{"id":"8eaed5ea-a930-498d-8cd9-56c2c6e26eec","arxiv_id":"2509.04220","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"low","formal_verification":"none","parameter_count":2,"one_line_summary":"For MIMO nonlinear systems with vector relative degree, box constraints on outputs yield mutually compatible control barrier function constraints, and the quadratic-programming safety filter is Lipschitz and closed-form under a Gram-matrix cost.","lead":"This paper shows that for nonlinear control systems whose outputs satisfy a relative degree condition, safety constraints that box in each output can always be satisfied at the same time, and the resulting safety filter has an explicit formula. The result gives designers a fast, provably safe way to enforce multiple constraints at once.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 2 overclaims forward invariance for unbounded safe sets: the proof never establishes forward completeness, and a concrete 2D system with finite output box escapes in finite time while outputs remain in bounds.","rationale":"The paper's main mathematical contributions—compatibility (Lemma 2), Lipschitz continuity of the QP map (Lemma 3), and the closed-form solution (Theorem 3)—appear sound; I checked the Farkas argument, the active-set count, and the KKT case analysis. The load-bearing weakness is in the forward-invariance theorem and its use of the standard ECBF result. The proof of Theorem 2 shows that the 2m inequality constraints hold along trajectories, which is enough to keep the ECBF sets invariant on the maximal interval of existence, but not enough to guarantee global existence. The paper's safe set is unbounded whenever there are unconstrained zero-dynamics directions (e.g., its own planar-drone example has unconstrained x and \\dot x), so this is not a purely academic edge case. A two-state counterexample within the paper's framework exhibits finite escape while the output remains in the box, so the theorem as stated is false unless S is compact or forward completeness is assumed. This is consistent with the reader's mention of a forward-completeness gap, but I regard it as more central than the relative-degree limitation: the relative-degree condition is an explicit, well-identified hypothesis, whereas the forward-completeness gap invalidates the stated safety guarantee in a regime the paper does not exclude.","tokens_in":13750,"tokens_out":29595,"duration_ms":295653,"concrete_test":"Simulate/analyze the 2D system \\dot z = u, \\dot q = q^2 + u with output y=z, box [0,1], kd=0, G=1, α=1, and the QP safety filter from (18) (equivalently (20) or the closed form (27)). Starting from (0.5,1), check whether the solution q(t)=1/(1-t) blows up at t=1 while z remains 0.5 and all ECBF constraints are satisfied. If yes, Theorem 2's 'for all t≥0' statement is false without a forward-completeness/compactness assumption.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The most load-bearing issue is not the relative-degree assumption but the forward-invariance theorem. The proof of Theorem 2 only verifies the ECBF inequalities along solutions on their maximal interval; it does not establish that the closed-loop solution exists for all t≥0. When S is unbounded, this can fail. Concretely, take the affine system \\dot z = u, \\dot q = q^2 + u, with output y=z, box constraints z∈[0,1], relative degree r=1 (B=1 invertible on R^2), α=1, G=1, and nominal input kd=0. The QP (18) has feasible set u∈[-α(z-0), α(1-z)], so the minimizer is u*=0 for every z∈[0,1]. Starting at (z,q)=(0.5,1), the closed loop is \\dot z=0, \\dot q=q^2, so q(t)=1/(1-t) escapes at t=1 while z(t)=0.5 remains in the box. Thus S={z∈[0,1], q∈R} is not forward invariant in the sense of 'for all t≥0', contradicting Theorem 2 as stated. The paper should either require S compact (as in Prop. 1) or assume the closed-loop system is forward complete. Lemma 4 inherits the same gap.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper studies multiple exponential control barrier functions (ECBFs) for MIMO affine nonlinear systems with box constraints on a vector-valued output. The main results are: when the output has a vector relative degree, the 2m ECBF constraints encoding the box constraints are mutually compatible (Lemma 2); the resulting QP safety filter (18) is locally Lipschitz (Lemma 3); with the particular weight G(x)=B(x)^T B(x), the QP admits the closed-form solution (27) (Theorem 3); and the safety filter degrades nominal tracking in an ISS sense (Proposition 1). The results are illustrated with planar quadrotor simulations.","tokens_in":14027,"tokens_out":18519,"duration_ms":164477,"significance":"The compatibility result is genuinely useful: it gives a clean structural condition under which multiple output-box ECBF constraints do not conflict, and the closed-form QP solution is valuable for embedded safety filters where online optimization is impractical. The Farkas/KKT derivations are largely self-contained and the case analysis in Theorem 3 is correct. The simulations demonstrate the framework. The principal defect is a missing forward-completeness condition in the safety theorem, which must be fixed before the practical safety guarantee is fully supported.","major_comments":[{"comment":"Theorem 2 states that the controller from (18) renders S in (17) forward invariant and satisfies (25) for all t≥0. The proof only verifies the ECBF inequalities pointwise and then invokes Theorem 1, which requires the closed-loop solution to exist. No forward-completeness argument is given when S is unbounded. This is not a technicality: take ˙z=u, ˙q=q^2+u with output y=z, box z∈[0,1], relative degree r=1 (B=1), α=1, G=1, and kd=0. All conditions of Lemma 2 hold, and (18) yields u*=0 for every (z,q) with z∈[0,1]. Starting at (0.5,1), the closed-loop is ˙z=0, ˙q=q^2, so q(t)=1/(1−t) escapes at t=1 while z remains in [0,1]. Thus S={z∈[0,1]}×R is not forward invariant for t≥0. The theorem should either be stated on the maximal interval of existence, assume S is compact (as in Proposition 1), or assume the closed-loop system is forward complete. Lemma 4 inherits the same gap because it reli","section":"§III, Theorem 2 and Lemma 4"}],"minor_comments":[{"comment":"The indexing is confusing: 'j∈{1,3,...,2m−1}' with λ_j=λ_j and λ_{j+1}=λ_j mixes paired indices. Use explicit ̲underline and overbar notation (e.g., ̲λ_i and ̄λ_i) for the two constraints per output.","section":"§II-D, Lemma 2 proof"},{"comment":"Weierstrass' Theorem is invoked for existence over a closed but non-compact feasible set; it is the radial unboundedness/coercivity of the objective that guarantees existence. Also, the citation to Hager's theorem should explicitly verify the strong second-order sufficient condition (which follows from G(x)>0) and the LICQ at the solution (which follows from the independent b_i).","section":"§III, Lemma 3 proof"},{"comment":"The assertion that feasibility implies Slater's condition is not generally true for affine inequalities. In this problem Slater does hold, because the invertibility of B and y_i>y_i give a strict feasible point, but this should be stated rather than inferred from nonempty feasibility.","section":"§III, Theorem 3 proof"},{"comment":"Typo: 'complimentary slackness' should be 'complementary slackness.' In addition, 'the left-hand-side of the first inequality in (30)' should refer to (33), which is the inequality expressed in terms of ω_i, rather than the original KKT primal feasibility condition.","section":"§III, Theorem 3 proof"},{"comment":"The setpoint notation 'x=(1,1,04)' and 'x=(−1,0.2,04)' is ambiguous; write the six-dimensional state vector explicitly, e.g., x=(1,1,0,0,0,0).","section":"§V-A"}],"recommendation":"major_revision","confidential_remarks":"The forward-completeness counterexample is the central load-bearing issue. The paper's other claims (compatibility, closed-form solution, local Lipschitzness) are sound or require only minor clarification. The paper is within scope for eess.SY. I recommend major revision rather than rejection because the gap is fixable by adding a compactness or forward-completeness assumption, which the authors already partially adopt in Proposition 1."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper does something real: it takes the LTI compatibility result for multiple ECBFs and pushes it to square nonlinear systems with vector relative degree, and it gives an explicit closed-form solution to the safety QP when the cost weight equals the Gram matrix of the decoupling matrix. The core lemmas check out. Lemma 2's Farkas argument is clean, the KKT case analysis in Theorem 3 is correct, and the decoupling trick with G = B^T B is genuinely useful for avoiding online optimization. The drone examples illustrate the ideas without overselling them.\n\nThe main soft spot is Theorem 2. As stated, it claims forward invariance of S for all t >= 0, but the proof never establishes global existence of solutions. Local Lipschitz (Lemma 3) gives local existence only. The stress-test example is convincing: a simple 2D system with a finite output box but unbounded other coordinate satisfies all the relative-degree and ECBF conditions, yet the closed loop escapes in finite time while the output stays in the box. The fix is easy and standard—assume S is compact or assume the closed-loop system is forward complete—and the paper actually already imposes compactness in Proposition 1. So this is a statement-level gap, not a fatal flaw, but it should be fixed.\n\nThere are two smaller issues worth noting. The abstract and introduction claim a closed-form controller without saying that this requires the specific cost weight G = B^T B, which is a real restriction. And the tracking result in Section IV relies on the prior reduced-order model work; that is fine, but it is borrowed machinery, not new. Also, the vector relative degree assumption is acknowledged as structural, and the paper is honest about not covering input bounds.\n\nSeriousness: yes, this is a thoughtful paper with sound mathematics in the central claims. I would send it to review, because the compatibility and closed-form results are useful and the flaws are fixable. I would cite it if I worked on multi-constraint CBFs.","headline":"Solid extension of LTI multiple-CBF compatibility to nonlinear square systems; the compatibility and closed-form results hold up, but Theorem 2's forward-invariance claim needs a global existence assumption.","tokens_in":14587,"tokens_out":1542,"would_cite":true,"duration_ms":16027,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proves that multiple exponential control barrier function constraints encoding box constraints on vector-valued outputs are always compatible whenever the output has a vector relative degree, and that the resulting quadratic-prog","keywords":["control barrier functions","multiple constraints","compatibility","exponential control barrier functions","quadratic programming","safety filter","vector relative degree","forward invariance"],"falsifier":"Find a system satisfying all other assumptions but where the decoupling matrix B(x) loses rank at a point inside the claimed safe set—for instance, the planar drone with θ reaching ±π/2—and exhibit a state in that set at which the two ECBF constraints on z_min and z_max admit no common input, or where the closed-form solution (27) violates one of the ECBF inequalities.","tokens_in":13571,"feed_emoji":"🛡️","tokens_out":3651,"duration_ms":37460,"temperature":0.7,"pith_summary":"This paper addresses a known gap in control barrier function (CBF) theory: most results handle one scalar state constraint, while real systems face several at once. The authors consider box constraints on the vector-valued output of a control-affine nonlinear system and encode each upper and lower bound as an exponential CBF (ECBF). Their central claim is that if the output has a vector relative degree, the 2m ECBF constraints are mutually compatible—there is always some input satisfying all of them—and the resulting quadratic-program safety filter is well-posed, locally Lipschitz, and available in closed form when the cost weight is chosen as the Gram matrix of the decoupling matrix. They also prove that this filter renders the safe set forward invariant and quantify how the filter degrades nominal tracking objectives. The practical payoff is a provably safe, optimization-free controller for simultaneous output constraints, demonstrated on a planar quadrotor.","feed_headline":"One condition makes many safety constraints mutually feasible","feed_subtitle":"With a vector relative degree, a multi-constraint safety filter becomes Lipschitz and closed-form.","key_machinery":"The vector relative degree of the output, captured by the m x m decoupling matrix B(x) whose rows are b_i(x)^T = L_g L_f^{r_i-1} y_i(x). Invertibility of B(x) on a neighborhood E of the safe set guarantees the rows b_i are linearly independent, which makes the pairwise opposite constraint directions ±b_i the only possible linear dependencies. The Farkas-type compatibility lemma (Lemma 1, following the proof of [11, Thm. 2]) then reduces compatibility to checking that a certifying linear combination of the constraint offsets is nonnegative; because each pair shares the same a_i and b_i with opposite signs, the cancellation leaves the positive gap y_i - y_i. The same linear independence also b","core_discovery":"For a square control-affine nonlinear system whose vector-valued output y has vector relative degree r = (r1,...,rm) on a neighborhood E of the safe set S, the 2m exponential CBF constraints encoding the box constraints y_i <= y_i(x) <= y_i are always compatible on E. Consequently, the QP safety filter (18) always has a feasible set, its solution u*(x) exists, is unique, and is locally Lipschitz continuous on E, and the closed-loop system keeps S forward invariant. When the quadratic cost weight is chosen as G(x) = B(x)^T B(x), where B(x) is the decoupling matrix, the filter admits the explicit closed-form solution (27): u*(x) = kd(x) + sum of active Lagrange-multiplier corrections, with eac","pith_inferences":["The proof structure suggests a general design recipe: choose auxiliary outputs as needed to achieve a vector relative degree, then every two-sided constraint on those outputs is automatically compatible. The planar-drone example shows this can force extra outputs (orientation) that consume actuation, so engineers will need to trade off which outputs to constrain directly.","The same compatibility argument may extend beyond boxes to any set of constraints where each constraint appears in opposite-sign pairs sharing a common high-order Lie derivative, e.g., symmetric limits on linear combinations of outputs—though the paper only proves the box case.","The closed-form multiplier λ_i*(x) doubles as an interpretable indicator of which constraint is active; in a deployed filter, these multipliers could be logged to detect which safety limits bind at any moment.","Since the paper explicitly leaves input bounds out of scope, a natural next test is whether compatibility persists when actuator saturation is added; the Farkas argument would need to be rechecked against the bounded-control case, where infeasibility typically appears at corners of the safe set."],"forward_implications":["Safety filters for multiple simultaneous output constraints no longer need online feasibility checks or conservative merging of constraints into a single CBF; compatibility comes from the system's relative-degree structure.","The closed-form filter (27) can run on platforms where an optimizer is impractical or prohibited, such as resource-constrained or aerospace systems.","For any system satisfying the vector-relative-degree assumption, the 2m ECBF constraints are always mutually feasible, so the QP is never infeasible and the controller is well-defined on the safe set.","The tracking analysis shows that the safety filter's effect on nominal tracking is input-to-state stable: tracking error degrades gracefully, bounded by a function of the filter's corrective action.","The approach extends the LTI compatibility results of [15] to a broader class of square nonlinear systems, subsuming several earlier special cases such as unicycle and fully actuated mechanical systems."],"supporting_citations":[{"why":"Establishes the CBF-QP approach that this paper builds on and extends to multiple constraints.","marker":"[1]"},{"why":"Provides the Farkas-type theorem that Lemma 1 follows, the key tool for proving constraint compatibility.","marker":"[11]"},{"why":"Defines exponential CBFs and supplies Theorem 1, used to prove forward invariance of the safe set.","marker":"[22]"},{"why":"Supplies the definition of vector relative degree and the decoupling matrix, the central structural assumption.","marker":"[20]"},{"why":"Used in Lemma 3 to conclude the QP solution is locally Lipschitz continuous under active-constraint regularity.","marker":"[24]"},{"why":"The LTI compatibility result that this paper generalizes to square nonlinear systems with vector relative degree.","marker":"[15]"}],"fun_headline_variants":["Vector relative degree makes box output constraints compatible","Multi-CBF safety filter stays Lipschitz under relative degree","Closed-form safety controller for multiple output constraints","Relative degree guarantees feasible multi-CBF safety constraints","Box constraints on outputs: one condition ensures compatibility"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The decoupling matrix B(x) must be invertible at every point in a neighborhood of the safe set; if the output loses its vector relative degree anywhere on the safe set, the rows b_i can become dependent, the compatibility proof fails, and the multiple box constraints can become mutually infeasible.","fun_headline_variants_meta":{"raw":{"variants":["Vector relative degree makes box output constraints compatible","Multi-CBF safety filter stays Lipschitz under relative degree","Closed-form safety controller for multiple output constraints","Relative degree guarantees feasible multi-CBF safety constraints","Box constraints on outputs: one condition ensures compatibility"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000301,"raw_usage":{"total_tokens":1545,"prompt_tokens":688,"completion_tokens":857,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":432,"completion_tokens_details":{"reasoning_tokens":785}},"tokens_in":432,"tokens_out":857,"duration_ms":7922,"temperature":1.0,"reasoning_tokens":785,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T10:19:10.627171+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Find a system satisfying all other assumptions but where the decoupling matrix B(x) loses rank at a point inside the claimed safe set—for instance, the planar drone with θ reaching ±π/2—and exhibit a state in that set at which the two ECBF constraints on z_min and z_max admit no common input, or where the closed-form solution (27) violates one of the ECBF inequalities.","supporting_citations":[{"cited_title":"Control barrier function based quadratic programs for safety critical systems,","cited_arxiv_id":null,"evidence_quote":"Establishes the CBF-QP approach that this paper builds on and extends to multiple constraints."},{"cited_title":"Composing control barrier functions for complex safety specifications,","cited_arxiv_id":null,"evidence_quote":"Provides the Farkas-type theorem that Lemma 1 follows, the key tool for proving constraint compatibility."},{"cited_title":"Exponential control barrier functions for enforcing high relative-degree safety-critical constraints,","cited_arxiv_id":null,"evidence_quote":"Defines exponential CBFs and supplies Theorem 1, used to prove forward invariance of the safe set."},{"cited_title":"Isidori, Nonlinear Control Systems","cited_arxiv_id":null,"evidence_quote":"Supplies the definition of vector relative degree and the decoupling matrix, the central structural assumption."},{"cited_title":"Lipschitz continuity of constrained processes,","cited_arxiv_id":null,"evidence_quote":"Used in Lemma 3 to conclude the QP solution is locally Lipschitz continuous under active-constraint regularity."},{"cited_title":"Servo-controllers for linear time- invariant systems with operational constraints,","cited_arxiv_id":null,"evidence_quote":"The LTI compatibility result that this paper generalizes to square nonlinear systems with vector relative degree."}],"review_version":1}