Safety stop with a 1.8 s facility clock error (alignment robustness test)

2 source perspectives · asset SIM-AMR-01 · scenario s01-large-offset

01 / Scope of analysis

Case SIM-2026-0003 (scenario s01-large-offset). Window: 14000.032 ms of robot recording on the ROBOT_ROS_TIME clock.

Sources: 9 robot topics (kinesim/0.1.0) and 72 facility controller records. Both sources are synthetic and were generated by logically separate components; neither is a physically independent witness.

02 / Recorded chronology

Event	Shared-clock time	Observation	Source
E-002	00:00.200 ±0.05 ms	Navigation goal executing	robot-controller-sim
E-003	00:11.000 ±2.56 ms	Facility controller records zone safety input ESTOP-ZONE-B2 open	facility-controller-sim
E-004	00:11.003 ±0.56 ms	Facility controller broadcasts stop request to zone approach group	facility-controller-sim
E-005	00:11.018 ±2.55 ms	Robot safety I/O registers external stop input	robot-controller-sim
E-006	00:11.020 ±0.05 ms	Robot safety controller starts Category-1 controlled stop	robot-controller-sim
E-007	00:11.050 ±0.05 ms	Navigation goal aborted	robot-controller-sim
E-008	00:11.050 ±0.00 ms	Zero velocity command recorded on /cmd_vel	robot-controller-sim
E-009	00:11.930 ±10.05 ms	Odometry reports speed < 0.01 m/s held ≥ 200 ms	robot-controller-sim
E-010	00:12.140 ±0.05 ms	Robot safety controller reports drive power removed	robot-controller-sim

03 / Measured and derived facts

F-001Recorded sequence. E-003 Facility controller records zone safety input ESTOP-ZONE-B2 open → E-004 Facility controller broadcasts stop request to zone approach group → E-005 Robot safety I/O registers external stop input → E-008 Zero velocity command recorded on /cmd_vel → E-009 Odometry reports speed < 0.01 m/s held ≥ 200 ms. Each step is ordered within its stated uncertainty. [E-003, E-004, E-005, E-008, E-009 · bounded interval under assumptions]

F-002Facility stop broadcast vs. robot stop input. The facility stop broadcast (E-004) precedes the robot's recorded stop input (E-005) by 11.754 to 17.976 ms on the aligned timeline. [E-004, E-005 · bounded interval under assumptions]

F-003Facility input change to robot stop input. Between the facility zone input change (E-003) and the robot stop input (E-005): 12.367 to 22.589 ms (before). [E-003, E-005 · bounded interval under assumptions]

F-004Reported speed at stop input. Wheel odometry reports 1.196 m/s when the stop input is registered (E-005), interpolated between /odom samples #550 (1.202 m/s) and #551 (1.196 m/s). [E-005 · derived from recorded values]

F-005Stop input to zero velocity command. The first zero velocity command (E-008) is recorded 30 ms after the stop input (E-005), same robot clock. [E-005, E-008 · derived from recorded values]

F-006Stop input to reported stationary. Odometry reports the robot stationary (E-009) 899.876 to 925.069 ms after the stop input (E-005). Reported travel in that window: 0.561 m; mean reported deceleration 1.3 m/s². [E-005, E-009 · derived from recorded values]

F-007Nearest lidar return when stationary. The /scan message nearest the reported stop (#119) has its closest return at 3.675 m, bearing -135° (robot frame). [E-009 · recorded value]

F-008Robot position relative to the facility zone. At the stop input the odometry pose is (9.243, 5.291) m, 1.957 m outside the mapped boundary of ZONE-B2. [E-005 · derived from recorded values]

F-009Facility-to-robot clock offset (derived from evidence). From 56 logged sync exchanges, the facility clock is -1813.217 to -1812.117 ms ahead of the robot clock at the stop input (width 1.1 ms); skew -111.039 to 99.017 ppm. [E-005 · bounded interval under assumptions]

F-012Navigation goal outcome. The navigation goal is recorded as ABORTED (E-007); drive power removal is reported at E-010. [E-007, E-010 · recorded value]

04 / Gaps and limitations

F-010Source coverage and evidence gaps. 2 of 2 expected sources present. Not present in this case: camera, physical contact sensor, person detection, and the identity of whatever opened the facility input. [E-003, E-005 · absence of signal]

F-011Record continuity. /odom: 701 messages, largest gap 20.095 ms (nominal 20 ms). Facility log: 72 records, sequence contiguous, hash chain checked separately by the verifier. [no events · recorded value]

What the data cannot show.

What opened the facility zone safety input (a person, a test, an equipment fault): the facility source records the input change, not its cause.
Whether any person or object was in the zone: no camera or person-detection source is present.
Whether physical contact occurred: no contact sensor is present, and a speed drop does not imply a collision.
Whether odometry matches the robot's true motion: there is no external ground-truth tracking source.
The true clock relationship outside assumptions A1–A3.
Cause, fault or responsibility. These are not assessed by KINWIT.

05 / Questions for a human reviewer

Was the zone safety input opened by a person, an automated test, or an equipment fault? A separate source (door sensor, camera, operator log) is needed.
Is the declared PLC scan cycle (and therefore the detection latency bound) correct for the real controller?
Is the safety-link path facility → robot I/O the only path that could have produced the robot's stop input?
Would a measured clock reference (PTP / GNSS) be available on site to tighten the alignment interval?

06 / Non-attribution statement

This report orders and measures recorded events. It does not determine cause, fault, liability, regulatory compliance or the accuracy of the underlying sensors. Event order is not causation.

07 / Integrity

Manifest kinwit.evidence.v1, canonicalized with RFC 8785 (integer profile), signed with Ed25519 by kinwit-demo-signer-01 (fingerprint af1a 9a59 c6fc bd01 9be9 4785 6a3d f3e6 de04 b60d 82c3 93a1 5cd8 204c e0f4 beb5). Files are bound by SHA-256 and an RFC 9162 Merkle tree over 64 KiB chunks. Integrity verification shows that these bytes match what the key signed. It does not show that the simulated sensors are accurate.

File	Bytes	SHA-256
raw/robot_navigation.mcap	1318919	f83d13a6f96e80182dd937e0cf6b1ffd6e51a5e9e824b6027e9cf38b88d23418
raw/facility_controller.jsonl	25543	9174486a36ef29589f821628a9681c953bd26540d6e94bcc0ac53e8c456ac9cd
derived/timeline.json	113175	f8dd0a9d48507cf98a9cf13ea9816124cda0a15a05bfbdb0c1d40aed88a5a144
derived/facts.json	11950	f65bd4668d8555f81d4c921ed5fd728f60d96610f0b2a81c55b5bc4e4cad8de3
derived/report.json	17577	90a19650446ecd0cd4c0182d7f9a7495704e22b327ef9a79a433dcfba5e14c5a

kinwit-facts/0.1.0 deterministic template (no AI) · manifest sha256 415ee0d4a79b457b7e3666f56fb860a84402ac17fc623d089a8b8d2240d091db · SYNTHETIC DATA