{"id":"ef2b9f45-8a2d-4206-b074-ff91bc6e1e7a","arxiv_id":"2505.03612","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"The authors build reach-avoid controllers for nonlinear multi-input multi-output systems by backstepping a certificate synthesized on a simpler single-integrator system.","lead":"This paper designs controllers that make multi-input, multi-output systems reach a target while staying inside a safe set. It uses feedback linearization and backstepping to turn a simple reach-avoid controller into one for more complex vehicles and robots.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 2's proof ignores cross-coupling derivatives of k1(y); Proposition 1's controller then fails its own ECGBF inequality on a two-output example.","rationale":"The reader's weakest assumption is the local-to-global relative-degree gap: Theorem 2 assumes vector relative degree at a point x0, yet concludes guarantees on the whole set C_Psi, which may contain points where the decoupling matrix A(x) is singular. That is a valid gap, but it is a domain-restriction issue that could be repaired by assuming a global vector relative degree or by confining C_Psi to the feedback-linearization neighborhood. The more fundamental problem is internal to the proof: the backstepping recursion in (22) and (26) differentiates the initial virtual controllers k_i^1 as if each depended only on its own output chain. The single-integrator controller k1(y) produced by the SOS step is a vector field on the output space and has no reason to be component-wise decoupled; in general it is coupled. The proof drops all cross-derivative terms, so the constructed controller does not actually enforce dot-Psi >= lambda Psi. The explicit two-output example above satisfies every hypothesis of Theorem 2 (global relative degree {2,2}, valid single-integrator ECGBF k1, nonempty target inside the safe set), yet the controller from Proposition 1 violates the ECGBF inequality at a point of C_Psi. This is not a matter of missing regularity or a stronger assumption: the provided synthesis algorithm can fail on a simple feedback-linearizable system. Since the central claim is the constructive reach-avoid guarantee, and the construction is shown incorrect, the verdict should move from CONDITIONAL to REJECT. The result might be salvageable by using the full Jacobian of k1 in the recursion, but that is a substantial revision, not a minor fix.","tokens_in":11387,"tokens_out":25945,"duration_ms":238830,"concrete_test":"Recompute dot-Psi for the two-chain system dot-eta_i^1=eta_i^2, dot-eta_i^2=v_i with psi=1-y1^2-y2^2, Xr={y1^2+y2^2<0.01}, k1=(-10y1-y2,-10y2), lambda=0.1, mu=1, at (y1,y2,eta1^2,eta2^2)=(0.11,0,-0.9,1.3), using v_i from (26). If the full Jacobian of k1 is retained, the computation returns dot-Psi approx -0.1045 < 0.1*0.1229, so Proposition 1's controller violates the ECGBF inequality; if the cross derivative partial k1_1/partial y2=-1 is dropped as in the paper, the erroneous calculation instead gives dot-Psi approx 0.1555 > 0.0123, exposing the missing term.","verdict_should_be":"REJECT","load_bearing_attack":"Equation (22) differentiates Psi and writes the derivative of each virtual control k_i^l(z_i^l) as sum_{s=1}^l (partial k_i^l / partial eta_i^s) dot-eta_i^s, i.e., only along the i-th output chain. This is valid only if k_i^l depends solely on eta_i^1,...,eta_i^l. But k_i^1 is the i-th component of k_1(y), the single-integrator controller from (19), which in general depends on the full output vector y=(eta_1^1,...,eta_m^1). For relative degree at least 2, dot-k_i^1 contains cross terms sum_{j≠i} (partial k_i^1 / partial y_j) eta_j^2, which are omitted from (22) and from the recursive formulas (26). The advertised cancellation therefore does not occur. Concrete counterexample: m=2, chains dot-eta_i^1=eta_i^2, dot-eta_i^2=v_i, psi=1-y1^2-y2^2, Xr={y1^2+y2^2<0.01}, k1=(-10y1-y2,-10y2), lambda=0.1, mu_i^l=1. This k1 satisfies (19) on C\\Xr. At (y1,y2,eta1^2,eta2^2)=(0.11,0,-0.9,1.3), Psi=0.1229>0, but the controller from (26) gives dot-Psi=-0.1045, while lambda Psi=0.0123. Hence Proposition 1's controller is not in K_e, and the claimed reach-avoid guarantee on C_Psi fails. The local-global relative-degree issue noted by the reader is real, but even with a global vector relative degree, this cross-coupling error invalidates the central construction.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a backstepping framework for reach-avoid controller synthesis in multi-input multi-output (MIMO) nonlinear systems with mixed relative degrees. The method first synthesizes a reach-avoid controller k1(y) for a single-integrator system (18) via sum-of-squares optimization, then constructs an exponential control guidance-barrier function (ECGBF) Psi(x) by subtracting squared error terms between virtual controls and transformed state variables, and finally derives the actual controller k(x) recursively through feedback linearization and backstepping. Theorem 2 claims that Psi is an ECGBF for the original system with respect to the safe set C_Psi, and Proposition 1 provides the recursive controller. The paper reports numerical simulations on a four-state example, a Dubins car, and a two-link robotic arm.","tokens_in":11808,"tokens_out":9245,"duration_ms":79647,"significance":"If correct, the proposal would be a valuable scalable alternative to direct SOS synthesis for high-relative-degree MIMO systems, because it reduces the certificate construction to a lower-dimensional single-integrator problem. The paper addresses an important problem and the single-integrator SOS step is standard. However, the central derivation contains a fundamental error in the treatment of virtual-control derivatives, and a concrete counterexample shows that the claimed ECGBF inequality fails; consequently, the main theorem is false as stated. The local-global gap between the pointwise vector relative degree and the global reach-avoid guarantee is a further unresolved issue. The simulations are illustrative only and do not compensate for the invalid proof.","major_comments":[{"comment":"The proof of Theorem 2 computes the derivative of each virtual control k_i^l only along the i-th output chain. Since k_i^1 is the i-th component of k1(y(x)), which generally depends on the full output vector y=(eta_1^1,...,eta_m^1), the term dot-k_i^1 contains cross contributions sum_{j!=i} (partial k_i^1 / partial y_j) eta_j^2 that are omitted from (22) and from the recursive formulas (26). The claimed cancellation therefore does not take place. A concrete two-output example with chains dot-eta_i^1=eta_i^2, dot-eta_i^2=v_i, psi=1-y_1^2-y_2^2, X_r={y_1^2+y_2^2<0.01}, k1=(-10y_1-y_2,-10y_2), lambda=0.1, mu_i^1=1, evaluated at (y_1,y_2,eta_1^2,eta_2^2)=(0.11,0,-0.9,1.3), gives Psi=0.1229>0 but dot-Psi=-0.1045, while lambda Psi=0.0123. Hence the controller from (26) violates the ECGBF inequality and the reach-avoid conclusion of Theorem 2 is false as stated.","section":"Section III, Eq. (22) and Proposition 1, Eq. (26)"},{"comment":"The vector relative degree is defined at a single point x0, and the strict feedback form (20) together with the controller k(x)=A(x)^{-1}b(x) is only guaranteed on a neighborhood of x0 where the decoupling matrix A(x) has rank m. The theorem, however, claims the reach-avoid guarantee for all x in C_Psi, with no argument that C_Psi lies in the domain of validity of the feedback linearization. Unless a global relative degree assumption is added or C_Psi is explicitly confined to the region of nonsingularity of A(x), the guarantees cannot be certified.","section":"Section II, Definition 2; Section III, Theorem 2"},{"comment":"The assertion that 'C_Psi can arbitrarily approximate C by adjusting each mu_i^l' is unproved and not quantified. Approximation of C alone does not imply that C_Psi cap X_r is nonempty and has no isolated points, which is required by Assumption 1 before Theorem 1 can be applied. This step needs a rigorous argument.","section":"Section III, proof of Theorem 2, final paragraph"}],"minor_comments":[{"comment":"The display (26) contains index errors: the summation in the formula for k_i^l runs to i-1 rather than l-1, and the expression for b_i(x) includes 'mu^{gamma-2}' without a chain subscript or a clear meaning. These should be corrected.","section":"Proposition 1, Eq. (26)"},{"comment":"The safe set is defined as C={x | 1-y_1(x)^2-y_2(x)^2 < 0}, which contradicts Assumption 1 where C={psi>0}. The sign should be >0 if psi=1-y_1^2-y_2^2 is the intended certificate.","section":"Example 1"},{"comment":"In the notation section, the sum-of-squares set is written as 'X [x]' but the intended symbol is evidently 'P[x]'.","section":"Notation"},{"comment":"The sentence 'The positivity of Psi(y) ensures psi(y)>0' should read Psi(x), since Psi is a function of the state, not only of the output y.","section":"Theorem 2, proof"}],"recommendation":"reject","confidential_remarks":"The cross-coupling error in Eq. (22) invalidates the central construction of Theorem 2 and Proposition 1, and the provided counterexample demonstrates that the synthesized controller does not satisfy the ECGBF condition. The local-global discrepancy regarding the vector relative degree is an additional unresolved issue. I do not see a straightforward repair that preserves the claimed reduction to a low-dimensional SOS problem, so I recommend rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague,\n\nShort version: the main theorem of this paper is not proven as stated. The backstepping recursion in Theorem 2 drops cross-coupling derivative terms, so the constructed controller does not actually satisfy the ECGBF inequality. I think the core idea is promising, but the current write-up needs a substantive repair.\n\nWhat is new and good: the combination of ECGBF certificates with backstepping for MIMO systems with mixed relative degrees is a genuine extension of the CBF-backstepping and ECGBF results cited in the paper. The proposal to solve SOS only on the low-dimensional single-integrator system, then lift the controller through a recursion, is attractive and, if correct, would be a useful reduction. The numerical examples are on reasonable underactuated systems and behave well in simulation.\n\nThe central problem is in the derivative computation. In equation (22), the time derivative of each virtual control k_i^l is written as a sum over partial derivatives with respect to the i-th chain coordinates only. But k_i^1 is the i-th component of k_1(y), which depends on the entire output vector y = (η_1^1, ..., η_m^1). For relative degree at least 2, the derivative of k_i^1 therefore contains cross terms ∂k_i^1/∂y_j η_j^2 for j ≠ i. These terms are missing from (22) and from the recursive formulas (26). Without them the cancellation used in the proof does not occur, and the resulting controller does not satisfy L_Ψ ≥ λΨ on C_Ψ. The stress-test counterexample is structurally right, even if its specific numbers may need adjusting: the omission is visible directly from the equations.\n\nA second, smaller issue is the local-global gap in the relative degree assumption. Definition 2 only assumes the decoupling matrix A(x) is invertible in a neighborhood of x0, while Theorem 2 claims guarantees on the entire set C_Ψ. No argument confines C_Ψ to the region where feedback linearization is valid.\n\nMinor issues: no code or simulation parameters are provided, and the claim that C_Ψ can approximate C by adjusting μ_i^l is asserted without proof.\n\nWho it's for: readers interested in constructive CBF/ECGBF synthesis for MIMO systems will find the idea worth tracking, but not in this form. I would not cite it as a reliable construction until the cross-coupling problem is fixed.\n\nRecommendation: this deserves a serious referee, because the flaw is identifiable and plausibly repairable, but I would not accept it in the current state. The authors should be asked to rework the proof, account for all cross terms, and provide reproducible experiments.","headline":"Main theorem's proof drops cross-coupling derivative terms, so the reach-avoid guarantee does not follow as stated; promising idea, needs a serious rewrite.","tokens_in":12318,"tokens_out":4691,"would_cite":false,"duration_ms":42769,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["93C10","93B18","93C35","93D30"],"pacs":[],"model":"deepseek-v4-flash","headline":"Reach-avoid guarantees for MIMO systems reduce to one output-level certificate plus backstepping.","keywords":["reach-avoid control","control barrier functions","backstepping","feedback linearization","multi-input multi-output systems","mixed relative degrees","sum-of-squares optimization","formal certificates"],"falsifier":"Find a MIMO system satisfying the assumptions where $A(x)$ is singular at some point $x^*\\in C_{\\Psi}$; at that point $k(x)=A(x)^{-1}b(x)$ does not exist, so either $C_{\\Psi}$ must be shrunk to exclude $x^*$ or the claimed reach-avoid guarantee fails for trajectories starting arbitrarily close to $x^*$.","tokens_in":11186,"feed_emoji":"🎯","tokens_out":8758,"duration_ms":80446,"temperature":0.7,"pith_summary":"This paper aims to show that a reach-avoid controller for a multi-input multi-output (MIMO) nonlinear system can be synthesized from a scalar reach-avoid certificate on the outputs alone, using feedback linearization and backstepping to lift that certificate to the full state. The main theorem states: if $\\psi(y(x))$ certifies reach-avoid for the single-integrator dynamics $\\dot y = v$, then subtracting squared virtual-tracking-error terms for each level of the relative-degree chains produces a certificate $\\Psi(x)$ for the original system, and the recursive construction simultaneously produces a state-feedback controller $k(x)$. The significance is that safety and reachability are handled by one certificate rather than two competing constraints, and the expensive sum-of-squares search is done only in the low-dimensional output dynamics, not in the full state space. If the theorem is right, formal reach-avoid guarantees for high-dimensional MIMO systems become a tractable extension of low-dimensional certificate synthesis.","feed_headline":"Output certificates backstep into MIMO reach-avoid controllers","feed_subtitle":"One low-dimensional SOS certificate is reshaped by backstepping into a provable safety-plus-reachability controller.","key_machinery":"The load-bearing object is the backstepping ECGBF candidate\n$$\\Psi(x)=\\psi(y(x))-\\sum_{i,l}\\frac{1}{2\\mu_i^l}\\|\\$eta_i^{{l+1}}$-k_i^l(z_i^l)\\|^2,$$\na scalar function that keeps the output-level certificate $\\psi$ and penalizes, in each relative-degree chain, the deviation of the virtual state $\\eta_i^{l+1}$ from the stabilizing function $k_i^l(z_i^l)$. The recursive choice of $k_i^l$ makes every cross term in $\\dot{\\Psi}$ equal to $\\frac{\\lambda}{2\\mu_i^l}\\|\\eta_i^{l+1}-k_i^l\\|^2$, so the derivative inequality $\\dot{\\Psi}\\ge\\lambda\\Psi$ follows directly from the single-integrator inequality $\\partial_y\\psi\\cdot k_1\\ge\\lambda\\psi$. The controller is recovered from the last layer via the decoupling matrix $A(x)$, which is the same matrix used in the feedback linearization (14)-(16).","core_discovery":"On its own terms, the paper's central discovery is Theorem 2. For a control-affine MIMO system (1) with output $y=h(x)$ and vector relative degree $\\{\\gamma_1,\\ldots,\\gamma_m\\}$ at a point $x_0$, suppose $\\psi(y(x))$ is an ECGBF for the single-integrator system (18) with respect to safe set $C$ and target set $X_r$. Then the function\n$$\\Psi(x)=\\psi(y(x))-\\sum_{i=1}^m\\sum_{l=1}^{\\gamma_i-1}\\frac{1}{2\\mu_i^l}\\|\\$eta_i^{{l+1}}$-k_i^l(z_i^l)\\|^2$$\nis an ECGBF for the original MIMO system with respect to the safe set $C_{\\Psi}=\\{x:\\Psi(x)>0\\}\\subseteq C$ and the same target set $X_r$. The proof is constructive: the auxiliary functions $k_i^l$ are chosen recursively so that the time derivative of $\\Psi$ collapses to $\\lambda\\Psi$, and the final layer defines $b(x)$ with the actual controller $k(x)=A(x)^{-1}b(x)$. Hence every trajectory starting in $C_{\\Psi}$ stays in $C_{\\Psi}$ and eventually enters $X_r$.","pith_inferences":["The constraints defining $K(x)$ in Proposition 1 are conditions that could be enforced in a real-time quadratic program around a nominal controller, turning the synthesis into an online safety filter with reach-avoid guarantees on $C_{\\Psi}$; the paper itself does not develop this online variant.","Because the optimization is performed only on the output-level single-integrator system, the cost of certificate search is governed by the output dimension and relative degrees rather than the full state dimension; whether this scaling holds for very high-dimensional examples is a testable prediction beyond the paper's simulations.","The same dissipation-style cancellation may extend to sampled-data or uncertain versions of the recursion, but the paper does not analyze robustness to disturbances or discretization."],"forward_implications":["For any MIMO system with a vector relative degree, an SOS-computed ECGBF on the output dynamics is enough to synthesize a provable reach-avoid controller for the full state-space system.","The certified set is $C_{\\Psi}\\subseteq C$, and it can be made arbitrarily close to $C$ by increasing the tuning parameters $\\mu_i^l$.","Trajectories starting in $C_{\\Psi}$ satisfy both safety (stay in $C_{\\Psi}$) and reachability (enter $X_r$) simultaneously, so safety and goal constraints do not need separate, possibly conflicting certificates.","Each output channel with relative degree $\\gamma_i$ gets its own chain of virtual controllers, so the construction handles mixed relative degrees without a uniform-degree assumption."],"supporting_citations":[{"why":"Supplies the ECGBF definition and Theorem 1, the bridge from the derivative inequality to the reach-avoid guarantee.","marker":"[24]"},{"why":"Provides the safe-backstepping pattern with control barrier functions that the recursive construction adapts.","marker":"[13]"},{"why":"Shows how to synthesize barrier certificates for partially feedback-linearizable systems, motivating the chain-wise construction.","marker":"[19]"},{"why":"Gives the vector-relative-degree and local feedback-linearization normal form used to write the strict-feedback form (20).","marker":"[26]"},{"why":"Introduces the exponential control barrier function condition $\\dot{\\psi}\\ge\\lambda\\psi$ that the ECGBF inequality generalizes.","marker":"[16]"}],"fun_headline_variants":["Backstepping turns output certificates into MIMO reach-avoid control","MIMO reach-avoid control via backstepped output certificates","Backstepping expands output certificates to MIMO safety and reachability","Output certificates backstepped into MIMO reach-avoid controllers"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The controller formula divides by the decoupling matrix $A(x)$, and the paper only assumes a vector relative degree at a single point $x_0$; nothing confines the certified set $C_{\\Psi}$ to the neighborhood where $A(x)$ is invertible and the feedback-linearized strict-feedback form is valid.","fun_headline_variants_meta":{"raw":{"variants":["Backstepping turns output certificates into MIMO reach-avoid control","MIMO reach-avoid control via backstepped output certificates","Backstepping expands output certificates to MIMO safety and reachability","Output certificates backstepped into MIMO reach-avoid controllers"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000961,"raw_usage":{"total_tokens":4094,"prompt_tokens":945,"completion_tokens":3149,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":561,"completion_tokens_details":{"reasoning_tokens":3085}},"tokens_in":561,"tokens_out":3149,"duration_ms":19419,"temperature":1.0,"reasoning_tokens":3085,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T23:47:42.256119+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Find a MIMO system satisfying the assumptions where $A(x)$ is singular at some point $x^*\\in C_{\\Psi}$; at that point $k(x)=A(x)^{-1}b(x)$ does not exist, so either $C_{\\Psi}$ must be shrunk to exclude $x^*$ or the claimed reach-avoid guarantee fails for trajectories starting arbitrarily close to $x^*$.","supporting_citations":[{"cited_title":"Reach-avoid controllers synthesis for safety critical systems,","cited_arxiv_id":null,"evidence_quote":"Supplies the ECGBF definition and Theorem 1, the bridge from the derivative inequality to the reach-avoid guarantee."},{"cited_title":"Safe backstep- ping with control barrier functions,","cited_arxiv_id":null,"evidence_quote":"Provides the safe-backstepping pattern with control barrier functions that the recursive construction adapts."},{"cited_title":"Isidori, Nonlinear control systems: an introduction","cited_arxiv_id":null,"evidence_quote":"Gives the vector-relative-degree and local feedback-linearization normal form used to write the strict-feedback form (20)."},{"cited_title":"Exponential control barrier functions for enforcing high relative-degree safety-critical constraints,","cited_arxiv_id":null,"evidence_quote":"Introduces the exponential control barrier function condition $\\dot{\\psi}\\ge\\lambda\\psi$ that the ECGBF inequality generalizes."}],"review_version":1}