Safety-Critical Control for Discrete-time Stochastic Systems with Flexible Safe Bounds using Affine and Quadratic Control Barrier Functions

Kenta Hoshino; Sotaro Fushimi; Yuki Nishimura

REVIEW 3 major objections 3 minor 17 references

Safety-Critical Control for Discrete-time Stochastic Systems with Flexible Safe Bounds using Affine and Quadratic Control Barrier Functions

T0 review · 3 major / 3 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read By pairing a control barrier function with a flexible auxiliary function, this paper derives a supermartingale certificate that yields tighter finite-horizon exit-probability bounds for discrete-time stochastic systems with Gaussian…

desk verdict A sound Ville-based safety framework with a genuinely new exponential-Phi construction for unbounded affine and quadratic CBFs, but the numerical sections assert global feasibility without proof and need revision. read the letter →

arxiv 2501.09324 v1 pith:A27RM5WV submitted 2025-01-16 eess.SY cs.SY

Sotaro Fushimi , Kenta Hoshino , Yuki Nishimura This is my paper · ORCID

classification eess.SYcs.SY

keywords controlbarrierfunctionsstochasticsafetydiscrete-timesystemssupermartingaleVille'sinequalityexitprobabilityquadraticGaussiannoise

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper establishes a unified sufficient condition for a discrete-time stochastic control system with Gaussian disturbances to stay inside a prescribed safe set with high probability over a finite horizon. The condition pairs a control barrier function h with a flexible auxiliary function Φ, requiring that Φ(h) form a supermartingale along the closed-loop trajectory. When the condition holds, the K-step exit probability is bounded by Φ(h(x0),0) divided by the minimum of Φ(0,k) over the horizon. The paper shows this generalizes earlier linear bounds and specializes to closed-form conditions for affine and quadratic barrier functions, including unbounded safe sets such as obstacle avoidance. The practical payoff is a safety filter that yields tighter probabilistic safety guarantees than existing methods while remaining computable as a, often convex, optimization problem.

What carries the argument

The load-bearing object is the auxiliary function Φ(h,k), which is nonnegative and decreasing in h. It converts the control barrier function condition into a supermartingale certificate: inequality (13) is exactly the requirement that Φ(h(x_{k∧τ}), k∧τ) is a nonnegative supermartingale. Ville's inequality then turns the supermartingale into a probability tail bound. The exponential choice Φ(h,k)=exp(-h)+(K-k)β for quadratic h makes the conditional expectation in (13) computable in closed form through a Gaussian integral, giving the explicit feasibility condition (29) and bound (33). The scaling trick h↦ah, a≥1, tightens the bound without changing the safe set.

What would settle it

Take the inverted-pendulum or obstacle-avoidance example and test the safety filter at a grid of states inside the safe set, including states far from the origin; if any state has no feasible control or if a Monte-Carlo run with many more than 500 trials exits more often than the claimed bound, the central guarantee fails.

Watch

Extended reading notes

Core claim

The central claim is Theorem 6: if there exists a control satisfying the supermartingale-like inequality E[Φ(h(F(x,u)+w_k),k+1)|F_k] ≤ Φ(h(x),k) for every state in the safe set, then the probability that the trajectory exits C within K steps is at most Φ(h(x0),0)/min_{0≤k≤K} Φ(0,k). The proof applies the supermartingale tail bound of Ville's inequality to the stopped process Φ(h(x_{k∧τ}), k∧τ). This one bound unifies and improves earlier results: linear choices of Φ give the known affine bounds, while a careful choice of Φ tightens the exit probability substantially. For quadratic CBFs h(x)=xᵀAx+bᵀx+c with Λ=1/$2Σ^{{-1}}$+A positive definite, Theorem 11 shows that Φ(h,k)=exp(-h)+(K-k)β works, producing the explicit bound exp(-h(x0))+Kβ and reducing the safety condition to a tractable inequality involving a Gaussian integral completion. The result extends to unbounded safe sets, which previous bounded-barrier approaches could not handle.

Load-bearing premise

The whole guarantee rests on the assumption that at every state inside the safe set and every time step there exists a control satisfying the supermartingale inequality; the paper only verifies this at selected points and asserts it holds throughout the safe set.

Editorial extensions

If this is right

The exponential auxiliary function gives finite-horizon probabilistic safety certificates for unbounded safe sets, such as obstacle avoidance with quadratic CBFs, where bounded-barrier methods cannot apply.
The bound (33) is tighter than the linear bound of Theorem 4; in the inverted-pendulum example the 100-step exit-probability bound drops from about 21.1% to about 0.10%.
When the barrier is concave and the auxiliary function is convex, the safety-filter optimization is convex, so the filter can be implemented online with standard convex solvers.
Multiple CBFs can be combined via Boole's inequality, allowing the same framework to certify safety in environments with several obstacles.
The scaling parameter a provides a direct trade-off between the tightness of the probability bound and the size of the feasible control set.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The same supermartingale argument should extend to sub-Gaussian or bounded noise, since only the moment-generating behavior of the disturbance matters; the Gaussian assumption is used for the closed-form integral but not for the martingale structure.
The scaling parameter a is a free design knob that could be optimized online to adapt safety margin to the current state, though the paper does not explore this.
Because the bound (14) only requires Φ nonnegative and decreasing, other families of Φ, such as polynomial or piecewise-exponential, might yield even tighter bounds while preserving convexity of the safety filter.
The feasibility check at selected points, rather than over all of C, is the main gap between the theorem's assumptions and its numerical practice; a region-based verification would close it.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The core theoretical result here is solid and worth engaging with. Theorem 6 is a clean restatement of Ville's inequality as a safety certificate: if you can find any auxiliary function Phi that makes E[Phi(h(x_{k+1}),k+1)|F_k] <= Phi(h(x_k),k), then the K-step exit probability is bounded by Phi(h(x0),0)/min_k Phi(0,k). That is not new in itself, but it unifies the linear bounds of Theorem 4 and provides the right framework for what is new: the exponential construction Phi = exp(-h) + (K-k)beta in Theorem 11, which works for unbounded affine and quadratic h under Gaussian noise. The Gaussian integral computation is correct as far as I checked, and the structural condition Lambda = 0.5 Sigma^{-1} + A > 0 is stated honestly. Proposition 8 for polynomial bounded CBFs is also a reasonable extension of Santoyo et al., and Remark 13 rightly concedes that the bounded quadratic case reduces to Steinhardt and Tedrake. The paper gives credit where prior work is due.

The soft spots are real but not fatal to the theory. The main issue is that the numerical examples assert global feasibility of the CBF condition without proof. Section 5.2 says a choice of (a,beta) that works at x=0 works 'consequently for all x in C' — that inference is unjustified for a nonlinear inverted-pendulum model. The same gap appears in the obstacle-avoidance example, where the optimization is non-convex. If at any reachable state no u satisfies the supermartingale inequality, the safety filter has no solution and the stated exit-probability bound does not apply to the closed loop. This is a standard issue in CBF papers, but here it undermines the applied claim that the filters achieve the computed bounds. Second, there is a sign error in Eq (40): the log term should be -log(exp(-ax)+beta), not +log(...). The simulations may have used the correct form, but as written the condition is wrong. Third, the proof of Theorem 6 has a quantifier typo in A1: 'for 0<=k<=K' should be 'there exists k'. Minor, but should be fixed.

Who is this for? People working on stochastic safety filters and discrete-time CBFs will find Theorem 11 useful and the comparison of bounds instructive. The paper deserves a serious referee: the mathematical framework is significant enough, and the probabilistic bound is a genuine tool. I would send it to peer review with a request for major revision on the feasibility question and the sign typo. The central argument holds up; the examples need to either prove feasibility on a verified subset of C or soften the claims to match what is actually demonstrated.

Referee Report

3 major / 3 minor

Summary. The paper studies discrete-time stochastic systems with additive Gaussian noise and proposes a CBF-based safety-filter synthesis with finite-horizon exit-probability bounds. The main result, Theorem 6, states that if an auxiliary function Φ is decreasing in the barrier h and satisfies the supermartingale condition (13) for every x in the safe set and k<K, then the K-step exit probability is bounded by Φ(h(x0),0)/min_{0≤k≤K}Φ(0,k). The proof uses Ville's inequality on the stopped process. The paper then specializes Φ to polynomial functions for bounded h (Proposition 8) and to exponential functions for unbounded quadratic h (Theorem 11), with closed-form Gaussian expectations. Numerical examples cover affine, inverted-pendulum, and obstacle-avoidance problems. The central theoretical result is conditional on the existence of a feasible control at every reachable state, and the numerical sections attempt to verify this by design choices and simulations.

Significance. If the existence conditions are met, Theorem 6 is a clean unification of supermartingale-based safety certificates and can yield tighter bounds than the linear bounds of Theorem 4; the extension to unbounded quadratic barriers in Theorem 11 is a useful contribution beyond prior bounded-barrier results. The manuscript gives explicit closed-form Gaussian integral computations and clearly identifies the structural restriction Λ>0. The main weakness is that the numerical sections assert global feasibility of the CBF constraint on the basis of local checks, and two displayed equations in the examples contain algebraic errors; these need to be fixed before the applied claims are fully supported.

major comments (3)

[§5.2, Eq. (47)] The statement that the chosen parameters a=10 and β=10^{-5} 'ensure the feasibility of (47) for the case x=0 and F(x,u)=0, and consequently for all x∈C' is not justified. Feasibility at a single point does not imply feasibility at every point of the safe set; the right-hand side of (47) varies with h(x) and the left-hand side depends on F(x,u) through the nonlinear pendulum dynamics. Since Corollary 7 requires the constraint (13) to have a solution at every reachable state before the stopping time, the safety bound (48) is not established for the closed-loop system unless global feasibility is proven or verified systematically (e.g., by SOS or a rigorous global-optimization argument). The same concern applies to the non-convex obstacle-avoidance example in §5.3, where local solutions of (23) do not constitute a global existence certificate.
[§5.1, Eq. (40); §5.2, Eq. (47)] Eq. (40) contains a sign error. From (36) with h replaced by ah, the correct condition is a(x+uΔt) ≥ -log(exp(-ax)+β) + (a²/2)σ²Δt. The printed expression uses log(exp(-ax)+β) without the minus sign, which is inconsistent with Theorem 11 and changes the feasible set. Additionally, in Eq. (47) the term involving (1/2Σ^{-1}+aA) appears to be missing the inverse required by (30); as written it is not the Θ term of Theorem 11. Both displayed equations should be corrected and the simulations re-verified.
[Theorem 6, Eq. (16)] The set A1 is defined with 'for 0≤k≤K', which would require the inequality to hold at every time. The exit event {min_{0≤k≤K} h(x_k)<0} only implies the existence of at least one k with Φ(h(x_k),k)>Φ(0,k). The equality in (15) is therefore false as written. Replace 'for' with 'for some' or an existential quantifier, and adjust the A1⊂A2 argument accordingly.

minor comments (3)

[§5.3, Fig. 3 and Fig. 4 captions] The captions state 'using Theorem 6', but the examples actually apply the quadratic CBF condition of Theorem 11; the captions should be updated to reflect the theorem used.
[§5.3] The word 'hyperbora' should be 'hyperbola'.
[General] The paper would benefit from a statement on whether simulation code or scripts are available for reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: Theorem 6 is a direct application of Ville's inequality to an assumed supermartingale; parameter choices are design decisions, not fitted predictions.

full rationale

The paper's central result, Theorem 6, is not circular: it takes the CBF condition (13) as an assumption and derives a K-step exit-probability bound by applying Ville's inequality to the nonnegative supermartingale Phi(h(x_{k∧tau}), k∧tau). The bound (14) is a logical consequence of that assumption plus Ville's inequality, which is cited as an external result from Ville (1939). The auxiliary-function conditions (13), (24), and (29) are sufficient conditions imposed on the controller, not quantities fitted to the exit probabilities they bound. The scalar parameters a and beta in the numerical examples are user-chosen design parameters, not estimated from data, and the reported probabilities are analytic upper bounds evaluated with those parameters rather than predictions fitted to simulation outcomes. The paper's self-citations (Hoshino et al. 2023; Nishimura and Hoshino 2024) appear only in the conclusion as future-work pointers and are not load-bearing. The proof does contain a quantifier typo in the definition of event A1 ('for 0 ≤ k ≤ K' should be 'there exists k'), and the numerical examples assert global feasibility of the CBF condition from feasibility at the origin without proof; these are correctness and rigor concerns, not circularity. Because the derivation chain from assumption to bound is explicit and the assumptions are not equivalent by construction to the conclusions, the paper exhibits no significant circularity.

Assumptions & free parameters 4 free parameters · 6 assumptions · 0 invented entities

The derivation rests on standard martingale theory and Ville's inequality. The main additional assumptions are structural: control-affine dynamics with additive Gaussian noise, a continuous barrier, and, for Theorem 11, positive-definiteness of Lambda. The numerical examples introduce hand-chosen scaling and slack parameters a and beta that modulate the tightness of the reported bounds. No new physical entities are postulated.

free parameters (4)

a (barrier scaling) = 50 (Sec 5.1), 10 (Sec 5.2), 20 (Sec 5.3)
Positive scalar multiplying the CBF h; larger a gives tighter probabilistic bounds but tightens the feasibility constraint. Chosen by hand for each example.
beta (supermartingale slack) = 1e-4 (Sec 5.1), 1e-5 (Sec 5.2), 1e-4 (Sec 5.3 single), 1e-5 (Sec 5.3 multiple)
Slack in the supermartingale condition; affects the value of the exit probability bound. Chosen to ensure feasibility at the origin.
alpha (Theorem 4 comparison) = 1 + tr(A Sigma)
Used to instantiate the comparison baseline in Section 5.2; set to the largest value preserving feasibility, yielding the tightest bound from Theorem 4.
beta for Proposition 8 = Tr((A Sigma)^2) + (Tr(A Sigma))^2
Slack in Eq (24); chosen to guarantee feasibility for all x in the safe set in the inverted pendulum example.

assumptions (6)

domain assumption The system is control-affine with additive Gaussian noise, and the disturbance is independent of the current filtration.
This is the system model in Eq (4); the Gaussian assumption is used explicitly in Theorem 11 for closed-form expectation computation.
standard math Ville's inequality holds for nonnegative supermartingales.
The main probabilistic bound (Theorem 6) is derived by applying Lemma 2, which is the classical Ville inequality from 1939.
domain assumption In Theorem 11, Lambda = (1/2) Sigma^{-1} + A is positive definite.
This condition is stated in Theorem 11 and is required for the Gaussian integral to converge and for det(I + 2 Sigma A) > 0.
domain assumption In Corollary 12, N = A - A Lambda^{-1} A is negative semidefinite for convexity of the optimization.
This condition is introduced in Corollary 12 to guarantee that constraint (29) is convex in u.
domain assumption The safe set is described by a continuous function h as C = {x : h(x) >= 0}.
This is the standard CBF safe-set representation used throughout the paper, stated in Eq (6).
domain assumption The controller is adapted to the filtration F_k.
This measurability assumption is used in the proof of Theorem 11 to move conditional expectations outside the nonlinearity.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Safety-Critical Control for Discrete-time Stochastic Systems with Flexible Safe Bounds using Affine and Quadratic Control Barrier Functions." pith.science (2026). https://pith.science/paper/A27RM5WV

@misc{pith2026250109324,
  author       = {Pith},
  title        = {Pith review of: Safety-Critical Control for Discrete-time Stochastic Systems with Flexible Safe Bounds using Affine and Quadratic Control Barrier Functions},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/A27RM5WV}},
  note         = {Machine review of arXiv:2501.09324}
}

read the original abstract

This paper presents a safe controller synthesis of discrete-time stochastic systems using Control Barrier Functions (CBFs). The proposed condition allows the design of a safe controller synthesis that ensures system safety while avoiding the conservative bounds of safe probabilities. In particular, this study focuses on the design of CBFs that provide flexibility in the choice of functions to obtain tighter bounds on the safe probabilities. Numerical examples demonstrate the effectiveness of the approach.

Figures

Figures reproduced from arXiv: 2501.09324 by the authors.

**Figure 2.** Safe control of an inverted pendulum using different [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

**Figure 4.** The upperbound for P(x0, 300) under this condition is approximately 0.30%. It can be observed that the system remains inside the safe region for all trials, showing the efficacy of our proposed method [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: Safe control of a single integrator model using [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

17 extracted references · 15 canonical work pages

[1]

and Sreenath, K

Agrawal, A. and Sreenath, K. (2017). Discrete control barrier functions for safety-critical control of discrete systems with application to bipedal robot navigation. In Robotics: Science and Systems , volume 13, 1–10

work page 2017
[2]

Sreenath, K., and Tabuada, P. (2019). Control barrier functions: Theory and applications. In 2019 18th Euro- pean control conference (ECC) , 3420–3431. IEEE

work page 2019
[3]

Panagou, D. (2023). Safety under uncertainty: Tight bounds with risk-aware control barrier functions. In 2023 IEEE International Conference on Robotics and Automation (ICRA) , 12686–12692. IEEE

work page 2023
[4]

Cosner, R.K., Culbertson, P., and Ames, A.D. (2024). Bounding stochastic safety: Leveraging freedman’s in- equality with discrete-time control barrier functions. IEEE Control Systems Letters

work page 2024
[5]

Cosner, R.K., Culbertson, P., Taylor, A.J., and Ames, A.D. (2023). Robust safety under stochastic uncertainty with discrete-time control barrier functions. arXiv preprint arXiv:2302.07469

arXiv 2023
[6]

Hoshino, K., Wang, Z., and Nakahira, Y. (2023). Scal- able long-term safety certiﬁcate for large-scale systems. IEEE Control Systems Letters , 7, 1285–1290

work page 2023
[7]

Kushner, H. (1966). Finite time stochastic stability and the analysis of tracking systems. IEEE Transactions on Automatic Control, 11(2), 219–227

work page 1966
[8]

Kushner, H.J. (1967). Stochastic stability and control

work page 1967

Show all 17 references

[9]

Liu, Z., Jafarpour, S., and Chen, Y. (2024). Safety ver- iﬁcation of stochastic systems: A set-erosion approach. IEEE Control Systems Letters

2024
[10]

and Hoshino, K

Nishimura, Y. and Hoshino, K. (2024). Control barrier functions for stochastic systems and safety-critical con- trol designs. IEEE Transactions on Automatic Control

2024
[11]

Prajna, S., Jadbabaie, A., and Pappas, G.J. (2007). A framework for worst-case and stochastic safety veriﬁca- tion using barrier certiﬁcates. IEEE Transactions on Automatic Control, 52(8), 1415–1428

2007
[12]

Santoyo, C., Dutreix, M., and Coogan, S. (2021). A bar- rier function approach to ﬁnite-time stochastic system veriﬁcation and control. Automatica, 125, 109439

2021
[13]

Tokumaru, P., and Ames, A. (2021). Comparative anal- ysis of control barrier functions and artiﬁcial potential ﬁelds for obstacle avoidance. In 2021 IEEE/RSJ Inter- national Conference on Intelligent Robots and Systems (IROS), 8129–8136. IEEE

2021
[14]

So, O., Clark, A., and Fan, C. (2023). Almost-sure safety guarantees of stochastic zero-control barrier functions do not hold. arXiv preprint arXiv:2312.02430

2023 arXiv
[15]

and Tedrake, R

Steinhardt, J. and Tedrake, R. (2012). Finite-time regional veriﬁcation of stochastic non-linear systems. The Inter- national Journal of Robotics Research , 31(7), 901–923

2012
[16]

Ville, J. (1939). Etude critique de la notion de collectif

1939
[17]

Zikelic, D., Lechner, M., Henzinger, T.A., and Chatterjee, K. (2023). Learning control policies for stochastic sys- tems with reach-avoid guarantees. In Proceedings of the AAAI Conference on Artiﬁcial Intelligence , volume 37, 11926–11935

2023

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [1]

and Sreenath, K

Agrawal, A. and Sreenath, K. (2017). Discrete control barrier functions for safety-critical control of discrete systems with application to bipedal robot navigation. In Robotics: Science and Systems , volume 13, 1–10

work page 2017

[2] [2]

Sreenath, K., and Tabuada, P. (2019). Control barrier functions: Theory and applications. In 2019 18th Euro- pean control conference (ECC) , 3420–3431. IEEE

work page 2019

[3] [3]

Panagou, D. (2023). Safety under uncertainty: Tight bounds with risk-aware control barrier functions. In 2023 IEEE International Conference on Robotics and Automation (ICRA) , 12686–12692. IEEE

work page 2023

[4] [4]

Cosner, R.K., Culbertson, P., and Ames, A.D. (2024). Bounding stochastic safety: Leveraging freedman’s in- equality with discrete-time control barrier functions. IEEE Control Systems Letters

work page 2024

[5] [5]

Cosner, R.K., Culbertson, P., Taylor, A.J., and Ames, A.D. (2023). Robust safety under stochastic uncertainty with discrete-time control barrier functions. arXiv preprint arXiv:2302.07469

arXiv 2023

[6] [6]

Hoshino, K., Wang, Z., and Nakahira, Y. (2023). Scal- able long-term safety certiﬁcate for large-scale systems. IEEE Control Systems Letters , 7, 1285–1290

work page 2023

[7] [7]

Kushner, H. (1966). Finite time stochastic stability and the analysis of tracking systems. IEEE Transactions on Automatic Control, 11(2), 219–227

work page 1966

[8] [8]

Kushner, H.J. (1967). Stochastic stability and control

work page 1967