{"id":"c8f1f6db-da12-45f0-8def-1f4cb877a08a","arxiv_id":"2411.13834","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A sampling-based method constructs spatiotemporal tubes and a closed-form controller that make unknown nonlinear systems satisfy temporal reach-avoid-stay tasks with formal guarantees.","lead":"Sampling-based optimization is used to build time-varying safety tubes that keep the output of an unknown nonlinear control system inside a safe corridor while it reaches a target and avoids moving obstacles. The paper gives a closed-form controller and shows it on robots and a magnetic levitator, with formal guarantees that depend on sample coverage and estimated Lipschitz constants.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Section 5.2's certificate is numerically impossible: condition (5) forces ε ≥ 6.17e-5 for 40,500 samples, while condition (7) requires ε ≤ 3.81e-5.","rationale":"The reader's conditional verdict is appropriate. I focused on the certificate premise because it is the linchpin of the paper's formal contribution: without condition (5) and condition (7), solving the SOP only enforces tube conditions on the sampled points, not on all of W. The reported numbers in Section 5.2 make the gap concrete and arithmetic rather than a matter of missing verification. The theorem itself is not wrong, but its hypotheses are not satisfied by the case study, so the 'certified confidence of 1' claim is currently unsupported. Section 5.1 has enough slack that it is merely unverified; Section 5.2 shows an actual inconsistency. I do not call for rejection because the method is plausible and the issue is fixable by either collecting enough samples to satisfy (5), choosing parameterization and Lipschitz estimates that make (7) hold at the true covering radius, or softening the guarantee. The controller proof has an additional backstepping gap, but the sampling certificate is the more fundamental blocker. Thus the verdict should remain CONDITIONAL. The reader's weakest_assumption already names the coverage condition; I agree with that identification and sharpen it into a numerical contradiction for Section 5.2, while not resting the verdict on the Lipschitz point alone.","tokens_in":19719,"tokens_out":14120,"duration_ms":133162,"concrete_test":"Re-run the certificate for Section 5.2 with a valid ε: first compute the covering radius of the stored 40,500 samples over W=[0,5]×U(t), at least the time projection max_{t∈[0,5]} min_r |t-t_r|, which is already ≥ 5/(2·40501) ≈ 6.17e-5. Then check whether η_S^* + L ε ≤ 0 with that ε. Since 2.623 × 6.17e-5 > 1e-4, the check fails for any sample set; the same computation on the actual samples will confirm it. For Section 5.1, report the actual covering radius of the 2000 samples and check condition (7) at that radius instead of at the nominal ε = 0.0005.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Theorem 3.1 certifies safety only when the sample set is an ε-cover of W=[0,t_c]×U(t) (condition (5)) and condition (7) holds. In Section 5.2 these two conditions are mutually inconsistent given the reported numbers. For any 40,500 points in [0,5], the time projection leaves a gap of length at least 5/40501 ≈ 1.23e-4, so the covering radius of W is at least 5/(2·40501) ≈ 6.17e-5. Thus any ε satisfying (5) is at least 6.17e-5. But the reported η_S^* = -0.0001 and L = 2.623 force (7) to require ε ≤ 1e-4/2.623 ≈ 3.81e-5. No ε can satisfy both, so the certificate claimed after solving the SOP cannot follow from Theorem 3.1. The same cardinality check shows Section 5.1's ε = 0.0005 is not a valid cover with N_t = 2000 (time-projection bound 5/(2·2001) ≈ 1.25e-3), though there condition (7) has enough slack that a larger ε might still work. Separately, L_L and L_U are estimated by Algorithm 1, whose Lemma 6.1 only gives asymptotic convergence; no finite-sample Lipschitz certificate is provided, so even a consistent ε would not yield a fully certified bound. The controller proof (Theorem 4.1) also assumes x_{k+1}=r_{k+1} at each stage rather than accounting for the funnel tracking error, but the sampling certificate alone already blocks the claimed guaranteed T-RAS in the examples.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper considers controller synthesis for unknown MIMO pure-feedback systems subject to bounded disturbances, aiming to satisfy a temporal reach-avoid-stay (T-RAS) specification with time-dependent unsafe sets. The authors formulate the construction of spatiotemporal tubes (STTs) as a robust optimization problem, approximate it by a finite-sample scenario optimization program (SOP), and state a sufficient condition (Theorem 3.1) under which a solution of the SOP yields tubes satisfying the STT conditions. They then propose a closed-form, approximation-free control law (Theorem 4.1) intended to keep the output inside the tubes, and demonstrate the approach on an omnidirectional robot, a 2R manipulator, a magnetic levitation system, and a drone, with comparisons against Hamilton-Jacobi and control-barrier-function methods.","tokens_in":20128,"tokens_out":8854,"duration_ms":107113,"significance":"If the main theorems were correct, the contribution would be significant for the control-synthesis community: an offline sampling-based tube synthesis with a certified a posteriori guarantee, combined with a closed-form online controller, would scale better than HJ reachability and would not require real-time optimization as CBF-based methods do. The explicit treatment of time-varying unsafe sets is also valuable. However, the central guarantees are not currently established: the proof of Theorem 3.1 has a quantifier gap in the avoid condition, the reported certificates in Sections 5.1 and 5.2 are numerically inconsistent with condition (5), the Lipschitz constants used in condition (7) are only asymptotically estimated rather than certified, and the proof of Theorem 4.1 omits the backstepping tracking-error terms. Because these issues are load-bearing for the paper's claims, the manuscript requires substantial revision before its guarantees can be accepted.","major_comments":[{"comment":"In the proof of condition (2d), the inequalities y_i - γ_i,L(ci,L,t) ≤ ... ≤ 0 and γ_i,U(ci,U,t) - y_i ≤ ... ≤ 0 are derived for all i and all y_i, using the SOP constraint (6d) as though it guaranteed min{y_i,r - γ_i,L(t_r), γ_i,U(t_r)-y_i,r} ≤ η_i^* for every dimension i. In fact, for each sample r, constraint (6d) only guarantees the existence of an active dimension i for which at least one of the two terms is at most η_i^*. The proof therefore needs an epsilon-net argument that, for each point (t,y) in W, selects the nearest sample w_r and the active dimension/side of that sample, and proves separation along that particular dimension. As written, the proof claims a stronger property than (6d) provides, so Theorem 3.1 is not proven.","section":"Theorem 3.1, Proof 3.2"},{"comment":"The numerical certificates reported for the 2R manipulator are inconsistent. With N_t = 40,500 samples in W = [0,5] × U(t), the projection onto [0,5] forces any covering radius ε to satisfy ε ≥ 5/(2·(40,501)) ≈ 6.17e-5, while the reported η_S^* = -0.0001 and L = 2.623 require ε ≤ 0.0001/2.623 ≈ 3.81e-5 for condition (7). Thus the reported ε = 0.00002 cannot satisfy condition (5), and no choice of ε satisfies both conditions with these numbers; consequently the claimed certified tube for Section 5.2 does not follow from Theorem 3.1. In Section 5.1, the reported ε = 0.0005 is also below the time-projection lower bound 5/(2·2001) ≈ 1.25e-3, although a larger ε could still satisfy (7) there, so that certificate is invalid as reported even if the approach is salvageable. The authors should report sample sizes, covering radii, and optimization values that are mutually consistent with conditions (5) and (7), or provide a separate rigorous verification of the covering condition.","section":"Sections 5.1, 5.2, condition (5) and (7)"},{"comment":"Condition (7) requires upper bounds on the true Lipschitz constants L_L and L_U of the tube functions, but Algorithm 1 and Lemma 6.1 only guarantee asymptotic convergence of the estimated constants, with no finite-sample confidence bound. Therefore the statement that the SOP solution yields a 'certified confidence of 1' is not supported by the Lipschitz estimation procedure described. Since the tube functions γ_i,L(ci,L,t) and γ_i,U(ci,U,t) are explicit polynomials in t with known coefficients after solving the SOP, exact Lipschitz constants (or rigorous interval upper bounds) can be computed directly from the coefficients and basis functions; the paper should use such exact computations or provide finite-sample high-confidence bounds for the constants in condition (7).","section":"Appendix A, Lemma 6.1"},{"comment":"The proof of the controller theorem is incomplete. In Stage 1, after differentiating the Lyapunov function, the proof replaces x2 by r2(x1,t) = -κ1 ξ1 ε1, writing the term g1(x1)x2 as g1(x1)(-κ1 ξ1 ε1); similarly in Stage k it replaces x_{k+1} by -κ_k ξ_k ε_k. But for k < N, x_{k+1} is the state of the next subsystem, not the reference signal r_{k+1}, and the tracking error e_{k+1} is never accounted for. A correct backstepping argument must include the interconnection term g_k(x_k)(x_{k+1} - r_{k+1}) in the Lyapunov analysis and bound it recursively using the prescribed-performance funnel of the following stage. As written, Theorem 4.1 is not proven because the actual closed-loop dynamics differ from the dynamics used in the Lyapunov inequalities.","section":"Theorem 4.1, Proof 4.2"}],"minor_comments":[{"comment":"The drone case study does not report the values of N_t, ε, L_L, L_U, or η_S^* needed to verify conditions (5) and (7), so the certificate cannot be checked from the text.","section":"Section 5.4"},{"comment":"The conclusion says the approach is demonstrated through three case studies, but Sections 5.1-5.4 contain five distinct examples; please correct the count.","section":"Section 6 / Section 5"},{"comment":"In Step 3, the slope S_{jk}^i is defined as |θ_j^i - θ_k^i| / (t_j - t_k); the denominator should be |t_j - t_k| so that the ratio is nonnegative when t_j < t_k.","section":"Algorithm 1"},{"comment":"The table caption says 'Quantitative Comparison' but the offline computation times for the single- and double-integrator STT rows (13.992 s) do not correspond to any case study reported in Section 5; please clarify the origin of these numbers and the system models used in the comparison.","section":"Table 2"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a relevant problem and the overall idea is potentially viable, but the current version contains load-bearing gaps: the avoid-condition proof in Theorem 3.1 needs a dimension-selection argument, the certification examples in Sections 5.1 and 5.2 are numerically inconsistent with the covering condition, the Lipschitz-certificate issue undermines the claimed confidence level, and the backstepping proof ignores tracking errors. All of these are technical rather than conceptual, so a careful revision could make the claims sound, but the present manuscript does not yet substantiate its guarantees. I would recommend the authors also consider computing exact Lipschitz constants for the explicit tube polynomials, since the stochastic estimation in Algorithm 1 is both unnecessary and insufficient for a formal certificate."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's the short version: the paper has a genuinely useful idea — replacing the circumvent-function tube construction with a scenario-optimization-based one that handles nonconvex, time-varying unsafe sets — but the advertised certificates do not hold as written. The case studies are nice, and the comparison against CBF/HJ is fair, but the numerical certificates fail a basic covering-radius check, and the proofs have gaps that need real work.\n\nWhat's new and good: The SOP formulation (6) is a clean way to turn the infinite constraints of the STT definition into a finite program, and the flexibility of basis functions is a real improvement over the convex-union restriction in [30]. The closed-form controller is standard prescribed-performance backstepping, but it is appropriate for the problem. The magnetic levitation example with a time-dependent obstacle is a nice demonstration.\n\nNow the soft spots, in increasing order. First, the Lipschitz estimates: Algorithm 1 gives only asymptotic convergence (Lemma 6.1), so the single numbers L_L=2.93 etc. are not certified. That alone would make 'certified confidence of 1' an overstatement. Second, Theorem 3.1's avoid proof has a quantifier mistake: (6d) only guarantees an active separating dimension for each sample, but the proof applies the same dimension to an arbitrary y in U(t). You need an epsilon-net and dimension selection. Third, and most seriously, the reported certificates are numerically impossible. With 40,500 sample points over [0,5], the time projection alone forces the covering radius to be at least 5/(2*40500)=6.17e-5. The paper reports epsilon=2e-5 for that example, and condition (7) requires epsilon <=3.81e-5. No epsilon can satisfy both, so the Sec 5.2 certificate cannot follow from Theorem 3.1. In Sec 5.1, N=2000 gives minimum radius 1.25e-3, but they report epsilon=0.0005; there, a larger epsilon could still work, but it's not what they report. Finally, the controller proof in Theorem 4.1 assumes x_{k+1}=r_{k+1} in each stage; the tracking error from the next funnel stage is not accounted for, so the backstepping argument is incomplete.\n\nWho is the paper for? People working on funnel control and spatiotemporal tubes will want to read it; the construction idea is worth taking seriously. It needs a major revision, not a rejection: the covering issue is fixable by reporting an epsilon that actually satisfies (5) (and choosing N accordingly), the Lipschitz estimates need finite-sample bounds, and the avoidance proof can be repaired with an epsilon-net. I'd send it to review, but the authors need to do the work.","headline":"Useful construction idea, but the reported certificates fail the paper's own covering condition and the avoid proof needs repair.","tokens_in":20633,"tokens_out":6229,"would_cite":false,"duration_ms":50785,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that sampling the time-and-obstacle space is enough to certify a spatiotemporal tube which, paired with a closed-form backstepping controller, lets an unknown MIMO system reach a target by a deadline while avoiding…","keywords":["spatiotemporal tubes","temporal reach-avoid-stay","scenario optimization","unknown MIMO nonlinear systems","closed-form control","funnel control","time-varying unsafe sets","Lipschitz estimation"],"falsifier":"For a reported case study, evaluate the synthesized tube boundaries on a dense grid over $[0,t_c]$, measure the largest slope, and compute the maximum distance from any point in $[0,t_c]\\times U(t)$ to the nearest sample; if the measured Lipschitz constant exceeds $L_L$ or $L_U$, or if any point is farther than $\\epsilon$ from every sample, the certified-confidence claim fails. An equally direct test is to simulate the closed loop with a disturbance chosen to drive the output toward the tube boundary and check whether the trajectory exits before $t_c$.","tokens_in":19498,"feed_emoji":"🎯","tokens_out":10150,"duration_ms":88622,"temperature":0.7,"pith_summary":"This paper sets out to show that an unknown, control-affine MIMO system can satisfy a temporal reach-avoid-stay task—start inside a set, hit a target by a deadline, and avoid time-varying unsafe sets—without a dynamics model. The construction fixes time-varying intervals around the desired output and solves a robust optimization program over the time horizon and the unsafe region using only finitely many samples. If those samples cover the region finely enough and the tube boundaries are Lipschitz, the sampled solution certifies the full tube. A closed-form backstepping controller then keeps the trajectory inside the tube, so the task is met under bounded disturbances. The payoff is a controller that needs no online optimization and no model of the dynamics.","feed_headline":"Sampled time and obstacles build a certified safety tube","feed_subtitle":"Offline samples certify a time-varying tube; a closed-form controller keeps unknown systems inside it.","key_machinery":"The spatiotemporal tube (STT) is the central object: for each output dimension $i$, a pair of continuously differentiable functions $\\gamma_{i,L}(t) < \\gamma_{i,U}(t)$ whose product interval contains the output, starts inside $S$, ends inside $T$ at $t_c$, and avoids $U(t)$ at every time. The argument is carried by two devices. First, the robust constraints over the continuum are replaced by a scenario optimization program over $N_t$ samples of $W=[0,t_c]\\times U(t)$; condition (5) (an $\\epsilon$-cover) together with the Lipschitz constants $L_L,L_U$ of the boundary functions turns satisfaction at samples into satisfaction everywhere, via the margin condition $\\eta^*_S + L\\epsilon \\le 0$. Second, the online device is a funnel/backstepping law: normalized errors $e_k$ and their logarithmic transforms $\\varepsilon_k$ give a closed-form input $r_{k+1}=-\\kappa_k \\varepsilon_k \\xi_k$ that forces $x_1$ to track the tube and each higher block to track the previous reference. Because the tube is only a function of time, the whole pipeline avoids state-space gridding.","core_discovery":"The paper's central claim is that temporal reach-avoid-stay can be reduced to keeping an output inside a time-varying box, and that the box can be certified from finitely many samples. Theorem 3.1 states that if the scenario program (6) is solved with samples forming an $\\epsilon$-cover of $W=[0,t_c]\\times U(t)$ and $\\eta^*_S + L\\epsilon \\le 0$, where $L$ is built from the Lipschitz constants of the tube boundaries, then the synthesized $\\gamma_{i,L}(t)$ and $\\gamma_{i,U}(t)$ satisfy the spatiotemporal-tube conditions (Definition 2.5) for every time and every unsafe point. Theorem 4.1 then states that, under the local-Lipschitz and sign-definite controllability assumptions, a closed-form backstepping law keeps the output inside the tube whenever it starts there, so $y(t_c)\\in T$ and $y(s)\\notin U(s)$ for $s\\in[0,t_c]$. The payoff is a division of labor: a one-time offline scenario optimization over time and unsafe samples, then a cheap, model-free online controller.","pith_inferences":["Strengthening the certificate would require replacing the asymptotic Lipschitz estimator with finite-sample confidence bounds; the theorems would then produce a genuinely data-driven confidence level instead of a nominal confidence of one.","Since the tube depends only on time, a tube synthesized for one system could be reused as a template for another system with the same relative degree and output dimension, something the paper does not claim.","A stress test not run in the case studies is to push the closed-loop trajectory to the boundary with the worst admissible disturbance; the tube's margin then quantifies robustness.","Switching from a global polynomial basis to piecewise-polynomial or spline tubes could fit complex obstacle layouts with fewer decision variables; this is a natural follow-up the paper leaves open."],"forward_implications":["If the margin condition (7) holds, the sampled solution already satisfies the full continuous tube conditions, not merely the sampled constraints.","Any system meeting Assumptions 1-2 whose output starts strictly inside the certified tube will satisfy the T-RAS task under the closed-form control (10).","The online controller requires no optimization and no model of $f_i,g_i$; the only offline cost is solving the scenario program.","Time-dependent, disconnected unsafe sets are representable because sampling is over the augmented space $[0,t_c]\\times U(t)$.","The approach scales to higher-order MIMO pure-feedback systems through the backstepping stages, in contrast to value-function or abstraction-based methods."],"supporting_citations":[{"why":"Prior spatiotemporal-tube construction for prescribed-time reach-avoid-stay that this paper extends and contrasts with.","marker":"[30]"},{"why":"Source of the scenario-optimization plus epsilon-cover template for data-driven safety synthesis.","marker":"[36]"},{"why":"Source of the asymptotic Lipschitz-estimation lemma and algorithm pattern used in Algorithm 1.","marker":"[37]"},{"why":"Statistical extreme-value method used to estimate the Lipschitz constants of the tube boundaries.","marker":"[55]"},{"why":"Supplies Assumption 2 and the prescribed-performance/funnel control ingredients for the closed-form design.","marker":"[20]"},{"why":"Approximation-free backstepping control for pure-feedback systems on which Theorem 4.1's law and proof build.","marker":"[41]"},{"why":"Standard existence and continuation results for maximal solutions used across the Lyapunov proof.","marker":"[42]"},{"why":"SMT solver used to solve the scenario optimization program in the case studies.","marker":"[43]"}],"fun_headline_variants":["Sampled tubes steer unknown systems past moving hazards","From samples to a certified time-varying safety corridor","Offline samples, online safety: STTs for unknown robots","Reach, avoid, stay with a sampled spatiotemporal tube","Finite samples certify time-varying safety tubes"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole guarantee depends on the premise that the collected samples truly cover every possible time-unsafe point within the chosen radius, and that the tube boundaries' true steepness is no greater than the numbers reported for their Lipschitz constants; the paper does not verify either with finite-sample bounds.","fun_headline_variants_meta":{"raw":{"variants":["Sampled tubes steer unknown systems past moving hazards","From samples to a certified time-varying safety corridor","Offline samples, online safety: STTs for unknown robots","Reach, avoid, stay with a sampled spatiotemporal tube","Finite samples certify time-varying safety tubes"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000733,"raw_usage":{"total_tokens":3298,"prompt_tokens":985,"completion_tokens":2313,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":601,"completion_tokens_details":{"reasoning_tokens":2237}},"tokens_in":601,"tokens_out":2313,"duration_ms":15482,"temperature":1.0,"reasoning_tokens":2237,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T15:50:50.305575+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"For a reported case study, evaluate the synthesized tube boundaries on a dense grid over $[0,t_c]$, measure the largest slope, and compute the maximum distance from any point in $[0,t_c]\\times U(t)$ to the nearest sample; if the measured Lipschitz constant exceeds $L_L$ or $L_U$, or if any point is farther than $\\epsilon$ from every sample, the certified-confidence claim fails. An equally direct test is to simulate the closed loop with a disturbance chosen to drive the output toward the tube boundary and check whether the trajectory exits before $t_c$.","supporting_citations":[{"cited_title":"Data-driven synthesis of safety controllers via multiple control barrier certificates.IEEE Control Systems Letters, 7:2497–2502, 2023","cited_arxiv_id":null,"evidence_quote":"Source of the scenario-optimization plus epsilon-cover template for data-driven safety synthesis."},{"cited_title":"Formal verification of unknown discrete- and continuous-time systems: A data-driven approach.IEEE Transactions on Automatic Control, 68(5):3011–3024, 2023","cited_arxiv_id":null,"evidence_quote":"Source of the asymptotic Lipschitz-estimation lemma and algorithm pattern used in Algorithm 1."},{"cited_title":"Wood and B","cited_arxiv_id":null,"evidence_quote":"Statistical extreme-value method used to estimate the Lipschitz constants of the tube boundaries."},{"cited_title":"Bechlioulis and George A","cited_arxiv_id":null,"evidence_quote":"Approximation-free backstepping control for pure-feedback systems on which Theorem 4.1's law and proof build."},{"cited_title":"Z3: An efficient SMT solver","cited_arxiv_id":null,"evidence_quote":"SMT solver used to solve the scenario optimization program in the case studies."}],"review_version":1}