Predictive Safety Filter

• Predictive safety filter is a modular architecture that certifies proposed actions by predicting and ensuring safe future trajectories.
• It uses finite-horizon optimization with robust constraints to compute minimally modified inputs when nominal actions may lead to unsafe states.
• Empirical implementations in varied domains show enhanced real-time performance, reduced intervention, and improved collision avoidance.

Predictive safety filter (PSF) denotes a class of modular safety mechanisms that sit between a nominal controller and a constrained dynamical system, predict future trajectories over a finite horizon, and either certify the proposed input or replace it with a minimally modified input that preserves safety. In the cited literature, PSFs are typically model-predictive-control-based wrappers with state and input constraints, a terminal safe condition, and receding-horizon re-optimization, thereby separating performance-oriented control from safety certification for learning-based policies, human inputs, or other arbitrary controllers (Wabersich et al., 2018, Milios et al., 2024).

1. Core architecture and control-theoretic role

The defining architectural property of a PSF is minimal intervention. A nominal controller proposes an action—denoted variously by $u_L(k)$, $u_{\mathrm{des}}(k)$, $u_{\mathcal L}(t)$, or $a_t$—and the filter either passes it through unchanged if it can be certified safe or computes the closest admissible alternative. In this sense, the PSF is not the task controller itself. Its role is supervisory: it renders an arbitrary controller safe by checking whether the current action admits a safe predicted continuation into a terminal safe region, and by overriding the action only when needed (Tearle et al., 2021).

A generic finite-horizon formulation used repeatedly in the literature is

$$\begin{aligned} \min_{u_{i|k},x_{i|k}} \quad & \|u_{0|k}-u_L(k)\|_W^2 \ \text{s.t.}\quad & x_{0|k}=x(k),\ & x_{i+1|k}=f(x_{i|k},u_{i|k},\Delta T),\ & x_{i|k}\in \mathbb X,\quad u_{i|k}\in \mathbb U,\ & x_{N|k}\in \mathbb X_f, \end{aligned}$$

after which the applied control is $u(k)=u_{0|k}^*$ (Vaaler et al., 2023). A closely related reinforcement-learning form minimizes only the distance to the proposed action,

$J(\mathcal U_t,\mathcal Z_t)=\|a_t-u_{0|t}\|_2,$

emphasizing that the PSF is not trying to optimize task reward directly; it is trying to minimize intervention while enforcing safety (Frauenknecht et al., 29 Apr 2026).

Terminal ingredients are central. Many formulations assume a terminal safe set or terminal invariant set $\mathbb X_f$, $S_f$, or $\mathcal S_f$, together with a terminal controller that can keep the system safe indefinitely once the predicted state enters that set. This is the mechanism behind recursive feasibility: if the online problem is feasible once, the shifted solution plus terminal control yields feasibility at future steps under the usual receding-horizon argument (Wabersich et al., 2018).

2. Finite-horizon certification, backup trajectories, and multi-step corrections

A PSF can be viewed as a finite-horizon certification problem for safe backup trajectories. Instead of asking whether the current input is locally admissible, it asks whether the current state and proposed action admit a future state/input sequence that remains within constraints and reaches a terminal safe set. This predictive viewpoint is explicit in racing, where the filter computes a backup trajectory under a nonlinear dynamic bicycle model and track-boundary constraints, and in marine navigation, where the filter enforces collision-avoidance, velocity, actuator, and terminal invariant-set conditions over a horizon $u_{\mathrm{des}}(k)$0 (Tearle et al., 2021, Vaaler et al., 2023).

Robust formulations tighten constraints along the horizon. For nonlinear systems with model uncertainty, one representative construction uses tightened sets $u_{\mathrm{des}}(k)$1, $u_{\mathrm{des}}(k)$2, and $u_{\mathrm{des}}(k)$3, together with a set-valued model confidence map $u_{\mathrm{des}}(k)$4, so that the planner only traverses regions where the uncertainty is sufficiently small and the closed loop is safe with probability at least $u_{\mathrm{des}}(k)$5 (Wabersich et al., 2018). This gives the PSF a predictive backup interpretation: a nominal plan is accepted only if its uncertainty tube fits inside progressively tightened constraints and terminates in a safe terminal set.

The standard one-step model predictive safety filter objective,

$u_{\mathrm{des}}(k)$6

is effective but myopic. The multi-step formulation

$u_{\mathrm{des}}(k)$7

extends the correction objective over a filtering horizon $u_{\mathrm{des}}(k)$8, while keeping the same robust tube-based feasibility structure. This change is not in the constraints but in what the optimizer prefers: it allows the filter to anticipate future corrections and thereby reduce oscillatory correction behavior, or chattering, near constraint boundaries (Bejarano et al., 2023).

This distinction is important because a common misconception equates predictive safety filtering with any MPC safety constraint. In the PSF literature, the predictive element is specifically tied to certifying that future recovery remains possible, not merely to optimizing a control sequence. A plausible implication is that PSFs occupy a middle position between pointwise safety constraints and full task-optimizing MPC: they preserve modularity while still using horizon-based reachability information.

3. Barrier-function and stability generalizations

Several lines of work reinterpret predictive safety filtering through barrier and Lyapunov constructions. A standard control barrier function (CBF) filter typically enforces

$u_{\mathrm{des}}(k)$9

or a discrete-time analogue, where $u_{\mathcal L}(t)$0 defines the safe set $u_{\mathcal L}(t)$1. Predictive control barrier function (PCBF) formulations replace this one-step decrease condition by a horizon-based feasibility condition, making the admissible control set larger and the filter more permissive because future corrective actions can be exploited instead of reacting myopically (Didier et al., 2022).

In the PCBF framework, the filter operates in two stages. Stage 1 computes the minimal state-constraint violation, via slacks $u_{\mathcal L}(t)$2, needed to make a predictive barrier problem feasible. Stage 2 computes the actual filtered input by minimizing deviation from the nominal input while respecting the predictive constraints and the slack information from Stage 1. The first stage defines a value function $u_{\mathcal L}(t)$3 associated with minimal violation; the second stage is the safety filter proper. The cited analysis shows convergence to a neighborhood of the feasible set, introduces a novel class-$u_{\mathcal L}(t)$4 lower bound on the PCBF decrease, and states that sufficiently accurate approximation can achieve zero constraint violation (Didier et al., 2022).

A second barrier-based line addresses infeasibility recovery. The predictive control barrier function problem

$u_{\mathcal L}(t)$5

is defined through a soft-constrained horizon problem with tightened constraints and a terminal control barrier function $u_{\mathcal L}(t)$6. Its optimal value is shown to be itself a discrete-time control barrier function, with safe set

$u_{\mathcal L}(t)$7

The purpose is not merely to soften constraints, but to make the violation measure decay until the original predictive safety filter becomes feasible again (Wabersich et al., 2021).

Stability-enhanced PSFs add an explicit decrease constraint on an MPC-style cost. One representative form augments the safety filter with

$u_{\mathcal L}(t)$8

where

$u_{\mathcal L}(t)$9

This converts the PSF into a stability-enhanced predictive safety filter whose value function acts as an implicit Lyapunov function and supports bounded convergence or uniform asymptotic stability, including dynamic trajectory tracking variants (Milios et al., 2024). A related predictive stability filter enforces decrease of an implicit Lyapunov function on the extended state $a_t$0, where $a_t$1 is a warmstart input sequence, and proves robust asymptotic stability with respect to a predefined disturbance set (Didier et al., 2024). The cascaded Predictive Safety–Stability Filter (PS$a_t$2F) takes this further by using a nominal MPC layer as a copilot whose optimal value function provides the Lyapunov certificate, while a secondary filtering layer projects arbitrary external commands into a safety–stability set without introducing additional conservatism beyond that associated with the nominal MPC (Yan et al., 29 Mar 2026).

4. Robustness, uncertainty, and output-feedback formulations

A large part of the PSF literature is concerned with uncertainty modeling. One early formulation considers discrete-time nonlinear systems with continuous state and input spaces, a probabilistic belief over model parameters, polyhedral state and input constraints, and chance-constrained safety

$a_t$3

The filter plans with a nominal model, uses tightened constraints, and restricts nominal trajectories to regions where the confidence-map condition

$a_t$4

holds, thereby yielding recursive feasibility and probability-based safety under state- and input-dependent uncertainty (Wabersich et al., 2018).

Output-feedback extensions replace full-state measurements by certified state estimation. The robust predictive output-feedback safety filter (RPOF-SF) combines a robustly stable observer with a predictive safety filter. At each time $a_t$5, the observer produces a state estimate $a_t$6 and a valid estimation-error certificate $a_t$7; the filter then propagates an estimation-error tube and a prediction-error tube through scalar recursions. Under the stated observer and terminal-set assumptions, if the optimization is feasible at $a_t$8 with valid initial estimation error bound $a_t$9, then

$$\begin{aligned} \min_{u_{i|k},x_{i|k}} \quad & \|u_{0|k}-u_L(k)\|_W^2 \ \text{s.t.}\quad & x_{0|k}=x(k),\ & x_{i+1|k}=f(x_{i|k},u_{i|k},\Delta T),\ & x_{i|k}\in \mathbb X,\quad u_{i|k}\in \mathbb U,\ & x_{N|k}\in \mathbb X_f, \end{aligned}$$0

and recursive feasibility follows under the stronger terminal-set condition (Brunke et al., 2022).

Probabilistic neural dynamics introduce a different uncertainty issue: model exploitation. UPSi, the Uncertainty-Aware Predictive Safety Filter, uses probabilistic ensemble neural networks,

$$\begin{aligned} \min_{u_{i|k},x_{i|k}} \quad & \|u_{0|k}-u_L(k)\|_W^2 \ \text{s.t.}\quad & x_{0|k}=x(k),\ & x_{i+1|k}=f(x_{i|k},u_{i|k},\Delta T),\ & x_{i|k}\in \mathbb X,\quad u_{i|k}\in \mathbb U,\ & x_{N|k}\in \mathbb X_f, \end{aligned}$$1

and constructs ellipsoidal reachable sets together with an explicit certainty constraint,

$$\begin{aligned} \min_{u_{i|k},x_{i|k}} \quad & \|u_{0|k}-u_L(k)\|_W^2 \ \text{s.t.}\quad & x_{0|k}=x(k),\ & x_{i+1|k}=f(x_{i|k},u_{i|k},\Delta T),\ & x_{i|k}\in \mathbb X,\quad u_{i|k}\in \mathbb U,\ & x_{N|k}\in \mathbb X_f, \end{aligned}$$2

The purpose of $$\begin{aligned} \min_{u_{i|k},x_{i|k}} \quad & \|u_{0|k}-u_L(k)\|_W^2 \ \text{s.t.}\quad & x_{0|k}=x(k),\ & x_{i+1|k}=f(x_{i|k},u_{i|k},\Delta T),\ & x_{i|k}\in \mathbb X,\quad u_{i|k}\in \mathbb U,\ & x_{N|k}\in \mathbb X_f, \end{aligned}$$3 is to restrict prediction to regions where the learned model is reliable enough for rigorous reachable-set reasoning, thereby preventing the controller from driving the dynamics model into out-of-distribution regions (Frauenknecht et al., 29 Apr 2026).

Dynamic environments require uncertainty quantification over other agents’ trajectories rather than only plant dynamics. Conformal predictive safety filters address this by learning a predictor $$\begin{aligned} \min_{u_{i|k},x_{i|k}} \quad & \|u_{0|k}-u_L(k)\|_W^2 \ \text{s.t.}\quad & x_{0|k}=x(k),\ & x_{i+1|k}=f(x_{i|k},u_{i|k},\Delta T),\ & x_{i|k}\in \mathbb X,\quad u_{i|k}\in \mathbb U,\ & x_{N|k}\in \mathbb X_f, \end{aligned}$$4, constructing distribution-free uncertainty radii $$\begin{aligned} \min_{u_{i|k},x_{i|k}} \quad & \|u_{0|k}-u_L(k)\|_W^2 \ \text{s.t.}\quad & x_{0|k}=x(k),\ & x_{i+1|k}=f(x_{i|k},u_{i|k},\Delta T),\ & x_{i|k}\in \mathbb X,\quad u_{i|k}\in \mathbb U,\ & x_{N|k}\in \mathbb X_f, \end{aligned}$$5 through conformal prediction, and then training a safety filter $$\begin{aligned} \min_{u_{i|k},x_{i|k}} \quad & \|u_{0|k}-u_L(k)\|_W^2 \ \text{s.t.}\quad & x_{0|k}=x(k),\ & x_{i+1|k}=f(x_{i|k},u_{i|k},\Delta T),\ & x_{i|k}\in \mathbb X,\quad u_{i|k}\in \mathbb U,\ & x_{N|k}\in \mathbb X_f, \end{aligned}$$6 that keeps the filtered trajectory outside the uncertainty-expanded predicted agent locations,

$$\begin{aligned} \min_{u_{i|k},x_{i|k}} \quad & \|u_{0|k}-u_L(k)\|_W^2 \ \text{s.t.}\quad & x_{0|k}=x(k),\ & x_{i+1|k}=f(x_{i|k},u_{i|k},\Delta T),\ & x_{i|k}\in \mathbb X,\quad u_{i|k}\in \mathbb U,\ & x_{N|k}\in \mathbb X_f, \end{aligned}$$7

The resulting probabilistic collision-avoidance guarantee is explicitly stated to rely on idealized assumptions and exact optimization; in practice the filter is learned approximately (Strawn et al., 2023).

A complementary robust line uses discrete-time barrier functions under bounded perturbations and time-varying constraints. There the safety filter solves a horizon-$$\begin{aligned} \min_{u_{i|k},x_{i|k}} \quad & \|u_{0|k}-u_L(k)\|_W^2 \ \text{s.t.}\quad & x_{0|k}=x(k),\ & x_{i+1|k}=f(x_{i|k},u_{i|k},\Delta T),\ & x_{i|k}\in \mathbb X,\quad u_{i|k}\in \mathbb U,\ & x_{N|k}\in \mathbb X_f, \end{aligned}$$8 problem on the disturbance-free nominal model, but enforces tightened state and terminal conditions such as

$$\begin{aligned} \min_{u_{i|k},x_{i|k}} \quad & \|u_{0|k}-u_L(k)\|_W^2 \ \text{s.t.}\quad & x_{0|k}=x(k),\ & x_{i+1|k}=f(x_{i|k},u_{i|k},\Delta T),\ & x_{i|k}\in \mathbb X,\quad u_{i|k}\in \mathbb U,\ & x_{N|k}\in \mathbb X_f, \end{aligned}$$9

and

$u(k)=u_{0|k}^*$0

so that the actual disturbed system remains in the time-varying safe set $u(k)=u_{0|k}^*$1. This formulation also admits event-triggered operation: if a nominal rollout already stays inside the tightened robust safe sets, the filter applies the nominal control without solving the optimization (Cortez et al., 2023).

5. Computational realizations and learned surrogates

The chief practical challenge of PSFs is online computation. The literature therefore contains a distinct subfamily of computationally light or learned implementations that preserve the modular filtering role while reducing solve times.

Method	Mechanism	Reported effect
Approximate PCBF via neural networks (Didier et al., 2022)	Replace the horizon-dependent Stage 1 slack/value optimization by a neural approximation of the optimal value function	Online computation becomes independent of the prediction horizon
Explicit SL-MPSF via system level synthesis (Leeman et al., 2022)	Precompute a simple safe set and backup policy offline	$u(k)=u_{0|k}^*$2 online, versus $u(k)=u_{0|k}^*$3 for SL-MPSF and $u(k)=u_{0|k}^*$4 for standard MPSF
DPC + PSF on quadcopter (Viljoen et al., 2024)	Offline differentiable predictive control plus an event-triggered PSF around a learned safe set	Up to three orders of magnitude reduction in computation time
PMP-sampled learned CBVF filter (Dallas et al., 14 Apr 2026)	Boundary-focused sampling via Pontryagin’s Maximum Principle for learned HJ reachability	Wall times around $u(k)=u_{0|k}^*$5
Reach-avoid policy + online SLS verification (Li et al., 2023)	Learn nominal reach-avoid policy offline and solve only the convex verification/robustification problem online	$u(k)=u_{0|k}^*$6 versus $u(k)=u_{0|k}^*$7 for nonlinear RMPC

These approaches alter different parts of the PSF pipeline. Neural approximation of the PCBF value function removes the most expensive horizon-dependent optimization while preserving the two-stage interpretation of minimal slack followed by minimal input deviation (Didier et al., 2022). System level synthesis replaces fixed tube feedback by optimized disturbance responses and also yields an explicit offline-computed variant with no online optimization, at the cost of more conservatism than the implicit formulation (Leeman et al., 2022). Data-driven safety wrappers for differentiable predictive control use event triggers so that the optimization is solved only when the state is outside a learned safe set; otherwise the DPC action is applied directly (Viljoen et al., 2024).

Boundary-focused learning changes the data bottleneck rather than the online solver. The PMP-based sampling method identifies trajectories that barely avoid safety violations, concentrates HJ-learning effort near the backward-reachable-tube boundary, and then deploys a learned Control Barrier Value Function in a QP-based filter (Dallas et al., 14 Apr 2026). The reach-avoid/SLS framework similarly decouples nominal plan generation from robust online verification: a deep adversarial actor-critic policy generates the nominal trajectory, while the online step solves a second-order cone program to certify the worst-case reach-avoid value (Li et al., 2023).

Event-triggering is a recurring efficiency mechanism. In robust time-varying nonlinear PSFs, nominal control is passed through whenever its predicted rollout remains inside tightened robust safe sets, and the optimization is activated only when a future violation is detected (Cortez et al., 2023). A plausible implication is that computationally viable PSFs increasingly rely on decomposition: prediction, certification, and performance optimization are separated rather than solved monolithically.

6. Domains, empirical behavior, and limitations

The application range of PSFs is unusually broad for a single control architecture. Reported deployments cover racing, drifting, marine navigation, quadrotors, dynamic-agent collision avoidance, safe RL benchmarks, and geometry-aware locomotion.

Domain	PSF configuration	Selected reported outcome
Autonomous drifting (Zhou et al., 28 Jun 2025)	RL motion planner with a short-horizon PSF on curvature before MPDC	Mean heading error reduced by 61.1% relative to MPC; 3.6 times faster on average than the MPC benchmark
Marine navigation (Vaaler et al., 2023)	PPO wrapped by a PSF on the Cybership II model	In Trondheim, 0% collision rate for PPO+PSF versus 17% collision rate for PPO
Safe RL benchmarks (Frauenknecht et al., 29 Apr 2026)	UPSi with probabilistic ensemble dynamics	Training infeasibilities: Pendulum 11 vs 142 and Cartpole 382 vs 3,660 relative to XMPSC
Crazyflie 2.0 quadrotor (Bejarano et al., 2023)	Multi-step MPSF with longer correction horizon	Chattering peak-to-peak amplitude near the boundary reduced from 16.3 cm to 3.6 cm

Beyond fully autonomous control, PSFs have also been used for assisted manual driving and deep imitation learning on a miniature remote-controlled vehicle, where the filter kept the vehicle inside track boundaries while allowing aggressive maneuvers when future recovery remained possible (Tearle et al., 2021). Shared-control automotive racing with a learned Control Barrier Value Function likewise demonstrates that predictive filtering can remain real-time, with approximately 3 ms wall time, while intervening near turns and boundaries rather than uniformly suppressing aggressive driver intent (Dallas et al., 14 Apr 2026).

The empirical record also clarifies the limits of the concept. Shield-Loco, a sampling-based predictive safety filter for legged locomotion, reports substantial reductions in safety violations with minimal deviation from the nominal input, but is explicit that it provides no formal safety guarantee and no optimality guarantee; it also notes that filtering contact targets alone does not fully control swing-phase or whole-body collision behavior (Shirwatkar et al., 5 Jun 2026). Geometry-aware Poisson-based filters for humanoids and quadrupeds show that orientation-sensitive buffering can keep the synthesized safety function $u(k)=u_{0|k}^*$8 positive throughout dynamic avoidance maneuvers and can prevent deadlock in narrow corridors, yet they also state that formal safety cannot be guaranteed in full generality for moving environments because future obstacle evolution is inherently unknown (Bena et al., 15 Aug 2025). Conformal predictive safety filters reduce collisions and failures in dynamic-agent navigation while avoiding Gaussian assumptions, but their guarantees are explicitly approximate in practice because the safety filter is learned approximately and conformal calibration can be affected by deployment-time distribution shift (Strawn et al., 2023).

Taken together, these reports suggest that the predictive safety filter is best understood not as a single algorithm but as an architecture: a predictive, minimally invasive certification layer whose concrete realization may be deterministic, robust, stochastic, output-feedback, learned, barrier-based, or stability-enhanced. What unifies these variants is the receding-horizon question they ask before execution: whether the currently desired action can be embedded into a future trajectory that preserves safety, and if not, what the closest certifiably safe replacement should be.