Safety Governor

command center · fail-closed verdict engine

Simulated dataState: NominalE-Stop: ARMED

Safety Score

composite governance index

98of 100

A+

envelope

100%

coverage

open

Emergency Stop Readiness

ARMED

Stop-path latency42 ms

Last self-test08:00:00 · pass

Redundant channels2 / 2 healthy

MRC profiledecel-to-stop · hold

Verdict Throughput

last 24h

18,599decisions

ALLOW

18,420

CLAMP

142

DENY

Operating Envelope

linear velocity × angular rate · admitted command region

phase plane

Envelope Bands

layered fail-closed limits

Hard kinematic limit
certified envelope · cap always wins
Nominal admitted region
all valid kinematics allowed
Degraded decel envelope
non-increasing speed · decel-to-stop

The envelope cap always wins over rate-of-change priority. In Degraded, only non-increasing speed on the decel-to-stop trajectory is admitted; re-acceleration is never authored.

Constraint Monitoring

active safety goals & envelopes

Speed envelope (SG1)1.2 m/s / ≤ 22.4 m/s
OK
Lateral containment (SG2)0.78 m / ≥ 0.40 m
OK
RSS safety distance (SG3)14.2 m / ≥ 9.0 m
OK
Geofence boundaryinside / corridor
OK
Comms heartbeat420 ms / ≤ 2000 ms
OK
Sensor confidence floor0.41 / ≥ 0.60
DEGRADED

Intervention History

governor actions

DENY12:04:21
KIRRA-13 cmd_vel 999 m/s — envelope breach
CLAMP12:01:09
KIRRA-08 4.1 m/s → 2.0 m/s (MRC decel)
DENY11:58:03
KIRRA-10 kinetic write in Degraded
MRC11:30:44
KIRRA-13 controlled stop — human reset pending
ALLOW11:02:18
KIRRA-09 cmd_vel 1.2 m/s dispatched

Rule Violations

fail-closed denials & lockouts

Time	Rule	Asset	Action
12:04:21	KINEMATIC_ENVELOPE_BREACH	KIRRA-13	DENY → MRC stop
11:58:03	DEGRADED_POSTURE_KINETIC_DENIED	KIRRA-10	DENY
11:41:55	UNKNOWN_ACTION_TYPE	KIRRA-09	DENY
10:22:10	CYCLE_DETECTED	fleet-dag	LOCKEDOUT