The One-Function Solution to Robot Safety That Took 126 Years

Two decades ago, Miroslav Krstić helped invent a way of thinking about control systems that now underpins autonomous cars, drones, and robots that must act safely in the real world. The idea is deceptively simple: split the job into two halves. One function — a control Lyapunov function — guarantees the system will reach its goal. Another — a control barrier function — guarantees it won't crash into a wall, another car, or a human along the way. Stability on one hand, safety on the other.

But here's the tension the field has wrestled with ever since: what do you do when the two goals pull in different directions? A robot that accelerates hard to reach a target might overshoot a safety boundary. A robot overly cautious about safety might never get anywhere. Engineers have spent years stitching these two functions together with quadratic programs — optimization routines that juggle the competing demands at every instant.

In a new paper, Krstić (joined by Bo Wang of the City College of New York) proposes something more elegant: instead of juggling two functions, combine them into a single mathematical object that encodes both stability and safety at once. The result is a recipe for building what they call a control Lyapunov-barrier function (CLBF) — one function whose decrease naturally guarantees that a system reaches its target while never leaving its safe zone. It's the mathematical equivalent of teaching a robot to both hurry and be careful in a single sentence.

The paper arrives at a moment when safety-critical control isn't just academic. Self-driving cars, warehouse robots, and increasingly autonomous aircraft all face the same core problem: stability and safety can conflict, and resolving that conflict wrong can be catastrophic. A clean, principled way to encode both goals in one object is more than a theoretical nicety — it's a design tool for machines we trust with physical consequences.

The Science

To understand what Wang and Krstić have built, it helps to know the origin story. Lyapunov functions date to the 1890s, when the Russian mathematician Aleksandr Lyapunov found a way to prove that a system will settle at an equilibrium without solving its equations directly. Think of it as a kind of energy function: if a controller can always make this "energy" decrease — no matter where the system is — then eventually the system has to reach the bottom, the goal state throughput.

Barrier functions are younger, added to the control toolbox over the last decade or so. Instead of measuring progress toward a goal, they measure distance to a danger zone. The set $\mathcal{C} = {x \in \mathbb{R}^n : h(x) \geq 0}$ marks the safe region — where a barrier function $h$ is nonnegative. A control barrier function guarantees the system never crosses $h = 0$, the safety boundarycars, drones keep their distance.

The standard modern approach, the CLF-CBF quadratic program, runs an optimization at every time step. At each instant, the robot's computer asks: what input both pushes the Lyapunov function down (toward the goal) and keeps the barrier function up (away from danger)? This works, but it's fragile. The two constraints can conflict, and when they do, there's no guarantee a single input satisfies both. Researchers have spent years studying when CLFs and CBFs are "compatible" — when such a compromise input exists at all.

Wang and Krstić take a different path. What if, instead of two constraints, there was one function that captured both? Define $W = F(V,h)$ — a single function built from the CLF $V$ and the CBF $h$. If $W$ increases with $V$ (rewarding progress) and decreases with $h$ (penalizing approach to the boundary), then a single decrease condition on $W$ might do all the work.

The key insight of the paper is that the entire behavior of such a combined function is governed by a single nonnegative number at each state: the weight $\kappa = -F_s/F_v$, the ratio of the function's sensitivity to the barrier value versus its sensitivity to the Lyapunov value. This weight says how much the combined function cares about safety relative to progress at any given point. And here's the crucial twist: because $\kappa$ depends only on the values $(V,h)$ — not on the full state $x$ — every state that happens to share the same Lyapunov and barrier values must use the same weight. A weight that works at one such state must work at all of them.

This is the paper's main conceptual contribution: the "joint-level-set admissibility condition." The decrease condition splits into two independent concerns — finding weight functions $\kappa(V,h)$ that are admissible in this sense, and then checking whether the resulting $W$ is proper (grows without bound as you approach danger or escape to infinity, so its sublevel sets stay trapped in the safe region).

What They Found

The results are constructive, not just existential. Given an admissible weight $\kappa$, the researchers show you can build $F$ by solving a first-order partial differential equation, followed along its characteristic curves — a method reminiscent of the construction of time-varying Lyapunov functions for nonholonomic systems (Krstić, 2026). The construction separates cleanly: the weight $\kappa$ shapes the "geometry" of the function (its characteristic curves), while a boundary function $\psi$ assigns actual values along a reference line $s = s_b$.

The approach yields explicit closed-form families. In the simplest, multiplicative case, $F(v,s) = ve^v/s$ emerges naturally from a weight $\kappa(v,s) = v/[s(1+v)]$ — giving the striking closed-form CLBF $W(x) = V(x)e^{V(x)}/h(x)$. This one-line function does what the field has been doing with running optimizations: its decrease condition simultaneously drives the system to the origin and keeps it inside the safe set.

The paper's most subtle finding is a cautionary one: admissibility alone doesn't guarantee safety. Proposition 1 identifies an integrability obstruction to properness. If the maximum weight $\kappa_{\max}(s)$ is integrable near the safety boundary — if $\int_0^{s_0}\kappa_{\max}(s),ds < \infty$ — then any $F$ with that weight fails to be proper. The intuition: the combined function needs the barrier to contribute a steep "wall" near $h = 0$ to trap trajectories in the safe set. If the weight grows too slowly as the boundary approaches, the function's sublevel sets leak out to the boundary, and the safety guarantee collapses.

The difference is stark enough to see in a single linear example. The system $\dot{x} = Ax + Bu$ with a quadratic Lyapunov function and linear barrier has disconnected admissible sets — $\mathcal{A}(v,s) = [0,\sqrt{v}) \cup (k_+(v,s), \infty)$ for $s \geq 1$ — showing that even in a linear setting, the set of "safe weight assignments" need not be a simple interval (

Admissible weights split into two disconnected branches near the safety boundary

Label	Value
Safe zone (0 < s < 1)	0
Near-boundary, low branch	455
Near-boundary gap	45
Near-boundary, high branch	492

Values show the endpoints of the admissible branches for a representative near-boundary state from the paper's linear Example 1.

). One admissible weight, $\kappa \sim 1/s$, grows fast enough near the boundary to produce a proper CLBF (

Boundary growth rate decides whether safety is guaranteed

Label	Value
Growth ~ 1/s (proper)	1
Growth ~ 1/√s (not proper)	13
Integrability threshold	100

Chart compares how the two weight selections in Example 1 grow as the barrier value s approaches 0, with the integrability threshold of Proposition 1.

). Another admissible weight, $\kappa \sim 1/\sqrt{s}$, is slower-growing, integrable at $s=0$, and therefore provably cannot produce a proper function. Both are admissible; only one is safe. The distinction lives entirely in the growth rate of the weight near the boundary.

Why This Changes Things

This result matters because it redraws the boundary between what's easy and what's hard in safety-critical control. The prevailing toolchain — CLF-CBF quadratic programs — treats stability and safety as separate constraints to be reconciled pointwise, at every time step, with an optimization. That's computationally demanding and conceptually awkward: the two goals are always in a kind of negotiation, and negotiations can fail.

A CLBF collapses the negotiation into a single decrease condition. This isn't just cleaner mathematics; it changes what's computable and what's provable. With a proper CLBF, safety is guaranteed before any control input is computed — the sublevel sets $\Omega_c(W)$ are compact and contained in the safe interior, so any trajectory along which $W$ decreases is automatically safe. There's no runtime optimization whose failure could undermine the guarantee.

The paper also surfaces a genuine theoretical subtlety that practitioners will need to respect: weight admissibility and properness are independent properties, and only one of them is guaranteed by the decrease condition. The integrability obstruction (Proposition 1) is a rigorous warning that you can't just pick any weight that satisfies the local decrease condition and expect safety. The weight must also grow sufficiently fast near the boundary — a quantitative requirement that the paper makes precise.

There's also a forward-looking motivation hiding in the construction. The single $L_gW$ term that a CLBF provides is exactly the structure needed for inverse optimal control — designing a controller that is provably optimal with respect to some cost, rather than merely stable. The paper notes that its construction "provides a natural starting point for extending inverse-optimal feedback design to safe stabilization through the CLBF $W$" (Krstić, 2026). This suggests a path toward controllers that are not just safe and stable, but provably efficient — the missing piece for machines that must justify their choices in energy, time, or risk.

What's Next

The paper is honest about what it doesn't yet settle. The characteristic construction requires the weight $\kappa$ to be continuously differentiable and for characteristic curves to be well-defined across the relevant domain — regularity conditions that may not always hold in practice. Positive definiteness and properness of $W = F(V,h)$ must still be verified separately; the weight characterizes the decrease condition but hands off the safety verification to a separate check.feedback law — applying Sontag's formula to the constructed CLBF $W$ yields an $L_gW$-type controller that renders $\dot{W} < 0$ away from the origin while keeping trajectories safe. But the inverse-optimal treatment — proving that such a controller is optimal with respect to some meaningful cost — is explicitly left for future work, as is the broader question of which systems admit CLBFs of this form at all.

The examples in the paper are deliberately modest — low-dimensional systems chosen to illustrate the mechanics rather than stress-test the approach on real hardware. The real payoff would come from extending these constructions to higher-dimensional, nonlinear, and partially unknown systems, where the tension between stability and safety is most acute)Skip-what can be proven about the growth of weights near boundaries. For an autonomous vehicle approaching a pedestrian, for a warehouse robot navigating crowded aisles, for a drone landing near people, the question isn't just whether a safe controller exists — it's whether we can prove it's safe before deploying it. Wang and Krstić's construction offers a way to build that proof into the mathematics from the start.,

It's a quiet kind of progress. No hardware demonstrations, no benchmark scoreboards. Just two control theorists asking a clean question — when can one function do the work of two? — and answering it with a constructive recipe, a warning about its limits, and a vision for what comes next. For a field that increasingly controls machines with physical consequences, that's not a footnote. It's the whole point.