By Muhammad Umar. This is the engineering summary of an open reference architecture. The paper, its object model as JSON and the model register are free to reuse under CC BY 4.0: https://codeatoms.ai/mobile-robot-fulfilment-centre-saudi-arabia/. DOI 10.5281/zenodo.24048579. The operator is described by class, never by name.
A warehousing and intralogistics operator in Saudi Arabia runs a robotic e commerce fulfilment centre of roughly 400,000 square feet with more than 250 autonomous mobile robots. The question it needs answered all the time is who and what is inside the robot field right now, and what that is doing to throughput and safety. Today the answer is scattered: the fleet orchestration system holds stall codes but not causes, the warehouse management system holds waves but not field state, and the incident and near miss log records a person in the field days after the event, if at all. When a replenishment cage is left in a lane during a peak wave, the design sees the blocked lane on the cameras that already cover the field, joins the stalled robots to the totes they carry and the wave those totes fulfil, and drafts the clearance task the fleet controller approves while the wave can still be recovered.
1. Six sources, read only, behind one adapter family
The warehouse management system owns orders, waves, totes and locations. The robot fleet orchestration system owns robot state, stall and fault codes and charging queues. The warehouse control system supplies conveyor and sorter jams, the labour management system supplies role and shift context, the incident and near miss log is the record the operator learns from late, and the building's camera recorders carry every detection point. All six are bound read only, and the direction is structural rather than a policy: the adapters hold credentials for read endpoints only, so nothing above them can reach a write path even by mistake. The platform never drives a robot, never issues a motion command and never writes into a system of record.
Data enters through one family of read only integration adapters, never directly: change data capture through Debezium for the transactional systems, which reads their change logs instead of polling them and adds no query load during a peak, and stream ingest through MediaMTX and Frigate for the camera substreams where they already exist. Every message is stamped with its source, its timestamp and its adapter version, so provenance is a queryable property of every object. Apache Kafka 4.3 in KRaft mode carries it all, partitioned by robot, zone and wave so each entity's sequence holds, at least once, with idempotent writes keyed by offset so a replayed message cannot double count an incursion. Linuxptp and chrony, disciplined by a GNSS PTP grandmaster, put evidence frames, robot positions and badge extracts on one clock, because the join between an incursion and a stall is only as good as its timestamps.
2. Fifteen objects, from a person at a gate to the orders delayed
The object model holds fifteen typed objects and thirteen typed links: zone, robot, charging bay, pick station, camera view, tote, order wave, shift, incursion, stall, person role, near miss, corrective action, agent draft and edge unit. A robot carries a tote, the tote fulfils an order wave, a stall delays that wave, a near miss references the stall and triggers a corrective action, so a query walks from a person at a gate to the orders their presence held up. The person role carries a pseudonymised badge reference, a shift and authorised zones, never an identity: people appear in the record as anonymous presence with a role. It is a governed graph written only by the adapter tier and the approvals service, and it is published as JSON for Hyper Ontology.
3. Three tiers inside the building, sized by arithmetic
Five models, no third party model service. On the edge tier, camera group units on an industrial grade octa core SoC with a 6 TOPS NPU sit beside the reused cameras and run RF-DETR (small) per frame under OpenVINO for person detection, with motion only trackers holding objects across frames and the re identification branch switched off. The checkpoints run about 61 to 68 MB at 16 bit, so the binding constraint is NPU load, and a dev board measurement on the real substreams is the gate before any unit is ordered at fleet scale. On the site servers, on CPU, Grounding DINO Swin-T classifies fallen totes, cages and blocked lanes on evidence frames the edge has already flagged, never per frame, and BGE-M3 serves Arabic and English cited retrieval.
The central tier is GLM 5.3 under vLLM, serving the three drafting agents, ontology maintenance and the command centre. The sizing is written out: 753 billion parameters at FP8 is 753 GB of weights, a factor of 1.2 for KV cache and activations gives 904 GB, and one node of eight 141 GB HBM accelerators provides 1,128 GB. It sits in the site data room at about ten kilowatts. Nothing in the design closes a control loop: the fleet's own sensors stop robots, and these analytics are operational feedback, never a safety rated stop. Frames, detections, weights and memory never leave the building. The node is a 4A090 class item for a D:3 and D:4 destination, so an export licence determination is a phase one procurement gate before the order, with an in country sovereign data center as the fallback placement.
Appendix A prices the node at about 569,000 US dollars to own over three years (541,000 to 594,000). Renting the same eight cards on the deepest three year commitment in AWS Middle East (UAE) is about 751,000, so ownership costs about three quarters of it; on demand is about 2.00 million, against which ownership costs a little over a quarter. Renting is a price reference only: AWS listed no Saudi region on the day read, and every rented option would carry evidence frames of the operator's people across the border. The edge units and site servers are not priced, because the paper does not count or size them.
4. Three agents, named people
The agents detect and draft, and people decide, by name. The shift supervisor approves the incursion agent's zone slow down and supervisor call, the fleet controller approves the stall agent's clearance task and reroute request, and the operations manager confirms the shift agent's handover. Execution is manual, every approval is logged with its reasoning, and known answer probes on the review queue measure whether approvers are rubber stamping. Nothing is trained into weights.
5. Gates, not dates
Three phases carry 16 scope items (4, 11 and 1), each closed by a gate. Camera reuse verification first, with six gates per view recorded at the worst hour, and purpose placed cameras bought only where a gate fails. Then one robot field zone and its pick stations live for one quarter against the operator's own baselines: incursions per thousand robot hours, stoppage minutes per shift, time from stall to clearance and orders per labour hour. Then the whole field and the next site, earned by that evidence.
Made with CodeNinja Praxis, the CodeNinja Atoms platform for designing physical AI systems. The object model imports into Hyper Ontology. Paper, ontology and register: https://codeatoms.ai/mobile-robot-fulfilment-centre-saudi-arabia/
One of the CodeNinja Atoms worked examples of physical AI system design: read only systems of record below, a governed ontology joined by typed links, detection on the cameras the building already runs, open weights on hardware the operator owns in its own country, and agents that draft while named people approve.
Top comments (0)