{"id":"57ec84bc-0bac-46c0-b992-2f54a9300445","arxiv_id":"2504.15850","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"A composite control barrier function safety filter, running online on a PX4 autopilot from sparse range measurements, modifies acceleration setpoints and avoids obstacles on a real quadrotor in two experiments.","lead":"This paper puts a collision-avoidance safety filter, based on control barrier functions, into the PX4 open-source autopilot used on many drones. It shows the filter deflecting a small quadrotor away from walls and panels using only live range-sensor data, without building a map.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Limited-FoV safety premise is not enforced: Eq. 17c makes FoV constraints soft, Eq. 16 drops the dot-R term, and Fig. 9 shows FoV CBFs going negative. The 'ensures collision avoidance' claim does not follow for the tested maneuvers.","rationale":"The reader identified the same load-bearing weakness: the formal safety argument for limited-FoV sensing assumes the velocity is always inside the frustum, while the implementation uses soft FoV constraints and a yaw-rate approximation, and the experiments show FoV CBF violations. My independent reading agrees. I checked whether the composite-CBF/ECBF construction itself had a hidden flaw; the soft-min formulation appears consistent with the cited composition result, and the ECBF theorem is invoked with the standard initial-condition caveat. The weakest link is not the algebra but the gap between the hard premise of Section III and the soft/approximate implementation of Sections IV-VI. This does not undermine the engineering contribution: the open-source PX4 integration, the timing numbers, and the two flight demonstrations are real evidence of practical effectiveness. It does mean the strong statement 'ensures collision avoidance' is not established by the presented theory for the aggressive maneuvers tested. A conditional acceptance, asking the authors to either harden the FoV constraints or replace the premise with a different safety argument, and/or to weaken the claim, is the appropriate verdict. Because the reader's conditional verdict already captures this, no change is needed.","tokens_in":10881,"tokens_out":8941,"duration_ms":88067,"concrete_test":"Replay the logged Experiment 2 state and obstacle data through the QP in Eq. 17 with the FoV constraints made hard (delta_fi identically zero) and with the exact term V e_j^T dot R_VI v included in Eq. 16. If the QP becomes infeasible or the FoV CBF still crosses zero during the high-yaw-rate portions of the ellipse, then the implementation is not enforcing the theory's premise, and the claimed guarantee must be restated as conditional on hard FoV enforcement or replaced by a weaker 'demonstrated heuristically' claim.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's guarantee of collision avoidance with a limited-FoV sensor depends on the Section III assumption that the current velocity vector stays inside the sensor frustum, so that obstacles on a collision course cannot be hidden outside the field of view. This premise is not enforced by the implementation. In the QP (17), the FoV constraints are soft constraints (17c) with slack variables delta_fi, so a feasible solution may still violate them. The yaw-aligned approximation in Eq. 15 is derived by neglecting the term V e_j^T dot R_VI v in Eq. 16, justified only by 'small yaw rates.' Experiment 2 contradicts that justification: Fig. 9 shows one FoV CBF repeatedly negative during the aggressive ellipse, and the text attributes this to skidding at high yaw rates. Thus the tested system operates outside the domain where the limited-FoV safety argument applies; the empirical results show practical usefulness but do not substantiate the formal 'ensures collision avoidance' conclusion. No internal inconsistency in the CBF construction was identified; the issue is that a hard theoretical premise is replaced by a soft, approximate implementation.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes an embedded safety filter for multirotor UAVs based on composite control barrier functions (CBFs), integrated into the PX4 autopilot stack. The filter modifies the acceleration setpoint produced by a nominal position/velocity controller to enforce a minimum distance to obstacles measured online by an onboard range sensor. A quadratic program (Eq. 17) combines an obstacle-avoidance CBF with two soft field-of-view (FoV) constraints; the implementation includes point-cloud sparsification, body-frame composition, and low-pass filtering of the filter input and output. The approach is evaluated in two hardware experiments: adversarial joystick commands in a hallway and aggressive ellipse tracking with a suddenly inserted obstacle. The paper claims that the architecture ensures collision avoidance and is computationally efficient (50–400 microseconds per solve without FoV constraints, about 2 ms with FoV constraints).","tokens_in":11122,"tokens_out":8116,"duration_ms":73148,"significance":"If the claims are substantiated, the paper offers a practical, open-source, real-time integration of CBF-based safety filtering in a widely used autopilot, with hardware validation in dynamic, unknown environments. The computational benchmarks and the two experiments are valuable, and the extension of the authors' prior composite-CBF work [20] to acceleration control in a cascaded architecture is a useful contribution. However, the formal safety guarantee is weakened by implementation choices: the FoV constraints are soft (Eq. 17c), the yaw-rate term in the FoV derivative is neglected (Eq. 16), low-pass filters are applied to the filter input/output (Eq. 20), and the experimental CBF values go negative (Figs. 7 and 9). The unqualified 'ensures collision avoidance' claim in the abstract and conclusion exceeds what the theory and experiments establish. The contribution is nonetheless a useful engineering advance that could be publishable after a substantial revision of the claims and supporting analysis.","major_comments":[{"comment":"The limited-FoV safety argument in Section III assumes the vehicle's velocity is contained in the sensor frustum, but the implementation does not enforce this condition: Eq. (17c) treats the FoV constraints as soft constraints with slack variables delta_fi, and the yaw-aligned approximation in Eqs. (15)-(16) drops the term V e_j^T dot(R_VI) v, justified only by the claim of small yaw rates. Experiment 2 (Fig. 9) shows one FoV CBF repeatedly negative, which the text attributes to skidding at high yaw rates. Consequently, the theoretical premise for reducing risk from unseen obstacles is not satisfied in the experiments, and the abstract/conclusion statement that the filter 'ensures collision avoidance' is not supported. Please either enforce the FoV constraints as hard constraints (with a feasibility analysis), or restrict the formal safety claim to the currently visible obstacles, or present the FoV behavior as an empirical heuristic rather than as part of the safety certificate.","section":"Sections III-IV-C (Eqs. 15-17) and Fig. 9"},{"comment":"The safety filter output a* is passed through a first-order low-pass filter before being sent to the attitude controller (Eq. 20). The CBF condition (2) is verified only for the unfiltered QP solution; the filtered command may violate the constraint between samples or during transients. Similarly, pre-filtering the nominal input asp changes the problem data. No argument is given that the filtered commands preserve the forward-invariance guarantee. The authors should either provide an input-to-state safety or filter-aware analysis, or explicitly limit the formal guarantee to the unfiltered command and present the filtered implementation as a heuristic for chattering reduction.","section":"Section V-D (Eq. 20)"},{"comment":"The experimental CBF values violate the safe set in both experiments: Fig. 7 shows the composite obstacle CBF h dropping below zero for a few instances in Experiment 1, and Fig. 9 shows one FoV CBF repeatedly negative in Experiment 2. A negative composite CBF means the state is outside the obstacle-avoidance safe set defined by the current point cloud, and a negative FoV CBF means the velocity-in-frustum condition is violated. The paper attributes these dips to sudden appearance of obstacles, measurement noise, and acceleration tracking errors, but it provides no robustness analysis (e.g., input-to-state safety or a disturbance bound) that reconciles these violations with the formal guarantee. Without such analysis, the 'ensures collision avoidance' wording should be tempered to a claim of demonstrated practical collision avoidance in the tested scenarios, or supplemented with a robustness framework.","section":"Sections VI-B and VI-C (Figs. 7 and 9)"}],"minor_comments":[{"comment":"The phrase 'Multirotors Systems' in the title and abstract should be corrected to 'Multirotor Systems.'","section":"Title and Abstract"},{"comment":"In Table I the low-pass time constant tau is listed with range [0.01, 0.1], but Table II reports the experimental value tau = 0.5, outside this range; please reconcile the discrepancy.","section":"Tables I and II"},{"comment":"Please define e_j explicitly as the unit vector in the vehicle frame V pointing along the inward normal of the j-th frustum plane; the current text refers to an 'inward-facing normal on the plane' but does not specify its frame or how it relates to the two horizontal constraints used in the QP.","section":"Section IV-B"},{"comment":"In Algorithm 1, the variable nu1 is used where the text uses nu_{i,1}; also the notation Bp[i]^T is ambiguous and should clearly indicate a row vector expressed in the body frame.","section":"Section V-C, Algorithm 1"},{"comment":"The computational benchmarks (50 microseconds, 400 microseconds, 2 ms) are reported for the embedded board, but the number of obstacles used in the FoV-constrained solve is not stated; adding this detail would facilitate reproducibility.","section":"Section VI-A"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is a solid systems contribution with a real embedded implementation and two hardware experiments. The main risk is that the formal language in the abstract and conclusion overstates the guarantee: the implementation uses soft FoV constraints, a neglected yaw-rate term, and low-pass filters, and the experiments show occasional CBF violations. I would require the authors to either enforce the FoV constraints exactly (which may raise feasibility issues) or substantially reword the safety claims to match what is actually proven, and to add a robustness discussion for the filtering and tracking errors. The open-source PX4 integration is a strong point, and the paper fits the journal's scope; the revision is feasible within the manuscript's scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nRead this if you care about putting CBF safety filters on actual small drones rather than in simulation. The paper does something concrete: it takes the composite-CBF construction from the authors' own ICRA work, adapts it to acceleration control inside PX4, adds a yaw-aligned FoV constraint, and validates it on hardware against adversarial joystick commands and an aggressive ellipse track. The code is open-sourced in a PX4 fork, the timing numbers are believable (50–400 µs analytical, ~2 ms with FoV constraints), and the experiments show real collision avoidance without a map. That is a legitimate engineering contribution and a useful reference point for anyone attempting embedded safety filters.\n\nThe theory is standard and mostly clean: ECBF for relative degree 2, soft-min composition from Molnar–Ames, QP with slack. The soft spots are in the gap between the formal claim and the implementation. The paper says 'ensures collision avoidance,' but the FoV constraint that underlies the limited-sensor safety argument is soft (Eq. 17c with slack), the yaw-rate term in Eq. 16 is dropped with a small-yaw-rate justification, and Fig. 9 shows a FoV CBF going negative precisely during the aggressive maneuver where yaw rates are high. The authors acknowledge the negative values and attribute them to skidding, which is honest, but it means the tested system operates outside the domain where the limited-FoV guarantee holds. The composite CBF itself stays positive, so the filter is doing useful work; the overclaim is about what the FoV constraint contributes.\n\nIs this fatal? No. The central contribution is the embedded integration and the empirical demonstration, and those hold up. The formal safety statement just needs to be scoped: 'collision avoidance for obstacles visible within the sensor frustum while the vehicle roughly satisfies the FoV assumption, with soft handling of transient violations.' The paper would be stronger if it either enforced the FoV constraints more strictly (at the cost of feasibility) or explicitly characterized the residual risk when they are violated. The limitations section mentions sudden obstacle appearance but stops short of connecting that to the FoV-constraint enforcement gap.\n\nCitation pattern looks fine: they build on [20] (their own prior work), Molnar–Ames, and the standard Ames/ECBF references, and the self-citation is appropriate. The experimental parameters are tuned but not fitted to produce the safety outcome; that is normal practice.\n\nWho is this for? Robotics practitioners working on mapless reactive safety and anyone considering a CBF filter inside PX4. It deserves a serious referee: the integration is real, the hardware evidence is meaningful, and the soft-spot analysis is exactly what peer review should tighten. I would send it out, with a request to reword the guarantee and discuss the FoV enforcement gap.\n\nBest,\n[You]","headline":"A clean, honest embedded-CBF paper: real PX4 integration, open code, hardware demos, but the limited-FoV safety argument is soft where it matters most.","tokens_in":11653,"tokens_out":718,"would_cite":true,"duration_ms":8741,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that a live-range composite control barrier function can be embedded in the PX4 autopilot to filter acceleration setpoints and prevent collisions in unknown environments without a map.","keywords":["control barrier functions","safety filter","collision avoidance","multirotor","PX4 autopilot","reactive navigation","composite CBF","embedded control"],"falsifier":"Command the quadrotor to fly along a velocity vector outside the horizontal field of view of the depth sensor with an obstacle hidden in that direction and check whether the filter prevents a collision; the paper's own Fig. 9 already shows the FoV CBF value crossing below zero during aggressive yaw, indicating the premise that keeps the safety argument valid is not always enforced.","tokens_in":10668,"feed_emoji":"🚁","tokens_out":7539,"duration_ms":61738,"temperature":0.7,"pith_summary":"This paper claims that a composite control barrier function (CBF) built only from instantaneous onboard range measurements can act as a complete safety filter inside the open-source PX4 autopilot, correcting acceleration setpoints before they reach the attitude controller. The aim is to make reactive collision avoidance for small multirotors practical without any consistent map or external computation. The claim is supported by two hardware flights: one where a human operator deliberately commanded the drone into walls, and one where the drone tracked an aggressive ellipse and a panel suddenly appeared in its path. If the claim holds, a standard flight controller can provide a last-resort safety layer that runs in about 2 ms with field-of-view constraints, and even faster without them.","feed_headline":"A 2 ms safety filter lets a quadrotor dodge unseen obstacles","feed_subtitle":"It plugs into PX4 and steers around obstacles using only live range measurements, no map.","key_machinery":"The central object is the composite control barrier function, a smooth under-approximation of the minimum over individual obstacle constraints that uses a log-sum-exp soft minimum with a tanh saturation, parameterized by $\\kappa$ and $\\gamma$. Each obstacle contributes a relative-degree-two exponential CBF: $\\nu_{i,0} = \\|p_i - p\\|^2 - \\epsilon^2$ and $\\nu_{i,1} = \\dot{\\nu}_{i,0} - p_0 \\nu_{i,0}$. The field of view is imposed by two linear constraints on velocity expressed in the yaw-aligned vehicle frame, which are relaxed with slack variables to keep the quadratic program feasible. When only the composite CBF is active, the safe acceleration is computed analytically by a projection formula; when the FoV constraints are active, the problem is solved with qpOASES, and a first-order low-pass filter on the setpoint reduces chattering.","core_discovery":"The central discovery claim is that the obstacle-avoidance problem for an acceleration-controlled multirotor can be expressed as a single composite CBF $h(x) = -(\\gamma/\\kappa) \\ln \\sum_i \\exp(-\\kappa s(\\nu_{i,1}/\\gamma))$, where each $\\nu_{i,1}$ is an exponential CBF of relative degree two derived from the squared distance to a measured obstacle point. The filter then solves a quadratic program that minimally modifies the nominal acceleration setpoint to satisfy $L_f h(x) + L_g h(x) a \\ge -\\alpha(h(x))$. In addition, the paper claims that the sensor field of view can be incorporated as two soft acceleration constraints in a yaw-aligned frame, that the unconstrained problem admits a closed-form projection, and that the full implementation runs on the embedded PX4 controller with average solve times of ~2 ms (with FoV constraints) and 50–400 µs (without). The two experiments are presented as evidence that this filter prevents collisions during both adversarial velocity commands and fast trajectory tracking in unknown environments.","pith_inferences":["A convincing stress test of the limited-FoV safety claim would be to command a velocity vector outside the sensor frustum; the paper's theory covers only the configuration where velocity stays inside the frustum, so a collision in that scenario would show the gap between the guarantee and the deployed soft constraints.","The same composite-CBF construction should transfer to other acceleration-controlled mobile robots (e.g., ground vehicles or manipulators) wherever relative-degree-two distance constraints appear.","Adding a short-term memory of recently seen obstacle points could smooth the jerky behavior caused by obstacles entering and leaving the frustum, a fix the authors mention as future work."],"forward_implications":["A multirotor autopilot can host a reactive safety filter in its standard position/velocity control loop, removing the need for a separate compute board for low-level avoidance.","Because the filter uses only current range measurements, collision avoidance is unaffected by map drift, localization failure, or memory of outdated obstacles.","Adversarial or erroneous operator commands are overridden only as much as needed: the vehicle is deflected around obstacles and brought to a stop in front of a wall, then resumes normal tracking.","Computation scales linearly with the number of obstacle points (about 50 µs for 25 points, 400 µs for 200), so dense point clouds remain feasible on embedded hardware.","The FoV constraints intentionally trade tracking performance for safety, reducing lateral accelerations and thus degrading aggressive trajectory tracking."],"supporting_citations":[{"why":"Introduces the reactive safety-filter quadratic program that this work instantiates.","marker":"[11]"},{"why":"The prior composite-CBF safety filter that this paper extends to acceleration control and PX4 integration.","marker":"[20]"},{"why":"Provides the control barrier function definition and invariance condition used throughout.","marker":"[21]"},{"why":"Supplies the exponential CBF construction that handles the relative-degree-two distance constraint.","marker":"[22]"},{"why":"Gives the soft-minimum composition rule (log-sum-exp with saturation) that builds the single h.","marker":"[23]"},{"why":"Defines the PX4 architecture the filter is embedded in.","marker":"[24]"},{"why":"The qpOASES solver used for the FoV-constrained quadratic program.","marker":"[26]"},{"why":"Provides the closed-form projection used for the unconstrained analytic solve.","marker":"[28]"}],"fun_headline_variants":["2ms range-only safety filter clears obstacles on PX4","Quadrotor dodges obstacles with 2ms onboard filter","No map? 2ms filter still avoids obstacles","PX4 gains 2ms reactive obstacle avoidance","Onboard 2ms CBF filter keeps quadrotor safe, no map"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The formal guarantee against collisions from unseen obstacles rests on the premise that the vehicle's velocity always points inside the sensor frustum; in the actual implementation this is enforced only by two soft, relaxable constraints, and the yaw-aligned approximation drops the time derivative of the rotation matrix.","fun_headline_variants_meta":{"raw":{"variants":["2ms range-only safety filter clears obstacles on PX4","Quadrotor dodges obstacles with 2ms onboard filter","No map? 2ms filter still avoids obstacles","PX4 gains 2ms reactive obstacle avoidance","Onboard 2ms CBF filter keeps quadrotor safe, no map"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001253,"raw_usage":{"total_tokens":5100,"prompt_tokens":872,"completion_tokens":4228,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":488,"completion_tokens_details":{"reasoning_tokens":4143}},"tokens_in":488,"tokens_out":4228,"duration_ms":29346,"temperature":1.0,"reasoning_tokens":4143,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T11:16:04.189314+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Command the quadrotor to fly along a velocity vector outside the horizontal field of view of the depth sensor with an obstacle hidden in that direction and check whether the filter prevents a collision; the paper's own Fig. 9 already shows the FoV CBF value crossing below zero during aggressive yaw, indicating the premise that keeps the safety argument valid is not always enforced.","supporting_citations":[{"cited_title":"Safe Quadrotor Navigation using Composite Control Barrier Functions","cited_arxiv_id":"2502.04101","evidence_quote":"The prior composite-CBF safety filter that this paper extends to acceleration control and PX4 integration."},{"cited_title":"Composing control barrier functions for complex safety specifications,","cited_arxiv_id":null,"evidence_quote":"Gives the soft-minimum composition rule (log-sum-exp with saturation) that builds the single h."},{"cited_title":"Px4: A node-based multithreaded open source robotics framework for deeply embedded platforms,","cited_arxiv_id":null,"evidence_quote":"Defines the PX4 architecture the filter is embedded in."},{"cited_title":"Control barrier functions and input-to-state safety with application to auto- mated vehicles,","cited_arxiv_id":null,"evidence_quote":"Provides the closed-form projection used for the unconstrained analytic solve."}],"review_version":1}