💻 computer science

A Formal gatekeeper Framework for Safe Dual Control with Active Exploration

This paper proposes a formal gatekeeper framework for safe dual control that integrates robust planning with active exploration, ensuring that uncertainty reduction is pursued only when it yields verifiable mission improvements without compromising safety.

Original authors: Kaleb Ben Naveed, Devansh R. Agrawal, Dimitra Panagou

Published 2026-05-26

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Kaleb Ben Naveed, Devansh R. Agrawal, Dimitra Panagou

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are teaching a robot to fly a drone through a cluttered room to reach a specific spot. The problem is that the robot doesn't perfectly know how the air pushes against it (aerodynamic drag) or how its motors respond. It has a "best guess," but that guess might be wrong.

If the robot plays it too safe, it will fly very slowly and take a wide, boring path just to avoid hitting anything, assuming the worst possible wind gusts. It will get the job done, but it will be inefficient and won't learn anything about the air.

If the robot tries to learn too fast, it might fly in a zigzag pattern to test the wind. This helps it learn quickly, but it risks crashing into a wall or running out of battery before reaching the goal.

This paper proposes a "smart middle ground" called a Formal Gatekeeper Framework. Here is how it works, using simple analogies:

1. The "Safety Net" (The Backup Plan)

Before the robot even thinks about learning, it first calculates a Backup Trajectory. Think of this as a "safety net" or a "lifeboat."

It is a very conservative, slow, and wide path that is guaranteed to be safe no matter how wrong the robot's guesses are.
The robot always has this path in its back pocket. If anything goes wrong, it can immediately switch to this safe path and survive.

2. The "Exploration Scouts" (The Candidates)

While holding onto the safety net, the robot generates several Candidate Trajectories. These are like "scouts" sent out to explore.

Some scouts are just copies of the safe backup path (boring, but safe).
Other scouts are Informative. They take slightly different, more interesting routes designed to "poke" the air and gather data. This helps the robot figure out the true wind speed and motor power faster.

3. The "Gatekeeper" (The Decision Maker)

This is the most important part. The robot doesn't just pick the most exciting path. It has a strict Gatekeeper that checks every single scout before letting it go. The Gatekeeper asks two questions:

Is it safe? Even if the robot takes this exciting path, can it still merge back onto the "safety net" later without crashing? If the answer is "maybe not," the Gatekeeper slams the door.
Is it worth the cost? Learning takes energy and time. The Gatekeeper checks if the robot has enough "budget" (battery or time) left to take this path and still finish the mission.

4. The Result: "Safe Learning"

If a scout passes the Gatekeeper: The robot takes that path. It learns something new, shrinks its uncertainty (gets a better guess), and might even finish the mission faster because it now knows exactly how the air works.
If no scout passes: The robot simply sticks to the boring, safe backup path. It doesn't learn anything new that day, but it is 100% safe and stays within its budget.

The Analogy of the Hiker

Imagine you are a hiker in a foggy forest trying to reach a campsite.

The Old Way (Robust Planning): You stay on the main, wide, paved road. You are safe, but you walk slowly and never learn the shortcuts.
The Risky Way (Active Exploration without safety): You run off-road to find shortcuts. You might find a great path, or you might fall into a ravine.
This Paper's Way (The Gatekeeper Framework): You have a map of the main road (the Backup). You send a dog ahead to sniff out shortcuts (the Informative Candidate).
- If the dog finds a shortcut that leads back to the main road safely and doesn't take too much time, you take it.
- If the dog finds a path that looks like a cliff or takes too long, you ignore it and stay on the main road.

What the Paper Actually Found

The authors tested this on a simulated drone (quadrotor) with unknown wind resistance.

Safety: The drone never crashed, even when it was trying to learn.
Efficiency: By learning the wind conditions on the fly, the drone actually used less energy and finished the mission faster than if it had just stuck to the boring, safe path the whole time.
Learning: The drone successfully narrowed down its guesses about the wind, turning a wide range of "maybe it's this, maybe it's that" into a very precise "it is exactly this."

In short, this framework allows a robot to be curious without being reckless, ensuring it learns faster while never breaking its safety rules or running out of resources.

Technical Summary: A Formal Gatekeeper Framework for Safe Dual Control with Active Exploration

Problem Statement
Planning safe trajectories under model uncertainty is a fundamental challenge in robotics. Existing robust planning methods (e.g., tube-based MPC, control barrier functions) guarantee safety by considering worst-case disturbances and model mismatches. However, these approaches are inherently conservative because they do not actively reduce model uncertainty during execution. Conversely, dual control approaches seek to balance exploitation (achieving mission objectives) with exploration (reducing uncertainty). Current dual control methods often lack formal safety guarantees, as exploration is frequently pursued without ensuring constraint satisfaction. Furthermore, the trade-off between exploration and exploitation is typically managed via weighted cost terms, which lack principled decision-making regarding when exploration is beneficial, potentially leading to excessive mission costs or suppressed uncertainty reduction.

Methodology
The authors propose a framework that integrates robust planning with active exploration under formal guarantees of safety and budget feasibility. The architecture is inspired by the "gatekeeper" concept, operating in a receding horizon fashion at each planning cycle $t_k$ :

Backup Trajectory Generation: A robust "backup" trajectory is first computed. This is a Robust Controlled-Invariant (RCI) tube trajectory that guarantees safety under worst-case parameter uncertainty and bounded additive disturbances. It serves as a safe fallback.
Candidate Pair Generation: The algorithm generates pairs of trajectories for various time horizons:
- A Conservative Candidate: Coincides with the backup trajectory, ensuring safety.
- An Informative Candidate: Designed to excite the system regressor $\Phi(x, u)$ to reduce parameter uncertainty (specifically, the width of the parameter set). This trajectory is optimized to minimize control effort while maximizing the log-determinant of the Gramian (promoting identifiability) but does not inherently guarantee safety.
Safety Verification and Validation: For each informative candidate, a tube is constructed around the trajectory to verify if it satisfies tightened state and input constraints. Only pairs where the informative trajectory is "tube-safe" (i.e., the tube remains within the safe set) are considered valid.
Selection and Commitment: Valid pairs are scored based on the predicted reduction in the average directional width of the parameter set, penalized by the horizon length to prioritize early information gain.
- A candidate is selected only if it is valid and the total mission cost (accumulated cost + cost of the informative segment + cost of the subsequent backup) remains within a user-defined budget $B$ .
- If no informative candidate satisfies the safety and budget constraints, the system defaults to the shortest-horizon conservative candidate.
Execution and Update: The committed trajectory is executed. Upon completion, the parameter set is refined using Set-Membership Identification (SMID) based on observed data, and the backup trajectory is updated for the next cycle.

Key Contributions

Formal Safety Guarantees in Dual Control: Unlike many existing dual control approaches, this framework ensures that exploration is pursued only when it is provably safe. Exploration is never allowed to compromise constraint satisfaction.
Budget-Feasible Exploration: The framework introduces a rigorous mechanism to ensure that the cost of exploration does not exceed a prescribed budget. It explicitly evaluates the trade-off between uncertainty reduction and mission cost before committing to an informative trajectory.
Gatekeeper Architecture Extension: The authors extend their prior gatekeeper work to generate not just safe fallbacks, but also "informative" trajectories that actively reduce uncertainty while maintaining the safety of the overall system.
Verifiable Improvement: Exploration is pursued only when it provides a verifiable improvement (reduction in parameter set width) without compromising safety or budget.

Results
The framework was evaluated via simulation on two quadrotor case studies involving parametric uncertainty in aerodynamic drag:

Case Study 1 (Scalar Drag): A quadrotor with an unknown scalar drag coefficient. The framework successfully reduced the admissible interval for the drag coefficient online. Compared to a conservative baseline, the proposed method achieved a total mission cost of 82.5% while remaining within a 110% budget, demonstrating improved efficiency alongside uncertainty reduction.
Case Study 2 (Vector Drag): A quadrotor with two unknown drag coefficients (linear and quadratic). The method reduced the parameter set bounds for both parameters, though the reduction was asymmetric due to the specific excitation of the regressors and the presence of obstacles which invalidated many informative candidates. The total cost was 81.3% of the baseline.
Parameter Convergence: In both cases, the parameter bounds tightened significantly around the true values, confirming the effectiveness of the active exploration strategy.

Significance and Claims
The paper claims that the proposed framework addresses the critical gap in dual control where safety and cost constraints are often violated or managed heuristically. By ensuring that exploration is pursued only when it is "provably safe, beneficial, and budget-feasible," the method enables reliable execution with uncertainty reduction. The authors state that the framework allows the robot to become progressively less conservative in its planning as uncertainty is reduced, while strictly adhering to safety and budget constraints.

Limitations and Future Work
The authors note that the current uncertainty shrinkage prediction assumes the executed trajectory coincides with the planned trajectory, neglecting tracking errors between the planned and actual closed-loop states. Future work aims to incorporate safety directly into the candidate generation phase, formalize the link between uncertainty reduction and cost decrease, and develop prediction methods for parameter set width that account for tracking deviations.