limits.toml

# SPEC 080 BG-2 — budget-guard limits. FROZEN after M0 (CON-7).
# All limits the guard enforces live here, never inline in code.

[embodiment.franka]
# arm dofs before the finger dofs in the command vector
n_arm_dof = 7
# official Panda joint position limits (rad), arm 7 dof + 2 finger dofs (m)
q_min = [-2.8973, -1.7628, -2.8973, -3.0718, -2.8973, -0.0175, -2.8973, 0.0, 0.0]
q_max = [2.8973, 1.7628, 2.8973, -0.0698, 2.8973, 3.7525, 2.8973, 0.04, 0.04]
# official Panda joint velocity limits (rad/s); fingers 0.05 m/s
qdot_max = [2.175, 2.175, 2.175, 2.175, 2.61, 2.61, 2.61, 0.05, 0.05]
# velocity is judged against the last SAFE command + the contract dt of the
# joint_cmd topic (TC-4: 100 Hz)
cmd_dt_s = 0.01
# EE workspace AABB (m, base frame): keeps the flange out of the floor and
# inside the pharmacy work envelope (reach 0.855 m)
workspace_min = [-0.20, -0.75, 0.01]
workspace_max = [0.90, 0.75, 1.20]
# reference pose: velocity/workspace clamping for the FIRST command is
# judged against this (the robot starts at home); also the hold target if
# a command cannot be made legal. MUST equal home_qpos in
# src/aisle/scenes/physics.toml (asserted by unit test)
fallback_qpos = [0.0, -0.785, 0.0, -2.356, 0.0, 1.571, 0.785, 0.04, 0.04]
# gripper_cmd scalar range (0 open .. 1 closed)
gripper_min = 0.0
gripper_max = 1.0
# max normalized rate: each Panda finger moves 0.05 m/s over ITS 0.04 m
# travel (the 0.08 m figure is the two-finger WIDTH, not one finger's
# travel) — matches the finger qdot_max, so the joint and gripper
# channels enforce the same physical rate
gripper_rate_max = 1.25
# contract dt of the gripper_cmd topic (TC: 30 Hz)
gripper_dt_s = 0.0333

[embodiment.so101]
# Official new-calibration follower URDF (ADR-27): five arm joints followed
# by the revolute gripper in TC-5 motor order.
n_arm_dof = 5
q_min = [-1.91986, -1.74533, -1.69, -1.65806, -2.74385, -0.174533]
q_max = [1.91986, 1.74533, 1.69, 1.65806, 2.84121, 1.74533]
# Every actuated joint in the pinned official URDF declares velocity=10 rad/s.
qdot_max = [10.0, 10.0, 10.0, 10.0, 10.0, 10.0]
cmd_dt_s = 0.01
# Conservative AABB inside the 0.5457 m official-chain reach sweep. The
# positive floor keeps the fixed TCP frame out of the work surface.
workspace_min = [-0.55, -0.55, 0.005]
workspace_max = [0.55, 0.55, 0.60]
# Official new-calibration arm zero and open gripper upper endpoint; MUST
# equal the scene home_qpos (asserted).
fallback_qpos = [0.0, 0.0, 0.0, 0.0, 0.0, 1.74533]
gripper_min = 0.0
gripper_max = 1.0
# Normalize the official 10 rad/s jaw velocity over its 1.919863 rad travel.
gripper_rate_max = 5.208705
gripper_dt_s = 0.0333

[episode]
# wall-clock BACKSTOP per episode against hung/runaway pipelines; on
# breach the guard holds the robot at the last safe command (clamp, never
# drop) and publishes wall_timeout until the next reset_done — the ONLY
# event that restarts the timer (idle pauses must not stretch it). The
# EPISODE timeout is the verifier's, in SIM time; sim can run slower than
# wall (T08 live: ~0.5x with rendering; the T15 STORE runs ~0.1x with 23
# entities), so this backstop must comfortably exceed the episode budget
# in wall terms for the SLOWEST scene: the 600 s-sim retail episode needs
# ~15 wall-minutes. 300 s froze the base AND arm mid-episode at exactly
# t+300 (T15 rounds 4-6) while the graph was healthy.
wall_timeout_s = 1800.0

# SPEC 210 MOB-3 — mobile base limits (extends SPEC 080). Class C.
[embodiment.mobile]
# differential-drive base command limits
v_max = 0.8
omega_max = 1.5
# creep speed the base is clamped to whenever the arm is in motion — arm
# motion and base motion above creep MUST NOT be commanded together (MOB-3)
v_creep = 0.05
omega_creep = 0.1
# contract dt of the base_cmd topic (MOB-1: <=50 Hz)
base_cmd_dt_s = 0.02
# keep-out: min base-to-shelf distance (m) required while the arm is
# extended beyond the base footprint (MOB-3 keep-out zones)
min_shelf_dist_m = 0.35
# mutex hold: a commanded arm-target change keeps the base clamped to creep
# for this long; refreshed by each change, expires on command silence so a
# settled arm releases the base and a still-travelling arm keeps it held
# (MOB-3; must exceed a single arm move's travel time)
arm_motion_hold_s = 1.0
# the arm is "reaching" (keep-out active) when the flange extends past this
# horizontal reach from the base origin; the home/ready pose (~0.31 m) is NOT
# reaching, so the base may still approach a shelf to set up before the arm
# extends to manipulate (MOB-3, CON-15 ADR-14)
arm_extended_reach_m = 0.40
# base watchdog: a base_cmd whose reference stamp is older than this in SIM
# seconds is stale; the guard emits a stop [0,0] so a latched command cannot
# integrate forever after the producer dies or the episode times out
# (MOB-3/BG-2). Sim seconds (ADR-29): the runaway TRAJECTORY a latched
# command can drive (v x sim seconds) is bounded identically at every rtf —
# the old wall window stopped a dead producer within half a wall second but
# covered a different amount of trajectory per machine.
base_staleness_s = 0.5
# fail-closed WALL net behind the sim-time watchdog (ADR-29): swept on the
# guard's 0.2 Hz stats tick, it stops a latched moving base when NO base_cmd
# has arrived for this many wall seconds — covering the paths the sim clock
# cannot see (unstamped pose sources, a hung sim, an env_id absent from the
# pose stream). 10.0: an order of magnitude above the worst healthy command
# gap at any plausible rtf (50 Hz sim at rtf 0.01 = 2 s wall between cmds),
# so it never fires on a healthy run and still bounds a runaway to seconds.
base_wall_backstop_s = 10.0
# nav action lifecycle (MOB-2): arrival tolerances (position m, yaw rad) and
# the timeout / stall tick budgets before a nav fails timeout / blocked
# 0.05: the pick IK chain must solve at the WORST arrival corner — the
# planning envelope test sweeps exactly these tolerances (T15)
nav_arrival_tol_m = 0.05
nav_arrival_yaw_rad = 0.05
# capture band (T15/PR #21 round 3): a diff-drive base cannot point-
# stabilize onto a target it is already ON — a drive-phase stall 0.5 mm
# OUTSIDE the arrival radius dithered (bearing flips at mm range, progress
# below the detector's epsilons) and nav declared blocked with yaw still
# ~pi off. A stall inside this band hands off to the final rotate instead,
# and arrival accepts it once rotated. The pick/place IK envelope sweep
# covers THESE corners, so every captured pose stays solvable.
nav_capture_tol_m = 0.075
# rotate-phase omega cap: saturated rotation (1.5 rad/s) with the
# pipeline's ~0.15 s-sim loop delay overshoots the 0.05 yaw band every
# swing and limit-cycles (T15 round 8 tap); 0.3 keeps the worst
# overshoot (~0.045) inside the band
nav_rotate_omega_max = 0.3
# near-field radius (T15/PR #21 round 3): inside it the DRIVE phase caps
# omega to nav_rotate_omega_max too. Near the target the bearing swings
# fast, K_OMEGA saturates omega (1.5), and the ~0.15 s-sim loop delay
# overshoots every swing — the S1 gate run ORBITED the counter for ~8 sim
# seconds (dist 0.19 -> 0.27, then blocked). v already self-scales with
# dist (K_V), so the omega cap is the missing half of the round-8 fix.
nav_near_field_m = 0.25
# nav budgets in SIM seconds (PR #21 round 4, CON-5): wall-tick budgets
# made the OUTCOME rtf-dependent — the same seed passed on one machine
# and timed out on another because a correct, converging leg burns wall
# ticks at a rate set by the machine, not by the trajectory. Decisions
# keyed to base_pose sim stamps depend on the trajectory alone. Worst S1
# leg: ~2.5 m near-field approach + up-to-pi final rotate at the 0.3 cap
# ~ 30 sim s; 60 doubles it. Genuine blockage (e.g. a guard keep-out
# zero) flatlines the pose and is caught in 5 sim s.
nav_timeout_sim_s = 60.0
nav_stall_sim_s = 5.0