Time and Time Source¶
A robot system carries at least three clocks that do not have to agree: the chassis, the host running our server, and the building hardware. As long as nothing is ordered by time, that is harmless. The moment a queue is decided by "who claimed first", it stops being harmless.
Where each timestamp comes from¶
| Timestamp | Source | Used for |
|---|---|---|
Fleet heartbeat seit |
host clock of the uGo server | precedence between robots |
Lift claim claimedAtMs |
gateway host clock | lift queue order |
Frame t |
host clock of the sender | freshness |
| Chassis move timestamps | chassis clock | chassis-internal only |
| Log lines | host clock | reading a run afterwards |
The important line is the last but one: the chassis clock does not enter any ordering. That is deliberate, and it is what made the drift below survivable.
The drift, and what it turned out to be¶
| Date | Observation |
|---|---|
| 18.08.2026 | chassis clock exactly 8 h off |
| 25.08.2026 | 4 h 48 min off |
| 26.08.2026 | all three chassis within 8 seconds of the host |
Exactly eight hours is not drift — that is a time zone, and the chassis vendor sits in one that is eight hours away from UTC. Drift does not land on round numbers. The second value sits on a round ratio too (0.6 × 8 h), which points at a conversion rather than an oscillator.
The third row is the one that changed the plan: measured over HTTP Date
headers, all three devices now agree with the host to within eight seconds. The
ordering by claim time is therefore usable today.
How to measure this without a working settings endpoint
Every HTTP response carries a Date header from the responding server's own
clock. That is enough to compare a chassis clock against a host clock —
no vendor endpoint required, and it works even where /system/settings
answers 502.
Measure twice, an hour apart. If the difference stays constant it is a zone or a conversion; if it grows, it is a real clock.
The requirement this places on any new interface¶
An interface that accepts claims from another system must either stamp the time of receipt itself or require a synchronised source. One of the two, not neither.
A ±5-minute frame window does not cover this. It is replay protection: a neighbour four minutes out passes it and still poisons the ordering. Freshness is a separate check against the local clock, in seconds.