Source-linked AI summary
Finite-Data Safety Informativity Under Dynamic Asymmetric Actuation
Abhinav Sinha, Praveen Kumar Ranjan, Yongcan Cao
TL;DR
Finite measurements may leave multiple models consistent with the data, while limited actuator authority complicates safety certification across those models. The paper combines finite-data support bounds with a certified actuator-error tube to test command feasibility and select certified commands. In the vehicle study, coverage varies across data records, reaching 76.27% for Ds versus 86.26% for the exact-parameter benchmark on the same queries.
Problem
Finite measurements may leave multiple models consistent with the data, and existing uncertainty estimates do not establish whether a record supports a safe command under limited authority.
Source: §I · pp. 1–2Method
The framework bounds worst-case safety contributions from data-consistent models and combines that support with an actuator-error tube to characterize feasibility and select commands.
Source: §V · p. 8Results
Coverage was 1.03% for Dc, 32.09% for Du, and 76.27% for Ds; the exact-parameter benchmark covered 86.26% of the same queries.
Source: §IV · p. 7Takeaways & Limitations
Broader-flight measurement selection tightened certificates and increased coverage despite equal-sized, full-row-rank records.
Source: §V · p. 8The guarantee applies within the certification domain under the stated regularity and continuation conditions.
Source: §V · p. 8
Abstract
from arXiv · showhide
When the system model is not fully known, measurement error and limited excitation can leave several models consistent with the same finite data. A command judged safe for one model may fail for another, while limited control authority can prevent the corrective action needed to preserve safety. To ensure safety under model uncertainty and asymmetric input limits, we develop a finite-data certificate that determines whether a command can enforce a prescribed safety inequality. For a linearly parameterized safety channel with exactly known regressors and bounded aggregate residual error, we derive a support formula for the worst-case safety contribution of all data-consistent models. The formula identifies the regressor directions that admit a finite bound, allowing rank-deficient records to contribute to safety certification. Using certified componentwise bounds on actuator tracking error yields an affine inequality with a necessary and sufficient test for pointwise command feasibility. The affine inequality reduces computation of the closest certified command to a scalar root-finding problem. It also yields a closed-form gate that selects the largest certified fraction of a prescribed command segment. The proposed certificate guarantees output safety within its operating domain, provided the feedback is locally Lipschitz and the uncertainty bounds remain valid. Domain retention and full-state continuation extend this guarantee to all time. A vehicle study demonstrates that output safety can be certified from finite measurements in a safety-critical setting with model and actuator uncertainty.
I. INTRODUCTION
Existing safety methods rely on valid models or uncertainty bounds, while finite measurements and limited actuator authority leave open whether any command is safe for every consistent model. This section frames that gap and introduces a finite-data certificate with actuator-aware command-selection rules.
Related work
- Barrier filters and learned uncertainty methods address safety with models or uncertainty bounds, but do not establish finite-record sufficiency under limited authority [1],,,,,,,,,,.Data informativity and actuator-aware formulations address related parts of the problem,, –,,,,, [21]– [23].Source: §I · p. 1
Research gap
- A finite record must support a command satisfying the safety inequality for every data-consistent model and its error bound, despite limited control authority.Prediction accuracy or uncertainty quantification alone does not establish this finite-record sufficiency.Source: §I · pp. 1–2
Contributions
- The certificate identifies regressor directions with unbounded worst-case model contributions and quantifies the minimum residual-error budget for data consistency.It characterizes finite support without requiring full parameter identification.Source: §I · p. 2
- Actuator tracking error reduces certified authority by an additive reserve, yielding pointwise feasibility and recovering the static certificate when error bounds vanish.The reserve is subtracted from static finite-data authority.Source: §I · p. 2
- Command projection and an admission gate have sufficient conditions for local Lipschitz continuity, while a counterexample separates pointwise feasibility from existence of a continuous feedback selector.The vehicle validation also compares coverage across equal-sized records and static and exact-parameter benchmarks, checks closed-loop constraints, and refines the integration step.Source: §I · p. 2
II. PROBLEM FORMULATION
The formulation turns output constraints into a storage-function dissipation inequality and asks whether finite measurements and actuator-error bounds certify a command at each state and time. It specifies the model, data, and regularity conditions, then poses command selection within the certified set.
Output-safety formulation
- Logit coordinates map output limits to unbounded boundaries, and bounded storage keeps outputs strictly within their permitted intervals.The storage function is quadratic in transformed tracking error, with a positive-definite weight.Source: §II · p. 2
Uncertainty model
- The safety-channel mismatch uses known regressors, fixed unknown coefficients, and a bounded remainder; input-independent regressors make the command constraint affine.The remainder bound must hold in transformed coordinates throughout the certification domain, which may need restriction near output boundaries.Source: §II · pp. 2–3
Actuator model
- The actuator model uses a smooth saturation map and bounded tracking error to form a componentwise physical-input error set for the safety certificate.The bound must cover commanded motion as well as inner-loop disturbance, and maximizing over the error set may be conservative.Source: §II · p. 3
Finite-data model
- Residuals use the realized input, and aggregate remainder and measurement error define a bounded data-consistency set without requiring full regressor rank.Regressor errors require additional uncertainty information.Source: §II · p. 3
Certificate and informativity
- A certified command must satisfy the worst-case dissipation inequality over data and actuator uncertainty; pointwise informativity differs from a locally Lipschitz feedback selection over the operating domain.The latter regularity supports closed-loop existence and uniqueness analysis.Source: §II · pp. 3–4
Command selection and scope
- At feasible queries, the formulation seeks the certified command nearest a baseline and the largest certified fraction of a desired command, with all-time guarantees requiring full-state continuation.The trajectory guarantee applies while the state remains in the operating domain.Source: §II · p. 4
III. MAIN RESULTS
The main results characterize when finite measurements support a safety command despite model uncertainty and actuator error. They connect that feasibility test to command-selection rules and safety guarantees under stated regularity and continuation conditions.
III. MAIN RESULTS
- For in-span queries, the worst-case safety contribution equals the measured residual term plus χ_N||c||||β_N||; a nonzero out-of-span query has infinite support.The queried feature is expressed using measured features, and its representation norm determines amplification of residual uncertainty.Source: §III · p. 4
- Pointwise feasibility is decided by minimizing the affine command margin over the command set; the negative minimum measures remaining certified control authority.The set of certified commands is nonempty exactly when the stated feasibility condition holds at a query with finite margin.Source: §III · p. 4
- A locally Lipschitz certified feedback keeps the storage bounded and output and realized-input constraints satisfied; full-state continuation extends safety to all time.The all-time conclusion for Ω(t)=C(t) uses positive output gaps and the full-state continuation condition; uncertainty bounds must remain valid.Source: §III · pp. 4–5
- Actuator-error support acts as a reserve subtracted from static authority, and zero certified error bounds recover the static certificate.The reserve measures the reduction in certified authority due to the tracking-error bound.Source: §III · p. 5
- The closest certified command is a clipped baseline shifted along the input direction, with its multiplier found by solving a scalar equation.When the clipped baseline is infeasible, bisection can approximate a root, and the returned command must satisfy the margin with a certified sign.Source: §III · p. 5
- Pointwise informativity alone does not ensure a locally Lipschitz feedback selector, even when the robust inequality is feasible near zero.In the scalar example, incompatible one-sided input bounds preclude a continuous selector through zero.Source: §III · p. 5
IV. NUMERICAL RESULTS AND DISCUSSIONS
The study compares three equal-sized measurement records and evaluates finite-data, actuator-aware safety certification on sampled state–time queries. Certificate coverage improves with distributed, certificate-directed data, and a closed-loop simulation maintains the tracking constraints while respecting actuator limits.
Dataset construction
- Each record retained 40 measurements: Dc used the first 40 samples of one flight, Du spread samples across five flights, and Ds selected from 72 flights.The broader campaign supplied 7,272 samples, with Ds retaining at most two measurements per flight after acquiring feature directions and favoring underrepresented ones.Source: §IV · p. 6
Dataset comparison
- 76.27% of validation queries were certified for Ds, versus 32.09% for Du and 1.03% for Dc; the exact-parameter benchmark certified 86.26%.These percentages measure coverage of the sampled state–time set; the benchmark remains limited by command bounds, disturbance reserve, actuator tube, and storage inequality.Source: Figure 2 · p. 7, §IV · p. 7
Closed-loop performance
- In closed loop, both tracking errors entered [−0.2, 0.2] m by 3.05 s horizontally and 4.25 s vertically, then remained there for the simulation.The actuator-aware margin was nonpositive at every simulated command update, and maximum sampled storage was 0.7349.Source: Figure 3 · p. 7, §IV · pp. 7–8
Dataset comparison
- The finite-data excess was 0.1477 s−1 for Du and 0.0353 s−1 for Ds; distributed measurements and targeted selection reduced the uncertainty penalty.The query-feature representation and its amplification of residual uncertainty determine the penalty.Source: §IV · p. 7
Closed-loop performance
- Realized velocities stayed within physical limits, ranging approximately m/s horizontally and [−1.856, 1.044] m/s vertically.The uncertainty reserve accounts for velocity mismatch in the storage inequality, while the actuator map enforces physical input bounds.Source: §IV · p. 8
- The gate fully admitted the desired command from approximately 0.1 to 2.44 s, then approached zero as the desired endpoint violated the certificate.Halving the integration step preserved sampled feasibility and changed each settling time by 0.0025 s; displayed gate transitions do not establish continuity at zero-slack endpoints.Source: §IV · p. 8
V. CONCLUSIONS AND FUTURE WORK
The paper combines finite-data safety bounds with actuator-error certification to select safe commands under dynamic asymmetric actuation. Its vehicle study reports tighter certificates and increased coverage from broader-flight measurement selection.
- Measured regressor span identifies queries with finite support for nonzero safety functionals without prior parameter bounds.Source: §V · p. 8
- Combining data support with a certified actuator-error tube gives pointwise feasibility, a minimum-deviation command, and a maximal gate along a prescribed command segment.Source: §V · p. 8
- With equal-size, full-row-rank records, broader-flight measurement selection tightened certificates and increased coverage; sampled updates had nonpositive certificate margins while tracking and velocity bounds held.Source: §V · p. 8
- Within the certification domain, feedback preserved output and input constraints under the stated regularity and continuation conditions.Source: §V · p. 8
- Future work targets acquisition strategies balancing certificate improvement against sampling effort and augmented-state certificates that retain actuator dynamics to reduce conservatism.Source: §V · p. 8