Safety stop with congested clock sync (ordering ambiguity test)

SIM-2026-0002·SIM-AMR-01·Robot + facility logs·Integrity verifiedSimulated

Report Verify evidence →

Facility signal → robot stop input

-12.0–21.0ms

Order cannot be proven: clock uncertainty exceeds the gap.

Robot reaction

40ms

Stop input to zero-velocity command, same clock

Time to stationary

0.92s

910–935 ms window, from odometry

Reported stop distance

0.55m

From 1.20 m/s, as reported by odometry

Replay

Warehouse W-01 · 00:08.508

Replay · recorded odometry

SIM-AMR-01 · 1.20 m/s

Timeline · shared robot clock00:08.508

Robot log

Facility log

0 s

14.0 s

Split evidence · ±40 ms around E-005

Each bar is where the real instant can lie

E-005 · input sampled by a 200 Hz poll: true arrival within one poll period before the stamp, ± jitter. Interval 11004.996 – 11010.096 ms on the shared clock.

Events

10 recorded events, each linked to its exact bytes

ID	Time (shared clock)	Event	Recorded at
E-001	00:00.150 ±0.05 ms	Navigation goal accepted	/navigate_to_pose/_action/status #0 bytes 20,749–20,812 · chunk 0
E-002	00:00.200 ±0.05 ms	Navigation goal executing	/navigate_to_pose/_action/status #1 bytes 27,890–27,953 · chunk 0
E-003	00:11.000 ±15.95 ms	Facility controller records zone safety input ESTOP-ZONE-B2 open	facility log · line 19 bytes 5,871–6,290 · chunk 0
E-004	00:11.003 ±13.95 ms	Facility controller broadcasts stop request to zone approach group	facility log · line 20 bytes 6,292–6,639 · chunk 0
E-005	00:11.008 ±2.55 ms	Robot safety I/O registers external stop input	/safety/stop_input #0 bytes 1,027,639–1,027,747 · chunk 15
E-006	00:11.010 ±0.05 ms	Robot safety controller starts Category-1 controlled stop	/safety/state #0 bytes 1,026,988–1,027,067 · chunk 15
E-007	00:11.050 ±0.05 ms	Navigation goal aborted	/navigate_to_pose/_action/status #2 bytes 1,029,520–1,029,583 · chunk 15
E-008	00:11.050 ±0.00 ms	Zero velocity command recorded on /cmd_vel	/cmd_vel #217 bytes 1,029,584–1,029,666 · chunk 15
E-009	00:11.930 ±10.05 ms	Odometry reports speed < 0.01 m/s held ≥ 200 ms	/odom #597 bytes 1,109,833–1,110,587 · chunk 16
E-010	00:12.130 ±0.05 ms	Robot safety controller reports drive power removed	/safety/state #1 bytes 1,127,863–1,127,948 · chunk 17

Clock alignment · from 7 sync exchanges

Calibrated

Offset at E-005: 28.280 … 56.153 ms (facility ahead of robot)
Skew interval: -200 … 200 ppm
Least-squares estimate: 40.224 ms @ t_ref, 486.819 ppm (lowest-delay 3)
Declared jitter: robot ±50 µs · facility ±10 µs + 1 µs resolution

A1 One-way network delays are non-negative (messages cannot arrive before they are sent).
A2 The facility clock runs at a constant rate relative to the robot clock within the record window, with |skew| ≤ 200 ppm.
A3 Logged sync timestamps are within each source's declared jitter and resolution of the true send/receive instants.

Key finding · F-002

The order of the facility stop broadcast (E-004) and the robot stop input (E-005) cannot be determined: the delta interval [-11.954, 21.046] ms spans zero.

Times are intervals after clock alignment derived from the evidence itself. Event order is not causation.

Findings

Click one to trace its evidence

What the data does not show

Whether the facility broadcast preceded the robot stop input: the clock uncertainty is larger than the gap.
What opened the facility zone safety input (a person, a test, an equipment fault): the facility source records the input change, not its cause.
Whether any person or object was in the zone: no camera or person-detection source is present.
Whether physical contact occurred: no contact sensor is present, and a speed drop does not imply a collision.
Whether odometry matches the robot's true motion: there is no external ground-truth tracking source.
The true clock relationship outside assumptions A1–A3.
Cause, fault or responsibility. These are not assessed by KINWIT.