{"id":"1a3e726e-78a1-4f8d-bb24-d8ea60f6ea10","arxiv_id":"2506.23346","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":3.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Adding a Hamilton-Jacobi reachability safety value as a terminal constraint in model predictive control makes the controller recursively feasible and reduces safety violations in car and robot arm simulations.","lead":"This paper builds a controller that plans a robot's motion step by step while using a safety map to know which states are guaranteed safe forever. In simulations of a car and a six-jointed robot arm, the method avoided collisions far more often than standard planning alone.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Lemma 1 transfers continuous-time HJ invariance to a discrete-time MPC without stating a discrete/continuous consistency condition; with an approximate discretization, the recursive-feasibility guarantee does not follow.","rationale":"The reader identified exactness of the learned value function and inter-sample safety as the main weaknesses. My concern is adjacent but distinct: even with an exact continuous-time safety value function, the proof of Lemma 1 silently assumes that the discrete-time dynamics inherit the continuous-time invariance property. Since the paper does not state that fd is an exact sampled-data model or provide a discretization-error bound, the central theoretical claim is not established for the implemented controller. This is load-bearing because the entire recursive-feasibility guarantee rests on Lemma 1, and the abstract states the guarantee without qualification. The proposed test would settle the issue by checking one-step invariance on the exact grid; if the invariance holds for the Dubins discretization, the concern is mitigated for that experiment, though the learned Kuka case still lacks formal guarantees. I therefore keep the reader's CONDITIONAL verdict, with the additional condition that the authors either prove a discrete/continuous invariance transfer or verify it empirically on the exact grid.","tokens_in":7034,"tokens_out":7106,"duration_ms":91746,"concrete_test":"Use the exact 4D Dubins Vs grid from Sec. IV.A. For every grid point x with Vs(x) >= 0, exhaustively scan a fine control grid to test whether there exists u such that l(fd(x,u)) >= 0 and Vs(fd(x,u)) >= 0, using the same fd and time step as the MPC. If any state in {Vs >= 0} has no such one-step successor, then {Vs >= 0} is not invariant under fd and Lemma 1's conclusion fails for that discretization.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The paper's only theoretical guarantee is Lemma 1 (Sec. III.B), which asserts recursive feasibility of Prob. 5 whenever the initial state lies in the super-0-level set of the continuous-time safety value function Vs from Eq. (5). The proof treats {Vs >= 0} as the set of recursively feasible states for Prob. 5, but Vs is defined for the continuous dynamics (1b), while the MPC uses discrete dynamics fd (6b). No assumption links fd to f, such as exact sampled-data discretization, zero-order-hold consistency, or a quantitative bound on discretization error. If fd is an Euler or RK approximation, a discrete state with Vs(x) >= 0 need not be invariant under fd: there may be no discrete control keeping subsequent sampled states inside {Vs >= 0}, so the terminal constraint (6d) does not ensure that the next MPC solve is feasible. The proof's statement that 'all states along the solution state trajectory ... are recursively feasible' imports a continuous-time property into a discrete-time algorithm without an argument. Thus even in the 4D Dubins experiment, where Vs is exact, the recursive-feasibility guarantee is unsupported for the discretized controller actually used. The 12D Kuka experiment is additionally outside the guarantee because Vs is learned and the paper concedes in Sec. V that no formal safety guarantee holds there, but the discrete/continuous gap affects the exact-value-function case as well.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes an MPC formulation (Problem 5) in which a Hamilton-Jacobi reachability safety value function Vs is imposed as a terminal constraint Vs(x(j+h)) >= 0. The authors argue that this makes the MPC recursively feasible (Lemma 1), because the super-0-level set of Vs is the maximal set of states from which the continuous-time safety constraints can be satisfied indefinitely. The method is demonstrated on a 4D Dubins car with an exact grid-based value function and on a 12D Kuka manipulator with a learned value function, with empirical results showing improved safety over an MPC baseline.","tokens_in":7297,"tokens_out":7567,"duration_ms":87742,"significance":"If the recursive-feasibility guarantee were established at the level of rigor claimed, the construction would be attractive: it uses the maximal recursively feasible set as a terminal constraint instead of a more conservative control-invariant subset, and it separates safety reasoning from the task cost. The Dubins experiments show a clear qualitative and quantitative improvement, and the learned 12D value function indicates a plausible scalability path. The paper also avoids fitting free parameters for the safety constraint, since the value function is obtained by HJ computation or learning rather than tuned against the experiments. However, the formal content is currently limited by the gap between the continuous-time value function and the discrete-time MPC, and by the paper's own admission that the high-dimensional experiment carries no formal guarantee.","major_comments":[{"comment":"The proof transfers a continuous-time invariance property to the discrete-time MPC without a consistency assumption. The safety value function Vs in Eq. (5) is defined through the continuous dynamics (1b), whereas Prob. 5 is solved with the discrete dynamics fd in Eq. (6b); the proof identifies {x | Vs(x) >= 0} with the recursively feasible set for Prob. 5, but this identification is not established and can fail for an approximate discretization such as an Euler or RK scheme. The recursive-feasibility guarantee therefore does not follow for the controller actually implemented unless fd is the exact sampled-data model of f, or unless a quantified discretization-error argument is supplied. Please state such an assumption explicitly and prove the corresponding discrete invariance, or restrict the claim to the exact-sampled case.","section":"III.B, Lemma 1 and Prob. 5"},{"comment":"Safety is enforced only at the sampling instants in Eq. (6c), while the original constraint (1c) is continuous in time. Lemma 1 does not provide any bound on l between samples. Since the motivating application is obstacle avoidance, a trajectory can enter the failure set between two MPC samples and leave it before the next sample; recursive feasibility alone does not rule this out. An inter-sample safety argument (e.g., Lipschitz or barrier-function estimates, or an inner-approximated continuous-time invariant set) is needed before the closed-loop system can be said to respect the safety constraints.","section":"III.A-B, Prob. 5 and Eq. (1c)"},{"comment":"For the 12D Kuka experiment the safety value function is learned, and Section V explicitly states that no formal safety guarantee currently holds. Therefore Lemma 1 is not applicable to the high-dimensional demonstration, and the abstract's unconditional claim that the framework 'guarantees recursive feasibility' is not supported. The formal guarantee should be scoped to settings with an exact or verified value function, and the 11/15 success in the Kuka study should be presented as empirical evidence rather than as a guaranteed outcome.","section":"IV.B and V"},{"comment":"The lemma statement omits two assumptions that the proof uses: the absence of disturbances and the ability of the solver to return a feasible solution at every invocation. The phrase 'assuming the absence of disturbances' appears only inside the proof. Because the implementation uses Crocoddyl, a local SQP solver, the guarantee is conditional on the solver's success; these assumptions should be stated as part of the lemma for the claimed guarantee to be meaningful.","section":"III.B, Lemma 1"}],"minor_comments":[{"comment":"The constraint index set in Eq. (6c) excludes the terminal index k=j+h, unlike Prob. 3; the inconsistency should be fixed, and it should be noted that for an exact Vs the terminal constraint implies l(x(j+h)) >= 0.","section":"Prob. 5, Eq. (6c)"},{"comment":"The text says 'the running cost and the terminal cost, defined in Eq. (6b)'; the costs are defined in Eq. (6a), not Eq. (6b).","section":"IV.A"},{"comment":"The superscript d in xi^{u,d}_{x,t} is never defined; it should be introduced, or the notation should be simplified.","section":"Eq. (5)"},{"comment":"The sentence 'our method replies on learning-based methods' contains a typo; 'replies' should be 'relies'.","section":"V"},{"comment":"The definition of 'Rollout Success Rate' and the number of trials should be stated explicitly; currently only percentages are given, and it is unclear whether success means safe arrival at the goal or merely absence of constraint violation.","section":"Table I"},{"comment":"The text says the safety value function is computed by 'a learning-based approach [6, 9]' but does not specify which method is used, what approximation error is observed, or whether any validation or verification was performed; at least the key hyperparameters and validation procedure should be reported.","section":"IV.B"}],"recommendation":"major_revision","confidential_remarks":"The stress-test objection is valid and is the main technical obstacle: Lemma 1 as written does not bridge the continuous-time HJ value function and the discrete-time MPC dynamics. The claim can likely be repaired by treating the sampled-data system as the true system, by adding a discretization-consistency assumption, or by proving a discrete viability result; the authors should also soften the abstract's unconditional guarantee language in light of Section V. The empirical contribution appears solid enough to warrant revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a well-written paper that combines two known control tools—HJ reachability and terminal-constrained MPC—into a practical safety filter. The 4D experiments are nice, and the authors are upfront that the high-dimensional version lacks formal guarantees. But the central claim of recursive feasibility is not actually proven for the discrete-time algorithm used, and the paper does not make clear what is new beyond the authors' own prior L-CSS paper.\n\nWhat is good: the MPC formulation (Prob. 5) is clean, and the idea of using the converged HJ safety value function as a terminal constraint is exactly the right way to give a short-horizon MPC a long-horizon safety certificate. The Dubins results show the expected trend: adding the terminal constraint makes safety nearly insensitive to horizon. The conclusion honestly concedes that learning-based value functions mean no formal guarantee for the 12D Kuka case. That honesty counts.\n\nWhere it gets soft: Lemma 1 is presented as the main theoretical contribution, but it is essentially a restatement of the known characterization from [8] plus the standard terminal-invariant-set argument. More importantly, the proof never connects the continuous-time dynamics f used to define Vs with the discrete-time dynamics fd used in the MPC. The superlevel set {Vs >= 0} is invariant in continuous time; that does not mean it is invariant under an arbitrary discretization. Without a stated condition—exact sampled-data discretization, zero-order hold, or a quantitative error bound—the recursive-feasibility guarantee does not follow for the actual controller. This is a real gap, not a technicality, and it applies even to the 4D case where Vs is exact.\n\nThe experiments are otherwise small: no error bars or trial counts beyond the headline percentages for Dubins, 15 runs for the manipulator, no code or data. The paper also does not distinguish itself from [25], the authors' prior control-constrained formulation; either it should or it should say explicitly what changed.\n\nWho it is for: robotics/control researchers working on safety filters and MPC. They will find the formulation useful as a baseline and the experiments informative, but they should not take the theoretical guarantee at face value. It deserves a serious referee, but the authors need to either fix the discretization gap or soften the guarantee language, and they should add experimental detail. I would accept it with major revision.","headline":"Nice combination of HJ reachability and MPC, but the recursive-feasibility guarantee has a discrete-continuous gap and the novelty over prior work is thin.","tokens_in":7813,"tokens_out":2790,"would_cite":false,"duration_ms":31213,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Inserting the Hamilton-Jacobi safety value function as a final-time constraint in MPC makes the controller recursively feasible: from any initially safe state, every future planning step has a feasible plan, so long-horizon safety holds…","keywords":["safety value function","model predictive control","Hamilton-Jacobi reachability","recursive feasibility","autonomous systems","safety constraints","6-DoF manipulator","Dubins car"],"falsifier":"For the 4D Dubins car, where the safety value function is computed exactly on a grid, run the closed-loop Safety Value MPC from every grid state in the super-zero level set for the full 2-second task horizon; finding any state from which the trajectory violates the obstacle constraint, or any step at which Problem 5 becomes infeasible, would contradict Lemma 1.","tokens_in":6797,"feed_emoji":"🤖","tokens_out":6980,"duration_ms":67114,"temperature":0.7,"pith_summary":"This paper proposes a way to make model predictive control (MPC) safe over long time horizons without sacrificing task performance: add a terminal constraint requiring the final state of each short-horizon plan to lie in the super-zero level set of the Hamilton-Jacobi safety value function, $\\{x : V_s(x) \\geq 0\\}$. The paper argues, via Lemma 1, that this terminal constraint makes the MPC recursively feasible: if the initial state is in the maximal set of recursively feasible states, a feasible solution exists at every future step, so the closed-loop system never gets forced into a safety violation. The framework is demonstrated on a 4D Dubins car and a 6-DoF Kuka manipulator, where it substantially improves safety-constraint satisfaction over baseline MPC without a formal safety term. When the safety value function is computed exactly (as for the Dubins car), the guarantee is formal; when it is learned (as for the Kuka), the safety improvement is empirical, since the learned approximation is not exact.","feed_headline":"Reachability terminal constraint makes MPC always feasible","feed_subtitle":"A Hamilton-Jacobi value function as the last constraint lets short-horizon MPC avoid long-horizon safety violations.","key_machinery":"The safety value function $V_s(x)$ — the value of the safety optimal control problem that maximizes the minimal safety margin $\\min_\\tau l(\\xi(\\tau))$ over all future times — is the machine that carries the argument. Its super-zero level set $\\{x : V_s(x) \\ge 0\\}$ is the maximal set of recursively feasible states: every state in it can keep the system safe forever, and no state outside it can. Inserting $V_s(x(j+h)) \\ge 0$ as the terminal constraint of the MPC (Problem 5) means every planning horizon ends inside a state from which safety can be maintained indefinitely; Lemma 1 then propagates feasibility from one MPC step to the next. The same object also makes the method scalable, because computing $V_s$ is a separate offline step that can be carried out by grid-based level-set methods in low dimensions or by learned approximators in high dimensions.","core_discovery":"The central claim is that a terminal constraint built from the converged Hamilton-Jacobi safety value function $V_s(x)=\\sup_u \\min_{\\tau\\in[t,\\infty)} l(\\xi^u_{x,t}(\\tau))$ turns any finite-horizon MPC into a recursively feasible controller. Because the super-zero level set of $V_s$ is exactly the maximal set of states from which the system can respect the safety constraint forever, a plan that ends anywhere inside that set can always be extended to another feasible plan at the next MPC step. Lemma 1 formalizes this: starting from a recursively feasible state, the Safety Value MPC (Problem 5) is feasible at every step $k$, under the assumption of an exact value function and successful solver returns. The significance is that the safety value function encodes all long-horizon safety reasoning offline, so online MPC only needs a short horizon to achieve persistent constraint satisfaction, and the same value function works for any task cost.","pith_inferences":["The formal guarantee inherits a caveat: it is a property of the exact value function; for learned approximations, a natural test would be to compare the learned zero level set against the true maximal safe set on a validation grid, which the paper does not do.","Because the value function is task-independent, the framework's computational cost can be amortized: a single offline reachability computation can serve an entire family of online tasks, suggesting practical deployment for goal-to-goal navigation or manipulation.","The guarantee is discrete-time: only the MPC sample points are certified, not the trajectory in between. A testable extension would be to combine the terminal value constraint with a low-level robust tracking controller to bound inter-sample violation.","For high-dimensional robots, if a neural verifier could certify that the learned value function's zero-level set sits inside the true maximal safe set, Lemma 1 would formally extend; the authors point to verification techniques as a future direction."],"forward_implications":["If the safety value function is exact, recursive feasibility is guaranteed for any planning horizon, so operators can choose shorter horizons for computational speed without sacrificing long-horizon safety.","The safety value function is independent of the task cost, so one offline reachability computation supports multiple goals and performance objectives; the MPC simply optimizes the task cost subject to the same terminal safety constraint.","The terminal constraint is compatible with high-level planners that emit cost functions (including LLM/VLM planners): the safety guarantee is preserved as long as the MPC respects the pre-defined constraints, regardless of the planner's incentives.","In high-dimensional settings where the value function is learned, the framework still improves safety-constraint satisfaction empirically, as shown by the 6-DoF Kuka experiments (11/15 success vs 3/15 baseline).","The method's task performance is slightly more conservative than unconstrained MPC, but the simulations show the conservatism is small and shrinks as the planning horizon grows."],"supporting_citations":[{"why":"Establishes that the super-zero level set of the safety value function is exactly the set of all recursively feasible states, the premise of Lemma 1.","marker":"[8]"},{"why":"Provides the general Hamilton-Jacobi framework for state-constrained optimal control problems underlying Problem 1.","marker":"[4]"},{"why":"The optimal control library used to implement the MPC solver in the experiments.","marker":"[18]"},{"why":"Supplies the sequential quadratic programming solver used to solve the MPC problems.","marker":"[12]"},{"why":"The level-set toolbox used to compute the exact safety value function on the 4D Dubins car grid.","marker":"[19]"},{"why":"The learning-based reachability method used to approximate the safety value function for the 12D Kuka manipulator.","marker":"[6]"},{"why":"The approach used to bridge MPC and deep learning for scalable reachability, supporting the high-dimensional value function approximation.","marker":"[9]"}],"fun_headline_variants":["HJ terminal constraint guarantees MPC safety forever","Safety value function makes short-horizon MPC feasible","MPC with reachability terminal set is always recursively feasible","Hamilton-Jacobi safety set ensures persistent MPC safety"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The recursive feasibility guarantee assumes the exact continuous-time safety value function characterizes all recursively feasible states and that every MPC solve returns a feasible solution ending in that set; for the 12D manipulator, the learned value function is not exact, so the formal guarantee does not apply there.","fun_headline_variants_meta":{"raw":{"variants":["HJ terminal constraint guarantees MPC safety forever","Safety value function makes short-horizon MPC feasible","MPC with reachability terminal set is always recursively feasible","Hamilton-Jacobi safety set ensures persistent MPC safety"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000141,"raw_usage":{"total_tokens":1127,"prompt_tokens":873,"completion_tokens":254,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":489,"completion_tokens_details":{"reasoning_tokens":194}},"tokens_in":489,"tokens_out":254,"duration_ms":3991,"temperature":1.0,"reasoning_tokens":194,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T21:44:37.732807+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"For the 4D Dubins car, where the safety value function is computed exactly on a grid, run the closed-loop Safety Value MPC from every grid state in the super-zero level set for the full 2-second task horizon; finding any state from which the trajectory violates the obstacle constraint, or any step at which Problem 5 becomes infeasible, would contradict Lemma 1.","supporting_citations":[{"cited_title":"On safety and liveness filtering using hamilton-jacobi reachability analysis","cited_arxiv_id":null,"evidence_quote":"Establishes that the super-zero level set of the safety value function is exactly the set of all recursively feasible states, the premise of Lemma 1."},{"cited_title":"Stagewise implementations of sequential quadratic programming for model-predictive control","cited_arxiv_id":null,"evidence_quote":"Supplies the sequential quadratic programming solver used to solve the MPC problems."},{"cited_title":"A toolbox of level set methods","cited_arxiv_id":null,"evidence_quote":"The level-set toolbox used to compute the exact safety value function on the 4D Dubins car grid."}],"review_version":1}