{"id":"8fdcd891-eb05-460d-918e-2ec449fdab61","arxiv_id":"2512.05292","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"An outer-loop ESO plus robust CBF safety filter achieves tracking and collision avoidance for closed-architecture manipulators without touching the inner-loop controller.","lead":"This paper presents a control add-on for industrial robots whose inner torque controller cannot be modified: an observer estimates all disturbances and a safety filter adjusts outer-loop velocity commands, giving better tracking and collision avoidance. It could give commercial robots a drop-in upgrade path for safer, more accurate motion without changing their firmware.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 3's safety guarantee hinges on an unproven discrete-to-continuous error bound and a circularly estimated l_f; neither is settled by the paper.","rationale":"The reader's weakest_assumption is Assumption 3 (known l_f), and the reader correctly notes that the hardware experiments estimate l_f from finite differences of the ESO output in the same runs used to claim safety. That is a genuine, load-bearing concern: the formal guarantee is conditional on a constant the paper never provides a principled method for, and the experimental calibration is circular. I partially agree because the paper also contains a second, arguably more fundamental gap: the error bound (51) is derived in discrete time, yet Theorem 3 is a continuous-time forward-invariance statement. The assertion that the discrete-time bound 'is still the same' as the continuous-time one is not proved, nor is any intersample behavior analyzed. Even with l_f known perfectly, a discrete-time bound does not by itself bound the continuous-time trajectory between samples. Thus the safety theorem is not fully established in the continuous-time setting claimed. The paper has real independent support: the hardware experiments at 1 kHz, the ANOVA robustness study, and the consistent simulation results are meaningful evidence that the method works in practice. The theoretical proof, however, is conditional on a calibration step that the paper does not justify. This does not change the reader's CONDITIONAL verdict: the contribution is plausible and useful, but the central safety guarantee needs either a rigorous continuous-time error bound or a proper sampled-data CBF analysis, plus a principled way to obtain l_f. The concrete test I propose uses the ground-truth simulation to separate the two issues: it first checks whether (51) actually dominates the true estimation error in continuous time, and then checks whether the experimental l_f-estimation procedure can under-estimate the true derivative and lead to a safety violation. This is a single, decisive experiment that would tell us whether the concern lands at the proof level, at the calibration level, or both.","tokens_in":23852,"tokens_out":11360,"duration_ms":96371,"concrete_test":"In the PUMA simulation (Sec. V, ground-truth model from [44]), compute the true total disturbance f(t) and the true maximum |f(t)−\\hat f(t)| over the 10 s trajectory. Also compute Γ(ω_o,T_s) from (51) using the true l_f = max_t|\\dot f(t)|. If Γ < max|f−\\hat f|, then the bound (51) is not a valid continuous-time upper bound and Theorem 3 fails even with perfect l_f. If Γ ≥ max|f−\\hat f|, repeat the safety experiment with l_f obtained from finite differences of \\hat f as in Sec. VI-C1 and check whether the robust CBF constraint (52) is satisfied for all time steps; if the resulting Γ under-estimates the actual error, the simulated end-effector will cross the boundary y0, falsifying the experimental safety declaration.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that Theorem 3 (Sec. IV-E) renders the safety set forward invariant using only the outer-loop kinematic controller. The proof rests on the disturbance-estimation error bound Γ_i(ω_o,T_s) in (51), which is derived in discrete time from (49)–(50), and on Assumption 3 requiring a known constant l_f with |∂f_i/∂t| ≤ l_f. Two conditions are needed for the theorem to apply: (i) the discrete-time bound (51) must be a valid upper bound on the continuous-time error |f_i(t)−\\hat f_i(t)| for all t, not just at sampling instants; the paper asserts this 'still the same' without proof, and no intersample analysis is given; (ii) l_f must be known a priori. In the hardware experiments (Sec. VI-C1), l_f is not known: it is computed as the maximum finite difference of the ESO's estimated \\hat f from the same experimental runs used to demonstrate safety. The estimated \\hat f can under-estimate the true derivative of f, and a finite-time maximum is not a guaranteed upper bound; if l_f is too small, the inequality in (53) fails and the forward-invariance claim collapses. Both gaps are acknowledged by the authors only as practical tuning advice ('it is crucial that the disturbance rate of change be carefully estimated'), not as a verified condition.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a unified outer-loop add-on for closed-architecture robotic manipulators. The inner-loop torque controller is assumed to have only a weak structural form (Assumption 1), and the user can command only kinematic quantities. An extended state observer (ESO) estimates a total disturbance that is used both for disturbance-rejection tracking control and for a robust control barrier function (CBF) safety filter. The main theoretical results are: (i) Theorem 1, bounded/asymptotic tracking stability under ESO-based disturbance compensation; (ii) Theorem 2, forward invariance of the safety set when the disturbance is known; and (iii) Theorem 3, the corresponding robust forward-invariance guarantee when only the ESO estimate and a disturbance-derivative bound are available. The manuscript validates the method on a PUMA 500 with hardware experiments including payload variation, external disturbance, and gravity disturbance, and compares tracking with a learning-based adaptive controller and safety with a DOB-CBF.","tokens_in":24203,"tokens_out":8167,"duration_ms":82793,"significance":"If the theoretical claims hold, the paper makes a useful practical contribution: it addresses a relevant closed-architecture scenario with minimal knowledge of the inner loop, a simple add-on structure, and a formal safety framework. The extension of the prior ESO-based robust CBF from relative degree one to arbitrary relative degree is significant, and the hardware implementation at 1 kHz with comparisons to both a learned adaptive controller and a DOB-CBF is a strength. The assumptions on the inner-loop controller are among the weakest in the literature, and the nominal-model formulation allows easy integration. However, the central safety theorem is not fully established as stated: the continuous-time error bound used in Theorem 3 is imported from a discrete-time analysis without proof, and the experimental estimate of the required bound is obtained from the same runs used to demonstrate safety. These are load-bearing issues, but they are fixable by providing a rigorous continuous-time/sampled-data analysis and an a priori bound or independent verification of the disturbance-derivative constant.","major_comments":[{"comment":"The forward-invariance proof of Theorem 3 requires the scalar inequality |f_i(t)−f̂_i(t)| ≤ Γ_i(ω_o,T_s) to hold for all continuous t. However, Eq. (51) is explicitly stated as a discrete-time convolution result imported from [35], and the paper's only justification for the continuous-time validity is the sentence 'the disturbance estimation error bound obtained from it is still the same as that from the continuous-time domain.' No intersample analysis or proof is given. The subsequent comment that 'T_s should be small, such as 0.1 ms' is a heuristic, and it conflicts with the stated 1 kHz hardware sampling rate. Without a continuous-time bound, inequality (53) does not follow, so Theorem 3 is not proven. Please either derive a genuine continuous-time bound, or reformulate Theorem 3 in an explicit sampled-data setting with sampled-data safety verification.","section":"§IV-E, Eq. (51)–(53), Theorem 3"},{"comment":"Assumption 3 requires a known positive constant l_f such that |∂f_i/∂t| ≤ l_f. In the hardware experiments, l_f is not known a priori: the text states that finite differences of the ESO's estimated f̂ are computed and their maximum is used as the bound. This is circular with respect to the safety demonstration: the estimated disturbance derivative can be smaller than the true derivative, and a finite maximum over one experiment is not a guaranteed upper bound. If l_f is underestimated, Γ in (51) is too small and the key inequality in (53) fails, so the forward-invariance claim collapses. The paper acknowledges at the end of VI-C1 only that 'the disturbance rate of change be carefully estimated,' which is practical tuning advice, not a verified condition. Please provide an a priori, physical or model-based bound for l_f, or state explicitly that the hardware results are heuristic and not","section":"§VI-C1, Fig. 12b; Assumption 3"},{"comment":"The discrete-time quantities in Eq. (50) are not fully defined in this manuscript: r_i is the relative degree of q̇_i with respect to f_i, and ω_oi is a discrete-time pole, but the precise discretization and the relationship between the continuous-time observer (24) and the discrete-time error formula (49) are left to reference [35]. Since the reader cannot verify the applicability of this bound to the system (41) and the ESO (24), please state the exact mapping from continuous observer gains to discrete-domain parameters and include the relevant derivation or a self-contained statement of the result.","section":"§IV-E, Eq. (50)–(51), Appendix A"}],"minor_comments":[{"comment":"The sentence 'T_s should be small, such as 0.1 ms, in our experiment setting' is inconsistent with the 1 kHz sampling stated in §VI and the computational-complexity paragraph. Please clarify which sampling time is used for the error-bound calculation and for the real-time implementation.","section":"§IV-E, after Eq. (51)"},{"comment":"The text repeatedly uses 'ANOV A' where 'ANOVA' is intended. Please correct this typo throughout.","section":"§VI-B2 and Fig. 10"},{"comment":"The notation y0 = [y1, −0.1, y3]^T for a virtual wall is confusing; it appears to define a plane with a y-axis bound, not a vector point. Please use standard plane or half-space notation.","section":"§VI-C1, Fig. 12"},{"comment":"The table uses check marks and dashes that are explained only in the footnote; please make the meaning of the dashes clear directly in the table to avoid ambiguity.","section":"Table I"},{"comment":"The QP constraint uses strict inequalities h_i(x(0)) > 0, i = 0,1,2, while the safety sets (43) are defined with ≥. This is standard in CBF practice, but please state that the strict inequalities are a mild initial-condition requirement rather than part of the forward-invariance condition.","section":"§IV-E, Eq. (56)"}],"recommendation":"major_revision","confidential_remarks":"The paper is an extension of the authors' CDC 2023 paper [11], and the novelty disclosure is clear. The main risk is that a rigorous continuous-time or sampled-data proof of the error bound is nontrivial; however, I do not think this is a reason to reject outright, because the practical framework and experiments are valuable and the missing analysis can be supplied. I would ask the authors to address the two load-bearing points (the continuous-time validity of Eq. (51) and the a priori nature of l_f) before acceptance. If they choose to weaken the claim to 'practical safety under empirically tuned bounds,' the paper should clearly state that limitation."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this paper deserves a serious referee, but the central safety theorem needs repair before I'd trust it as a guarantee.\n\nWhat is actually new: the authors extend their own relative-degree-one ESOR-QP to arbitrary relative degrees, adding a higher-order robust CBF that uses the ESO's disturbance estimate both in the tracking controller and in the safety constraint. That is a sensible, coherent architecture, and the PUMA 500 hardware experiments with an unmodifiable inner-loop controller are a genuine step beyond simulation-only work. The tracking comparisons with learning-based adaptive control [2] are honest: performance is comparable in the no-payload case, and the payload robustness results are a credible practical point.\n\nThe soft spots are exactly where the stress-test lands. Theorem 3's forward-invariance claim depends on (i) the discrete-time error bound in (51) being a valid continuous-time bound for all t, which is asserted but not proved; and (ii) Assumption 3's known l_f. In the hardware section, l_f is computed as a finite difference maximum from the same experimental runs used to demonstrate safety. That is circular for a formal guarantee. If l_f is under-estimated, the inequality in (53) breaks and the entire safety argument collapses. The paper's own remark that 'it is crucial that the disturbance rate of change be carefully estimated' is an admission that this is tuning advice, not a verified condition.\n\nI don't think this is a fatal flaw in the sense that the method probably works in practice — the experiments show it does — but as a theoretical contribution it is under-specified. The fix is straightforward in principle: provide an inter-sample analysis or switch to a sampled-data CBF formulation, and give a conservative a priori way to select l_f, or clearly frame the guarantee as conditional on an estimated bound. The comparison with DOB-CBF [21] is also narrow; tuning gains to match minimum h is a bit cherry-picked.\n\nThe citation pattern and self-citation are fine: [11] is their own prior conference paper, and [35] is the source of the error bound, both legitimately cited.\n\nBottom line: this is a solid within-subfield paper with real hardware evidence and addressable theoretical gaps. It deserves peer review, and I'd expect major revision on the safety proof and the l_f handling before acceptance.","headline":"Useful extension of the authors' ESO-CBF framework to high relative degree with real hardware, but the formal safety guarantee has an unproved discrete-time link and a circularly estimated disturbance bound.","tokens_in":24704,"tokens_out":2439,"would_cite":false,"duration_ms":24351,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["93C85"],"pacs":[],"model":"deepseek-v4-flash","headline":"One outer-loop add-on can make closed-architecture robots track accurately and stay safe, despite a locked, unknown inner-loop controller.","keywords":["disturbance rejection","extended state observer","control barrier function","closed architecture","kinematic control","forward invariance","robotic manipulator","safe control"],"falsifier":"Drive the end-effector toward the virtual wall while imposing a disturbance whose |∂f_i/∂t| exceeds the l_f value used to compute Γ; if the safety function h (end-effector distance to the wall) crosses below zero while constraint (52) remains satisfied, the forward-invariance claim is false.","tokens_in":23738,"feed_emoji":"🤖","tokens_out":5147,"duration_ms":45823,"temperature":0.7,"pith_summary":"Commercial robots often ship with an inner-loop torque controller that users cannot touch or inspect; only the outer-loop kinematic command (joint velocity or position) is open. This paper's central claim is that a single add-on at that outer loop can deliver both high-precision tracking and provable safety for the whole robot, using only a nominal second-order model and no knowledge of the inner loop. The trick is to pack all uncertainty—model error, imperfect inner loop, external forces—into one 'total disturbance,' estimate it online with an extended state observer, and feed that estimate both to the tracking controller and to a control-barrier-function safety filter. The theoretical result (Theorem 3) proves forward invariance of a high-order safety set under matched disturbances, and the authors demonstrate the method on a PUMA manipulator at 1 kHz. A sympathetic reader would care because this turns safety-critical control into an easily addable software patch for legacy industrial arms.","feed_headline":"One add-on lets locked-architecture robots stay safe and precise","feed_subtitle":"An extended-state observer turns an unknown total disturbance into a formal safety filter, proven and tested on a PUMA at 1 kHz.","key_machinery":"The load-bearing object is ESOR-QP, a quadratic-program safety filter whose hard constraint is the robust control-barrier-function inequality (52). An extended state observer (ESO) (24) treats each joint's total disturbance as an extra state and estimates it from measured joint velocity. The CBF constraint then uses the estimate together with a deterministic error bound Γ(ω_o, T_s) derived from the observer error dynamics (49)–(51), or equivalently from a Lipschitz bound l_f on the time derivative of the disturbance. That error-bound term is what converts a nominal-model CBF—which would rely on perfect tracking—into a provably safe filter for the full uncertain system.","core_discovery":"On its own terms, the paper establishes that kinematic control of an uncertain closed-architecture robot can be reduced to estimating, per joint, one scalar total disturbance f and using that estimate twice: in a disturbance-rejection term that cancels f at the nominal-model level, and in a robust high-order control-barrier-function constraint that compensates for the remaining estimation error. Theorem 3 states that any controller satisfying the robust CBF constraint (52)—which subtracts a precomputed error bound Γ(ω_o, T_s) from the nominal CBF inequality—keeps the safety set forward invariant for the nonlinear affine system (41), as long as the disturbance derivative is bounded (Assumptio","pith_inferences":["Because the safety proof hinges on a known l_f, a natural next step is to estimate l_f online or adaptively; the same framework could then self-adjust Γ and preserve the forward-invariance argument under time-varying disturbance rates.","The total-disturbance view likely ports to other cascade-control robots (e.g., mobile manipulators or legged systems with firmware-level torque loops) as long as disturbances remain matched and joint velocity is measurable.","The explicit discrete-time error bound (49)–(51) may scale more tightly with observer bandwidth than Lyapunov-style bounds, reducing conservatism in safe control; this is an inference from the derivation, not a claim the paper makes.","A direct experimental comparison of the proposed ESO-based error bound against a disturbance-observer-based CBF error bound on the same testbed would clarify how much conservatism each observer structure actually saves."],"forward_implications":["Any commercial robot whose inner-loop controller is unmodifiable can gain tracking and safety guarantees by adding an outer-loop module, without touching firmware.","The same ESO estimate serves two purposes—disturbance rejection for accuracy and a robustness margin for safety—so no separate worst-case disturbance bound is required.","High-order safety specifications, such as end-effector distance to a virtual wall, can be enforced under matched uncertainty, not just simple first-order constraints.","Hardware results on a PUMA 500 demonstrate the add-on runs at 1 kHz and reaches tracking precision comparable to a learning-based adaptive controller, without a neural network or its tuning burden.","The proposed method also handles payload changes and external disturbances that would violate a nominal-model CBF, as shown in the reported experiments."],"fun_headline_variants":["One add-on keeps locked-architecture robots safe","Disturbance-aware filter for unmodifiable inner loops","Robust CBF add-on for safe kinematic control","Single add-on ensures safety and precision in robots","Extended-state observer meets control barrier function"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"Assumption 3 (Section IV-E) requires a known constant l_f bounding the rate of change of the total disturbance; in the hardware experiments (Section VI-C1) l_f is obtained from finite differences of the ESO's estimated disturbance, so if the true rate exceeds the estimated l_f, the forward-invariance guarantee of Theorem 3 no longer holds even though the controller keeps running.","fun_headline_variants_meta":{"raw":{"variants":["One add-on keeps locked-architecture robots safe","Disturbance-aware filter for unmodifiable inner loops","Robust CBF add-on for safe kinematic control","Single add-on ensures safety and precision in robots","Extended-state observer meets control barrier function"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000179,"raw_usage":{"total_tokens":1120,"prompt_tokens":709,"completion_tokens":411,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":453,"completion_tokens_details":{"reasoning_tokens":339}},"tokens_in":453,"tokens_out":411,"duration_ms":4823,"temperature":1.0,"reasoning_tokens":339,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-03T18:24:24.451585+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Drive the end-effector toward the virtual wall while imposing a disturbance whose |∂f_i/∂t| exceeds the l_f value used to compute Γ; if the safety function h (end-effector distance to the wall) crosses below zero while constraint (52) remains satisfied, the forward-invariance claim is false.","supporting_citations":[],"review_version":1}