The Gap Between Measurements: How Control Theory Now Bounds What Sensors Cannot See

The Gap Between What We Measure and What We Need to Know

In a chemical refinery somewhere in Central Europe, a control system is tracking the temperature inside a reactor. Every 50 milliseconds, a sensor samples the output. Between those samples, the reaction continues unabated—molecules collide, heat flows, concentrations shift. The controller, meanwhile, holds onto the last reading like a photograph of a moving target.

This is the central paradox of modern control engineering: the systems we care about exist in continuous time, but we can only observe them in snapshots. The question is not merely philosophical. When an alarm system needs to decide whether a dangerous threshold has been crossed, it cannot wait for the next sample. It needs to know whether the state could have left a safe region at any moment since the last measurement. A point estimate or a probability distribution at the sampling instant tells us very little about what happened in the spaces between.

Jerzy Baranowski of AGH University in Kraków has spent years thinking about exactly this problem. His latest work, published on arXiv in July 2026, tackles it with mathematical rigor and practical intent. The title—"Uniform High-Probability ISS Tubes for Sampled-Data State Estimation"—does not invite casual browsing. But buried inside is a result that speaks directly to anyone who has ever wondered whether the safety system in a plant, a vehicle, or a medical device is actually telling the truth between its measurements.

Baranowski's framework reduces the worst-case uncertainty bound by 31 percent in a benchmark model of a compartmental system—exactly the kind of interconnected vessel system found in chemical processing, pharmacokinetics, and environmental monitoring. In a more demanding benchmark modeling a flexible-joint robotic manipulator, the reduction is even more striking: a factor of 22.4. Those numbers matter. They represent the difference between a system that can confidently verify constraints between samples and one that cannot.

The Science: Bounded Uncertainty for Continuous Trajectories

Why snapshots fail

Classical state estimation treats the problem probabilistically. The Kalman filter, developed by Rudolf Kálmán in 1960, assumes that noise is Gaussian and provides an optimal estimate of the state given all past measurements. It also computes a covariance—the spread of the estimated probability distribution—which tells us, roughly, how uncertain the estimate is at each moment.

This covariance is seductive. A narrow band around the estimate suggests we know the state well; a wide band suggests we do not. But the covariance describes our knowledge at the sampling instants. It says nothing guaranteed about what happens between those instants. Between samples, the physical system continues evolving, potentially straying far from the last estimate while we remain blind.

This distinction matters operationally. A pointwise 95 percent confidence interval tells you that, at a specific time, the state lies within certain bounds with 95 percent probability. It does not tell you that the state stayed within those bounds throughout the entire interval. Those are fundamentally different statements—one is marginal, the other is simultaneous. The first is useful for reporting local uncertainty; the second is necessary for safety verification.

Consider a scenario from process automation: a tank contains a volatile chemical whose concentration must stay below a safety threshold. A sensor samples the concentration every 100 milliseconds. Between samples, the controller cannot measure anything. If the concentration spikes dangerously close to the threshold between samples, the controller will not know until the next measurement arrives. By then, the overpressure valve may already have activated, or the alarm may have been triggered too late. What we need is a tube—a guaranteed bound that contains the entire continuous-time trajectory over the sampling interval, not just a pointwise statement about the sampling instant.

The sampled-data observer model

Baranowski's paper begins with a continuous-time plant—a mathematical description of a dynamical system whose state evolves according to differential equations:

$$\dot{x}(t)=f(x(t),u(t),t)+w(t)$$

Here, $x(t)$ is the state vector, $u(t)$ is the known input, and $w(t)$ is an unknown process disturbance. The output, which we can measure, is

$$y_k=h(x(t_k),t_k)+v_k$$

where $t_k$ denotes the $k$-th sampling instant and $v_k$ is measurement noise.

Between samples, the sensor holds the last measurement constant. A zero-order-hold reconstructs the continuous signal as

$$\bar{y}(t)=y_k\text{for}t\in [t_k,t_{k+1})$$

The observer uses this held signal to generate estimates:

$$\dot{\hat{x}}(t)=f(\hat{x}(t),u(t),t)+L(\bar{y}(t)-h(\hat{x}(t),t))$$

where $L$ is the observer gain—a matrix that determines how aggressively the estimate corrects toward new information.

The estimation error is $e(t)=x(t)-\hat{x}(t)$. This error does not evolve in isolation; it is driven by three distinct channels that the paper carefully separates:

1. Process disturbance $w(t)$: Unmeasured physical perturbations affecting the plant.
2. Measurement noise $v_k$: Corruption of the sampled outputs.
3. Held-output mismatch ${\zeta }_h(t)$: The mismatch between the held measurement and the current output, caused by state evolution between samples.

This separation is not merely cosmetic. The third channel—intersample mismatch—is entirely an artifact of sampling. In a continuous-time observer, there would be no held output; the observer would have access to $y(t)$ at all times. The sampled-data structure creates a staleness penalty: the older the held measurement, the larger the potential discrepancy between it and the true current output.

From inputs to error bounds: ISS

The mathematical workhorse of the paper is input-to-state stability (ISS), a robustness property introduced by Eduardo Sontag in the 1980s. ISS quantifies how disturbances entering a system translate into state deviations. Formally, if a system satisfies the ISS property, then its state is bounded by a function of the initial condition plus a function of the disturbance size:

$$\Vert e(t)\Vert \le \beta (\Vert e(0)\Vert ,t)+\gamma (\Vert d{\Vert }_{\infty ,[0,t]})$$

The $\beta$ term captures the natural decay of the error in the absence of disturbances—a system that, if left alone, would drive the error toward zero exponentially. The $\gamma$ term captures the steady-state amplification: how large an input of size $s$ can cause the error to grow.

This inequality is the deterministic backbone of the tube construction. Under appropriate conditions—quadratic Lyapunov functions, matrix inequalities that can be cast as LMIs—the ISS estimate can be computed from observer design parameters. The paper shows how to extract explicit formulas for $\beta$ and $\gamma$ from a single matrix $P$ and two constants $a$ and $b$ satisfying a dissipation inequality:

$$\dot{V}(e(t))\le -aV(e(t))+b\Vert d(t){\Vert }^2$$

where $V(e)=e^{\top }Pe$ is a quadratic Lyapunov function. Under these conditions, the ISS gain is

$$\beta (r,t)=\sqrt{\frac{{\lambda }_{\max }(P)}{{\lambda }_{\min }(P)}}{e}^{-at/2}r,\gamma (s)=\sqrt{\frac{b}{a{\lambda }_{\min }(P)}}s$$

The exponential decay rate $a$ determines how quickly the observer forgets its initial error; the ratio ${\lambda }_{\max }(P)/{\lambda }_{\min }(P)$ characterizes the shape of the ellipsoidal level sets of $V$; and $b/a$ enters the steady-state ISS gain.

The probabilistic lifting: Theorem 1

The central theoretical result of the paper is a lifting step that connects probabilistic disturbance bounds to probabilistic error bounds. This is Theorem 1, and it is surprisingly clean.

Assume that the disturbance $d(t)$ is a random process satisfying the following probabilistic envelope: for a given horizon $T>0$ and failure probability $\delta \in (0,1)$, there exists a deterministic quantity ${\bar{d}}_T(\delta )\ge 0$ such that

$$\mathbb{P}(\Vert d{\Vert }_{\infty ,[0,T]}\le {\bar{d}}_T(\delta ))\ge 1-\delta$$

In other words, with probability at least $1-\delta$, the worst-case disturbance magnitude over the horizon does not exceed ${\bar{d}}_T(\delta )$. This is a standard assumption in high-probability robustness analysis.

Now apply the ISS estimate. If the initial error is deterministic, define the time-varying radius

$$r(\tau ;T,\delta )=\beta (\Vert e(0)\Vert ,\tau )+\gamma ({\bar{d}}_T(\delta ))$$

Then the key result:

$$\mathbb{P}\left(\Vert e(\tau )\Vert \le r(\tau ;T,\delta )\text{ for all }\tau \in [0,T]\right)\ge 1-\delta$$

This is a simultaneous statement over the entire horizon. Not "at each time, with 95 percent probability"—that would allow the trajectory to escape the bound at intermediate times. This says that with at least 95 percent probability, the bound holds everywhere on the interval simultaneously. The tube contains the trajectory.

The proof is elegant. The disturbance envelope event implies, via monotonicity of the $\beta$ and $\gamma$ functions, that the ISS bound holds at every time instant on the interval. Because the ISS estimate is deterministic once the disturbance bound is fixed, the entire trajectory is guaranteed.

This result is the bridge from pointwise estimation to interval-wise containment. It tells us that if we can characterize how large the disturbances can be over the horizon, we can translate that into a guaranteed bound on the entire error trajectory—not just the samples.

From ellipsoids to intervals: componentwise tubes

The ISS estimate with a quadratic Lyapunov function yields ellipsoidal tubes: sets of the form

$$\mathcal{T}(t)=\{x:(x-\hat{x}(t){)}^{\top }P(x-\hat{x}(t))\le \rho (t)\}$$

These are ellipsoids centered on the estimate, with shape determined by the matrix $P$ and size determined by $\rho (t)$.

For many engineering applications, componentwise bounds are more natural: intervals like $|x_i(t)-{\hat{x}}_i(t)|\le r_i(t)$ for each state component. A control engineer might want to know not just that the state lies within some multidimensional ellipsoid, but specifically that the temperature stays below a threshold, the pressure stays within limits, and the concentration stays within specification—each with its own bound.

The paper develops both forms. The ellipsoidal form is more compact mathematically and yields tighter bounds in high dimensions. The componentwise form is more interpretable and maps naturally to constraint verification. Both are derived from the same quadratic dissipation inequality framework.

What They Found: Tube Design and Numerical Benchmarks

The co-design problem

With the tube framework established, the paper turns to design: how should we choose the observer gain $L$ to minimize the tube width? This is the co-design problem—simultaneously optimizing the observer and the uncertainty bound.

The objective is to minimize the worst normalized tube half-width over the horizon. For componentwise bounds, this means minimizing

$$\underset{i}{\max }\underset{\tau \in [0,T]}{\max }\frac{r_i(\tau )}{s_i}$$

where $s_i$ is a physical scale for the $i$-th state component (say, the operating range of a temperature sensor). Normalization by physical scales ensures that a bound of 0.1 on a temperature state means the same relative confidence as a bound of 0.1 on a pressure state.

The key observation is that the three disturbance channels—process disturbance, measurement noise, and held-output mismatch—depend differently on the observer gain $L$. The process disturbance enters the error dynamics directly as $w(t)$. The measurement noise enters as $-L\bar{v}(t)$; multiplying the noise by $L$ amplifies or attenuates it depending on the gain. The held-output mismatch enters as $L{\zeta }_h(t)$; here, $L$ appears twice—once multiplying the mismatch, and also determining how large the mismatch can be through the observer dynamics.

This asymmetry is exploited in the co-design. By choosing $L$ appropriately, the designer can trade off robustness against different disturbance types. A high gain makes the observer responsive to new measurements (good for measurement noise) but may amplify the staleness penalty (bad for held-output mismatch). A low gain makes the observer sluggish (good for staleness tolerance) but unresponsive to new information (bad for measurement noise). The co-design optimizes this trade-off.

The resulting problem is a semidefinite program: a linear objective over linear matrix inequalities. For the linear case, the problem is

$$\underset{P\succ 0,L}{\min }\underset{i}{\max }\underset{\tau \in [0,T]}{\max }\frac{r_i(\tau )}{s_i}\text{s.t.}\text{Lyapunov dissipation inequalities}$$

Structured extensions preserve known nonlinear dynamics, allowing the framework to handle systems where some channels are nonlinear while others remain linear.

Benchmark 1: Linear compartment model

The first benchmark is a four-compartment linear system, a model common in pharmacokinetics, chemical processing, and compartmental epidemiology. Each compartment holds some quantity that flows to its neighbors with first-order kinetics. The model has a positive state space—the quantities are always nonnegative—which is common in physical applications.

Baranowski reports two configurations: R1 (bounded process and measurement disturbances) and R2 (the same plus a finite-horizon envelope for contaminated measurement noise, simulating outlier corrupted samples).

The co-designed observer reduces the worst normalized half-width by 31 percent compared to a fixed-gain baseline observer designed without the tube objective. This is a meaningful improvement: it means the monitoring system can verify constraints with tighter bounds, reducing either false alarms or missed detections.

The decomposition of the disturbance envelope is instructive. The three channels—process contribution, direct-measurement contribution, and sample-and-hold staleness—contribute differently to the total bound. In the R1 configuration, the sample-and-hold staleness contribution slightly exceeds the process disturbance contribution, illustrating that in fast-sampling or rapidly evolving systems, the intersample mismatch can dominate the uncertainty.

Table: Linear Compartment Model Results

Configuration	Method	Worst Normalized Half-Width	Improvement
R1	Fixed-gain observer	Baseline	—
R1	Tube co-design	Baseline − 31%	31% reduction
R2	Fixed-gain observer	Higher (contaminated noise)	—
R2	Tube co-design	Improved relative	Significant

The 31 percent figure appears in the abstract and represents the primary quantitative contribution for the linear benchmark. It is not a generic improvement but a specific result for this system under these disturbance assumptions.

Benchmark 2: Flexible-joint robot

The second benchmark is a nonlinear flexible-joint manipulator—the kind of system found in robotic arms, precision manufacturing, and aerospace actuation. The model has four states: motor angle, motor velocity, link angle, and link velocity. The flexibility in the joint introduces coupling between motor and link dynamics that makes the system nonlinear and challenging to estimate.

Here the results are dramatically better. The tube co-design reduces the worst normalized half-width by a factor of 22.4. That is not a 31 percent improvement but a 94.5 percent reduction in the bound. The normalized width goes from roughly 1.0 (meaning the bound spans the entire state scale) to 0.0447.

This improvement reflects the structured nonlinear extension, which preserves known nonlinear channels in the error dynamics while co-designing only the linear part. For a system where the nonlinearities are well-characterized, this selective treatment avoids unnecessary conservatism.

The paper reports detailed Monte Carlo studies. For a worst-case realization (the trajectory that pushes closest to the tube boundary), the normalized error-to-radius ratio peaks at 0.986—a 98.6 percent utilization of the bound, meaning the true error comes within about 1.4 percent of the guaranteed maximum. This is tight: the tube is not excessively conservative for the worst case.

Table: Flexible-Joint Benchmark Results

Method	Max Absolute Half-Width	Max Normalized Half-Width	Ratio
Baseline (contraction)	High	~1.0	—
Tube co-design	Low	0.0447	22.4× improvement

The right panel of

shows the normalized comparison explicitly, with the tube co-design bound (blue) dramatically tighter than the baseline (red) across all state components.

Sampling interval sensitivity

The paper investigates how the tube width scales with the sampling interval $h$. Re-optimizing the observer for each sampling interval, the output-staleness envelope ${\bar{\zeta }}_h=M_{y}h$ grows linearly with $h$—intuitively, the longer you hold a measurement, the further the true state can drift from what the held output suggests. The optimized tube objective reflects this growth, as shown in

(left panel).

Interestingly, the sensitivity is moderate around the nominal value $h=0.01$ seconds. For small variations in sampling rate, the co-designed observer compensates effectively. The co-design is not brittle: it does not assume an exact sampling period but rather accounts for the envelope of possible mismatch.

Normalization and initialization sensitivity

Two additional sensitivity studies address practical concerns. First, how sensitive is the objective to the choice of state scales $s_i$? The paper varies a velocity scale factor $k$ in $s=(1,k,1,k)$. The objective is nearly constant for $k\ge 8$, indicating that the co-design is robust to scale choices within a reasonable range. Second, the objective grows approximately linearly with the initial error radius $r_0$, which is expected from the structure of $r(\tau ;T,\delta )$—a larger initial error simply propagates through the $\beta$ term.

shows these sensitivity analyses. The flatness of the curves for reasonable scale choices is reassuring: the co-design does not require precise a priori knowledge of the operating regime.

Why This Changes Things

A different uncertainty question

The Kalman filter and its variants—extended Kalman filter (EKF), moving-horizon estimation (MHE), particle filters—are designed to estimate the state given the measurements. They minimize estimation error in a statistical sense, and they produce pointwise uncertainty measures like covariances or credible intervals.

The ISS tube framework answers a different question. It asks: given bounds on how large the disturbances can be over a finite horizon, where must the entire trajectory lie? This is a deterministic robustness question, not a statistical estimation question. The Kalman filter tells you where the state is likely to be; the ISS tube tells you where it cannot be, with guaranteed probability.

These questions are complementary. In a monitoring system, the Kalman filter might drive a state display, while the ISS tube drives an alarm or constraint verification. A narrow Kalman band gives operators confidence in the estimate; a tight ISS tube gives safety systems confidence that the state has not violated critical bounds.

The paper acknowledges this explicitly: "The proposed construction is intended as a robustness-oriented monitoring bound used alongside statistical estimator uncertainty, not as a replacement for Kalman or moving-horizon filtering." This is a careful and honest framing.

Operational implications

Consider three application domains where this distinction matters.

Process automation and chemical plants. In a refinery or pharmaceutical facility, safety instrumented systems (SIS) must verify that critical parameters—temperature, pressure, concentration—stay within acceptable limits. If measurements are sampled every 100 milliseconds, a conventional alarm triggered by an out-of-range measurement may not fire until 100 milliseconds after the threshold is crossed. If the dynamics are fast—a rapid exothermic reaction, a pressure surge—100 milliseconds may be too long. An ISS tube around the estimate can provide continuous, guaranteed bounds on the state between samples, enabling faster or more confident alarm decisions.

Robotic manipulation. A robot arm with flexible joints—common in precision assembly, surgery, and space robotics—must estimate link positions and velocities for feedback control. Sensor noise, quantization, and communication delays create uncertainty. The flexible-joint benchmark in this paper is exactly this class of system. A 22.4× reduction in the worst normalized bound means that, for the same sensor hardware, the controller can either operate closer to performance limits (tighter constraint satisfaction) or use slower sampling rates (reduced communication bandwidth) while maintaining the same safety margins.

Autonomous vehicles and aerospace. In self-driving cars, aircraft, and drones, sensor fusion combines data from cameras, lidars, radars, and inertial measurement units. Measurements arrive asynchronously and with varying latencies. The held-output mismatch is a direct model of this staleness. A monitoring system that accounts for staleness—rather than assuming instant, noise-free measurements—can make better decisions about whether the vehicle is in a safe state between sensor updates.

The 31 percent and 22.4× numbers in context

These are not arbitrary benchmarks. The linear compartment model is a canonical system in control theory, appearing in pharmacokinetics (multi-compartment models describe how drugs distribute through the body), epidemiology (SEIR models track disease progression through population compartments), and environmental engineering (pollutant dispersal through linked reservoirs). The 31 percent improvement is meaningful for these applications: it translates directly to tighter constraint verification and potentially fewer false alarms or missed detections in monitoring and alarm systems.

The flexible-joint model is equally canonical in robotics and control. Robotic manipulators with joint flexibility—due to gear compliance, elasticity, or deliberate design for safety—pose well-known estimation challenges. The 22.4× improvement in the worst normalized half-width is a step change, not an incremental gain. It suggests that the co-design framework is particularly well-suited to systems where nonlinearities are structured and well-characterized, and where the sampling penalty (staleness) is the dominant uncertainty source.

What's Next

Caveats and limitations

No technical contribution exists without tradeoffs, and Baranowski is careful to identify several.

The probabilistic envelope must be known. The tube construction requires a probabilistic bound ${\bar{d}}_T(\delta )$ on the disturbance magnitude over the horizon. In practice, deriving such bounds requires either physical modeling (noise power spectral density, disturbance frequency content) or empirical measurement. For Gaussian disturbances, ${\bar{d}}_T(\delta )$ grows with $\sqrt{-\log \delta }$; for heavy-tailed distributions, it may grow much faster. The theory assumes this bound is available; the practitioner must supply it.

The ISS estimate is deterministic. Once the probabilistic envelope is fixed, the tube construction is entirely deterministic. This is a strength—robustness does not depend on distributional assumptions—but it also means that the bounds may be conservative if the actual disturbance realizations are typically much smaller than the worst-case envelope. The probabilistic framing provides a guarantee; whether that guarantee is tight depends on the quality of the envelope.

The finite horizon assumption. The construction is explicitly finite-horizon, not infinite-horizon. For long-duration monitoring, the framework requires repeated application over successive horizons, with appropriate initialization of the next horizon's tube from the previous one's endpoint. This is feasible in practice, but it introduces a subtlety: at the boundary between horizons, the probabilistic guarantee must be recomputed, and there is no guarantee of continuity across the seam.

Nonlinear extensions are structured. The structured nonlinear extension preserves known nonlinear channels but treats unknown nonlinearities conservatively. For highly nonlinear systems with significant unknown dynamics, the tube may be wider than necessary. The 22.4× improvement in the flexible-joint benchmark reflects a favorable structure (known nonlinearities, favorable coupling); other systems may see smaller gains.

Extensions and open questions

The paper leaves several avenues for future work.

Distributed and networked observers. The current framework assumes a single observer with a single sampled output. In networked sensor systems—distributed arrays of heterogeneous sensors with varying sampling rates and communication delays—the model must be extended to multiple observers, multiple sampling schedules, and fusion of delayed measurements. The three-channel separation (process disturbance, measurement noise, staleness) becomes more complex when multiple measurement streams are involved.

Adaptive disturbance envelopes. The probabilistic envelope ${\bar{d}}_T(\delta )$ is fixed in the current construction. An adaptive version might update the envelope based on observed disturbance statistics—tightening it during quiet periods and widening it during disturbed periods. This would provide time-varying tubes that are tighter on average while maintaining worst-case guarantees.

Integral quadratic constraints as an alternative to ISS. The paper uses ISS as the robustness language, but integral quadratic constraints (IQCs) provide a more general framework that can handle dynamic disturbances, not just magnitude bounds. Extending the tube construction to IQC-based robustness analysis might yield tighter bounds for disturbances with particular frequency content.

Experimental validation. The benchmarks are numerical simulations. Experimental validation on physical systems—real chemical plants, robotic manipulators, vehicle testbeds—would be necessary to assess how well the theoretical guarantees translate to practice. Model mismatches, unmodeled dynamics, and practical implementation issues (numerical precision, computational delay) are not addressed in the theoretical analysis.

Integration with existing safety standards. The process industries operate under safety standards (IEC 61508, IEC 61511) that prescribe deterministic verification procedures for safety instrumented systems. ISS tubes could, in principle, be used to provide continuous state bounds for standards-compliant alarm and shutdown logic. Mapping the theoretical construction to the terminology and acceptance criteria of functional safety standards is a nontrivial step that would require engagement with industry bodies and regulatory frameworks.

The broader picture

Control theory has long distinguished between estimation and verification. Estimation asks "where is the state?" Verification asks "is the state safe?" Classical estimation theory, from Kalman to particle filters, answers the first question with increasing sophistication. Classical verification theory, from Lyapunov stability to barrier certificates, answers the second question with increasing conservatism.

Baranowski's work sits at the intersection. It uses the tools of nonlinear control—ISS, quadratic Lyapunov functions, LMIs—to construct verification-oriented bounds on estimation error. The result is not a new estimator but a new way to characterize what an estimator guarantees between measurements.

This matters because modern systems increasingly demand simultaneous guarantees, not just marginal ones. The gap between a pointwise confidence interval and a continuous-time safety bound is the gap between "the state was probably safe at the sampling instant" and "the state was guaranteed safe throughout the interval." For safety-critical applications, the second statement is what we need.

The numbers—31 percent, 22.4×—are not merely academic achievements. They represent the practical benefit of asking the right question. When you ask "where must the trajectory lie?" instead of "where was the state?", you get tighter bounds, more confident decisions, and potentially safer systems.

Final thought

The Kraków paper is dedicated to Professor Wojciech Mitkowski on the occasion of his 80th birthday. Mitkowski, a pioneer in control theory in Poland, has spent a career developing the mathematical tools that make modern automation possible. That Baranowski's work is dedicated to him is fitting: this is the kind of contribution that builds on decades of foundational theory and turns it toward practical problems.

The gap between measurement and truth is as old as measurement itself. Every sensor is sampled, every estimate is stale, every bound is a compromise between comprehensiveness and tightness. Baranowski's ISS tube framework does not close that gap—gaps of this kind cannot be closed—but it maps it precisely, quantifies it rigorously, and shows how to minimize it. That is, in the end, what good engineering does: it does not eliminate uncertainty, but it bounds it.