An arXiv preprint describes an online way to estimate how much additional disturbance a robust model predictive control (MPC) system can accommodate after a finite disturbance falls outside the set it assumed. Rather than immediately solving the full reserve linear program, the method builds a lower and an upper certificate around the system's disturbance reserve, then tightens those bounds through a sequence of smaller solves.
The aim is to keep a valid answer available when online computation is limited. The basis-first adaptive algorithm preserves validity after each completed reduced solve, allows the calculation to stop at a prescribed tolerance and becomes exact after finitely many hierarchy expansions.
Why the reserve is state-dependent
Here, reserve means the maximum admissible disturbance scaling at a particular state. Strong duality in the underlying linear program gives an equivalent dual characterization: the reserve is the minimum dual objective over all dual-feasible multiplier vectors. That lets the procedure use a primal calculation for a lower bound and a dual calculation for an upper bound.
That state dependence is visible in the double-integrator example. Two states with equal position margins had reserves of 8.90 times 10 to the minus 4 and 3.19 times 10 to the minus 2, a 35.8-fold difference. In other words, the same position margin did not imply the same disturbance reserve in the tested formulation.
A gap that can be tightened on demand
For each modeled or realized successor, the selected primal certificate is no greater than the true reserve, while the selected dual certificate is no smaller. The pair therefore encloses the true reserve and gives bounds on how much reserve was depleted by the disturbance.
The width of that envelope is the sum of the two statewise certificate gaps. It cannot increase when either hierarchy is expanded, and terminal expansion gives the exact state reserve under the stated condition. The result is a tunable calculation: more expansion narrows the reported uncertainty, while a prescribed tolerance can end the work sooner.
The simple test
The numerical test first used a double integrator sampled every 0.1 seconds, with a 15-step horizon. It imposed absolute bounds of 4 metres on position, 2 metres per second on velocity and 1 metre per second squared on input magnitude.
In an illustrated recycled-basis-failure case, the envelope contained the exact depletion after every completed solve and reached the prescribed tolerance after six reduced solves, before either exact endpoint was reached. Across 4,000 retained pairs, no reported violation of validity, monotonicity, endpoint exactness or repair feasibility exceeded 10 to the minus 7.
Among feasible signed repairs, approximately 60.3 percent had a negative signed reserve adjustment, which the paper treats as a reserve gain.
A larger benchmark made the tradeoff visible
The second benchmark used a zero-order-hold discretized linear bicycle model. It ran at a 0.05-second sampling time, a vehicle speed of 15 metres per second and horizons of 20, 40 and 60 steps.
At a two percent certificate tolerance, the 40-step setting had a median normalized width of 0.01109 and a paired median speedup of 2.03 times relative to warm-started full solves. At 60 steps, the median normalized width was 0.00845 and the paired median speedup was 4.97 times.
For the 40-step setting, the proposed method reported zero violations, a median runtime of 2,003.5 microseconds, a 95th-percentile runtime of 10,500.4 microseconds and early stopping in 92.3 percent of cases. The result captures the method's intended tradeoff: an allowed tolerance can end the calculation before the hierarchy is fully expanded, while further expansion narrows the certificate.
What the numbers do, and do not, establish
The authors also tested the bound in 100 domain-conditioned closed-loop runs lasting 40 steps each. Of 4,005 disturbance candidates, five were rejected; no trajectory restart was required, and the cumulative bound held at all 4,000 accepted states within 10 to the minus 7. The maximum numerical shortfall was 1.83 times 10 to the minus 13.
Those are numerical certification results for the two reported model benchmarks. They do not establish physical closed-loop safety or show that the timing and certificate tightness will carry over to nonlinear, time-varying or adaptive-uncertainty-set MPC. The speed comparisons also depend on the hierarchy construction and solver implementation used in the tests, so the broader computation tradeoff remains an open question.
Publication and support
The document is identified as arXiv version 1, dated 28 Aug 2026. The work was supported in part by NSF grants SLES-2415479 and CPS-2227185, NASA ULI grant 80NSSC25M7104, and the NYUAD Center for AI and Robotics through Tamkeen under NYUAD Research Institute Award CG010.
Paper data and sources
Original title: Anytime Primal--Dual Certification of the Maximum Disturbance Radius in Robust MPC
Authors: Wenqi Cai, Muhammad Bakr Abdelghany, Kyriakos G. Vamvoudakis, Anthony Tzes
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-28
DOI: Not available
Original paper · Full text