{"id":"c9faa7b1-74f0-4d82-93a2-a2f12d539290","arxiv_id":"2411.17079","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A sampled-data safety filter that compares a safety function at consecutive sampling instants, avoiding derivatives and handling input-dependent and high-relative-degree constraints.","lead":"The paper proposes a zero-order control barrier function for sampled-data control systems, replacing derivatives with a comparison of safety values at consecutive sampling instants. It claims this handles safety constraints that depend on both state and input, as well as constraints of any relative degree, while guaranteeing safety between samples.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Definition 1's universal feasibility assumption fails even on the safe set for the paper's own double-integrator example, so Theorem 1's hypotheses are not satisfied in the demonstrated setting.","rationale":"The reader's weakest_assumption identifies exactly this issue: Definition 1 postulates existence of a ZOCBF input for all state-input pairs, including unsafe states, with no feasibility verification, and the double-integrator inequality is infeasible for large v. My analysis agrees and shows the failure can occur even on the safe set boundary, which directly undermines the forward-invariance guarantee, not just the convergence part. The paper's central claim—that any sampled-and-hold controller satisfying (4) renders the system safe—becomes vacuous if no such controller exists at a critical state. This is a genuine soft spot rather than a mere technicality, because the method's practical value depends on the ZOCBF constraint being solvable exactly when safety is threatened. The simulations in the paper avoid infeasible states, but the theory as stated overclaims. I did not find a separate issue with Lemma 1 more load-bearing than this, although the boundedness assumption on C is also problematic for the same example. The appropriate disposition remains CONDITIONAL: the ZOCBF idea is plausible and the numerical demonstrations are useful, but the theoretical guarantees need to be qualified with feasibility assumptions or a local reformulation before the claims can be accepted as stated. Since the reader already flagged this, the verdict is unchanged.","tokens_in":13619,"tokens_out":7508,"duration_ms":69993,"concrete_test":"Run the safety filter QP (10) for the double integrator from §V.A with parameters T=0.1, γc=1, δ=0.01, U=[−10,10], starting at the state (p,v)=(10,1) and previous input u0=0. The ZOCBF constraint (4) for h1=10−p reduces to −0.005u − 0.1 + (10−10) ≥ 0.01, i.e., u ≤ −22, which has no solution in U. A solver for (10) will report infeasibility. This check confirms that Definition 1's universal existence fails on the safe set C, so Theorem 1's hypotheses are not met even in the paper's flagship example; the paper would need to add a feasible-region characterization or a relaxed local condition to support its claims.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The most load-bearing gap is Definition 1's assumption that for every (x0,u0) in R^n × U there exists u ∈ U satisfying (4). This feasibility is never characterized or verified, and it fails for the paper's first numerical example even on the safe set C. For the double integrator (§V.A) with h1 = 10 − p, T = 0.1, γc = 1, δ = 0.01, U = [−10,10], the ZOCBF condition (4) becomes −0.005u − 0.1v + (10−p) ≥ 0.01. At the safe state (p,v) = (10,1), this requires u ≤ −22, which lies outside U. Thus there is no feasible input at a state that is exactly on the safety boundary with positive velocity—precisely the situation where a safety filter is most needed. Consequently, the forward-invariance claim in Theorem 1, which requires the ZOCBF condition to be solvable at every sampling time from states in C, does not apply to the example as stated. The convergence implication (6) is even more affected because it demands solvability for arbitrarily negative h(x0,u0), where the required one-step increase −γ(h)+δ is impossible under bounded inputs. The paper should either restrict the ZOCBF definition to a feasible subset of C and prove forward invariance over that subset, or provide a feasibility condition that can be checked online. As written, the central safety guarantee is conditional on an unverified existence assumption that is false for the paper's own demonstration.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces a zero-order control barrier function (ZOCBF) framework for sampled-data continuous-time control-affine systems with safety constraints that may depend on both state and input. Definition 1 replaces the usual derivative-based CBF condition with a one-step look-ahead inequality comparing h at consecutive sampling instants, and Lemma 1 provides a robustness margin to guarantee inter-sample safety. Theorem 1 claims forward invariance of the safe set and asymptotic convergence to it, and three numerical implementation approaches are proposed: dynamics linearization, numerical integration, and parallel simulation. Two numerical examples, a double integrator with high-relative-degree position constraints and a differential-drive robot with a ZMP-based rollover constraint, are presented.","tokens_in":13941,"tokens_out":7212,"duration_ms":69699,"significance":"If the theoretical gaps identified below are addressed, the paper makes a useful contribution: the ZOCBF condition avoids differentiation and relative-degree analysis, handles state- and input-dependent constraints in a unified way, and the three implementation strategies with the provided open-source code are practical assets. The inter-sample safety guarantee is a genuine improvement over purely discrete-time CBF conditions. However, the current formulation has load-bearing feasibility and proof issues that prevent the main theorem from being applied as stated.","major_comments":[{"comment":"The assumption that for every (x0,u0) in R^n × U there exists u in U satisfying (4) is not characterized or verified, and it fails for the paper's own double-integrator example. For h1(x)=10-p, T=0.1, γc=1, δ=0.01, U=[-10,10], at the boundary state (p,v)=(10,1) (which lies in the safe set C), the ZOCBF inequality reduces to -0.005u - 0.1 >= 0.01, i.e., u <= -22, which is outside U. Thus the forward-invariance claim of Theorem 1 does not apply to the demonstrated setting. The convergence implication (6) is even more demanding because it requires feasibility for arbitrarily negative h(x0,u0), which cannot hold under bounded inputs. The paper should either restrict the ZOCBF definition to a feasible subset of C and prove invariance over that subset, or provide a checkable feasibility condition for (4).","section":"Section III, Definition 1, Eq. (4)"},{"comment":"The proof of Lemma 1 assumes bounds ∥∂h/∂x∥≤ h̄x and ∥f(x)+g(x)u∥≤ M for all (x,u) in C, but the integration along the trajectory segment from t to T requires these bounds to hold at every point φ(τ; x, u) for τ in [t, T]. The trajectory may leave C during that interval, and the lemma's conclusion is exactly what would guarantee that it stays in C. This is circular as written. The assumption should be stated on a set that contains the relevant reachable tube (or globally), or the proof should be restructured so that the bounds are applied on a forward-invariant neighborhood of C.","section":"Section III, Lemma 1"},{"comment":"The convergence proof claims that if h(x(tk), u(tk-1)) < 0, then the ZOCBF condition gives an increase of at least δ each step, so h becomes positive in finite time. This reasoning requires the existence of u in U satisfying (4) for arbitrarily negative h values. For the double-integrator constraint h1=10-p with bounded U, as p becomes large the required one-step increase cannot be achieved, so the convergence claim is not supported. The theorem should either add assumptions that guarantee feasibility for all states outside C, or remove/weaken the convergence implication.","section":"Section III, Theorem 1, second implication (6)"}],"minor_comments":[{"comment":"The backward-time extension with a hypothetical v is unnecessary and leaves the initialization of u(tk-1) at t=0 unspecified for the online controller (10). Please define how the previous input is chosen at the first sampling instant and state the resulting condition on the initial pair (x0, u−1).","section":"Section III, Theorem 1 proof"},{"comment":"In the line '≥ −γ(h(x(tk)), u(tk−1)) + δ', the parentheses are misplaced; it should be '−γ(h(x(tk), u(tk−1))) + δ'.","section":"Section III, Theorem 1 proof, second paragraph"},{"comment":"The caption refers to a 'collision avoidance example,' but the simulation is a double-integrator position-constraint example; please adjust the wording.","section":"Section V, Figure 1 caption"},{"comment":"The bound m(T,u) with a fourth-order Runge-Kutta method is stated to be K c0 T^5, but no justification or reference is provided; please add a derivation or citation.","section":"Section IV.D, Eq. (20)"}],"recommendation":"major_revision","confidential_remarks":"The central idea is promising and the practical contributions (three implementations, open-source code) are valuable. The feasibility gap in Definition 1 and the circular bound issue in Lemma 1 are fixable with additional assumptions, but the convergence claim likely needs to be removed or substantially restricted. I recommend major revision with a request to re-verify the theoretical statements against the numerical examples."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the ZOCBF condition is a clean and plausible idea, and the paper is honest about its relation to discrete-time CBFs, but the main theorem as stated has a load-bearing feasibility assumption that is never verified and that fails on the paper's own double-integrator example.\n\nWhat's actually new: replacing the instantaneous derivative condition of CBFs with a one-step difference condition computed with the exact sample-and-hold flow, plus a robustness margin delta, is a natural but useful move. It does let you write down safety conditions for h(x,u) constraints and for high-relative-degree constraints without differentiation, and Section IV's three implementation strategies (linearization, numeric integration, parallel simulation) are practical. They also ship code, which helps. Remark 2 is candid that for state-only constraints and small delta this reduces to the discrete-time CBF of [19] with a robustness margin.\n\nThe soft spots are real and central. Definition 1 assumes that for every (x0,u0) in R^n x U, including states outside the safe set, there exists a u in U satisfying (4). No feasibility condition is given. It fails in their own Section V.A: for the double integrator with T=0.1, gamma_c=1, delta=0.01, U=[-10,10], at the safe boundary state (p,v)=(10,1) the condition requires u <= -22, which is outside U. So the forward-invariance hypothesis of Theorem 1 does not hold at the very boundary the filter is meant to enforce. The convergence claim (6) is even harder, since it requires solvability for arbitrarily negative h(x0,u0) under bounded inputs. This is not a minor gap; the central guarantee is conditional on an existence assumption that is false in the demonstrated setting.\n\nThe other issue is Lemma 1: the bound on dh/dx and f+gu is assumed on C, but the proof integrates along trajectories that may leave C. For the double integrator, C is unbounded in velocity, so no finite M exists over C, and the paper simply picks delta=0.01 without checking (5). This is fixable by either global bounds or a local argument that keeps trajectories in a compact sublevel set, but as written the inter-sample safety argument also doesn't formally apply to the example.\n\nMinor point: the abstract says the input always appears in the ZOCBF condition; with approximate integration this is only true if the RK order is at least the relative degree (Section IV.B), which the paper does acknowledge.\n\nBottom line: the core idea is worth pursuing and the writing is clear, but the paper currently overclaims what is proven. It deserves a serious referee, but major revision is needed. The authors should characterize or at least check feasibility of (4), and fix the Lemma 1 domain issue.\n\nRecommendation: send it to review, but expect heavy revision.","headline":"The ZOCBF idea is clean and worth pursuing, but the main theorem rests on a feasibility assumption that the paper never checks and that fails on its own double-integrator example.","tokens_in":14478,"tokens_out":2603,"would_cite":true,"duration_ms":23423,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["93C57","93D30","93C10"],"pacs":[],"model":"deepseek-v4-flash","headline":"A continuous safety constraint h is a zero-order control barrier function if every state has an admissible input making h grow by at least $-\\gamma(h)+\\delta$ over one sampling period; Theorem 1 shows this keeps the closed-loop…","keywords":["zero-order control barrier function","sampled-data systems","safety constraints","state-input dependent constraints","high-relative-degree constraints","forward invariance","safety filter","zero-order hold"],"falsifier":"Compute the ZOCBF condition for the double-integrator example with $T=0.1$, $\\gamma_c=1$, $\\delta=0.01$, $p=0$, $v=101$: the inequality $-0.5T^2 u - T v + (10-p) \\ge \\delta$ becomes $-0.005u \\ge 0.11$, which no $u \\in [-10,10]$ satisfies. Observing such an infeasible state in simulation would show the existence assumption in Definition 1 can fail for exactly the systems the method targets.","tokens_in":13354,"feed_emoji":"🛡️","tokens_out":7679,"duration_ms":67753,"temperature":0.7,"pith_summary":"This paper proposes a zero-order control barrier function (ZOCBF) for sampled-data systems, where a controller is recomputed at sampling instants and held constant in between. The central idea is to compare the safety constraint's value at two consecutive sampling instants rather than differentiate it, which removes the relative-degree obstruction that forces conventional CBFs into high-order or backstepping constructions. The authors prove that when $h$ satisfies the ZOCBF difference inequality with a robustness buffer $\\delta$, any sampled-and-hold controller meeting the condition at each sampling time keeps $h \\ge 0$ at every continuous time, and draws initially unsafe trajectories back to the safe set. The formulation also handles safety constraints that depend explicitly on both state and control input, and the authors give three numerical ways to enforce the condition.","feed_headline":"A difference check, not a derivative, keeps sampled-data systems safe","feed_subtitle":"New zero-order CBF condition handles high-relative-degree and input-dependent constraints with inter-sample guarantees.","key_machinery":"The load-bearing object is the one-step difference inequality (4), evaluated between the state–input pair at a sampling instant and the predicted pair one sampling period later. Its companion is Lemma 1, which chooses $\\delta \\ge \\bar{h}_x M T$ so that a value at least $\\delta$ at the end of a sampling interval forces nonnegativity throughout that interval; this is what converts a discrete-time check into a continuous-time safety guarantee. The relative-degree argument rests on the normal form of a control-affine system: in coordinates where a relative-degree-$\\rho$ constraint is the first element of a chain of integrators, the control input enters that element through the $\\rho$-th integrator over one sampling step, so $u$ appears in the ZOCBF condition without any differentiation.","core_discovery":"The paper's central claim is Theorem 1: if a continuous $h$ is a ZOCBF in the sense of Definition 1 and $\\delta$ satisfies the bound $\\delta \\ge \\bar{h}_x M T$ from Lemma 1, then every sampled-and-hold controller with $u_k \\in U_{\\mathrm{zocbf}}(x(t_k), u(t_{k-1}))$ renders the system safe for all times—starting safe, the trajectory never leaves the safe set; starting unsafe, the distance to the safe set tends to zero. The ZOCBF condition $h(\\phi(T; x_0, u), u) - h(x_0, u_0) \\ge -\\gamma(h(x_0, u_0)) + \\delta$ uses no derivative of $h$, and the paper shows by a normal-form argument that $u$ always appears in the condition even when $h$ has relative degree greater than one, because $u$ enters the first component of the flow over one sampling period. Three implementations are proposed: local linearization of the dynamics, numerical integration of the flow, and parallel simulation with sampling over the control set; each gives a practical constraint that implies the ZOCBF condition when the approximation error is bounded.","pith_inferences":["The paper does not characterize when $U_{\\mathrm{zocbf}}$ is nonempty; an implementation would need a fallback or a relaxation when the inequality is infeasible at a sampled state.","If the existence assumption were restricted to states inside the safe set, forward invariance would remain valid but the convergence-from-unsafe implication would require a separate argument; this is a natural follow-up.","The relative-degree analysis suggests that any flow predictor accurate enough to capture the $\\rho$-th step of the integrator chain suffices for high-relative-degree constraints, so the order of the numerical integrator is a tuning parameter, not a structural barrier.","Lemma 1's bound $\\delta \\ge \\bar{h}_x M T$ gives a quantitative trade-off: faster sampling or flatter $h$ allows a smaller robustness margin, while steep $h$ or slow sampling forces a larger buffer."],"forward_implications":["High-relative-degree safety constraints can be handled by the same difference condition used for relative-degree-one constraints, with no exponential or high-order CBF construction.","State-and-input dependent constraints, such as the ZMP rollover constraint, enter the condition directly through $h(x_{k+1}, u_k)$.","The $\\delta$ buffer gives inter-sample safety, a guarantee not provided by a discrete-time CBF checked only at sampling instants.","The ZOCBF condition can be formulated as a linear, convex quadratic, or general nonlinear constraint on $u$, depending on the implementation and the concavity of $h$.","A safety filter of the form (10) can be run online, preserving the nominal controller whenever it is safe and correcting it when it is not."],"supporting_citations":[{"why":"Defines the conventional CBF condition and forward-invariance framework that ZOCBF generalizes.","marker":"[2]"},{"why":"One of the high-order CBF constructions that ZOCBF avoids for high-relative-degree constraints.","marker":"[9]"},{"why":"Another high-order barrier function construction used as a contrast point for the no-differentiation feature.","marker":"[10]"},{"why":"Integral CBF approach for state-input dependent constraints, the main alternative ZOCBF replaces.","marker":"[12]"},{"why":"Discrete-time CBF condition whose form ZOCBF resembles while adding inter-sample safety.","marker":"[19]"},{"why":"Treats safety of sampled-data systems with CBFs via approximate discrete-time models, providing context for the sampled-data formulation.","marker":"[20]"},{"why":"Discrete-time high-order CBFs, which ZOCBF avoids for high-relative-degree constraints.","marker":"[21]"},{"why":"Supplies the normal-form theorem used to show u appears in the ZOCBF condition regardless of relative degree.","marker":"[23]"},{"why":"Provides the ZMP-based rollover constraint used in the state-input dependent numerical example.","marker":"[30]"}],"fun_headline_variants":["Safety without derivatives via zero-order CBF","Difference-based CBF: no differentiation needed","ZOCBF: sampled-data safety with input constraints","Discrete barriers: safe sampled-data systems"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that at every state and previous input, including states already outside the safe set, some control input in $U$ satisfies the ZOCBF inequality; the paper gives no feasibility condition ensuring this holds.","fun_headline_variants_meta":{"raw":{"variants":["Safety without derivatives via zero-order CBF","Difference-based CBF: no differentiation needed","ZOCBF: sampled-data safety with input constraints","Discrete barriers: safe sampled-data systems"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000173,"raw_usage":{"total_tokens":1260,"prompt_tokens":911,"completion_tokens":349,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":527,"completion_tokens_details":{"reasoning_tokens":292}},"tokens_in":527,"tokens_out":349,"duration_ms":4467,"temperature":1.0,"reasoning_tokens":292,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T12:37:38.867768+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute the ZOCBF condition for the double-integrator example with $T=0.1$, $\\gamma_c=1$, $\\delta=0.01$, $p=0$, $v=101$: the inequality $-0.5T^2 u - T v + (10-p) \\ge \\delta$ becomes $-0.005u \\ge 0.11$, which no $u \\in [-10,10]$ satisfies. Observing such an infeasible state in simulation would show the existence assumption in Definition 1 can fail for exactly the systems the method targets.","supporting_citations":[{"cited_title":"Control barrier function based quadratic programs for safety critical systems,","cited_arxiv_id":null,"evidence_quote":"Defines the conventional CBF condition and forward-invariance framework that ZOCBF generalizes."},{"cited_title":"Control barrier functions for systems with high relative degree,","cited_arxiv_id":null,"evidence_quote":"One of the high-order CBF constructions that ZOCBF avoids for high-relative-degree constraints."},{"cited_title":"High-order barrier functions: Robustness, safety, and performance-critical control,","cited_arxiv_id":null,"evidence_quote":"Another high-order barrier function construction used as a contrast point for the no-differentiation feature."},{"cited_title":"Integral control barrier functions for dynamically defined control laws,","cited_arxiv_id":null,"evidence_quote":"Integral CBF approach for state-input dependent constraints, the main alternative ZOCBF replaces."},{"cited_title":"Safety of sampled-data systems with control barrier functions via approximate discrete time models,","cited_arxiv_id":null,"evidence_quote":"Treats safety of sampled-data systems with CBFs via approximate discrete-time models, providing context for the sampled-data formulation."},{"cited_title":"Discrete-time control barrier function: High-order case and adaptive case,","cited_arxiv_id":null,"evidence_quote":"Discrete-time high-order CBFs, which ZOCBF avoids for high-relative-degree constraints."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the normal-form theorem used to show u appears in the ZOCBF condition regardless of relative degree."},{"cited_title":"Rollover prevention for mobile robots with control barrier functions: Differentiator-based adaptation and projection-to-state safety,","cited_arxiv_id":null,"evidence_quote":"Provides the ZMP-based rollover constraint used in the state-input dependent numerical example."}],"review_version":1}