{"id":"d45d4772-9597-41fb-855b-f394604c3c85","arxiv_id":"2411.16479","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Safety guarantees for complex robots can be inherited from simple reduced-order models when a simulation function certifies how well the full system tracks the simple model.","lead":"This paper shows how to use simple reduced-order models to design safety controllers for complex robots, with formal safety guarantees transferred to the full system. The method is tested on a drone in simulation and on a 3D hopping robot in hardware.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 2 proves invariance of an inflated set Sδ that is not a subset of the constraint set C; the advertised safety guarantee h(π(x))≥0 does not follow from the stated result.","rationale":"The central claim of the paper is that ROM-based CBF controllers provide safety guarantees for the full-order model. The reader's verdict accepts Theorem 2 as a correct conditional result and focuses on unverified assumptions in the examples. My review finds a more fundamental issue: the theorem's conclusion is formally correct but does not establish the advertised safety property. The proof in Section IV shows that the function Bδ in (19) has a positive offset, so the invariant set Sδ may include points outside the constraint set C. Since trajectories are only promised to remain in W, they can violate h(π(x)) ≥ 0 even when all conditions of Theorem 2 hold and the simulation function is perfectly known. This is not a matter of numerical verification; it is a mismatch between the statement of Theorem 2 and the safety claim in the abstract and Section I. The concrete test above (analytical re-derivation or scalar counterexample) would settle whether the theorem can be strengthened to S invariance or whether the paper must reframe the guarantee as 'practical safety' with an explicit bound on constraint violation. Either way, a revision is needed, so the verdict remains CONDITIONAL.","tokens_in":21481,"tokens_out":18038,"duration_ms":171047,"concrete_test":"Independently re-derive the proof of Theorem 2 attempting to establish forward invariance of S∩Ωβ (with Bδ replaced by B). The same completion-of-squares step yields the additional requirement (λ−α)V(x)/μ ≥ (ε/4)‖ψ(x)−κ(π(x))‖² + (σ/4)δ² + ι/μ on ∂S, which is not implied by (8)–(9). If this requirement is necessary, Theorem 2 cannot guarantee safety. To confirm numerically, instantiate a scalar FOM ẋ = u + d with constant simulation function V ≡ 0.5, λ = 1, ι = 0.25, β = 0.5, |d| ≤ 0.1, and choose α, ε, μ, ρ, σ to satisfy (18); simulate from an initial condition in S∩Ωβ and check whether h(π(x)) becomes negative while the state remains in W.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"Section IV, after defining Bδ in (19), the proof shows forward invariance of W = Sδ ∩ Ωβ, where Sδ in (17) is given by Bδ(x) = h(π(x)) − V(x)/μ + (1/α)(σ/4 δ² + ι/μ) ≥ 0. The additive term c = (1/α)(σ/4 δ² + ι/μ) is positive whenever δ or ι is positive, so Sδ contains states with h(π(x)) < 0 (e.g., V(x)=0 and Bδ(x)=0 gives h = −c). The paper claims that rendering this set forward invariant leads to satisfaction of the state constraint C in (11), but forward invariance of a superset of S does not imply that trajectories starting in S remain in C. Even if all assumptions (8), (9), (13) are verified with known bounds, a trajectory may leave S and move into W\\C, violating h(π(x)) ≥ 0. Thus Theorem 2, as stated, does not deliver safety of the full-order system; it only delivers invariance of a possibly unsafe inflated set. This is a logical gap that is independent of the unverified simulation-function bounds.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents a framework for safety-critical control of high-dimensional full-order models (FOMs) using reduced-order models (ROMs). The authors define projection maps from the FOM to a ROM, introduce a simulation function V and an interface k that relate the ROM controller to the FOM controller, and combine V with an input-to-state safe control barrier function h for the ROM. The main result, Theorem 2, states that under a simulation-function inequality (9), an ISS-CBF condition (13), and the parameter condition (18), the set W = S_delta ∩ Omega_beta is forward invariant for the closed-loop FOM, where S_delta is an inflated version of the candidate safe set S. The paper also presents a quadrotor simulation and a hardware demonstration on the ARCHER hopping robot.","tokens_in":21760,"tokens_out":6491,"duration_ms":68474,"significance":"The framework is a natural and potentially useful generalization of earlier ROM-based CBF work, and the algebraic core of the proof of Theorem 2 is coherent: the derivative estimates and the use of Nagumo's theorem are standard and check out. The paper also clearly identifies the role of the simulation function and gives a concrete route to transferring ROM safety filters to full-order systems. However, the advertised safety guarantee is not actually delivered by the stated theorem, because forward invariance is proved only for an inflated set S_delta that is not a subset of the constraint set C. In addition, the examples do not verify the numerical assumptions of the theorem, and the hardware demonstration involves a hybrid system while the theorem applies to continuous ODEs. The contribution is therefore conditional: the main idea is promising, but the central safety claim needs repair before the paper can be accepted.","major_comments":[{"comment":"Theorem 2 proves forward invariance of S_delta, not of the candidate safe set S defined by B(x) >= 0. The set S_delta contains points with h(pi(x)) < 0 because the offset (1/alpha)(sigma/4 delta^2 + iota/mu) is positive whenever delta or iota is positive. For instance, a point with V(x)=0 and B_delta(x)=0 satisfies h(pi(x)) = -(1/alpha)(sigma/4 delta^2 + iota/mu) < 0, so the boundary of W includes states that violate the state constraint C in Eq. (11). Forward invariance of a superset of S does not imply that trajectories starting in S remain in C; a trajectory may leave S and enter W \\setminus C. Thus the theorem, as stated, does not establish the safety guarantee h(pi(x)) >= 0 that the paper claims in the abstract and conclusions. The authors should either prove forward invariance of a subset of S (or of C), or explicitly reframe the result as a practical-safety statement with a quantified worst-case violation and adjust all claims accordingly.","section":"Section IV, Theorem 2, Eq. (17)"},{"comment":"The hardware example does not verify the hypotheses of Theorem 2. The zero dynamics policy from [21], [30] is invoked as the interface k, and its Lyapunov function is used as the simulation function V, but the required constants lambda, iota, rho, beta, and the bound delta = sup_{Omega_beta} d(x) are not computed. Condition (18) is asserted to hold by choosing alpha = 0.4, but this cannot be checked without values for lambda, epsilon, mu, and rho. The statement in Remark 1 that one can 'initialize alpha and epsilon very small to ensure safety and then increase' is a heuristic, not a verification of the theorem's assumptions. Without these numerical certificates, the demonstration does not show that the observed safety of ARCHER is explained by Theorem 2.","section":"Section V, ARCHER demonstration"},{"comment":"ARCHER is described as a high-dimensional, hybrid, underactuated system, whereas Theorem 2 applies to the continuous ODE (2) with locally Lipschitz dynamics and uses Nagumo's theorem on a closed set. The paper does not provide a hybrid-system extension of the invariance argument, nor does it state conditions under which the simulation function inequalities (8) and (9) survive resets or impacts. The prior work [21], [30] may indeed provide a hybrid Lyapunov function for the tracking interface, but this is not established here. The hardware claim therefore requires either a hybrid version of Theorem 2 or a clear argument that the continuous theory applies to the closed-loop hopping behavior.","section":"Section V and Theorem 2"}],"minor_comments":[{"comment":"The definition delta := sup_{x in Omega_beta} d(x) requires the supremum to be finite, but no assumptions are stated that guarantee this (for example, compactness of Omega_beta and continuity of d). The authors should add such assumptions or discuss the degenerate case.","section":"Section IV, definition of delta"},{"comment":"The phrase 'the largest sublevel set of V contained within D' is ambiguous if D is not all of R^N and V is not proper. Since Omega_beta is later treated as a closed set in Nagumo's theorem, the authors should clarify the topological properties of Omega_beta.","section":"Definition 1"},{"comment":"The sentence 'we took epsilon = 20 and omitted the sigma term since grad h = L_g h' is unclear: condition (13) includes both the (1/epsilon)||L_g h||^2 and (1/sigma)||grad h||^2 terms, and eliminating one of them needs a justification (for example, that d = 0 in that example so delta = 0).","section":"Example 2"},{"comment":"The suggestion to initialize alpha and epsilon 'very small' and then increase them until adequate performance is achieved should be separated from the formal verification of condition (18); as written, it may give the impression that the theorem's hypotheses can be satisfied by parameter tuning without checking the underlying bounds.","section":"Remark 1"}],"recommendation":"major_revision","confidential_remarks":"The paper is built on the authors' own prior work [2]–[4], [21], [30], which is legitimate, but the practical safety claim leans heavily on a Lyapunov function from [21], [30] that is not verified here. The most serious issue is the mismatch between Theorem 2 and the advertised safety guarantee; this is a fixable gap if the authors are willing to either strengthen the theorem or weaken the claims to practical safety, but it is central and cannot be waived. The hybrid nature of ARCHER is an additional obstacle that the authors should address explicitly."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things. The paper gives a clean, general framework for ROM-based CBF design: projection maps, simulation functions, interfaces, and a theorem that transfers an ISS-CBF condition on the ROM to an invariance condition on the full-order system. It also has a real hardware demo on ARCHER. But the main theorem as stated does not deliver what it claims. The set it proves forward invariant is an inflated version of the candidate safe set, and that inflated set can contain states that violate the original constraint. So the advertised safety guarantee h(pi(x)) >= 0 does not follow.\n\nThe good parts first. The framework is a legitimate generalization of the authors' prior work and of abstraction-based control: it handles time-invariant safe sets, relaxes bounded-gradient assumptions, and the proof of Theorem 2 is coherent under its assumptions. The note that S intersect Omega_beta is invariant when d = 0 and iota = 0 is correct and shows where the ideal case works. The ARCHER demo is a real point in the paper's favor; the figure showing commanded vs actual velocities is exactly what a reader wants to see, and the authors are honest that tracking is imperfect.\n\nThe soft spot is central, not cosmetic. In Theorem 2, S_delta is defined by B_delta(x) = h(pi(x)) - V(x)/mu + c >= 0 with c = (1/alpha)(sigma delta^2/4 + iota/mu). Whenever d or iota is nonzero, c > 0, so S_delta is a strict superset of S and includes states with h(pi(x)) < 0. Forward invariance of S_delta intersect Omega_beta only says trajectories stay in that superset; it does not keep them inside S. A trajectory can leave S, cross into W\\S with h < 0, and still satisfy B_delta >= 0. The inequality h >= B is true but useless here because B is allowed to be negative. This is a load-bearing gap, not a missing numerical bound.\n\nSecondary issues: the examples never compute lambda, iota, rho, beta, delta, and condition (18) is asserted rather than verified. ARCHER is hybrid and Theorem 2 is for continuous ODEs. These are real but secondary; the set-invariance gap is the thing that matters.\n\nThis paper deserves a serious referee: the framework is useful, the hardware work is valuable, and the gap may be fixable by adding a margin or redefining the safe set. As written, the main theorem needs major revision. I would send it out, not desk-reject, but the referee report should start with this logical issue.","headline":"Theorem 2 proves invariance of a superset of the intended safe set, so the advertised full-order safety guarantee does not follow as stated.","tokens_in":22283,"tokens_out":3835,"would_cite":false,"duration_ms":39134,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Provable safety for complex systems via simplified models.","keywords":["control barrier functions","reduced-order models","simulation functions","forward invariance","safety-critical control","input-to-state safety","zero dynamics policies","hopping robot"],"falsifier":"For the ARCHER hardware setup, record $\\psi(x(t))$ and $\\kappa(\\pi(x(t)))$ over several runs, compute the Lyapunov values $V(x(t))$ from the zero dynamics policy, and verify whether inequality (9) holds with the parameters claimed; if (9) or (18) fails while the robot still stays safe, then the theorem's conditions are not necessary. To test the theorem itself, simulate a full-order system with a known simulation function, pick parameters satisfying (18), and search for an initial condition in $W$ whose trajectory leaves $W$; any such exit would contradict forward invariance and expose a flaw in the proof.","tokens_in":21288,"feed_emoji":"🤖","tokens_out":6432,"duration_ms":54620,"temperature":0.7,"pith_summary":"This paper proves that safety-critical controllers can be designed on a low-dimensional reduced-order model and then transferred to a high-dimensional full-order system, provided the full system can track the reduced-order commands with a known error bound. The key object is a simulation function, a Lyapunov-like certificate that bounds the tracking error, and an interface that converts reduced-order inputs into full-order inputs. Using these, the paper constructs a barrier function $B(x)=h(\\pi(x))-V(x)/\\mu$ for the full system and shows that under the inequality $\\lambda \\ge \\alpha + \\varepsilon\\mu/(4\\rho)$, a slightly inflated safe set is forward invariant. This matters because constructing control barrier functions directly for high-dimensional systems is hard, while simplified models are easy to work with. The result is demonstrated in simulation on a quadrotor and in hardware on a 3D hopping robot.","feed_headline":"Simplified models now certify safety for full robots","feed_subtitle":"A tracking-error bound transfers safety guarantees from simplified models to complex robots, shown on a hopper.","key_machinery":"The load-bearing objects are the simulation function $V$ and the interface $k$. $V$ is a continuously differentiable, positive function satisfying $V(x) \\ge \\rho\\|\\psi(x) - \\kappa(\\pi(x))\\|^2$ and $\\nabla V(x)\\cdot F(x,k(x)) \\le -\\lambda V(x) + \\iota$; it certifies that the full-order system tracks the reduced-order controller $\\kappa$ with an exponentially decaying error bound (Lemma 1). The interface $k$ maps reduced-order inputs back to full-order inputs. The second central object is the combined barrier $B(x) = h(\\pi(x)) - \\frac{1}{\\mu}V(x)$, which merges the reduced-order CBF $h$ with the simulation function. The derivative inequality $\\dot{B}_\\delta(x) > -\\alpha B_\\delta(x)$ on $W$, together with Nagumo's theorem, is what yields forward invariance. Condition (18) is the exact inequality that makes the tracking error term small enough to preserve this derivative bound.","core_discovery":"The central claim is Theorem 2: if a simulation function $V$ and interface $k$ exist, with parameters satisfying $\\lambda \\ge \\alpha + \\varepsilon\\mu/(4\\rho)$, then the set $W = S_\\delta \\cap \\Omega_\\beta$ is forward invariant for the closed-loop full-order system $\\dot{x} = F(x, k(x))$. Here $S_\\delta$ is the zero superlevel set of $B(x) + \\frac{1}{\\alpha}(\\frac{\\sigma}{4}\\delta^2 + \\frac{\\iota}{\\mu})$, a slightly inflated version of the candidate safe set $S = \\{x : h(\\pi(x)) \\ge V(x)/\\mu\\}$, and $\\Omega_\\beta$ is the largest sublevel set of $V$ inside the domain. Since $B(x) \\ge 0$ implies $h(\\pi(x)) \\ge 0$, forward invariance of $W$ guarantees that the original state constraint $h(\\pi(x)) \\ge 0$ is satisfied along trajectories. The theorem is an extension of earlier ROM-CBF results: it allows general projection mappings, handles disturbances in the reduced-order dynamics, gives time-invariant safe sets, and relaxes prior restrictions such as bounded-gradient CBFs. The proof combines Nagumo's theorem with derivative bounds: along the boundary of $W$, the barrier derivative is positive because condition (18) compensates for the tracking error term from the simulation function.","pith_inferences":["A natural extension would be to state a hybrid-system version of Theorem 2, since ARCHER is a hybrid system and the current proof relies on Nagumo's theorem for continuous dynamics; the hardware demo suggests the inequality may tolerate the mismatch, but a formal treatment would close the gap.","The inflation term $\\frac{1}{\\alpha}(\\frac{\\sigma}{4}\\delta^2 + \\frac{\\iota}{\\mu})$ quantifies conservatism: users could trade off safety margin against performance by measuring $\\delta$ and $\\iota$ experimentally rather than assuming them.","The framework could also be applied in the reverse direction—using simulation functions to certify when a reduced-order model is not safe enough—or to other abstraction-based control settings where approximate simulation relations are available.","One testable prediction is that, for a fixed full-order system, decreasing $\\alpha$ should monotonically enlarge the verified safe region $W$, which practitioners could check by sweeping $\\alpha$ in simulation."],"forward_implications":["If the theorem's conditions hold, the full-order system satisfies the original safety constraint $h(\\pi(x)) \\ge 0$ for all time, even though the controller was designed on the reduced-order model.","For a fixed interface, the condition $\\lambda \\ge \\alpha + \\varepsilon\\mu/(4\\rho)$ can always be met by choosing $\\alpha$ and $\\varepsilon$ small, so the framework gives a tuning rule for safe implementation.","The safe set for the full-order system is time-invariant, unlike earlier ROM-CBF constructions that produced time-varying safe sets.","The framework permits black-box tracking interfaces, so existing high-performance controllers on drones or legged robots can be upgraded with safety filters without redesigning them.","The hardware demonstration on ARCHER indicates the approach can be applied to highly underactuated, hybrid robotic systems despite the theorem being stated for continuous ODEs."],"supporting_citations":[{"why":"Introduces approximate simulation relations, the basis for the simulation function definition used here.","marker":"[14]"},{"why":"Prior framework connecting CBFs and ROMs that this paper generalizes.","marker":"[2]"},{"why":"Early use of simple kinematic models to generate safe velocity commands.","marker":"[3]"},{"why":"Extends ROM-CBF approach to bounded inputs; the paper relaxes several of its conditions.","marker":"[4]"},{"why":"Original CBF-QP formulation on which the reduced-order safety filter is built.","marker":"[1]"},{"why":"Defines input-to-state safe CBFs, the property required of the ROM controller in (13).","marker":"[26]"},{"why":"Provides the zero dynamics policy and Lyapunov function used as interface and simulation function for ARCHER.","marker":"[30]"},{"why":"Supplies Nagumo's theorem and the contingent cone machinery used in the invariance proof.","marker":"[22]"}],"fun_headline_variants":["Reduced models can certify full-system safety with a new theorem","Safety transfer theorem for reduced-order control barrier functions","From simplified to full: safety guarantees with simulation functions","New condition transfers reduced-order safety to full robots","Theorem 2: safety certificates for full systems from reduced models"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The entire argument rests on the existence of a simulation function and interface with known parameters $\\lambda, \\iota, \\rho, \\beta$ that bound how well the full-order system tracks the reduced-order controller, and on the ability to verify inequalities (9) and (18) for the actual system; for the ARCHER demo, the paper assumes the Lyapunov function from the zero dynamics policy certifies tracking but does not provide those numerical bounds, and it applies a continuous-ODE theorem to a hybrid robot.","fun_headline_variants_meta":{"raw":{"variants":["Reduced models can certify full-system safety with a new theorem","Safety transfer theorem for reduced-order control barrier functions","From simplified to full: safety guarantees with simulation functions","New condition transfers reduced-order safety to full robots","Theorem 2: safety certificates for full systems from reduced models"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000627,"raw_usage":{"total_tokens":2903,"prompt_tokens":954,"completion_tokens":1949,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":570,"completion_tokens_details":{"reasoning_tokens":1885}},"tokens_in":570,"tokens_out":1949,"duration_ms":13236,"temperature":1.0,"reasoning_tokens":1885,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T13:03:46.403112+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"For the ARCHER hardware setup, record $\\psi(x(t))$ and $\\kappa(\\pi(x(t)))$ over several runs, compute the Lyapunov values $V(x(t))$ from the zero dynamics policy, and verify whether inequality (9) holds with the parameters claimed; if (9) or (18) fails while the robot still stays safe, then the theorem's conditions are not necessary. To test the theorem itself, simulate a full-order system with a known simulation function, pick parameters satisfying (18), and search for an initial condition in $W$ whose trajectory leaves $W$; any such exit would contradict forward invariance and expose a flaw in the proof.","supporting_citations":[{"cited_title":"Model-free safety-critical control for robotic systems,","cited_arxiv_id":null,"evidence_quote":"Early use of simple kinematic models to generate safe velocity commands."},{"cited_title":"Safety-critical control with bounded inputs via reduced order models,","cited_arxiv_id":null,"evidence_quote":"Extends ROM-CBF approach to bounded inputs; the paper relaxes several of its conditions."},{"cited_title":"Hierarchical control system design using approximate simulation,","cited_arxiv_id":null,"evidence_quote":"Introduces approximate simulation relations, the basis for the simulation function definition used here."},{"cited_title":"Control barrier functions and input-to-state safety with application to automated vehicles,","cited_arxiv_id":null,"evidence_quote":"Defines input-to-state safe CBFs, the property required of the ROM controller in (13)."},{"cited_title":"Constructive Nonlinear Control of Underactuated Systems via Zero Dynamics Policies","cited_arxiv_id":"2408.14749","evidence_quote":"Provides the zero dynamics policy and Lyapunov function used as interface and simulation function for ARCHER."}],"review_version":1}