PaperlayerView exact revision on arXiv

Source-linked AI summary

Timely Activation of Safety Filters via One-Step Reachability Expansion

Javier Borquez

arXiv:2609.17904v1cs.RO

TL;DR

Continuous-time reachability filters can lose their safety margin when discrete updates let a system jump into the unsafe BRT before the filter reacts. The One-step Expanded BRT derives an earlier activation boundary from worst-case one-step reachability. In simulations it improved safety outcomes over the base filter, though failures remained possible.

  • Problem

    Discrete control updates can move a system into the unsafe BRT before a continuous-time least-restrictive filter can react.

    Source: §I · p. 1, §III · p. 2

  • Method

    The One-step Expanded BRT uses a worst-case one-step reachability expansion as the filter's activation boundary.

    Source: §III · p. 2, §VI · p. 5

  • Results

    The One-step Expanded BRT produced 67 to 89 safe trajectories out of 100 runs, compared with 5–11 for the Base BRT filter across tested timesteps.

    Source: §V · p. 5

  • Takeaways & Limitations

    The construction provides the smallest expanded boundary that prevents a safe state from transitioning into the unsafe BRT within one control period.

    Source: §VI · p. 5

    The method still relies on a value function computed with continuous-time control authority, so its boundary may not capture the true discrete-time reachable set and failures can remain.

    Source: §V · p. 5

Abstract

from arXiv · show

Least-restrictive safety filters based on Hamilton-Jacobi reachability provide strong safety guarantees by overriding a nominal controller only when the system reaches the boundary of the set of unsafe states defined as a Backward Reachable Tube (BRT). These guarantees, however, rely on the continuous-time nature of the underlying formulation. In practice, robotic systems apply control at discrete sampling intervals, which creates a mismatch where the system may jump into the unsafe BRT between updates, allowing failures that are theoretically avoidable. This work introduces a principled solution based on a one-step expanded BRT that predicts all states capable of reaching the true BRT within a single timestep. By using this expanded boundary as the activation condition for the safety filter, safety interventions occur early enough to ensure correctness under discrete-time execution. We formulate this expanded set as a modified reachability problem and compute it using standard continuous-time solvers.

I. INTRODUCTION

Hamilton–Jacobi reachability supplies safety certificates and controls, while least-restrictive filters preserve nominal behavior until intervention is needed. Discrete control updates can undermine continuous-time guarantees, motivating a principled one-step expansion of the BRT.

I. INTRODUCTION

  • Hamilton–Jacobi reachability computes a Backward Reachable Tube (BRT) of states that cannot avoid failure and provides a safety-preserving control policy,.The framework handles general nonlinear dynamics, bounded controls, and adversarial disturbances.Source: §I · p. 1
  • Least-restrictive filtering uses the nominal controller in the safe region and intervenes at the BRT boundary, preserving nominal behavior elsewhere,.This gives safety guarantees in continuous time.Source: §I · p. 1
  • Discrete sensing, planning, and control updates can let a system enter the continuous-time BRT between updates, with the mismatch worsening as the sampling period increases.Direct discrete-time reachability formulations remain less developed and are rarely supported by existing toolchains.Source: §I · p. 1
  • Heuristic BRT inflation can trigger the filter earlier, but requires manual tuning and may introduce unnecessary conservatism, [25].A system outside the BRT can enter it within one control interval before the filter reacts.Source: §I · p. 1
  • The One-step Expanded BRT derives an activation boundary from system dynamics and worst-case evolution, retaining least-restrictive behavior while minimizing unnecessary conservatism.It is designed to give the filter time to intervene before the original BRT can be reached within one sampling interval.Source: §I · p. 1

A. Hamilton-Jacobi Reachability

Hamilton–Jacobi reachability formulates safety as a robust control-versus-disturbance problem over trajectories. Its value function captures worst-case proximity to failure, and the converged value function supports safety control synthesis.

A. Hamilton-Jacobi Reachability

  • The BRT contains states from which the system cannot avoid entering the failure set F within horizon T despite its best control effort.Its value-function formulation uses bounded control and disturbance and the trajectory generated by the system dynamics.Source: A. Hamilton-Jacobi Reachability · p. 2
  • HJ reachability frames BRT computation as a zero-sum game, measuring proximity to F with a signed-distance cost along system trajectories.The controller maximizes distance from failure while the worst-case disturbance minimizes it.Source: A. Hamilton-Jacobi Reachability · p. 2
  • Dynamic programming converts the robust value-function problem into a Hamilton–Jacobi–Isaacs variational inequality (HJI-VI).Its Hamiltonian optimizes over the inner product of the value-function spatial gradient and the system dynamics.Source: A. Hamilton-Jacobi Reachability · p. 2
  • The BRT is the sub-zero level set of the value function, and safety control uses the time-converged value function without time dependency.The paper relies on the converged value function because the unsafe set typically stops expanding after some time.Source: A. Hamilton-Jacobi Reachability · p. 2

B. Least Restrictive Filtering

The least-restrictive filter uses a nominal controller while the state remains safe, then switches to an optimal safety-preserving control at the BRT boundary. This boundary-triggered intervention guarantees safety in continuous time.

B. Least Restrictive Filtering

  • The filter uses an arbitrary nominal controller while the value function is positive, when the system is not at risk of breaching safety.The nominal controller may optimize performance without enforcing safety constraints.Source: B. Least Restrictive Filtering · p. 2
  • At the BRT boundary, where V(x) = 0, the filter switches to the optimal control that maintains or increases V(x), keeping the system out of unsafe states.The optimal control is derived from the reachability solution.Source: B. Least Restrictive Filtering · p. 2
  • The filter guarantees safety in continuous time because control can switch instantaneously at the boundary.The approach is compatible with most existing control or planning algorithms.Source: B. Least Restrictive Filtering · p. 2

III. PROBLEM STATEMENT

Finite sampling intervals create a gap between continuous-time safety guarantees and discrete-time control execution. The problem is to set a minimally expanded BRT boundary that triggers intervention before a system can reach the original BRT in one update.

III. PROBLEM STATEMENT

  • Finite sampling intervals create a mismatch between continuous-time HJ guarantees and discrete-time control execution.The least-restrictive filter relies on instantaneous switching at the BRT boundary in continuous time.Source: §III · p. 2
  • A discrete update can move the system from V(x_t) > 0 to V(x_t+∆t) < 0, so the filter reacts only after the state has entered the unsafe BRT.This can produce safety violations despite use of the optimal safety filter.Source: §III · p. 2
  • The expanded boundary must require more than one sampling interval ∆t to reach the original BRT under worst-case dynamics.This prevents an outside state from entering the true BRT within a single discrete control step.Source: §III · p. 2
  • Figure 1 contrasts updates at, inside, and before the true BRT boundary with updates relative to an inflated boundary.The caption states that an outside update remains safe because the system cannot enter the true BRT within one update step.Source: §III · p. 2, Figure 1 · p. 3
  • The target is the minimal expansion that ensures intervention before the original BRT can be crossed during one control interval, while preserving least-restrictive behavior.The expansion is intended to compensate for control discretization in the filter.Source: §III · p. 3

A. One-step Expanded BRT

The One-step Expanded BRT captures states that can reach the base BRT within one sampling interval under worst-case evolution. It is computed as a modified reachability problem using standard HJ solvers.

A. One-step Expanded BRT

  • The One-step Expanded BRT contains states that can reach the original BRT within one sampling interval under worst-case evolution.It treats the base, time-converged BRT as the failure set and uses a horizon of Δt.Source: A. One-step Expanded BRT · p. 3
  • The value function characterizes the minimum value of the base BRT that can be reached under worst-case dynamics during one sampling period.It therefore measures the minimum distance to the true base BRT achievable in one discrete control step.Source: A. One-step Expanded BRT · p. 3
  • The modified HJI-VI propagates the expanded value function backward over t ∈ [0, Δt], with the base value function as its terminal condition.The control and disturbance are both modeled as adversarial to safety, and the modified Hamiltonian encodes their actions toward the base BRT.Source: A. One-step Expanded BRT · p. 3
  • Standard HJ reachability solvers compute the expansion by propagating the HJI-VI backward for one sampling interval.The formulation sets the converged base value function as the terminal condition and treats both control and disturbance as adversarial to safety.Source: A. One-step Expanded BRT · p. 3

B. Safety of the One-step Expansion

Activating the least-restrictive safety filter at the one-step expanded BRT boundary guarantees safety under discrete-time execution with period Δt for states initially outside that set. The guarantee relies on the filter intervening before the system can reach the base BRT.

B. Safety of the One-step Expansion

  • Starting outside the one-step expanded BRT guarantees safety under discrete-time control execution with period Δt.The switching condition is the boundary of the one-step inflated BRT.Source: B. Safety of the One-step Expansion · p. 3
  • If the sampled successor enters the expanded BRT but remains outside the base BRT, the filter switches to the safe controller at the next update.The proof rules out reaching the base BRT in one step from a state initially outside the expanded BRT.Source: B. Safety of the One-step Expansion · pp. 3–4
  • The proof’s cases ensure the nominal policy either stays outside the expanded BRT or is replaced by the safe policy before the true BRT can be reached.Thus, safety is maintained at the stated discrete sampling period.Source: B. Safety of the One-step Expansion · p. 4

V. SIMULATION STUDIES

In Dubins’ car simulations, the One-step Expanded BRT filter is compared with the Base BRT across discrete control timesteps. It substantially improves safety, although failures remain possible because the boundary is derived from a continuous-time value function.

V. SIMULATION STUDIES

  • The simulations use a Dubins’ car with fixed speed 0.3 m/s, angular input in [−0.75, 0.75] rad/s, and bounded random velocity disturbance of norm at most 0.03 m/s.The failure set is a 2 m × 5.6 m enclosure containing four 0.2 m-diameter circular obstacles, inflated by 0.17 m for the robot body.Source: §V · p. 4
  • For ∆t = 0.2 s, the expanded BRT activates the filter early enough to preserve obstacle clearance, while the Base BRT trajectory penetrates the obstacle.Figure 2 shows trajectories as lines and discrete control-update times as dots.Source: §V · p. 4, Figure 2 · p. 4
  • Across four control timesteps from 0.1 to 0.4 s, each filter setting is evaluated in 100 Monte Carlo runs with random starting states, perfect state estimates, and an exact dynamics model.Figure 2 shows a two-dimensional projection of the three-dimensional BRTs at θ = π/2; the base BRT converges over a 1 s horizon.Source: §V · p. 4
  • 67–89 safe trajectories out of 100, versus 5–11 for Base BRT; expanded-BRT runs also had lower median penetration and later failures.Table I reports results across control timesteps, with metrics summarized by their median across 100 runs.Source: Table I · p. 5, §V · p. 5
  • At every tested timestep, one-sided Mann–Whitney U tests found significantly better maximum-penetration and time-to-first-collision outcomes for the expanded-BRT filter (p < 0.05).The tests compare distributions across methods at each control timestep.Source: §V · p. 5
  • The expanded boundary still does not guarantee safety: failures occur at every tested timestep because the filter uses a continuous-time value function during discrete-time execution.The resulting boundary may not perfectly capture the true discrete-time reachable set.Source: §V · p. 5
  • Safety improved at larger timesteps, with a pronounced increase in successful trajectories at 0.2 s versus 0.1 s; worst-case expansion offers more protection than delayed activation alone requires.The expansion assumes adversarial control and disturbances, while the nominal shooting-MPC policy is non-adversarial.Source: §V · p. 5

VI. CONCLUSION

The one-step expanded BRT defines the smallest expanded boundary that prevents entry into the unsafe BRT within one control period. Dubins-vehicle simulations report improved filtering reliability, while the expansion only partially resolves the continuous–discrete mismatch.

VI. CONCLUSION

  • The one-step expanded BRT is the smallest expanded boundary that prevents a safe state from reaching the unsafe BRT within one control period.It is derived by solving an adversarial one-step reachability problem.Source: §VI · p. 5
  • Dubins-vehicle simulations found more safe trajectories, smaller penetration when failures occurred, and later first violations with the expanded filter than with the standard LR filter.The improvements were statistically validated on maximum penetration and time-to-first-collision metrics.Source: §VI · p. 5
  • The expansion improves discrete-time filtering with continuous-time BRTs but does not eliminate failures or fully resolve the continuous–discrete mismatch.Proposed future directions include discrete-time safety sets or conservative discrete-time over-approximations of system flows.Source: §VI · p. 5
  • The adversarial one-step expansion could also be applied to barrier certificates defining unsafe sets and propagating trajectories under bounded inputs.The paper names control barrier functions, tube-MPC safety sets, and other viability-based certificates as possible settings.Source: §VI · p. 5
Loading 2609.17904v1…