cs.ROFeb 26, 2026
SaveRefining Almost-Safe Value Functions on the Fly
Organizations: University of California, San Diego
Abstract
Control Barrier Functions (CBFs) are a powerful tool for ensuring robotic safety, but designing or learning valid CBFs for complex systems is a significant challenge. While Hamilton-Jacobi Reachability provides a formal method for synthesizing safe value functions, it scales poorly and is typically performed offline, limiting its applicability in dynamic environments. This paper bridges the gap between offline synthesis and online adaptation. We introduce refineCBF for refining an approximate CBF - whether analytically derived, learned, or even unsafe - via warm-started HJ reachability. We then present its computationally efficient successor, HJ-Patch, which accelerates this process through localized updates. Both methods guarantee the recovery of a safe value function and can ensure monotonic safety improvements during adaptation. Our experiments validate our framework's primary contribution: in-the-loop, real-time adaptation, in simulation (with detailed value function analysis) and on physical hardware. Our experiments on ground vehicles and quadcopters show that our framework can successfully adapt to sudden environmental changes, such as new obstacles and unmodeled wind disturbances, providing a practical path toward deploying formally guaranteed safety in real-world settings.
Figures & tables
| Characterizes safety: | Characterizes control invariance: ( 5 ) | Non-intrusive safety filter | |
|---|---|---|---|
| Invalid CBF | ✓ | ✗ | ✓ ✗ |
| Unsafe CBF | ✗ | ✓ | ✓ |
| Conservative (safe) CBF | ✓ | ✓ | ✗ |
| Desired (safe) CBF | ✓ | ✓ | ✓ |
TABLE I : The 4 possible categories of CBFs and their properties.
Fig. 1 : Comparison of converged value functions for refineCBF , HJ-Patch , HJR, and jointCBF at a fixed robot orientation (see arrow) and velocity ( m/s) slice. (Left) The 0-level sets show that naively combining constraints (jointCBF) incorrectly merges the safe sets, creating an unsafe region between the obstacles. HJ-Patch and refineCBF both produce safe, comparable boundaries compared to the HJR baseline. (Right) The difference plots highlight that HJ-Patch ’s value function is a close match to the HJR solution, while refineCBF is more conservative (negative differences) and jointCBF is dangerously optimistic (large positive differences).
Fig. 2 : Online performance with limited-range obstacle detection. These plots show system behavior across 10 simulation rollouts where obstacles are discovered online. (Left) shows the trajectories for all methods (with dotted lines for trajectories post collision) for multiple rollouts. We additionally visualize the detection points based on the limited range of the sensor. (Right) visualizes the value function (with the safety boundary). These rollouts demonstrate the need for refinement, as HJR and jointCBF lead to collision. Additionally, when a GPU is not available, HJ-Patch ’s computational efficiency enables patching rapidly to provide safety, whereas refineCBF (CPU) fails.
| refineCBF | refineCBF (CPU) | HJ-Patch (CPU) | jointCBFs | HJR |
| 0/10 | 5/5 | 1/10 | 5/5 | 5/5 |
TABLE II : Quantiative measure ( better) of number of collisions of jackal simulation experiments for online adaptation. Experiments that constantly lead to collisions are only executed times. These measures highlight the benefits of refineCBF and HJ-Patch .
Fig. 3 : Online adaptation and deadlock avoidance in a quadcopter navigation task. The quadcopter must navigate to a goal in a region initially occluded by an obstacle. (Left) Trajectories show refineCBF successfully discovering a path over the obstacle, progressively incorporating the newly seen free space (yellow) into the safe set, then iteratively incorporating this new information into its safe set. In contrast, the backupCBF method gets stuck in a deadlock, unable to find a path to the goal with its fixed backup policy. (Right) The value function confirms this behavior. refineCBF ’s value dips as it navigates the obstacle and unseen space boundary, and then recovers as the safe set expands. The backupCBF value drops and oscillates near the safety boundary (value=0), indicating a persistent deadlock. Further analysis on why refineCBF avoids deadlock is provided in Fig. 10(a) .
Fig. 4 : A snapshot of the Jackal hardware experiment. The robot detects the suddenly fallen obstacle blocking its path. The top-right inset shows the robot’s internal map at the moment of detection; the safe set (green) has not yet been updated to incorporate the new SDF map (black), highlighting the need for rapid, in-the-loop replanning to ensure safety.
Fig. 5 : Trajectory comparison for the Jackal hardware experiment. These plots show time snapshots of the system’s trajectory after the environment is altered at . The fully adaptive refineCBF (blue) successfully backtracks to find a new, safe path. The non-adaptive baseline (refineCBF (no online detection), orange) operates on a stale map, leading directly to a collision with the new obstacle.
Fig. 6 : Quadcopter hardware experiment with a previously occluded obstacle. Snapshot of the physical setup where a quadcopter navigates towards its goal (green circle). The circular obstacle is initially hidden from view by the blue block. The bottom-right inset shows the constraint and safe set at the moment the new obstacle is first detected; the safe set (green) has not yet been updated, highlighting the challenge for the real-time safety filter.
Fig. 7 : Trajectories from 10 hardware trials comparing adaptive and non-adaptive refineCBF . The quadcopter must navigate an environment with an unexpected obstacle (light gray circle) that only becomes visible after clearing the first obstacle. The fully adaptive refineCBF (blue) successfully avoids the new obstacle in all 10 trials. The non-adaptive baseline (refineCBF (no online detection), orange), operating under the optimistic assumption that unseen space is free, collides in every trial.
Fig. 8 : Hardware experiment with unmodeled aerodynamic disturbances. A snapshot of the quadcopter navigating through a narrow passage containing a fan (wind visualized with yellow streamlines). While the geometry of the passage is known, the aerodynamic disturbance produced by the fan’s and its interaction with the environment is not and must be detected and compensated for in real time.
Fig. 9 : Trajectories from 10 hardware trials with a dynamic disturbance. The quadcopter encounters a strong wind disturbance while flying between the two known obstacles. The safety value function is initialized as a CBF centered at the starting position with a small initially safe region. The adaptive refineCBF , which incorporates real-time disturbance changes, successfully compensates and navigates the passage in 9/10 trials. The baseline controller (orange), which assumes nominal dynamics, fails in every trial, consistently being pushed into the wall by the unexpected disturbance.
Fig. 10 : Safe set across the position space evaluated at the current velocities (arrow and slice highlight the velocities). A broad range of value function initializations are presented (conservative SDF (top), optimistic SDF (center), and conservative CBF guess (bottom)), in addition to a broad range of online changes. refineCBF (or safeadapt-refineCBF ) succeeds in all scenarios, highlighting the diversity of scenarios where it can be deployed. In addition, all experiments highlight that encoding safety through a value function over all states, not just positional states, is required in dynamic scenarios to preserve safety and maintain performance.