A Learned Policy Is Not A Safety Case
A goal-seeking policy can be effective on average and still issue one command that crosses an obstacle boundary.
safepathshield wraps nominal velocity with an analytical control-barrier projection: unchanged when safe, minimally corrected when the barrier inequality would be violated.
The Demo
The nominal controller records 39 collision steps. The shield intervenes 75 times, preserves 0.00137 positive minimum clearance, records zero collisions, and reaches the goal with 0.05978 error.
The fixture is a deterministic single-integrator robot with one circular obstacle. Physical deployment requires full dynamics, uncertainty, actuator limits, state estimation, and hardware validation.
Research Basis
Current work combines learned control-barrier functions with formal verification and reinforcement-learning safety layers.
Read the Control-barrier verification at PMLR 2025.
The Guarantee Only Held At One Control Rate
A safety filter enforces its inequality at the current instant, then a real controller applies that velocity for an entire discrete time step. The barrier projection here checked the continuous-time condition but never accounted for how far the robot actually travels during that step.
Verified directly: at a slower but entirely realistic 3.3 Hz control rate, the "safe" shielded controller drove the robot straight into the obstacle. A 60-scenario randomized sweep across control rate, start position, and obstacle size — 40 tuning configurations plus 20 disjoint holdout configurations — found the original filter collided in roughly half of realistic setups on both sweeps, with penetration as deep as 0.29 units past the boundary.
Fixed in a new, non-destructive core_v2.py module using a discrete-time-exact barrier projection that solves for the true next position rather than a linear approximation of it. The published demo — untouched core.py, same 39 nominal collisions, 75 interventions, 0.00137 clearance, 0.05978 goal error — still reproduces exactly; re-running the same 60-scenario sweep against the fix produces zero collisions on both tuning and holdout sets.