Safety stop with congested clock sync (ordering ambiguity test)

2 source perspectives · asset SIM-AMR-01 · scenario s01-ambiguous

01 / Scope of analysis

Case SIM-2026-0002 (scenario s01-ambiguous). Window: 14000.046 ms of robot recording on the ROBOT_ROS_TIME clock.

Sources: 9 robot topics (kinesim/0.1.0) and 23 facility controller records. Both sources are synthetic and were generated by logically separate components; neither is a physically independent witness.

02 / Recorded chronology

Event	Shared-clock time	Observation	Source
E-002	00:00.200 ±0.05 ms	Navigation goal executing	robot-controller-sim
E-003	00:11.000 ±15.95 ms	Facility controller records zone safety input ESTOP-ZONE-B2 open	facility-controller-sim
E-004	00:11.003 ±13.95 ms	Facility controller broadcasts stop request to zone approach group	facility-controller-sim
E-005	00:11.008 ±2.55 ms	Robot safety I/O registers external stop input	robot-controller-sim
E-006	00:11.010 ±0.05 ms	Robot safety controller starts Category-1 controlled stop	robot-controller-sim
E-007	00:11.050 ±0.05 ms	Navigation goal aborted	robot-controller-sim
E-008	00:11.050 ±0.00 ms	Zero velocity command recorded on /cmd_vel	robot-controller-sim
E-009	00:11.930 ±10.05 ms	Odometry reports speed < 0.01 m/s held ≥ 200 ms	robot-controller-sim
E-010	00:12.130 ±0.05 ms	Robot safety controller reports drive power removed	robot-controller-sim

03 / Measured and derived facts

F-001Recorded sequence. E-003 Facility controller records zone safety input ESTOP-ZONE-B2 open → E-004 Facility controller broadcasts stop request to zone approach group → E-005 Robot safety I/O registers external stop input → E-008 Zero velocity command recorded on /cmd_vel → E-009 Odometry reports speed < 0.01 m/s held ≥ 200 ms. At least one step's order is not determinate within clock uncertainty. [E-003, E-004, E-005, E-008, E-009 · ordering indeterminate]

F-002Facility stop broadcast vs. robot stop input. The order of the facility stop broadcast (E-004) and the robot stop input (E-005) cannot be determined: the delta interval [-11.954, 21.046] ms spans zero. [E-004, E-005 · ordering indeterminate]

F-003Facility input change to robot stop input. Between the facility zone input change (E-003) and the robot stop input (E-005): -11.15 to 25.851 ms (indeterminate). [E-003, E-005 · bounded interval under assumptions]

F-004Reported speed at stop input. Wheel odometry reports 1.2 m/s when the stop input is registered (E-005), interpolated between /odom samples #550 (1.202 m/s) and #551 (1.198 m/s). [E-005 · derived from recorded values]

F-005Stop input to zero velocity command. The first zero velocity command (E-008) is recorded 40 ms after the stop input (E-005), same robot clock. [E-005, E-008 · derived from recorded values]

F-006Stop input to reported stationary. Odometry reports the robot stationary (E-009) 909.857 to 935.058 ms after the stop input (E-005). Reported travel in that window: 0.549 m; mean reported deceleration 1.29 m/s². [E-005, E-009 · derived from recorded values]

F-007Nearest lidar return when stationary. The /scan message nearest the reported stop (#119) has its closest return at 3.646 m, bearing -135° (robot frame). [E-009 · recorded value]

F-008Robot position relative to the facility zone. At the stop input the odometry pose is (9.24, 5.304) m, 1.96 m outside the mapped boundary of ZONE-B2. [E-005 · derived from recorded values]

F-009Facility-to-robot clock offset (derived from evidence). From 7 logged sync exchanges, the facility clock is 28.28 to 56.153 ms ahead of the robot clock at the stop input (width 27.873 ms); skew -200 to 200 ppm. [E-005 · bounded interval under assumptions]

F-012Navigation goal outcome. The navigation goal is recorded as ABORTED (E-007); drive power removal is reported at E-010. [E-007, E-010 · recorded value]

04 / Gaps and limitations

F-010Source coverage and evidence gaps. 2 of 2 expected sources present. Not present in this case: camera, physical contact sensor, person detection, and the identity of whatever opened the facility input. [E-003, E-005 · absence of signal]

F-011Record continuity. /odom: 701 messages, largest gap 20.095 ms (nominal 20 ms). Facility log: 23 records, sequence contiguous, hash chain checked separately by the verifier. [no events · recorded value]

What the data cannot show.

Whether the facility broadcast preceded the robot stop input: the clock uncertainty is larger than the gap.
What opened the facility zone safety input (a person, a test, an equipment fault): the facility source records the input change, not its cause.
Whether any person or object was in the zone: no camera or person-detection source is present.
Whether physical contact occurred: no contact sensor is present, and a speed drop does not imply a collision.
Whether odometry matches the robot's true motion: there is no external ground-truth tracking source.
The true clock relationship outside assumptions A1–A3.
Cause, fault or responsibility. These are not assessed by KINWIT.

05 / Questions for a human reviewer

Was the zone safety input opened by a person, an automated test, or an equipment fault? A separate source (door sensor, camera, operator log) is needed.
Is the declared PLC scan cycle (and therefore the detection latency bound) correct for the real controller?
Is the safety-link path facility → robot I/O the only path that could have produced the robot's stop input?
Would a measured clock reference (PTP / GNSS) be available on site to tighten the alignment interval?

06 / Non-attribution statement

This report orders and measures recorded events. It does not determine cause, fault, liability, regulatory compliance or the accuracy of the underlying sensors. Event order is not causation.

07 / Integrity

Manifest kinwit.evidence.v1, canonicalized with RFC 8785 (integer profile), signed with Ed25519 by kinwit-demo-signer-01 (fingerprint af1a 9a59 c6fc bd01 9be9 4785 6a3d f3e6 de04 b60d 82c3 93a1 5cd8 204c e0f4 beb5). Files are bound by SHA-256 and an RFC 9162 Merkle tree over 64 KiB chunks. Integrity verification shows that these bytes match what the key signed. It does not show that the simulated sensors are accurate.

File	Bytes	SHA-256
raw/robot_navigation.mcap	1314045	85506b8080bb1918dd580cf2a290a6e2775c9de93d53bfb97130902d1a581cfc
raw/facility_controller.jsonl	7563	eecf794ac852273ff961312ba3098b5f4d3cf6527791cef616e34688708aee77
derived/timeline.json	102571	2f88e5b586cb3e2cad7a73312ef119b00ce9efe0a2a6b478ebcc3d3a440ec32e
derived/facts.json	12086	e38d652da021b244c152dd6359a86558f75f0a2931904b082c1d3caa96aebcb7
derived/report.json	17727	1d131b088c8b5966cded80f27cbb3cf16a426886808f1a06de24edf52a5cd7ee

kinwit-facts/0.1.0 deterministic template (no AI) · manifest sha256 1c39c112df3bb767588a8ea8a3ca0e208ff00b53855b296c44dc63cc7358366e · SYNTHETIC DATA