PaperlayerView exact revision on arXiv

Source-linked AI summary

Context-Conditioned Hamilton-Jacobi Reachability for Adaptive Safety Filtering

Ali Fuat Sahin, Yunus Yazoglu, John Talbot, Zeyuan Feng, James Dallas, Somil Bansal

arXiv:2610.08115v1eess.SYcs.ROcs.SY

TL;DR

The paper asks whether one safety certificate can represent a family of context-dependent reachability problems rather than requiring synthesis for every deployment condition. It learns a tube conditioned on geometry, friction, and disturbance scale, and reports transfer across tested geometries and operating conditions with containment on hardware and modest performance variation.

  • Problem

    A reachability certificate is tied to its specified dynamics and safety constraint, raising the question of whether one value function can represent multiple deployment contexts without re-synthesis.

    Source: §I · p. 1

  • Method

    The paper learns a backward reachable tube for an eight-state vehicle model conditioned on local boundary geometry, friction, and adversarial disturbance scale.

    Source: §I · p. 1

  • Results

    Across hardware certificates evaluated under a fixed racing-line tracker, lap time varied by 3.1%, while simulation transfer included held-out geometries and simultaneous geometry and grip shifts.

    Source: §VIII · p. 8

  • Takeaways & Limitations

    A single context-conditioned certificate transferred across deployment geometries and operating conditions without context-specific re-synthesis in the reported simulations and hardware evaluation.

    Source: §VIII · p. 8

    The certified property is lateral containment of the vehicle center of gravity, and full-scale evaluation covers only two skidpad geometries.

    Source: §VIII · p. 8

Abstract

from arXiv · show

Hamilton-Jacobi reachability constructs safety certificates for specified dynamics and safety constraints, tying each certificate to the deployment context for which it is synthesized. We ask whether a single certificate can instead represent a family of context-dependent safety problems and be queried across deployment conditions without re-synthesis. We learn a backward reachable tube for an eight-state vehicle model conditioned on local boundary geometry, friction coefficient, and adversarial disturbance scale. Geometry enters through an ego-frame boundary observation that defines the local containment constraint, while friction and disturbance scale enter as explicit operating-condition variables. This allows the same value function to be queried across friction coefficients from 0.4 to 2.0 and on geometries absent from synthesis. On 11 held-out evaluation geometries, the certificate maintains containment across the full tested friction range, including simultaneous geometry and grip shifts, while remaining within 1.2 percentage points in intervention rate and 0.09 m/s in speed of certificates re-synthesized with knowledge of the test geometry. We then deploy the certificate as a sampled discrete-time control barrier function filter on a full-scale vehicle near the handling limit. Lateral containment holds in every hardware session under both adversarial driving and autonomous racing, with 99th-percentile acceleration magnitude reaching 0.99 g. Across three certificates evaluated under a fixed autonomous racing controller, lap time varies by only 3.1%, demonstrating that a context-conditioned reachability certificate can transfer to deployment geometries absent from synthesis with modest performance cost.

I. INTRODUCTION

The paper asks whether one safety certificate can represent context-dependent reachability problems and transfer across deployment conditions. It conditions a learned reachable tube on geometry, friction, and disturbance scale, then evaluates its transfer in simulation and on a full-scale vehicle.

I. INTRODUCTION

  • Safety certificates are tied to deployment context because track geometry changes the admissible region and friction changes which vehicle states remain recoverable.This motivates asking whether one value function can represent a family of context-dependent problems.Source: §I · p. 1
  • The learned backward reachable tube conditions an eight-state vehicle model on local boundary geometry, friction, and adversarial disturbance scale, enabling queries on geometries absent from synthesis.Geometry is supplied as an ego-frame boundary observation.Source: §I · p. 1
  • One certificate maintains containment across tested contexts while staying close in intervention rate and speed to certificates specialized to the test condition.The filter is also deployed on a full-scale vehicle, with professional-driver and autonomous-racing trials.Source: §I · p. 2

II. RELATED WORK

  • Prior learned reachability methods can make high-dimensional reachable sets tractable, but learned value functions are approximations whose zero level sets are not certified safe sets.The paper reports containment empirically and treats formal verification as complementary.Source: §II · p. 2
  • The formulation jointly conditions on geometry that changes the safety constraint and friction and disturbance scale that change the recoverable envelope.This couples changes in the constraint and recoverable envelope in one learned representation.Source: §II · p. 2
  • Earlier model-adaptation and robustification approaches modify the model or barrier margin, whereas this work keeps one learned certificate and evaluates transfer against certificates re-synthesized for target conditions.The related-work discussion notes that modest grip or dynamics changes can alter recoverable states near the handling limit.Source: §II · p. 2

III. PROBLEM FORMULATION

The formulation treats each deployment context as a distinct safety problem, then represents the family with a context-conditioned value function. Its objective is to identify states from which the safety constraint cannot be maintained under worst-case disturbance.

A. Context-indexed safety problems

  • A context indexes safety problems whose environment structure and operating conditions can vary across deployments while remaining fixed over a reachability horizon.In shared-control racing, these include track geometry, boundary layout, available grip, and disturbance authority.Source: A. Context-indexed safety problems · p. 2
  • For each fixed context, the discrete-time dynamics are affine in control and adversarial disturbance.The disturbance can represent model uncertainty or external inputs to safeguard against, while context is not controlled or treated as adversarial.Source: A. Context-indexed safety problems · p. 2
  • The context specifies the particular safety problem; it is distinct from the adversarial disturbance that acts within that problem.The dynamics, control, and disturbance sets are compact.Source: A. Context-indexed safety problems · p. 2

B. Context-dependent safety specification

  • A context-dependent margin defines the failure set, and changing track geometry changes the lateral-containment constraint and the states from which containment is recoverable.Other state bounds are certificate domain limits, not part of the safety specification.Source: B. Context-dependent safety… · p. 2

C. Reachability objective for a fixed context

  • For a fixed context, the finite-horizon backward reachable tube describes states from which entry into the failure set cannot be avoided under worst-case disturbance.The zero sublevel set of the value function contains those states.Source: C. Reachability objective for a fixed… · p. 3
  • The value function follows a Bellman–Isaacs recursion with the context-dependent safety margin as its terminal condition.The recursion is stated for the fixed-context reachability objective.Source: C. Reachability objective for a fixed… · p. 3

D. Problem statement

The problem is to construct a runtime filter that adapts a minimally modified nominal input to a queried safety context. For shared-control racing, context includes track geometry and grip-related operating conditions.

D. Problem statement

  • For a queried context and arbitrary nominal input, the filter applies an admissible input minimally modified from the nominal input while remaining consistent with the context’s safety certificate.The problem is posed for a family of context-indexed dynamics and safety constraints.Source: D. Problem statement · p. 3
  • The filtering framework must adapt both to track geometry, which changes the safety constraint, and grip, which changes the vehicle’s recoverable envelope.The same filtering framework is intended to address both forms of context variation.Source: D. Problem statement · p. 3

A. State, control, and context

  • The vehicle is represented in a Frenet frame attached to a track centerline, with half-width and curvature profiles read from track-indexed lookup tables.Geometric quantities are referenced to the vehicle center of gravity.Source: A. State, control, and context · p. 3
  • The eight-state vehicle representation includes position, heading, velocity, yaw, sideslip, steering angle, and commanded longitudinal force; control inputs are steering and force rates.Using rates includes actuator bandwidth in the safety problem rather than treating it as unmodeled lag.Source: A. State, control, and context · p. 3
  • The context includes track index, assumed friction coefficient, and disturbance scale, representing geometry, available tire force, and robustness budget, respectively.The track library covers 38 closed circuits spanning three geometry families.Source: A. State, control, and context · p. 3, Table I · p. 3

B. Vehicle dynamics

The vehicle model combines lateral and yaw-related dynamics with actuator-rate inputs and scaled disturbances. Its tire model makes friction an explicit determinant of available lateral force and recoverable safety.

B. Vehicle dynamics

  • The continuous-time dynamics define course angle as heading error plus sideslip and use track-indexed curvature in the model.The state dynamics include lateral motion, yaw rate, heading error, and sideslip.Source: B. Vehicle dynamics · p. 3
  • Steering and commanded longitudinal force evolve through rate inputs, while a two-dimensional disturbance has authority scaled by the disturbance parameter.The disturbance acts on yaw and lateral velocity; the latter perturbation scales with speed magnitude plus one.Source: B. Vehicle dynamics · p. 3

C. Tire model and grip context

  • Axle forces use a nonlinear brush tire model with longitudinal load transfer and coupling between longitudinal and lateral tire forces.The cited tire model is.Source: C. Tire model and grip context · p. 3
  • The friction coefficient directly modulates lateral tire-force capacity and therefore the vehicle dynamics and recoverable safe set.The tire-force capacity relation uses ζ = 0.99 to promote numerical stability.Source: C. Tire model and grip context · p. 3

D. Track context and failure set

The safety constraint varies with track geometry, while friction and disturbance conditions define which states remain recoverable. A single context-conditioned value function can query a corresponding safety envelope while holding context fixed over each reachability rollout.

D. Track context and failure set

  • Safety is lateral containment between track boundaries, measured by distance from the vehicle’s center of gravity to the nearest boundary without vehicle-footprint inflation.State, input, and context bounds are read from the deployed configuration.Source: D. Track context and failure set · p. 3, Table II · p. 4

A. Context-conditioned reachable tube

  • A single value function approximates a family of reachability problems by augmenting the state with deployment context held fixed during each rollout.The queried context determines the safety envelope for the corresponding geometry, grip, and disturbance assumption.Source: A. Context-conditioned reachable tube · p. 4
  • The value function uses local boundary geometry rather than a track index, so its safety envelope can adapt to the queried layout.The safety specification depends on track half-width, and the library spans 38 circuits across three geometry families.Source: D. Track context and failure set · p. 3, A. Context-conditioned reachable tube · p. 4

B. Observation map and architecture

The method represents track geometry with an ego-frame boundary observation and synthesizes a context-conditioned reachability certificate. At runtime, a sampled control barrier filter uses that certificate to select a safe input or a recovery action.

B. Observation map and architecture

  • Track geometry enters through ego-frame boundary polylines sampled at 1 m intervals over a 254 m lookahead and encoded into a 64-dimensional feature.The feature is concatenated with remaining inputs and curriculum time.Source: B. Observation map and architecture · p. 4

C. Reachability synthesis

  • A gradient-free discrete-time solver propagates the Bellman–Isaacs recursion backward over a 12 s horizon sampled at 0.05 s.Training samples span the track library and specified friction and disturbance ranges.Source: C. Reachability synthesis · p. 4

D. Online safety filter

  • At runtime, the filter tests 129 candidate controls against a discrete-time barrier decrease condition and applies the closest admissible input.If needed, its fallback is a co-trained recovery policy that shares the observation encoder and emits bang-bang actions.Source: D. Online safety filter · p. 4

VI. SIMULATION STUDY

The simulation study evaluates whether one context-conditioned certificate can replace certificates synthesized for individual track and grip conditions. Grip-query mismatch can cause violations, with the risk depending on the true grip and the direction of mismatch.

A. Simulation Setup

B. The cost of querying the wrong grip

  • At µ0 = 0.92, querying grip 0.20 too low or high raises violations to 40% or 43%, respectively; at mismatch magnitude 0.30, violations reach roughly 90% in both directions.Figure 2 maps plant grip against queried grip, with violations on the left and intervention rate on the right.Source: B. The cost of querying the wrong grip · p. 5, Figure 2 · p. 5
  • Intervention falls from 92% at the most pessimistic grip query to 60% at the most optimistic, while either direction can ultimately lose containment.Optimistic queries understate risk; pessimistic commands can also cause containment loss at large mismatch.Source: B. The cost of querying the wrong grip · p. 5
  • At µtrue = 0.72, querying 0.92 produces 73% violations, compared with 17% when querying 0.52.The more consequential mismatch in this low-grip case is overestimating friction.Source: B. The cost of querying the wrong grip · p. 5

C. Generalization across geometry

The certificate transfers across held-out geometries and conditioned grip values, with modest performance costs relative to context-specialized references. Geometry is evaluated on unseen layouts, while the grip sweep isolates changes in friction.

C. Generalization across geometry

  • On unseen geometries, OURS removes all violations and stays within 0.1 percentage points in intervention and 0.09 m/s in speed of the geometry-specialized ONETRACK reference.The comparison uses 11 held-out tracks at µq = µtrue = 0.92.Source: C. Generalization across geometry · p. 5

D. Generalization across grip

  • The grip comparison holds geometry within the training library, isolating grip as the shifted condition.NOMINALGRIP incurs violations away from its synthesis grip, whereas OURS maintains zero violations across the conditioned range.Source: D. Generalization across grip · pp. 5–6
  • Across the conditioned grip range, OURS has zero violations and matches the grip-specialized ONEGRIP in containment.The Table IV caption specifies matched plant and queried grip across 11 training geometries, with 30 trials per cell.Source: D. Generalization across grip · p. 6, Table IV · p. 6
  • Across the grip sweep, OURS intervenes 0.7 to 2.2 percentage points more often and runs 0.7% to 2% slower than ONEGRIP.The specialist recovers only a small amount of additional performance.Source: D. Generalization across grip · p. 6

E. Simultaneous geometry and grip shift

The certificate maintained containment across held-out geometries and grip values, including simultaneous shifts, with performance close to geometry-specialized references. The hardware tests used a full-scale vehicle on a dry skidpad, with separate training-geometry configurations and adversarial driving.

E. Simultaneous geometry and grip shift

  • Across all 11 held-out geometries and tested grip values, OURS maintained containment and stayed within 1.2 intervention points and 0.09 m/s of ONETRACK.The comparison used µq = µtrue, sd = 0.5, and 30 trials per cell; only NOFILTER and NOMINALGRIP incurred violations.Source: Table V · p. 6, E. Simultaneous geometry and grip shift · p. 6

1) Vehicle, site, and surface:

2) Track library and conditions:

  • IND included the deployment geometry, OOD excluded it, and FINETUNED adapted OOD using deployment-geometry data; model, horizon, and filter stayed identical.Source: 2) Track library and conditions · p. 6

B. Adversarial Driving with Safety Filtering

1) Operating regime:

On hardware, containment held across the tested queried-grip values, while intervention-cost trends were obscured by run-to-run variability. The filter operated near the handling limit and frequently modified the driver’s steering, with intervention rates remaining high across curvature bins.

1) Operating regime:

  • The 99th-percentile acceleration magnitude reached 0.99 g, while 99.9th-percentile sideslip stayed below 6.6° in sessions with clean β estimation.Source: 1) Operating regime · pp. 6–7

2) Where the filter engages:

  • The filter modified the driver’s command 84.1% of the time in one sustained override, reversing steering more often than merely attenuating it near the boundary.Near low Vθ, intervention reached 99%; across curvature bins, intervention remained between 81% and 94%.Source: 2) Where the filter engages · p. 7

3) Behavior across queried grip:

  • Containment held at every tested queried grip, including runs beyond the µ0 = 0.92 model-implied envelope; hardware tests covered the interior of the simulated robustness band.The first simulated failures occurred at the untested queried values µq = 0.72 and µq = 1.12.Source: 3) Behavior across queried grip · p. 7
  • Run-to-run variability dominated intervention-cost changes: consecutive drives at µq = 0.85 differed by 23 percentage points, so hardware established containment rather than an intervention-cost trend.Source: 3) Behavior across queried grip · p. 7

C. Safety Filtering on an Autonomous Racing Controller

The autonomous-racing evaluation measures the performance cost of deploying a held-out certificate, alongside containment and model-mismatch results. Across the hardware tests, lap-time variation remained modest, while the evidence is bounded by the tested skidpad geometries and grip range.

C. Safety Filtering on an Autonomous Racing Controller

1) Two geometries, three certificates:

  • On the bean, held-out versus in-distribution mean lap time differed by 0.08 s, mean speed by 0.09 m/s, and intervention by 0.1 percentage points.On the oval, the three certificates spanned 3.1% in mean lap time, and OOD reached the highest peak speed at 18.43 m/s.Source: 1) Two geometries, three certificates · p. 8
  • The measured acceleration envelope mismatched the certificate model: it overpredicted across much of the range but underpredicted near the handling limit, with the largest gap near the loaded lateral direction.Maximum directional gaps were 3.22 m/s2 for FINETUNED, 2.91 m/s2 for OOD, and 1.92 m/s2 for IND.Source: 1) Two geometries, three certificates · p. 8

VIII. CONCLUSION

  • Hardware lateral containment held in every session, including professional-driver trials that deliberately attempted to leave the corridor.The evaluation also included autonomous racing near the friction limit.Source: §VIII · p. 8
  • 3.1%: lap time varied across certificates over ten autonomous laps, while held-out and in-distribution certificates produced comparable performance on both hardware geometries.The certificates were trained on in-distribution, held-out, and fine-tuned geometry sets.Source: §VIII · p. 8
  • The certified property is lateral containment of the vehicle center of gravity, and full-scale evaluation covered only an oval and a bean-shaped course.The hardware results are deployment validation, not evidence of transfer across all track families.Source: §VIII · p. 8
  • Hardware grip-mismatch tests covered only an interior range; the first simulation failures occurred at the next mismatch levels, which were not tested on the vehicle.The authors identify lower-grip surfaces and diverse full-scale geometries as needed for more complete characterization.Source: §VIII · p. 8
Loading 2610.08115v1…