MAFIS
Multi-Agent Fault Injection Simulator
A Resilience Observatory for Lifelong Multi-Agent Path Finding
Teddy Truong · Yannick Francillette
UQAC, Canada · PAAMS 2026
1 million
robots in Amazon warehouses
Source: Amazon, July 2025, reported by TechCrunch
Pick up.Deliver.Repeat.
The robot loads a container from a rack.
It carries it to a station on the right.
Then the next task. Tasks never stop.
One planner moves them all
Time moves in ticks. Each tick, the planner gives every robot its next move.
Blue dots: where each robot goes next. No two robots may collide.
Planners are ranked on one number
And they assume every robot moves exactly as planned.
League of Robot Runners: the yearly planner competition, run since 2023 with Amazon Robotics
2026
The competition adds delays.
A robot can now be late for a planned move.
League of Robot Runners · 2026 call for participation
Being fast on paper is no longer enough.
More than delays
BurstWear
Zone outageIntermittent
Many robots fail at once, for good.
Robots fail one by one as they age.
One area freezes for a while, as when it loses signal.
Robots pause at random, then resume.
One robot stops. What does it cost the fleet?
1 / 4 · how small becomes big
Butterfly effect
Two copies of the same run. They move exactly alike.
In one copy, one robot is one tick late.
The change spreads. Red: a robot no longer where its copy is.
One robot, one tick late. ticks later, all 40 robots are somewhere else.
0 / 40 robots no longer where their copy is
Edward Lorenz, 1961: rounding one starting number in a weather simulation changed the whole forecast
2 / 4
Waiting chains
Robots queue at a station and hand over their containers.
The robot at the station breaks down.
Each robot waits for the one ahead.
One failure blocks the whole line.
How MAFIS finds these chains: Hönig et al., 2019
3 / 4
Phantom traffic jam
22 robots on a loop. Nothing blocks the road.
One brakes for a moment. A jam forms, stays, and moves backward.
Sugiyama et al., 2008: the same test with 22 real cars · The robots follow the driver model of Bando et al., 1995
4 / 4
Cascading failure
Each point of a network carries a load (the fill) up to a limit (the ring).
One point fails. Its load moves to its neighbours.
Pushed past their limit, they fail in turn.
The model: Motter & Lai, 2002 · Real case: the 2003 blackout in the USA and Canada, about 50 million people without power
And the opposite
Braess’s paradox
Every driver takes the shortcut: the shortest path.
Shortest is not fastest. It jams.
Close the shortcut. Drivers spread over both routes.
Every trip gets faster.
Braess, 1968 · Seen for real: a highway removed in Seoul (2003), 42nd Street closed in New York (1990)
How MAFIS works
Run it twice. Break one on purpose. Compare.
- 01Measure
Run the fleet. Count tasks delivered.
- 02Copy
A twin: same map, robots and tasks.
- 03Break
A fault hits the copy only: 8 robots fail.
- 04Compare
The gap is the fault’s cost: 0 tasks
Chaos engineering: Netflix shuts down its own servers to find weak spots (Netflix Tech Blog, 2011) · steps from principlesofchaos.org
1 / 4 · what MAFIS measures
Fault tolerance
What share of the work still gets done?
Tasks after the fault
Twin ·
With fault ·
of the twin’s work still done.
2 / 4
Critical time
How long does the fleet work at less than half its twin’s pace?
of the time after the fault.
Long slumps miss deadlines.
3 / 4
Time-weighted gap
Does the gap close, or keep growing?
average gap, with late ticks counting more.
A gap that lasts costs more than one that closes.
4 / 4
Cascade spread
How many robots does one fault block?
The failed robots, plus the chain waiting on them at that moment.
Same fault, three planners
A burst: 8 robots fail. Each planner against its own twin.
One run each: an example, not a ranking
A good planner is fast and resilient
Today, planners are ranked on speed alone: left to right.
Our three planners, one run each.
MAFIS adds resilience: bottom to top.
The ranking flips
Same map, same robots, same tasks. No fault: PIBT delivers more.
With intermittent faults, RHCR delivers more.
Across random setups, the order flips in . One tick of delay alone does not flip it.
Averages over random setups: PIBT is tasks ahead with no fault and behind with faults (give or take and )
Faults are designed,
not measured.
Reasonable guesses, not taken from real failure records.
Simulation only · grid maps · three planners
Next: fit fault models to real fleet logs.
Have failure data? Let’s talk.
Beyond warehouses
Any system that moves, carries or supplies.
Many already have a digital twin: a simulation of the real system.
Try the fault on the twin first.
A good planner keeps delivering when robots fail.
Score every faulty run against its fault-free twin.
github.com/stasis-industries/mafis
Try the simulator
Connect on LinkedIn