MPC as a Copilot: A Predictive Filter Framework with Safety and Stability Guarantees
Authors: Yunda Yan, Chenxi Tao, Jinya Su, Cunjia Liu, Shihua Li
Organizations: Department of Computer Science, University College London, London WC1E 6BT, UK · School of Automation, Southeast University, Nanjing 210096, China · Department of Aeronautical and Automotive Engineering, Loughborough University, Leicestershire LE11 3TU, UK
Ensuring both safety and stability remains a fundamental challenge in learning-based control, where goal-oriented policies often neglect system constraints and closed-loop state convergence. To address this limitation, this paper introduces the Predictive Safety--Stability Filter (PS2F), a unified predictive filter framework that guarantees constraint satisfaction and asymptotic stability within a single architecture. The PS2F framework comprises two cascaded optimal control problems: a nominal model predictive control (MPC) layer that serves solely as a copilot, implicitly defining a Lyapunov function and generating safety- and stability-certified predicted trajectories, and a secondary filtering layer that adjusts external command to remain within a provably safe and stable region. This cascaded structure enables PS2F to inherit the theoretical guarantees of nominal MPC while accommodating goal-oriented external commands. Rigorous analysis establishes recursive feasibility and asymptotic stability of the closed-loop system without introducing additional conservatism beyond that associated with the nominal MPC. Furthermore, a time-varying parameterisation allows PS2F to transition smoothly between safety-prioritised and stability-oriented operation modes, providing a principled mechanism for balancing exploration and exploitation. The effectiveness of the proposed framework is demonstrated through comparative numerical experiments.
Figures & tables
Figure 1: Conceptual illustration of the proposed PS 2 F framework. The external controller generates a goal-oriented command uext , which may prioritise efficiency or high-level task performance but can potentially violate constraints or compromise stability. The PS 2 F framework acts as a predictive filter that projects uext onto the safety–stability set S(x) (defined in ( 16 ) and implicitly constructed via the two OCPs), ensuring that the applied control input remains both safe and stable.
Figure 2: Schematic of the proposed PS 2 F framework. The nominal MPC serves as a copilot , generating safety- and stability-certified trajectories. The filtering OCP Pf,M(⋅) then refines the external command within a safe and stable region before applying the final control action to the system plant. The dashed arrow above the external controller indicates that the external command may be independent of the system state, i.e., operating in open-loop mode.
Figure 3: Three-dimensional illustration of the PS 2 F operation over time. The S 2 -set S(x(k)) (grey surface) evolves with the system state, while the external command uext(k) (red circle) and the filtered control u(k) (blue square) are visualised along the time axis.
Figure 6
Param.
Effect on S(x)
Side Effect
a
Enlarges S(x)
Typically slower convergence
M
Enlarges S(x)
Higher computational cost
Table 1: Effect of increasing each PS 2 F design parameter.
Figure 5: Effect of parameter a on S(x) , with N=M=5 , Q=10I2 , and R=I2 .
Figure 6: Effect of prediction horizon M on S(x) , with N=5 , a=0.95 , Q=10I2 , and R=I2 .
Figure 7: Effect of MPC weighting Q=ρI2 on S(x) , with N=M=5 , a=0.95 , and R=I2 .
Figure 8: Effect of prediction horizon N on S(x) , with Q=10I2 , R=I2 , a=0.95 , and M=N .
Figure 9: Closed-loop evolution of the robot system under the baseline controller and the proposed PS 2 F method. (a) States; (b) Control inputs; (c) Value function.
Figure 10: Comparison of robot trajectories under the baseline controller and the proposed PS 2 F method when both are scheduled to return at k=30 . A yellow robot marker denotes that the state violates the safety constraints. (a) Baseline. (b) Proposed.
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Figure 11: Schematic illustration of the recursive feasibility analysis.
Safety-critical control designs controllers that keep physical systems within hard safety constraints despite uncertainty, disturbances, and limited actuation.
Autonomous systems are increasingly deployed in real-world environments, where they must achieve high performance while maintaining safety under state and input constraints. Although Model Predictive Control (MPC) provides a principled framework for constrained optimal control, guaranteeing safety beyond its finite planning horizon remains a fundamental challenge. In this work, we augment MPC with a safety value function-based terminal constraint that enforces membership in a control-invariant safe set at the end of each planning horizon. This formulation enables real-time synthesis of trajectories that are both high-performing and provably safe. We show that, under an exact safety value function and a feasible initialization, the proposed MPC scheme is recursively feasible, thereby ensuring persistent safety. In contrast to traditional terminal set constructions that rely on local linearizations or conservative approximations, our approach incorporates a reachability-based safety value function for terminal constraints, yielding less conservative and more expressive safety guarantees. We validate the proposed framework through simulation and hardware experiments on a Flexiv Rizon 10s manipulator. Results demonstrate improved constraint satisfaction and robustness compared to standard state-constrained MPC and reactive safety filtering, while maintaining competitive task performance. The full implementation and experiments are available on the project website.
Hao Wang, Nam Nguyen, Armand Jordana +2
Ming Hsieh Department of Electrical and Computer Engineering, University of Southern California · Department of Aeronautics and Astronautics, Stanford University · Electrical and Computer Engineering Department, New York University
Safety filters provide a practical approach for enforcing safety constraints in autonomous systems. While learning-based tools scale to high-dimensional systems, their performance depends on informative data that includes states likely to lead to constraint violation, which can be difficult to efficiently sample in complex, high-dimensional systems. In this work, we characterize trajectories that barely avoid safety violations using the Pontryagin Maximum Principle. These boundary trajectories are used to guide data collection for learned Hamilton-Jacobi Reachability, concentrating learning efforts near safety-critical states to improve efficiency. The learned Control Barrier Value Function is then used directly for safety filtering. Simulations and experimental validation on a shared-control automotive racing application demonstrate PMP sampling improves learning efficiency, yielding faster convergence, reduced failure rates, and improved safe set reconstruction, with wall times around 3ms.
James Dallas, Thomas Lew, John Talbot +3
Toyota Research Institute, Los Altos, CA 94022, USA. · Department of Aeronautics and Astronautics, Stanford University, Stanford, CA 94305, USA.
Predictive safety filters (PSFs) leverage model predictive control to enforce constraint satisfaction during deep reinforcement learning (RL) exploration, yet their reliance on first-principles models or Gaussian processes limits scalability and broader applicability. Meanwhile, model-based RL (MBRL) methods routinely employ probabilistic ensemble (PE) neural networks to capture complex, high-dimensional dynamics from data with minimal prior knowledge. However, existing attempts to integrate PEs into PSFs lack rigorous uncertainty quantification. We introduce the Uncertainty-Aware Predictive Safety Filter (UPSi), a PSF that provides rigorous safety predictions using PE dynamics models by formulating future outcomes as reachable sets. UPSi introduces an explicit certainty constraint that prevents model exploitation and integrates seamlessly into common MBRL frameworks. We evaluate UPSi within Dyna-style MBRL on standard safe RL benchmarks and report substantial improvements in exploration safety over prior neural network PSFs while maintaining performance on par with standard MBRL. UPSi bridges the gap between the scalability and generality of modern MBRL and the safety guarantees of predictive safety filters.
Bernd Frauenknecht, Lukas Kesper, Daniel Mayfrank +2
Institute for Data Science in Mechanical Engineering (DSME), RWTH Aachen University · Institute of Climate and Energy Systems (ICE), Energy Systems Engineering (ICE-1), Forschungszentrum Jülich GmbH