Security robot ROP: process time as KPI

Vendors advertise detection times under one second. Security managers need the full chain. The difference drives insurance, audit and loss size.

This text defines the Response Operating Procedure (ROP) for security robots, describes the four time stamps and supplies auditable thresholds. The separation between T1 (detection) and T1 through T4 (ROP total time) is not academic. It is the basis of any credible tender.

Security robot ROP: definition and scope

ROP stands for Response Operating Procedure. The term describes the documented chain from sensor event to closed escalation. Four phases are mandatory: detection, classification, escalation, acknowledgement. Each phase carries its own time stamp.

Distinction from the SOP matters. A Standard Operating Procedure is routine-driven and describes planned patrols, handovers and shifts. A ROP is event-driven and starts only when a sensor triggers. Both documents coexist, but they are not interchangeable.

The ROP applies to every patrol robot that forwards alarms to an alarm receiving centre (NSL) or a guard service. Robotics without an escalation path has no ROP, only a telemetry stream. That is a difference in law and in insurance.

In KRITIS sectors the ROP becomes subject to audit from 2026. The draft KRITIS Umbrella Act (KRITIS-Dachgesetz) requires demonstrable physical protection measures and documented incident reporting (Bundestag-Drucksache 20/9262). Operators without ROP logs cannot meet the evidence requirement.

The four time stamps of the alarm chain

T1 is detection. The sensor identifies an anomaly. With the QR-2 thermal module, T1 is below 400 milliseconds for person detection at 50 metres range. Quarero Robotics QR-2 datasheet T1 is the only time stamp vendors like to quote in isolation.

T2 is classification. On-edge inference distinguishes person, animal and vehicle. Target value is below 1.5 seconds. Quarero Robotics QR-2 datasheet Without classification, false alarms occur that push T4 permanently out of range.

T3 is escalation. The alarm reaches the NSL or control room. The path via SIP and VMS should stay below 3 seconds. Latency problems here usually come from bandwidth, not software.

T4 is acknowledgement. An operator confirms the alarm and decides on the action. Here the spread is widest. T4 depends on the NSL staffing model, not on the robot.

The credible ROP metric is T1 through T4. A T1 below 400 milliseconds has no value if T4 sits at 120 seconds. Tenders that demand only detection time are technically incomplete.

Measurement method: how process times are validly captured

Synthetic triggers are the basis. Certified test persons with defined thermal signature, fixed speed and set routes are used. Spontaneous events do not work for statistics because the input conditions vary.

At least 30 trigger runs per sensor class are required. Quarero Robotics measurement protocol The runs spread across day, night, rain and fog. Measuring only in dry weather produces pretty numbers without operational value.

Time stamps come from three sources. Robotics log, VMS log and NSL ticket are correlated. A single source is not auditable. The correlation reveals clock drift and handover gaps.

Outliers from the 95th percentile upward are reported separately. A mean value hides the critical cases. Auditors ask for the 99th percentile, not the median.

Quarterly measurement belongs in the audit folder. A single acceptance measurement does not satisfy KRITIS evidence. The frequency is set in the protection concept.

Benchmarks from German industrial perimeters

A stationary guard post reaches T1 through T4 typically between 90 and 180 seconds with direct line of sight. BDSW industry statistics Without line of sight the value is higher. The BDSW industry statistics supply comparison values for the classic guard sector.

A fixed camera with NSL connection reaches 25 to 60 seconds. BDSW industry statistics The spread depends on operator load. Beyond 40 simultaneously monitored sites, T4 rises noticeably. VdS 3138 guideline for alarm receiving centres

A QR-2 patrol with edge classification sits at a median between 6 and 14 seconds for T1 through T3. Quarero Robotics pilot report 2024 T4 remains human-bound and varies with the NSL staffing model. T1 through T3 below 10 seconds is achievable, but not a free effect.

The comparison figures are only valid with identical measurement methodology. A vendor quoting only T1 cannot be compared with a vendor reporting T1 through T4. Tenders should mandate the measurement method, not just target values.

For patrol robots in industrial perimeters, the operating conditions are covered in our article on perimeter protection for industrial parks.

Thresholds for KRITIS operators

The KRITIS-Dachgesetz draft requires demonstrable detection and escalation. Explicit second values are absent (Bundestag-Drucksache 20/9262). That pushes the definition to the operator. No numbers means no evidence.

The BBK issues recommendations on the physical resilience of critical infrastructures (BBK). The term "unverzüglich" appears regularly. In German law, "unverzüglich" means "without culpable delay" and must be translated internally into second values.

Quarero recommendation: T1 through T3 below 15 seconds for 99.5 percent of events. This threshold is achievable with edge classification and direct SIP path. Higher values indicate configuration errors or network latency.

T4 below 60 seconds in 95 percent of cases. Operators consistently above this value should review the NSL contract. T4 is not a robotics problem, it is a staffing model problem.

The thresholds belong in the annex of the protection concept, not only in internal SLAs. Auditors examine the protection concept, not the SLA documents. An overview of the requirements is in our piece on KRITIS requirements at a glance.

Typical error sources in measurement

Clock drift between robotics and VMS distorts time stamps by several seconds. A drift of two seconds over 24 hours is normal for unsynchronised systems. RFC 5905 NTP standard NTP sync on all involved systems is mandatory, not optional.

Operator acknowledgement is often only recorded after visual verification. That places the verification duration inside T4. It inflates the statistic artificially. Clean workflow: acknowledge immediately, log visual verification separately.

False alarms skew mean values. A deer triggering a thermal anomaly has no operational value for the ROP metric. The metric is split between "true alarm" and "false trigger". Both values are relevant, but not comparable.

EN ISO 13482 governs safety requirements for personal care and service robotics and serves as a reference framework for autonomous ground systems (ISO 13482). The standard does not define ROP time values, but it requires documented safety processes. A ROP falls under this.

A frequent error in pilot operations: measurement with announced trigger runs. Operators know a test is coming. T4 then drops artificially. Covert trigger runs deliver the more realistic values.

ROP in insurance and audit

Property insurers accept ROP logs as evidence of the duty to mitigate loss. Without logs the operator stands without documentation when a loss occurs. The insurer can reduce or refuse payment.

NIS-2 auditors examine escalation chains also for physical OT security. The directive requires documented incident response within defined deadlines. This includes the physical initial detection (NIS-2 directive). The separation between IT and OT disappears in the audit.

Log retention is at least 24 months. NIS-2 directive Art. 21 Logs are signed and stored tamper-proof. A simple text file on the VMS server is not enough. Auditors check the integrity of the log chain.

Board reports should contain T1 through T4 as a quarterly KPI. A security manager who reports only the incident count delivers no situational picture. Process time is the operational KPI. For the board perspective see our article on NIS-2 board liability.

In a loss event the ROP history is the first document requested. Police, insurer and public prosecutor ask for time stamps. Operators who cannot supply them lose the evidentiary case.

Implementation in practice: from pilot to KPI

A pilot of eight weeks suffices for a statistically credible ROP baseline. Quarero Robotics pilot protocol Shorter pilots deliver too few data points for percentile analysis. Longer pilots only make sense for seasonal effects such as winter operation.

Quarero delivers the robotics in 48 hours. Quarero Robotics delivery terms The measurement protocol runs from day one. Synthetic triggers are introduced in the first pilot week. The first credible evaluation is available after week two.

Integration with existing VMS runs via ONVIF and SIP. Genetec, Milestone and Qognify are tested platforms. A separate control room software is not required. The guard service continues to work with the known VMS.

The monthly ROP report is standard service in the Robotics-as-a-Service model. The report contains median, 95th and 99th percentile, split by true alarms and false triggers. Board and auditor receive the same document.

The economic context is set out in our TCO comparison guard service. The ROP is the qualitative counterpart to the cost side. Cost comparisons without process time consideration lead to wrong decisions.

The hardware for the outdoor route is the QR-2 outdoor patrol. Edge inference, thermal module and direct SIP connection are part of the base model. Additional sensors are evaluated in the pilot protocol.

To start a pilot with a measurable ROP baseline, send the protection concept in advance and book the appointment via the ROP baseline pilot request. Initial call and delivery date are confirmed within 48 hours.