{"id":"e4d83f4b-8f6d-4537-b8b6-1521a2caed8f","arxiv_id":"2501.01831","paper_version":3,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"Changing the reference state rather than redesigning the controller can restore reachability safety after abrupt constraint changes; the authors solve this as an optimization and claim 100 to 10000 times faster recovery than online redesign.","lead":"When safety constraints change mid-run, the usual fix of redesigning the controller is too slow. This paper instead shifts the controller's reference point, using a fast optimization to keep the system out of newly forbidden states.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"ORSOP constraint (22) does not encode E'' subset F': it drops the 1/||v_k|| distance factor and permits v_k·x'_o+beta_k >= 0, so Corollary 1 is false and the safety guarantee can fail even when the optimization succeeds.","rationale":"The reader's weakest assumption concerned the IPM fallback: no convergence or runtime guarantee, so the safety guarantee 'never materializes' when the KKT step fails. That is a legitimate concern about the numerical procedure. However, the more load-bearing problem is in the statement of the optimization itself: constraint (22) does not characterize E''⊂ar{F}', and Corollary 1's proof uses a false distance formula. This means the safety guarantee can fail even when the KKT method succeeds, with no numerical fallback involved. The 1D counterexample respects Assumptions 1-5: P=I, the Lyapunov equation holds with Q=2, the operational region is compact and convex, the present state lies in it, and the reference-feasible region is closed. The ORSOP solution is exactly x'_o=1, which satisfies (22) but produces an ellipsoid intersecting the forbidden region and a trajectory that immediately becomes forbidden. So the central claim of the paper is internally inconsistent, not merely under-supported experimentally. I still agree with the rejection verdict, but for a different and more fundamental reason than the one the reader emphasized. The fix is clear in principle: replace (22) with v_k·x'_o+beta_k + ||v_k||·||x'_o-x_p|| <= 0 (plus the requirement that x'_o lie on the safe side of each halfspace), or explicitly normalize all normals and add a sign condition; but as published, the architecture is not verifiably safe.","tokens_in":22543,"tokens_out":15479,"duration_ms":159619,"concrete_test":"Run the 1D instance above through the proposed 3-step procedure: A=-1, B=0, K=0, P=1, ar{F}'=[-1,0], x_p=0, Ro=[1,∞). Verify that Algorithm 1 returns x'_o=1, that (22) holds for both constraints, and that E''=[0,2] intersects F'=(-∞,-1)∪(0,∞); then confirm the trajectory x(t)=1-e^{-t} enters F' for t>0. If this reproduces, Corollary 1 is falsified. Then repeat with the corrected constraint v_k·x'_o+beta_k + ||v_k||·||x'_o-x_p|| <= 0 and check that the ORSOP becomes infeasible for this instance, identifying the exact repair needed.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central 'verifiably safe' claim rests on Corollary 1, which asserts that a solution of Problem 1 gives E''∩F'=∅. The proof of Corollary 1 uses constraint (22) as a surrogate for containment of the Lyapunov sphere in the new operational region. That surrogate is incorrect in two independent ways. First, the Euclidean distance from x'_o to the hyperplane v_k·x+beta_k=0 is |v_k·x'_o+beta_k|/||v_k||, not sqrt((v_k·x'_o+beta_k)^2); hence (22) is missing a factor ||v_k||^{-2} whenever normals are not unit. The paper never states ||v_k||=1, and after the SVD transformation in Section V-E the transformed normals Λ^{-1/2}U^T v_{k,1} generally are not unit even if the original ones were. Second, (22) bounds only the absolute value of the signed distance, so it admits v_k·x'_o+beta_k >= 0, meaning the reference state lies on the forbidden side of the constraint, provided the absolute value is at least the radius. A fully valid 1D instance shows the failure: take A=-1, B=0, K=0 (so Acl=-1), P=1, Q=2, operational region ar{F}'=[-1,0] given by v_1=(1), beta_1=0 and v_2=(-1), beta_2=-1, and x_p=0 in ar{F}'. Let Ro=[1,∞) via g_1=1-x'_o<=0. The ORSOP solution is x'_o=1: objective f=1, q_1=1-1=0, q_2=1-(-2)^2=-3<=0. But E''={ξ:(ξ-1)^2<=1}=[0,2], while F'=(-∞,-1)∪(0,∞), so E''∩F' contains (0,2]. The closed-loop trajectory x(t)=1-e^{-t} indeed enters F' immediately. Thus the guarantee asserted by Corollary 1 is not merely unproven; it is false as stated. The IPM fallback is therefore irrelevant to this defect: even the analytical KKT route returns an unsafe reference on a satisfying instance. A correct constraint would be v_k·x'_o+beta_k + ||v_k||·||x'_o-x_p|| <= 0.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes the \"Emergency-Brake Simplex\" architecture for handling abrupt runtime changes of reachability constraints in linear control systems. Instead of redesigning the controller online (OCR), the authors propose to keep the controller matrix K fixed and switch the reference state to a new value x'_o obtained by solving an optimization problem (ORSOP, Problem 1), so that the new Lyapunov ellipsoid E'' = E(x_p, x'_o, P) is disjoint from the new forbidden region F'. The proposed solution pipeline first solves a KKT-based projection problem (Problem 2, without the q_k constraints) and falls back to an IPM-based Newton method when the KKT candidate violates constraint (22). An SVD-based coordinate transformation (Section V-E) is introduced to reduce general Lyapunov ellipsoids to spheres. The abstract claims that the approach is 10^2--10^4 times faster than OCR and achieves a 49.44% success rate versus 0% for OCR under a 1.5-second deadline.","tokens_in":23050,"tokens_out":11747,"duration_ms":98346,"significance":"The idea of recovering reachability safety at runtime by moving only the reference state is conceptually attractive, and the manuscript has genuine strengths: Theorem 1 is a standard and correct Lyapunov confinement argument; Lemma 3 and Lemma 4 correctly show that a P1-ellipsoid maps to a sphere under the transformation Lambda^{1/2}U^T and that P2 = I solves the transformed Lyapunov equation; and the optimization formulation is clearly stated. However, the central safety claim is wrong: constraint (22) in Problem 1 does not encode E'' cap F' = empty, so Corollary 1 is false as stated. Because the verifiable-safety guarantee is the paper's core contribution, this error is load-bearing and cannot be repaired by a local edit; additionally, the empirical claims in the abstract are unsupported by any experimental section in the manuscript.","major_comments":[{"comment":"Constraint (22) does not encode the containment E'' cap F' = empty, so Corollary 1 is false as stated. The distance from x'_o to the hyperplane v_k . x + beta_k = 0 is |v_k . x'_o + beta_k| / ||v_k||, not sqrt((v_k . x'_o + beta_k)^2); Eq. (22) is therefore missing the factor ||v_k||^{-2}, and the paper never assumes unit normals (after the SVD transformation of Section V-E, the transformed normals Lambda^{-1/2}U^T v_{k,1} are generally not unit even if the original ones were). More importantly, (22) bounds only the absolute value of the signed distance and therefore admits v_k . x'_o + beta_k >= 0, i.e., a reference state lying on the forbidden side of the constraint. The required containment condition is v_k . x'_o + beta_k <= -||v_k|| * ||x'_o - x_p||. A concrete counterexample refutes the theorem: take A = -1, B = 0, K = 0 (so A_cl = -1), P = 1, Q = 2, new operational region \\bar{F}' = [-1,0] given by v_1 = (1), beta_1 = 0 and v_2 = (-1), beta_2 = -1, x_p = 0 in \\bar{F}', and R_o = [1, inf) via g_1 = 1 - x'_o <= 0. The ORSOP solution is x'_o = 1 (f = 1, q_1 = 0, q_2 = -3 <= 0), but E'' = {xi : (xi - 1)^2 <= 1} = [0,2] intersects F' = (-inf,-1) union (0,inf), and the closed-loop trajectory x(t) = 1 - e^{-t} leaves \\bar{F}' immediately. Thus the safety guarantee asserted in Corollary 1 fails even when the optimization succeeds.","section":"Section IV, Problem 1 Eq. (22); Corollary 1"},{"comment":"The IPM-based Newton fallback has no feasibility guarantee, no convergence guarantee, and no runtime bound. Its initialization x'^(0)_o = x_o may violate the barrier constraints (49)-(50), in which case the method fails immediately at iteration 0; the authors explicitly state that \"How to best choose x'^(0)_o remains as an open problem\" in Section V-D. Moreover, Problem 1 is nonconvex (each q_k defines a reverse-convex constraint, and (22) is a complement of a convex set), so the barrier objective (41) is not convex and the Newton iterates need not reach a global minimum or even a feasible point. Since the Step-2 KKT candidate is checked against (22) only after solving the convex Problem 2, and Step 3 may fail, the safety conclusion of Corollary 1 is conditional on an unproven numerical step; the paper must either provide a guaranteed-feasible initialization with convergence and runtime analysis or state explicitly that the safety guarantee is void when the fallback fails.","section":"Section V-B, Step 3; Section V-D, Eqs. (49)-(50)"},{"comment":"The paper's central empirical claims -- a 10^2 to 10^4 times speedup over OCR, a 40.81% success-rate improvement, and a 49.44% versus 0% success rate under a 1.5-second deadline -- are stated in the abstract as demonstrated by \"numerical simulations\", and Contribution 4 in Section I refers to \"our testbed\", but the manuscript contains no experimental section, no testbed description, no benchmark configuration, and no tables or figures reporting these numbers. These claims are therefore unverifiable as submitted; either a complete reproducible experimental section must be added or the claims must be removed from the abstract.","section":"Abstract and Section I, Contribution 4"}],"minor_comments":[{"comment":"\"Globally Asymptopitcally Stable\" should read \"Globally Asymptotically Stable\".","section":"Section III-A, Definition 1"},{"comment":"The notation for the operational constraint normals is inconsistent: Assumption 3 and Eq. (19) use \\vec{v}_k, while Problem 1, Eq. (22), and Sections V-D and V-E use \\vec{nu}_k; the same symbol should be used throughout.","section":"Assumption 3 vs. Eq. (22)"},{"comment":"\"Case 2: \\vec{x}_p < R_o\" uses the symbol '<' for set non-membership; replace it with 'not in'.","section":"Section V-B, Case 2"},{"comment":"S2-R2 states \"i.e. \\vec{x}'_{o,1} in R_{o,2}\", which mixes subscripts; it should read \"\\vec{x}'_{o,2} in R_{o,2}\".","section":"Section V-E, S2-R2"},{"comment":"The transformed matrices B_2 = Lambda^{1/2}U^T B_1 U Lambda^{-1/2} and K_2 = Lambda^{1/2}U^T K_1 U Lambda^{-1/2} are not the standard input and feedback transformations (which would be B_2 = Lambda^{1/2}U^T B_1 and K_2 = K_1 U Lambda^{-1/2}) and are dimensionally ill-defined when m != n; the closed-loop identity (82) still holds because the extra factors cancel in the product B_2K_2, but the formulas as written are misleading.","section":"Section V-E, Eq. (74)"},{"comment":"The proof contains the typo \"Beause\"; also, the final line \"Combining (star)(dagger)(double-dagger)\" uses the symbols without a formal statement of the implication chain they abbreviate.","section":"Theorem 3 proof"},{"comment":"References [3] and [12] are the same paper (L. Sha, \"Using simplicity to control complexity\"), and references [4] and [20] are the same book (Brogan, Modern Control Theory); the duplicates should be merged.","section":"References"}],"recommendation":"reject","confidential_remarks":"The central theorem of this manuscript is refuted by a simple one-dimensional counterexample, so I do not see a path to acceptance within the current scope. I would also flag for the editor that the manuscript's quantitative claims are stated in the abstract but the submitted text contains no experimental section at all; the editor may wish to confirm that the submitted version is complete before further review."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea here is genuinely interesting: when reachability constraints change at runtime, shift the reference state instead of redesigning the controller. That framing is new, and the analytical KKT solution to the simplified problem (minimize distance to the current state under reference-region constraints) is worked out cleanly. Lemma 4's SVD transformation, which turns the Lyapunov ellipsoid into a sphere, is also correct and elegant.\n\nBut there is a load-bearing error in the ORSOP formulation. Constraint (22) is supposed to guarantee that the Lyapunov sphere E'' lies inside the new operational region. The condition ||x'_o - x_p||^2 <= (v_k * x'_o + beta_k)^2 does not do that. It drops the ||v_k||^{-2} factor, so it overestimates the safe distance when normals are not unit; and because it uses an absolute value, it permits the sphere to lie entirely on the forbidden side of the hyperplane, which is exactly where it must not be. The proof of Corollary 1 even states the distance to the hyperplane as sqrt((v_k * x'_o + beta_k)^2), which is only true for unit normals with the center on the safe side. The stress-test 1D example works: A=-1, B=0, P=1, operational region [-1,0], R_o = [1,infinity), x_p=0. The ORSOP solution x'_o=1 yields E''=[0,2], which overlaps F' immediately. The closed-loop trajectory x(t)=1-e^{-t} is unsafe. So the central guarantee is not merely unproven; it is false.\n\nThere are additional problems. The abstract claims numerical results (10^2-10^4x speedup, 40.81% success-rate improvement), but the manuscript has no experimental section, no testbed description, no data. The IPM fallback has no convergence or runtime guarantee, and the initialization x'_o^(0)=x_o may violate barrier constraints; the authors themselves note that choosing a good initial point is an open problem. The paper also does not cite the reference-governor literature, which is conceptually overlapping: adjusting setpoints/references online to enforce constraints is a well-established idea.\n\nThe idea is salvageable. A correct constraint would be v_k * x'_o + beta_k + ||v_k|| * ||x'_o - x_p|| <= 0, which enforces both the side and the margin. With that fix, plus a real evaluation and a discussion of reference governors, this could become a useful paper. As it stands, I would not send it to review: the main theorem is disproved by a simple 1D counterexample, and the empirical claims are absent from the manuscript.","headline":"The reference-state-change idea is worth a look, but ORSOP constraint (22) is geometrically wrong, so the verifiable safety guarantee is false and the paper should not go to review in this form.","tokens_in":23592,"tokens_out":5637,"would_cite":false,"duration_ms":48149,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["93C05","93D05","90C30"],"pacs":[],"model":"deepseek-v4-flash","headline":"Shifting the reference state, not the controller, restores safety after runtime constraint changes.","keywords":["reachability safety","runtime constraint change","reference state optimization","Lyapunov ellipsoid","KKT conditions","interior point method","Simplex architecture","control cyber-physical systems"],"falsifier":"Run the method on a case where the analytical KKT step is skipped or known to fail, pick an initial reference that violates one of the barrier inequalities, impose a tight deadline, and observe whether the IPM-based Newton solver returns a feasible $\\vec{x}'_o$; a concrete pass/fail test is to generate many random constraint-change scenarios, measure the fraction where both the KKT step and the IPM fallback fail within $1.5$ seconds, and check whether any such failure leaves the trajectory entering the new forbidden region in simulation.","tokens_in":22330,"feed_emoji":"🛑","tokens_out":5522,"duration_ms":51656,"temperature":0.7,"pith_summary":"This paper takes on a gap in the Simplex safety architecture: when reachability constraints change abruptly at runtime, a controller designed for the old constraints may steer the plant into a newly forbidden region. The authors propose to leave the controller matrix $K$ unchanged and instead move the reference state $\\vec{x}'_o$ to a new location that makes the Lyapunov ellipsoid of the closed-loop system disjoint from the new forbidden region. They formulate this as an optimization problem (ORSOP), solve it analytically via KKT conditions when possible, and use an IPM-based Newton method as a fallback. If the method finds a feasible reference state, the future trajectory is provably confined to a safe ellipsoid; on their testbed it runs $10^2$-$10^4$ times faster than online controller redesign and keeps a $49.44\\%$ success rate under a $1.5$-second deadline, where the redesign baseline drops to $0\\%$.","feed_headline":"Safety restored by moving the reference state, not the controller","feed_subtitle":"A fast re-targeting scheme keeps trajectories inside a safe Lyapunov ellipsoid after abrupt constraint changes.","key_machinery":"The load-bearing object is the Lyapunov ellipsoid $E(\\vec{x}_p, \\vec{x}'_o, P) = \\{\\vec{\\xi} \\mid (\\vec{\\xi}-\\vec{x}'_o)^T P (\\vec{\\xi}-\\vec{x}'_o) \\leq (\\vec{x}_p-\\vec{x}'_o)^T P (\\vec{x}_p-\\vec{x}'_o)\\}$, which bounds the reachable set of the closed-loop linear system. Because $A-BK$ is fixed, $P$ and $Q$ from the original Lyapunov equation remain valid, so only the ellipsoid's center moves. The paper's main technical device is the orthogonal-plus-scaling transformation $T_{1\\to 2} = \\Lambda^{1/2} U^T$, where $P = U\\Lambda U^T$, which maps the $P$-ellipsoid to a unit sphere and makes the disjointness condition checkable as a distance between the new reference and each operational-constraint hyperplane. KKT conditions give candidate reference states analytically; the log-barrier numerical Newton step is the fallback when the analytical conditions fail.","core_discovery":"The central claim is that reachability safety after an abrupt constraint change can be re-established in real time by re-pointing the controller's reference state rather than re-designing the controller. For the new system $\\dot{\\vec{x}} = A(\\vec{x}-\\vec{x}'_o) + B\\vec{u}$, $\\vec{u} = -K(\\vec{x}-\\vec{x}'_o)$, the same Lyapunov matrix $P$ used for the original controller still works, because the closed-loop matrix $A-BK$ is unchanged. The new Lyapunov ellipsoid $E'' = E(\\vec{x}_p, \\vec{x}'_o, P)$ contains the future trajectory, so if $E''$ is disjoint from the new forbidden region $F'$, safety is restored. The ORSOP solves for $\\vec{x}'_o$ by minimizing $\\|\\vec{x}'_o - \\vec{x}_p\\|_2^2$ subject to reference-state constraints and the constraint that the ellipsoid does not cut through any hyperplane bounding the operational region. A linear transformation $T_{1\\to 2} = \\Lambda^{1/2}U^T$ based on the eigenvalue decomposition of $P$ turns the general ellipsoid into a sphere, so the safe-disjointness condition becomes a simple distance inequality.","pith_inferences":["A natural next step is to give the fallback solver a guaranteed-feasible initialization strategy; the paper leaves that as an open problem, but a feasible warm start would likely close the gap between the $49.44\\%$ deadline success rate and the no-deadline success rate.","The same reference-state shifting idea could be tested against other fast reconfiguration schemes, such as reference governors or model-predictive safety filters, where the comparison would be about computation time and conservatism rather than only controller redesign.","Because the safety proof only needs the Lyapunov matrix $P$ and the linear structure, the method should extend to output-feedback or observer-based controllers as long as the error dynamics preserve the same invariant ellipsoid property.","A testable extension would be to evaluate whether the feasible set remains convex under the sphere map for non-spherical original ellipsoids, which would determine when the KKT analytical step is guaranteed to find the global optimum."],"forward_implications":["If a feasible reference state is found, the safety guarantee is immediate: the trajectory stays inside $E''$ and $E''$ never meets $F'$, so the plant never enters the forbidden region even though $K$ is unchanged.","The computation reduces to solving a small analytical optimization in the sphere-mapped coordinates, which is what drives the reported $10^2$-$10^4\\times$ speedup over controller redesign.","Because the method reuses the existing $K$, $P$, and $Q$, it fits directly into the Simplex architecture as an emergency-brake layer that can respond to runtime constraint changes without halting the system.","Minimizing the ellipsoid's radius leaves more slack for future constraint changes, so each rescue also increases the system's tolerance to subsequent changes.","Under a $1.5$-second hard deadline, the proposed method keeps a $49.44\\%$ success rate where online controller redesign achieves $0\\%$, so the method is viable for real-time recovery on the tested scenarios."],"supporting_citations":[{"why":"Establishes the Simplex architecture premise that a simple linear controller plus a Lyapunov region can bound the reachable set even when the active controller is untrusted.","marker":"[3]"},{"why":"Supplies the Lyapunov stability theorem and the invariant ellipsoid level-set property that keeps the trajectory inside $E$.","marker":"[4]"},{"why":"Supplies the KKT conditions used to derive the analytical candidate reference states in the Step 1 optimization.","marker":"[21]"},{"why":"Supplies the log-barrier/Newton convergence framework used for the numerical fallback when KKT conditions do not yield a feasible solution.","marker":"[23]"},{"why":"Supplies the standard barrier-method construction and the logarithmic approximation of the indicator function used in the IPM formulation.","marker":"[25]"},{"why":"Supplies the LMI routine that originally produces $K$, $P$, and $Q$, the matrices the new method keeps fixed.","marker":"[26]"}],"fun_headline_variants":["Reachability safety restored by re-targeting, not re-designing","Shift reference state, keep controller: fast safety recovery","Abrupt constraint change? Re-point the reference, avoid redesign","Changing reference state beats online controller redesign for safety","Safe after sudden constraints: move the target, not the controller"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole safety claim depends on the fallback interior-point solver actually returning a feasible reference state before the deadline; the paper gives no runtime or convergence guarantee for that fallback, and its default starting point (the original reference) can violate the barrier constraints and fail immediately.","fun_headline_variants_meta":{"raw":{"variants":["Reachability safety restored by re-targeting, not re-designing","Shift reference state, keep controller: fast safety recovery","Abrupt constraint change? Re-point the reference, avoid redesign","Changing reference state beats online controller redesign for safety","Safe after sudden constraints: move the target, not the controller"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000474,"raw_usage":{"total_tokens":2464,"prompt_tokens":1166,"completion_tokens":1298,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":782,"completion_tokens_details":{"reasoning_tokens":1215}},"tokens_in":782,"tokens_out":1298,"duration_ms":12000,"temperature":1.0,"reasoning_tokens":1215,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T22:19:55.039535+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the method on a case where the analytical KKT step is skipped or known to fail, pick an initial reference that violates one of the barrier inequalities, impose a tight deadline, and observe whether the IPM-based Newton solver returns a feasible $\\vec{x}'_o$; a concrete pass/fail test is to generate many random constraint-change scenarios, measure the fraction where both the KKT step and the IPM fallback fail within $1.5$ seconds, and check whether any such failure leaves the trajectory entering the new forbidden region in simulation.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the Lyapunov stability theorem and the invariant ellipsoid level-set property that keeps the trajectory inside $E$."},{"cited_title":"Nonlinear programming,","cited_arxiv_id":null,"evidence_quote":"Supplies the KKT conditions used to derive the analytical candidate reference states in the Step 1 optimization."},{"cited_title":"On the convergence of the newton /log-barrier method,","cited_arxiv_id":null,"evidence_quote":"Supplies the log-barrier/Newton convergence framework used for the numerical fallback when KKT conditions do not yield a feasible solution."}],"review_version":1}