{"id":"8edc64c7-cd82-4f61-b4c3-ca1bba8b2782","arxiv_id":"2501.13199","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A GPU-accelerated symbolic controller with formal safety guarantees was used to dock a scale-model vessel around static obstacles, validated in simulation and a towing tank.","lead":"This paper demonstrates a hierarchical control system that uses symbolic control to dock an autonomous marine vessel while avoiding obstacles, with safety checks synthesized in real time on a GPU. The authors validate it in simulation and in physical experiments with a scale-model tugboat, a first for this type of formal control approach.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The formal safety guarantee does not transfer to the physical vessel because the perfect velocity tracking assumption is unverified and the tracking error is not accounted for in the abstraction.","rationale":"The reader's weakest_assumption identifies the same fragile premise: the low-level velocity loop realizes any commanded velocity exactly and the kinematic model captures all behavior relevant to safety. This is precisely the point where the central claim is least secure. The abstraction guarantee from [18] is a mathematical statement about the kinematic model with velocity inputs; it says nothing about the closed-loop kinetic plant unless the low-level tracking is perfect or its error is bounded and included in the abstraction. The paper itself (Section V and Section VI) acknowledges the gap: it lists the perfect-tracking assumption as an assumption, and admits the tracking error was not formally accounted for. The reported MSE values, although small, are nonzero and no worst-case bound is derived. Therefore the formal safety guarantee for the physical docking maneuver does not follow from the theorem in Section III-A. I considered other potential concerns, such as the unusual liveness specification in Eq. (3) and the unreported abstraction parameters, but those are secondary: even if the abstraction were perfectly specified and the liveness property were standard, the idealization gap would remain the load-bearing obstruction. The concrete test I propose would settle the issue: by quantifying the worst-case tracking error and checking whether the abstraction can absorb it, the authors would either produce a genuine formal guarantee for the physical system or demonstrate that the current guarantee is only for an idealized model. Since the reader's verdict was already CONDITIONAL and this concern reinforces that conditionality without shifting the overall assessment, I do not recommend changing the verdict.","tokens_in":9227,"tokens_out":5863,"duration_ms":65372,"concrete_test":"Measure (or formally bound) the worst-case tracking error of the low-level loop over the entire command grid U1 at the vessel states encountered in the experiments, by issuing step commands in surge, sway, and yaw and recording the maximum deviation from the commanded velocity. Then add this worst-case error as a bounded disturbance w to the kinematic model (eta_dot = R(eta)nu + w) and re-run the pFaces/SCOTS symbolic synthesis with a disturbance-robust abstraction. If no winning controller can be synthesized with the measured error bound and the same obstacle margins, the formal safety guarantee does not transfer to the physical plant. If a controller does exist, it provides the missing rigorous link claimed in the paper.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that the hierarchical controller provides formal, correct-by-construction safety guarantees for autonomous docking. Section III-A proves (via the feedback refinement relation from [18]) that the symbolic controller is correct for the 3-DOF kinematic model (Eq. 1) with the desired velocity nu as input. However, the physical system is the closed loop of the kinetic plant (Eq. 2), PID controller, thrust allocation, and EKF. Section V states two explicit assumptions: (1) the low-level loop realizes any commanded velocity, and (2) the kinematic model captures all real-world behavior. Section VI concedes that the tracking error was not formally accounted for, reporting nu_MSE = [0.00768 m/s, 0.00431 m/s, 0.62108 deg/s]. Because no upper bound on tracking error is established, and no such bound is folded into the abstraction margins (the obstacle over-approximations O2 and target under-approximation T2), the refinement theorem does not connect the symbolic controller to the physical vessel. The ten successful laboratory trials are empirical evidence of favorable behavior, not a formal guarantee. The asserted safety property therefore holds only under idealizations that are unverified and quantifiably false; the formal guarantee claimed for the physical docking system is not established.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a hierarchical control architecture for autonomous docking of marine surface vessels. The upper-level controller uses symbolic control over a 3-DOF kinematic model (Eq. 1), synthesizing safe velocity commands in real time on a GPU; the lower level is a MIMO PID velocity controller with thrust allocation and an EKF. The authors claim formal, correct-by-construction safety guarantees via a feedback refinement relation from [18], and they validate the scheme in simulation and in ten physical trials with a scaled model vessel. The paper also presents a cost-based optimization over the synthesized safe action set and reports roughly 0.5-second re-synthesis times.","tokens_in":9451,"tokens_out":1981,"duration_ms":22951,"significance":"If the formal guarantee were fully established for the physical system, this would be a meaningful step toward practically deployable, verifiable autonomous docking: real-time symbolic synthesis on a physical vessel with static obstacles is genuinely novel in the marine control literature. The experimental demonstration, including ten successful docking runs, is a valuable contribution, and the use of GPU acceleration for re-synthesis addresses a well-known scalability bottleneck of symbolic control. The paper is also honest about several limitations, particularly the tracking-error issue in Section VI, which is commendable. However, the asserted safety guarantee currently holds rigorously only for the abstract kinematic model, not for the closed-loop physical vessel, and the abstraction parameters needed to check the refinement relation are not reported.","major_comments":[{"comment":"The formal guarantee for the physical vessel is not established as stated. Section V explicitly assumes that the low-level control system can realize any commanded velocity and that the kinematic model (Eq. 1) encompasses all real-world behavior, but Section VI reports nonzero tracking error (nu_MSE = [0.00768 m/s, 0.00431 m/s, 0.62108 deg/s]) and concedes that this error was not formally accounted for. Since the feedback refinement relation theorem from [18] applies to the kinematic plant (Eq. 1), not to the closed loop of the kinetic model (Eq. 2), PID controller, thrust allocation, and EKF, the abstraction-based safety guarantee does not transfer to the real vessel unless a verified bound on the tracking error is incorporated into the abstraction margins. The ten successful experiments are empirical evidence, not a formal proof. This is the load-bearing gap that must be addressed.","section":"Section V and Section VI"},{"comment":"The paper does not provide the abstraction parameters needed to verify that the feedback refinement relation from [18] actually holds for the vessel model (Eq. 1). In particular, the quantizer (grid size and type), the discrete input set, the sampling/update period, and the transition relation of the abstract system S2 are not specified. Without these details, a reader cannot check the hypotheses of Theorem III.5 of [18], nor reproduce the synthesis results. Please report these parameters explicitly, including how the 2-second update period relates to the abstraction sampling time and to the low-level settling time.","section":"Section III-A"},{"comment":"The obstacle over-approximation margins (O1_2, O2_2) and the target under-approximation margin (T2) are described qualitatively but never quantified. These margins are essential to the safety claim because they must absorb not only the vessel geometry but also any uncertainty in obstacle position and any unmodeled tracking error. Please provide the numerical values used in the experiments and state which physical effects each margin is intended to cover. If the margins were chosen only from preliminary observations, that should be stated explicitly and their effect on the guarantee assessed.","section":"Section III-A and Fig. 3"},{"comment":"The statement in Section VI that the tracking error could be handled by a continuous abstraction as in [23] is a proposal for future work, not an established property of the current system. As written, the claim in Section V that the synthesized velocity commands are 'theoretically guaranteed to maintain vessel safety' under the stated assumptions is conditional on assumptions that are quantifiably false in the experiments. Please either weaken the safety claim to apply only to the kinematic model, or extend the abstraction to include a verified bound on the low-level tracking error.","section":"Section IV-A and Section VI"}],"minor_comments":[{"comment":"The phrase 'for the first time' in the abstract and contributions is used for physical experiments of symbolic control on a scale model vessel; please clarify whether this refers to symbolic control for docking specifically, since the current wording is open to a broader interpretation.","section":"Abstract and Section I"},{"comment":"Equation (7) defines W_i conditionally on the sign of the forward velocity component, but the text says 'W is chosen conditionally based on the forward velocity component of the proposed control action, sigma_i_nu_x' without noting that the two branches of W_i are both used in the same experiment; please make this explicit.","section":"Section IV-E"},{"comment":"There is a typo in 'minium' (should be 'minimum') and in 're-sythesizes' (should be 're-synthesizes'). Also, 'apx.' is informal; consider writing 'approximately'.","section":"Section V"},{"comment":"The figure labels O1_1, O2_1, O1_2, O2_2, T1, T2 are hard to read in the printed version; please increase font sizes or use a legend that is legible after typesetting.","section":"Fig. 3 and Fig. 7"},{"comment":"Please define the notation nu_ref and nu_MSE at first use, and ensure that the units for yaw error are consistently stated (rad/s vs deg/s). Currently Section VI reports yaw MSE in deg/s while Section II defines angular velocities in rad/s.","section":"Section III-B"}],"recommendation":"major_revision","confidential_remarks":"The paper is a strong experimental demonstration of real-time symbolic control for docking, but the formal claim is currently overreaching relative to what is proven. I believe this can be fixed within the scope of the manuscript by either (a) explicitly limiting the formal guarantee to the kinematic model and describing the experiments as empirical validation, or (b) adding a verified bound on the low-level tracking error to the abstraction. The missing abstraction parameters and margins are also essential for reproducibility. I recommend major revision rather than rejection because the core real-time synthesis contribution is sound and the experimental results are valuable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"What should you know about this paper? It demonstrates that symbolic control can be resynthesized in real time (about 0.5 s on an A6000 GPU) and can actually drive a scale-model vessel through a docking maneuver — ten successful physical runs in a towing tank. That is a real step forward: prior work on symbolic control for ship docking did not combine real-time re-synthesis with physical experiments.\n\nThe paper is well organized and, to its credit, it does not hide its own limitations. Section V states two assumptions for the formal guarantee: the low-level loop realizes any commanded velocity, and the kinematic model captures all relevant behavior. Section VI then reports that the tracking error was not formally accounted for, with MSE values of 0.0077 m/s in surge, 0.0043 m/s in sway, and 0.62 deg/s in yaw. So a reader can see exactly where the gap is.\n\nThe soft spots are real, though. The formal safety guarantee is proven for the kinematic model (1), not for the closed-loop physical system. The leap from that model to the vessel is the unquantified tracking error. Ten successful trials are empirical evidence of favorable behavior, not a formal guarantee. The paper says \"we observed this to be true\" in simulation and experiments, but observation is not proof. More importantly, the abstraction parameters — quantizer, grid sizes, transition relation, obstacle margins — are not reported anywhere. That means the formal argument cannot be independently checked or reproduced. For a paper whose central selling point is correctness-by-construction, this is a meaningful omission.\n\nThe cost matrix W is hand-tuned and application specific. That is not a flaw by itself; the paper says so plainly. The citation pattern looks sound, and the authors cite their own prior work where it is genuinely relevant.\n\nBottom line: this is a credible engineering demonstration with an honest description of its limits, not a paper that establishes a formal guarantee for physical docking. It deserves a serious referee — a good reviewer will ask for the abstraction details and a careful distinction between the formal result for the kinematic model and the empirical results for the physical system. If those details are added, or the claims are reworded, this would be a solid contribution to the symbolic control and maritime autonomy communities. I would send it to peer review and request revision rather than desk reject it.","headline":"Real-time symbolic control is demonstrated on a physical vessel, and that is genuinely new; the formal guarantee, however, only covers the kinematic model, not the hardware.","tokens_in":10045,"tokens_out":2416,"would_cite":true,"duration_ms":25737,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A hierarchical symbolic controller docks a model vessel with formal safety guarantees.","keywords":["autonomous docking","symbolic control","formal safety guarantees","feedback refinement relation","real-time controller synthesis","GPU acceleration","marine surface vessel","dynamic positioning"],"falsifier":"Run a docking maneuver in the towing tank while logging commanded and realized velocities; if the measured tracking error ever exceeds the margin that the abstraction's obstacle over-approximation assumed, the vessel could be pushed outside the safe set, and the formal guarantee for the physical system would not follow.","tokens_in":9005,"feed_emoji":"🚢","tokens_out":5069,"duration_ms":46484,"temperature":0.7,"pith_summary":"The paper sets out to show that a hierarchical controller can give autonomous docking of a marine surface vessel genuinely formal safety guarantees, not just heuristic behavior. The key idea is to treat the vessel's desired surge, sway, and yaw velocities as control inputs, abstract the kinematic model into a finite symbolic system, and synthesize a controller on that abstraction that is then refined back to the real model. Because the abstraction over-approximates obstacles and under-approximates the target, any controller that solves the abstract problem guarantees that the real vessel avoids obstacles and reaches the docking target. The authors further claim that GPU-accelerated synthesis makes this feasible in real time, with re-synthesis taking about 0.5 seconds, and they support the claim with simulations and, for the first time, physical experiments on a scale-model vessel.","feed_headline":"GPU symbolic controller docks model vessel with safety proof","feed_subtitle":"Real-time re-synthesis every half-second steers a scale-model tug past obstacles to a docking target.","key_machinery":"The central object is the feedback refinement relation $Q$ between the plant $S_1$ (the kinematic model $\\dot{\\eta}=R(\\eta_\\psi)\\nu$) and a finite-state abstraction $S_2$. The relation ensures that every behavior of the plant is mirrored by a behavior of the abstraction, so safety synthesized on $S_2$ transfers to $S_1$. The synthesis itself is a standard graph search over the abstract states, accelerated by a GPU-based parallel kernel to run in about 0.5 seconds; a cost function $J(\\sigma_i)=\\beta(\\sigma_i)^\\top W_i\\beta(\\sigma_i)$ then selects the most practical action from the list of safe ones, favoring forward motion and smooth heading changes.","core_discovery":"The central claim is that the feedback refinement relation between the 3-DOF kinematic vessel model and a finite abstraction transfers safety from the abstract to the real system. If an abstract controller solves the abstract docking problem—avoid the over-approximated obstacles and reach the under-approximated target—then the refined controller solves the actual problem and returns a list of all safe control actions at every step. The paper demonstrates that this synthesis can be performed and repeated in real time on a GPU, and that the resulting controller successfully docks a scale-model vessel in a towing tank while avoiding static obstacles. The authors state the formal guarantee explicitly: under the assumptions that the low-level loop realizes any commanded velocity and the kinematic model covers all real-world behavior, the synthesized velocity commands maintain vessel safety by construction.","pith_inferences":["If the tracking-error bound were formally incorporated via a continuous abstraction, the same architecture could give guarantees for the closed-loop kinetic plant, not just the kinematic model.","The real-time synthesis rate could serve as a safety filter for other planning algorithms, checking their proposed velocity commands against the abstract safe set before execution.","Treating obstacle positions as additional state variables and re-synthesizing at the demonstrated rate would extend the approach to moving obstacles without changing the core machinery.","The performance of the scheme on full-scale vessels would depend on the accuracy of the kinematic model and on communication latency; the current experiments do not yet address those scales."],"forward_implications":["Any control action on the synthesized list is safe with respect to the obstacles, so the choice among them can be optimized without re-verification.","Re-synthesis every 0.5 seconds lets the controller adapt to a changing environment, such as moving obstacles or a shifted target.","The finite abstraction means the same synthesis procedure applies to larger and more complex docking regions, with computational cost shifted to the abstraction size.","Successful physical experiments indicate that symbolic control can leave the simulation domain and run on real hardware with modest onboard computation."],"supporting_citations":[{"why":"Supplies the feedback refinement relation theorem that transfers safety from the abstract controller to the refined controller.","marker":"[18]"},{"why":"Provides the symbolic controller synthesis tool used to compute the abstract controller.","marker":"[20]"},{"why":"Introduces the GPU-accelerated parallel synthesis kernel that makes real-time re-synthesis possible.","marker":"[21]"},{"why":"Earlier ship-docking abstraction work that motivates the hierarchical approach and proposes accounting for tracking error.","marker":"[23]"},{"why":"Defines the 3-DOF maneuvering model used as the plant's kinematic equation.","marker":"[26]"},{"why":"Supplies the standard search algorithm used to synthesize controllers over the finite abstraction.","marker":"[27]"},{"why":"Provides the simulation model and hydrodynamic coefficients used for simulated docking trials.","marker":"[32]"}],"fun_headline_variants":["GPU-accelerated symbolic controller docks vessel safely","Real-time re-synthesis guarantees safe docking","Symbolic method assures safe autonomous docking","Scale-model docking validated with formal safety","Formal abstraction steers ship to safe dock"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the vessel's low-level velocity controller can realize whatever surge, sway, and yaw velocity the symbolic controller commands, and that the kinematic model captures every behavior that matters for safety.","fun_headline_variants_meta":{"raw":{"variants":["GPU-accelerated symbolic controller docks vessel safely","Real-time re-synthesis guarantees safe docking","Symbolic method assures safe autonomous docking","Scale-model docking validated with formal safety","Formal abstraction steers ship to safe dock"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000841,"raw_usage":{"total_tokens":3583,"prompt_tokens":784,"completion_tokens":2799,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":400,"completion_tokens_details":{"reasoning_tokens":2733}},"tokens_in":400,"tokens_out":2799,"duration_ms":21107,"temperature":1.0,"reasoning_tokens":2733,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T16:21:55.456053+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a docking maneuver in the towing tank while logging commanded and realized velocities; if the measured tracking error ever exceeds the margin that the abstraction's obstacle over-approximation assumed, the vessel could be pushed outside the safe set, and the formal guarantee for the physical system would not follow.","supporting_citations":[{"cited_title":"Feedback refinement relations for the synthesis of symbolic controllers,","cited_arxiv_id":null,"evidence_quote":"Supplies the feedback refinement relation theorem that transfers safety from the abstract controller to the refined controller."},{"cited_title":"SCOTS: A tool for the synthesis of symbolic controllers,","cited_arxiv_id":null,"evidence_quote":"Provides the symbolic controller synthesis tool used to compute the abstract controller."},{"cited_title":"pFaces: An acceleration ecosystem for symbolic control,","cited_arxiv_id":null,"evidence_quote":"Introduces the GPU-accelerated parallel synthesis kernel that makes real-time re-synthesis possible."},{"cited_title":"Continuous and discrete abstractions for planning, applied to ship docking,","cited_arxiv_id":null,"evidence_quote":"Earlier ship-docking abstraction work that motivates the hierarchical approach and proposes accounting for tracking error."},{"cited_title":"Tabuada, Verification and Control of Hybrid Systems: A Symbolic Approach, 1st ed","cited_arxiv_id":null,"evidence_quote":"Supplies the standard search algorithm used to synthesize controllers over the finite abstraction."},{"cited_title":"Development of a DP system for CS Enterprise I with V oith Schneider thrusters,","cited_arxiv_id":null,"evidence_quote":"Provides the simulation model and hydrodynamic coefficients used for simulated docking trials."}],"review_version":1}