The Epistemic Robotics Project

The run

Sixty seconds without a radio

The belief is not a guess about the future. While the link is up it is the last pose that arrived. When the link falls, nothing arrives, and what is drawn from then on is the last velocity integrated forward: the partner is assumed to carry on doing what it was last seen doing. The disc is the positional covariance, which grows for as long as the outage lasts and never shrinks. At fifty seconds it crosses the threshold the requirement sets, the arrow turns red, and the engine says in as many words that where r1 is should no longer be believed.

Epistemic SLAM

Two views of one fact, and the moment they come apart

The demonstrations on this site rest on a coincidence that is easy to miss because it holds so consistently. A robot drives, its laser sweeps, slam_toolbox writes what it saw into a grid, and the epistemic layer writes the same event into a Kripke model. A bay the robot has not entered is unobserved in the grid and undecided in the model at once. Those are two views of one fact, and keeping them that way is what makes a run honest: no prepared map is published anywhere, so the robot cannot know a thing it did not look at.

The coincidence holds because one robot's observation drives both views. What this run does is take it away.

Three things SLAM does not store

An occupancy grid records a probability per cell. It does not record whose probability it is. A robot handed a merged map holds cells it never saw, and nothing in the format distinguishes them from cells it measured itself. That distinction is the whole of what the collaborative layer adds: coverage is a mask of what this robot observed, not of what is free in the map it happens to hold.

Nor does the grid record abstention. A cell at −1 was never observed, and a cell whose probability sits between the thresholds was observed and not resolved. Both are unknown to the epistemic layer, and collapsing the second into free or occupied would hand the model a certainty the sensor never produced. An occupancy grid stores a probability and a modal formula needs a decision, so a threshold has to be chosen somewhere; it is chosen once, in the classification, and nowhere else.

And it does not record disagreement. Two robots that observed the same cell and reached opposite conclusions have produced a fact about the fleet, not a defect in either map. Reconciliation here records the contradiction and does not stop; a disputed cell that somebody can go and look at again is worth more than a hole punched in the map, and worth much more than an average of the two readings, which would describe a floor neither robot saw.

Where knowledge ends and belief begins, in metres

While the link is up, what one robot holds about its partner is a received measurement: the partner said where it was, and the statement inherits whatever the partner's own localisation was worth. The instant the link falls that stops being an observation of anything. What continues is inference from a motion model, and the covariance is the distance it has travelled from the fact.

That gives the boundary a number, which is unusual. In the epistemic models on this site an agent either knows which of two worlds it is in or it does not, and the survey domains are built so that the question is settled by looking. Here the same distinction is continuous: the disc on the left of the film is how far the belief has drifted from being knowledge, and it widens for as long as nothing arrives. At fifty seconds it passes the threshold, and past that point the proposition about where the partner is has no business being treated as something the robot knows. The engine says so; what it cannot do is act on it, because marking that proposition uncertain means editing a model, and there is one model for the whole fleet rather than one per robot.

That last clause is the honest edge of this run. The two grids diverge because two robots observed different things while incommunicado, and reconciling them is the operation this layer performs. The two models never diverge, because there is only one, and an accessibility relation in it is a column of a shared structure and not a perspective held on a robot. Partitioning the model is a different piece of work.

Why merging maps is not a registration problem

The obvious reading of what happens at reconnection is that two grids must be aligned and combined. That reading is available and it is the wrong one. The alignment is arithmetic: both maps came from the same simulator at the same resolution, and putting them on a common extent is a translation by whole cells, with no interpolation and no rotation. Maps at different resolutions are refused rather than approximated, because a wrong registration produces a merged map that is confidently wrong, which is worse than one that is obviously missing.

What is not arithmetic is the question underneath: after the merge, what does each robot know? The answer is not the union of the grids. It is a per-robot fact, and this run reports it as one: the believing robot learned 5 246 cells it had never observed, the patrolling one 4 870, and neither now confuses them with cells it measured. That accounting is what the layer exists for, and it is the part an occupancy grid has no field for.

The measurement

The bound is met, and that is weaker than it sounds

The requirement admits an error of v_max·Δt + σ_prop, with v_max = 0.22 m/s taken from the speed the fleet's own controller enforces. Three runs, of thirty, sixty and a hundred and twenty seconds, meet it with no breaches: worst errors of 3.63, 6.97 and 19.20 m, each at the last sample and each larger than the one before, which is what an estimate that ages should do.

A propagation that holds the last velocity cannot fail this bound while the partner keeps its course, and the arithmetic gives the other half: a partner that reverses at full speed the instant the link falls separates at 2v·Δt and breaches the bound after σ_prop/v_max, which here is 0.23 s. What these runs show is that the engine tracks a partner that holds its course. They do not show that the bound cannot be broken.

The zero conflicts are the same kind of fact. The believing robot sits at its dock and the partner patrols elsewhere, so the two sets of observed cells barely touch; a contradiction needs two robots to have looked at the same cell and disagreed, and this pair never did. Routing them through one aisle from opposite ends is the next run.

Reproduction

Running it

colcon build --packages-select epistemic_msgs epistemic_comm epistemic_slam
colcon test --packages-select epistemic_comm      # 62 tests

ros2 launch epistemic_comm link_outage_launch.py t_disc:=70 t_recon:=130

t_disc and t_recon are seconds from the monitor's first clock tick, and the schedule is open loop on purpose: an outage triggered by distance would make its own duration a function of the trajectory it perturbs. Two JSON records are written per run, and the six behind the numbers above are published beside this page: short, baseline, long, and the run in the film as demo.

The full account is the report, A Link That Actually Falls: the three outage lengths, the proposition that fixes what the bound is and is not worth, the map alignment the reconciliation needed, and what it would take to make two robots hold two models instead of one.

Two findings from building it are worth recording here, because both cost a run to discover. Gating the announcement channel measures nothing: the channel is an audit path, read only by the transcript recorder, and the epistemic model advances through a service the executor calls when an action completes. And the reconciliation refused the first real pair of maps it was ever handed, for differing in size, which is correct and had never been exercised, because a test that builds both grids builds them the same shape and two maps that two robots built never are.