{"id":"14c7b219-839c-4205-af0f-96054a40902e","arxiv_id":"2510.17525","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"The paper contributes a linear MPC safety constraint that, for the first control input alone, prevents the drone's future reachable set from ever being fully inside a human's reachable set, avoiding inevitable collisions.","lead":"This paper presents an MPC controller for drones that avoids people by checking all the places a person could move to, while only fixing the very next control command. The approach is fast enough to run on an embedded board and was tested in simulation and on a real quadrotor.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. (18) does not follow from the stated reachable set: R_R in Eq. (13) is u0-independent, so the linear constraint is not the noncontainment condition.","rationale":"The reader's weakest assumption (fixed human motion bounds) is a real limitation, but the load-bearing flaw is more fundamental: even granting perfect human bounds, the mathematical object constrained by (18) is not the object defined in Eq. (13). The central deliverable—a linear constraint whose satisfaction guarantees noncontainment—therefore lacks a valid derivation. This is an internal inconsistency, not merely a disagreement with consensus or a missing validation of human motion parameters. The reader's rationale flagged internal inconsistency between Eq. (9)-(10) and Eq. (15)-(18), so there is partial agreement, but the reader's chosen weakest_assumption does not identify this as the primary issue. I would move the verdict from CONDITIONAL to REJECT: the manuscript's central theoretical claim is unsupported as written. A corrected derivation, with a clear definition of the reachable set used in the constraints and a proof of recursive feasibility, would be needed before the paper can be considered for acceptance. The empirical results are encouraging but cannot substitute for the missing mathematical link.","tokens_in":11567,"tokens_out":7377,"duration_ms":64829,"concrete_test":"Minimal re-derivation: for a scalar double integrator x_{k+1} = [[1,dt],[0,1]]x_k + [0,dt]u_k, T=2, u∈[-1,1], compute R_R^2 from Eq. (13). Then evaluate the support function n^T c_R + |n|^T e_R for two different u0 with the same x0. If Eq. (13) is correct, the value is identical for both u0, so h_i in (6e) cannot depend on u0. Alternatively, compute the set with u0 fixed and remaining controls free and compare to Eq. (18); any mismatch beyond rounding invalidates (17).","verdict_should_be":"REJECT","load_bearing_attack":"Section IV-B's central claim is that the linear inequality (18) enforces R_R^k(u0) ⊄ R_H^k, i.e. noncontainment. But R_R is defined in Eq. (13) as the full open-loop reachable set R_R = {Φx0 + Γu_c + ΓE_uξ : ‖ξ‖∞ ≤ 1}. This set depends only on x0 and the control bounds u_min,u_max, not on the optimized first input u0. Eq. (17), however, replaces the center with Φ1x0 + Γ1u0. No definition of Φ1/Γ1 is given; if they are stacked blocks of Φ/Γ, the remaining columns' contribution to the center and to e_R is dropped, so the inequality is not the support function of Eq. (13). If instead R_R is meant to be the reachable set with first input frozen to u0, that is a different set from Eq. (13) and is not derived. Either way, the claimed equivalence between noncontainment and (18) is not established. The recursive statement—'(18) recursively assures feasibility and therefore safety'—is asserted, not proved. Even if (18) were valid at one step, future replans recompute x0 and R_H; no invariant or backward-reachable-set argument shows that remaining feasible inputs exist. The paragraph's own provisos (no control saturation, accurate joints, well-identified model) do not repair the missing step.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents HumanMPC (called HumanHalo in the abstract), a model predictive control framework for 3D MAV navigation in human-populated environments. The method tracks the full 24-joint SMPL human body, forecasts future motion with MotionMixer, and proposes a reachability-based safety constraint that, unlike standard disjoint-reachable-set formulations, constrains only the first control input u0 while accounting for future control freedom over the whole horizon. The central claim is that enforcing non-containment of the MAV reachable set in the human reachable set for the executed initial input guarantees the absence of inevitable collisions and recursive safety. Experiments in simulation with AMASS motions and on a real quadrotor are reported, comparing against distance-constraint baselines, forward-reachability variants, and a 2D navigation baseline.","tokens_in":11931,"tokens_out":13329,"duration_ms":117900,"significance":"If the safety derivation were sound, the contribution would be significant: a real-time, linear MPC safety constraint that works with a full 3D human-body model, avoids HJ-reachability precomputation, and remains computationally cheap. The paper provides real-world validation on an embedded MAV, clear experimental comparisons, and a sensible integration of a data-driven human motion forecaster. However, the theoretical core is not currently defensible: the distance function in Eq. (9)-(10) does not encode the stated non-containment condition, and the key linear constraint in Eq. (17)-(18) does not follow from the reachable set defined in Eq. (13). The recursive safety guarantee is asserted rather than proven. Because these issues directly affect the paper's central claim, the manuscript cannot be accepted in its present form.","major_comments":[{"comment":"The stated constraint h_i>0 with d defined in Eq. (9) is not equivalent to R_R(u0) ⊄ R_H. For any overlapping but non-contained sets, the second case of Eq. (9) yields distance 0, so h_i=0 and the constraint is violated. Thus Eq. (10) forbids all overlap, directly contradicting the text and Fig. 2, which state that overlaps are safe. Moreover, h_i is defined as d(R_H, R_R), so in the dangerous case R_R ⊂ R_H the function evaluates to 0 (not negative), failing to identify the hazard. The separation formulation in Eq. (15) with ε>0 is a different condition. The manuscript must specify exactly which inequality is implemented and reconcile it with Eq. (8).","section":"Section IV-B, Eqs. (8)-(10) and (15)"},{"comment":"The linear constraint does not follow from the reachable set defined in Eq. (13). R_R in Eq. (13) depends only on x0 and the control bounds u_min,u_max, not on the optimized input u0; its center is Φx0 + Γu_c. Eq. (17) replaces this center with Φ1x0 + Γ1u0, but Φ1 and Γ1 are never defined. If they are stacked blocks of Φ and Γ, the remaining block contributions and the center term Γ_rem u_c,rem are dropped, and the half-extent e_R in Eq. (14) still includes variation of u0 that is no longer free. If instead R_R(u0) is intended to be the reachable set with the first input frozen, that set is different from Eq. (13) and is not derived. In neither case is Eq. (18) the support-function condition for the stated reachable set.","section":"Section IV-B, Eqs. (12)-(18)"},{"comment":"The claim that Eq. (18) 'recursively assures feasibility and therefore safety' is not proved. Non-containment at each k can be certified by different future input sequences; the paper does not show the existence of a single continuation, an invariant set, or a backwards reachable set argument, nor does it prove that the QP remains feasible at the next replan. The listed provisos (no saturation, accurate joints, identified model) do not replace the missing inductive step. A formal proof or a counterexample is needed.","section":"Section IV-B, paragraph after Eq. (18)"},{"comment":"The human reachable-set bounds (v_i,max, a_i,max, ρ_i) are validated by comparing the reachable-set expansion against AMASS, and the simulation test scenarios are also drawn from AMASS. This makes the empirical validation circular for the core assumption that R_H is a true over-approximation of human motion. An out-of-distribution test set or a formal biomechanical justification of the bounds is required to support the claim that the safety guarantee holds beyond the specific motions used for calibration.","section":"Section V-A, Table II and AMASS validation"}],"minor_comments":[{"comment":"The abstract and arXiv metadata use the name 'HumanHalo', while the full paper uses 'HumanMPC' throughout. Please unify the name.","section":"Title/Abstract"},{"comment":"The table lists 'τmin −15° τmax 15°' twice; the second entry is presumably for θ or φ control limits. Please correct the label.","section":"Table II"},{"comment":"Eq. (5) uses x for the stacked state vector, but Eq. (17) writes x_{k+1} = Φ1 x0 + Γ1 u0 with no definition of Φ1, Γ1, or the relationship to the stacked dynamics. This notation needs to be made precise.","section":"Section III-B and IV-B"},{"comment":"The baseline row labeled 'None' omits the safety constraint entirely; consider clarifying in the baselines paragraph that this is the unconstrained MPC baseline, since the connection is easy to miss.","section":"Table I"},{"comment":"The real-world result 'never closer than 2.4 m' is compared to a safety margin of 0.5 m; please clarify whether 2.4 m already includes the MAV safety radius R_MAV and how the margin is defined in the real-world experiments.","section":"Section V-B"}],"recommendation":"reject","confidential_remarks":"The experimental system is substantial and the paper is clearly written, but the theoretical core is internally inconsistent and the key derivation is not valid as stated. The recursive safety guarantee is also not established. These are load-bearing issues for the central claim, and I do not see how they can be repaired by local edits; a correct treatment would require redefining the reachable set parameterization, re-deriving the constraint, and providing a genuine recursive-feasibility proof. I therefore recommend rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea is the real thing: enforce safety only on the executed first input, allow the robot's reachable set to overlap the human's, and forbid full containment. That is a new twist in the reachability-MPC literature, and the paper backs it with a serious evaluation—100% collision avoidance in simulation across all reachability-constrained variants, real-world trials on a full onboard stack, and a sensible comparison against distance-constraint and forward-reachability baselines. The 3D SMPL-based human model and the hybrid complex/simplified reachable sets are also pragmatic choices that keep the QP tractable. Credit where due: this is a useful engineering contribution, and the authors are honest about limitations (occlusions, conservative human bounds).\n\nThe soft spots are in the theory, and they are load-bearing. The reader's report and the stress-test note both land. First, the distance function in Eq. (9)-(10) forbids any overlap (h_i > 0 only when sets are disjoint), which contradicts the paper's own claim that overlaps are safe and only full containment is dangerous. Second, the stress-test is right: the reachable set R_R in Eq. (13) is defined using the full control box center u_c and is independent of the optimized first input u0. Eq. (17)-(18) swap in Φ1x0 + Γ1u0 as though that were the center, which it is not, and the generator contribution from the remaining control inputs is dropped. So Eq. (18) is not a linear encoding of non-containment for the stated set. The recursive safety/feasibility claim is asserted, not proved, and the provisos (no saturation, accurate joints, well-identified model) do not repair the missing invariant or backward-reachability argument. These are fixable—the non-containment condition can be written as a linear constraint in u0 if you parameterize the reachable set correctly with the first input fixed—but as written the proof does not hold.\n\nThe fixed human motion bounds (v_max = 1.0, a_max = 1.0, fixed body radii) are an assumption, not a flaw by themselves, since the paper states them; but the validation against AMASS is qualitative and the empirical claim of safety depends on those bounds holding. No code or data is provided, which makes independent verification harder.\n\nBottom line: the paper deserves a serious referee. The idea is worth engaging, the experiments are above the bar for the subfield, and the theory needs major revision, not desk rejection. Give it to someone who can check the zonotope algebra carefully.\n\nRecommendation: send to review, with a clear request for a corrected derivation and a more rigorous recursive-feasibility argument.","headline":"Genuinely novel MPC safety idea with solid experiments, but the central derivation has two concrete gaps; send to review so the theory gets fixed.","tokens_in":12454,"tokens_out":3272,"would_cite":false,"duration_ms":29196,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper's central claim is that a single linear constraint on the very first control input—requiring that the drone's future reachable set is never fully swallowed by a human's reachable set—recursively guarantees collision-free 3D naviga","keywords":["safe robot navigation","model predictive control","reachability analysis","collision avoidance","micro aerial vehicle","human motion prediction","zonotopes","real-time control"],"falsifier":"Pick the linear MAV model and one human, fix a horizon, and solve the MPC with Eq. (18); then brute-force search all admissible control sequences to check whether any state sequence that satisfies the per-step noncontainment condition can still end in collision (e.g., because the required escape direction changes from step to step faster than the drone can turn). A single such counterexample would falsify the recursive-safety claim. An experimental alternative: run the visual-servoing task with a person walking at 1.5 m/s, exceeding the assumed bound; a collision would show the guarantee's dep","tokens_in":11423,"feed_emoji":"🚁","tokens_out":4779,"duration_ms":41387,"temperature":0.7,"pith_summary":"HumanMPC tries to show that formally safe drone navigation among moving humans is compatible with real-time, efficient flight. Instead of demanding the drone's entire trajectory stay outside the human's reachable region—the standard, conservative approach—it constrains only the control input executed now, while checking its consequences across the whole horizon. The safety constraint is linear, so the online problem stays a quadratic program that solves in milliseconds on embedded hardware. If the guarantees hold, this would let aerial robots interact closely with people in tasks like filming, inspection, or delivery without freezing or taking over-conservative detours. The paper validates the claim in simulation with real human motion data and on a live quadrotor.","feed_headline":"Drone safety near humans reduces to one linear constraint","feed_subtitle":"New MPC constrains only the first control input but guarantees collision-free paths across the horizon, running in real time on a drone.","key_machinery":"The central object is the linear safety constraint of Eq. (18), derived from zonotope reachable sets: the drone's reachable set is an exact zonotope from its linearized dynamics and box control bounds, while the human's is a conservative over-approximation built from capsules/spheres following the 24-joint body and an inflated cylinder. The support function of the zonotope gives a separating hyperplane, and substituting the stacked dynamics converts the noncontainment condition d(R_H,R_R)>0 into a single linear inequality on u0. This makes the MPC a QP and gives recursive safety assurances without Hamilton-Jacobi precomputation.","core_discovery":"The core discovery is the noncontainment reachability constraint: at every horizon step, the drone's reachable set must not be a subset of the human's reachable set. If the drone's reachable set is ever fully inside the human's, collision is inevitable no matter what later controls are applied; if there is even one point outside, a future control can still escape. The authors derive a supporting-hyperplane condition that turns this geometric requirement into one linear inequality on the initial control input u0 (Eq. 18), and argue that satisfying this inequality recursively—step by step, in a receding-horizon MPC—guarantees feasibility and therefore safety, under stated assumptions about ini","pith_inferences":["The key insight—safety can be enforced on the executed input alone, not on all future inputs—might transfer to other safety-critical control settings (e.g., manipulators or autonomous vehicles), where conservative trajectory tubes are currently the bottleneck.","The paper's assumption of fixed human velocity/acceleration bounds is the main practical limit; a learned reachable set driven by current activity (walking, reaching, falling) would be a natural testable extension to reduce conservatism while preserving the guarantee.","The approach implies a trade-off: the human reachable set must grow with prediction horizon, so long horizons become expensive; the hybrid complex/simplified switch at 0.2s is a pragmatic answer, but adaptive switching times could be explored.","One could test whether the recursive guarantee survives imperfect tracking by injecting synthetic latency and noise into the joint observations in simulation, since the paper's real-world latency handling inflates reachable sets proportionally to unobserved time."],"forward_implications":["Safe MAV navigation among moving humans becomes a real-time quadratic program with linear safety constraints, solvable at 40 Hz on embedded hardware.","The method removes the need for extensive reachability precomputation, unlike Hamilton-Jacobi approaches, while retaining formal safety guarantees under stated assumptions.","Because the safety constraint is embodiment-independent, the same formulation can be ported to other robot platforms with linearizable dynamics.","Allowing overlaps between reachable sets—instead of requiring them disjoint—yields less conservative paths than standard forward reachability, as shown by higher efficiency in experiments.","The constraint degrades gracefully: when the initial state is infeasible (e.g., after perception failure), it is softened and the objective drives recovery."],"fun_headline_variants":["One linear constraint keeps drones safe near humans","Safe drone navigation: one linear inequality does it","One constraint prevents drone-human collisions","HumanHalo: safety from a single linear constraint","One linear condition keeps drones collision-free"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The guarantee rests on the human reachable set being a true conservative envelope: if a person moves faster than the assumed 1.0 m/s, accelerates harder, or extends a limb beyond the fixed radii, the robot's safe set can contain the real human state and no formal guarantee remains.","fun_headline_variants_meta":{"raw":{"variants":["One linear constraint keeps drones safe near humans","Safe drone navigation: one linear inequality does it","One constraint prevents drone-human collisions","HumanHalo: safety from a single linear constraint","One linear condition keeps drones collision-free"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000753,"raw_usage":{"total_tokens":3173,"prompt_tokens":716,"completion_tokens":2457,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":460,"completion_tokens_details":{"reasoning_tokens":2391}},"tokens_in":460,"tokens_out":2457,"duration_ms":15803,"temperature":1.0,"reasoning_tokens":2391,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T09:01:32.630959+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Pick the linear MAV model and one human, fix a horizon, and solve the MPC with Eq. (18); then brute-force search all admissible control sequences to check whether any state sequence that satisfies the per-step noncontainment condition can still end in collision (e.g., because the required escape direction changes from step to step faster than the drone can turn). A single such counterexample would falsify the recursive-safety claim. An experimental alternative: run the visual-servoing task with a person walking at 1.5 m/s, exceeding the assumed bound; a collision would show the guarantee's dep","supporting_citations":[],"review_version":1}