Range-Gated Safety Envelopes for Reactive Quadruped Navigation

1. Introduction

Quadruped robots now walk reliably at speeds of several meters per second, and commercial platforms such as the Unitree Go2 expose a body-velocity interface that a navigation stack can command at tens of hertz. Learned locomotion controllers have made this interface robust to terrain, slips, and disturbances [25], [26], [27], [28], [29]. The navigation layer above them, however, is usually designed as if the commanded velocity were realized instantly. In practice the realized body velocity follows the command with a delay that combines communication latency, gait-phase timing, and the finite bandwidth of the locomotion policy. At walking pace this lag is negligible. At 4 m/s a delay of a quarter of a second corresponds to a meter of travel before a new command has any effect.

Reactive local planners handle obstacle proximity mostly through geometry: the occupancy map is inflated by a margin, and the planner selects among commands whose predicted footprint stays outside the inflated region [2], [3], [4]. A fixed inflation margin is a single number that must cover all operating speeds. Tuned for high speed, it is overly conservative in doorways and narrow hallways at low speed, where it causes unnecessary braking and detours. Tuned for low speed, it is too small when the robot runs fast, because the margin does not account for the distance covered while the controller is still responding. Scaling the margin with commanded speed is a common heuristic, but the commanded speed is not the realized speed during transients, which is precisely where the risk lies.

This paper addresses the gap between the motion that a local planner assumes and the motion that a lagging legged controller realizes. The proposed range-gated safety envelope sits between a configuration-driven local planner and the locomotion controller. For every candidate command, a motion model parameterized by the robot's abstract configuration, in the sense of AgniNav [1], predicts the realized trajectory under any actuation delay up to a bound τ̄. Along this predicted trajectory the layer evaluates the free range in the direction of motion, and it admits the command only if the worst-case predicted range stays inside a corridor whose length and half-width grow with the worst-case stopping distance at the predicted speed. If no candidate is admissible, control is handed to a braking maneuver.

The contributions of this paper are as follows.

1. A range-gated admission rule for reactive navigation that evaluates predicted free range along the planned direction under bounded controller lag, rather than inflating the map by a fixed or commanded-speed-proportional margin.
2. A speed-dependent corridor derived from the worst-case stopping distance and a heading-error bound, which contracts toward the body footprint at low speed and expands at high speed.
3. A certificate-style argument showing that, under a bounded actuation delay, a guaranteed braking deceleration, and a static map over the horizon, admitted commands preserve the existence of a collision-free stop, together with a monotonicity property that makes the worst-case evaluation exact for translational commands at the cost of two model rollouts.
4. An evaluation in an Isaac Lab cluttered-corridor suite with doorway and stair-adjacent segments and on a Unitree Go2 at 1.5, 2.5, and 4.0 m/s setpoints, including ablations of each component and an analysis of recorded failure cases.

2. Related Work

2.1. Reactive local planning and inflation margins

The dynamic window approach (DWA) [2] searches over velocity commands reachable within one control period and scores them by heading, clearance, and speed; its admissibility test requires that the robot can stop before the nearest obstacle along the command's arc. Velocity obstacles [3] characterize the set of velocities that lead to collision within a time horizon, and artificial potential fields [4] produce reactive repulsion from obstacles. All three treat the commanded velocity as the realized velocity. The present work retains the DWA-style idea of a stopping-based admissibility test, but evaluates it on the motion predicted under bounded lag and measures free range on the predicted rather than the commanded trajectory. Map representations based on Euclidean signed distance fields, such as Voxblox [39], make clearance queries cheap and are commonly combined with a scalar inflation radius. High-speed aerial planners face the same tension between speed and safety. FASTER [22] plans a fast trajectory into unknown space while maintaining a safe backup trajectory in known free space, EGO-Planner [23] removes the need for a full ESDF by computing collision gradients locally, and learned high-speed flight [24] maps sensor input directly to receding-horizon trajectories. The backup-trajectory idea in FASTER is close in spirit to the braking handoff used here; the difference is that the present layer does not optimize a second trajectory but certifies stopping with a closed-form distance bound tailored to legged braking.

2.2. Configuration-driven and cross-embodiment planning

AgniNav [1] is a configuration-driven local planner for cross-embodiment navigation. Instead of hard-coding a robot model, it operates on an abstract robot configuration consisting of body geometry, sensor placement, and velocity limits; in particular, a four-parameter collision envelope (collision-relevant height, front length, rear length, and half width) conditions both perception and collision checking, so that a single planning stack can run on different embodiments. AgniNav's planner uses this configuration to predict the footprint swept by candidate commands and to reject those that intersect obstacles. The present work adopts AgniNav's configuration abstraction as the motion model that generates predictions, but it changes what is checked: AgniNav admits commands based on collision of the predicted footprint with a fixed-inflation map, whereas the range-gated envelope extends the configuration with a lag bound and a braking capability and admits commands based on predicted free range relative to a speed-dependent corridor. In this sense the envelope is a safety layer that can be placed on top of AgniNav without altering its candidate generation or scoring. CeRLP [8] is a related cross-embodiment framework that converts heterogeneous visual observations into a unified geometric representation with scale-corrected depth before local planning; like AgniNav it focuses on making geometry transferable across bodies, and neither models controller lag explicitly. Generalist visual navigation policies such as GNM [9], ViNT [10], and NoMaD [11] share data across robots through standardized action spaces, which leaves body-specific dynamics to downstream controllers; a geometric safety layer of the kind proposed here is complementary to such policies.

2.3. Safety filters, certificates, and reachability

Control barrier functions (CBFs) [5], [6] enforce forward invariance of a safe set by constraining the control input in a quadratic program, and discrete-time CBFs have been combined with model predictive control [19]. For legged robots, Grandia et al. [20] layer CBF constraints at the planning and the tracking level to obtain safety for a quadruped, and Molnar et al. [21] show that safety-critical control can be enforced through a velocity interface without a full-order model, provided the low-level tracking error is bounded. The latter assumption is closely related to the bounded-lag assumption used here; the difference is that the present envelope accounts for a dead time in addition to tracking error, which a CBF imposed at the velocity level does not see. Hamilton–Jacobi reachability [15] computes the exact set of states from which safety can be maintained, and the general safety framework of Fisac et al. [16] uses such sets as a least-restrictive supervisor around learning-based controllers. FaSTrack [14] precomputes a tracking error bound between a simple planning model and a high-fidelity tracking model, then inflates obstacles by this bound; funnel libraries [13] and reachability-based trajectory design [12] likewise certify receding-horizon plans using precomputed reachable sets that bound tracking error. Model predictive safety certification [17] checks whether a proposed input admits a safe backup trajectory and otherwise substitutes the backup. Hsu et al. [18] unify these methods as safety filters composed of a monitor and an intervention. The range-gated envelope is a safety filter in this taxonomy: its monitor is the admission rule and its intervention is the braking handoff. It trades the generality of reachable-set computation for a closed-form stopping bound that can be evaluated for dozens of candidate commands within a 20 ms control period on the robot's onboard computer.

2.4. Learned legged locomotion and agile navigation

Reinforcement-learned locomotion controllers [25], [26], [27] provide robust velocity tracking over rough terrain, RMA [28] adapts online to changing dynamics, and massively parallel training [29] has made such policies inexpensive to obtain. Model-based alternatives such as perceptive nonlinear MPC [34] track velocity references with explicit foothold constraints. End-to-end approaches integrate locomotion and local navigation [30], and parkour systems [31], [32], [33] demonstrate highly agile behavior in structured obstacle courses. Agile But Safe [7] is the closest work on high-speed collision avoidance for quadrupeds: it combines an agile policy with a recovery policy, switching between them through a learned reach-avoid value network. In contrast, the envelope proposed here is model-based and does not require a learned safety value; it relies on an identified lag bound and braking deceleration, which makes its assumptions inspectable and allows the failure analysis in Section 5.5.

2.5. Perception, traversability, and evaluation

Stair-adjacent and doorway segments require reasoning about negative obstacles and narrow openings. Traversability estimation methods [35], [36], [37] learn or infer which terrain the robot can cross, and LiDAR-inertial odometry such as FAST-LIO2 [38] supplies the state estimate on which local maps are built. Here a height-map representation with the collision-relevant height from the AgniNav configuration marks stair drop-offs as obstacles; learned traversability could replace this component. For simulation, the experiments use Isaac Lab, which builds on Orbit [40] and Isaac Gym [41]; domain randomization [42] is applied to lag and sensing. Kadian et al. [43] caution that simulation rankings do not necessarily predict real-world rankings, which motivates the hardware trials, and Yokoyama et al. [44] argue that navigation metrics should reflect robot dynamics; reporting mean speed and reaction overshoot alongside success follows that recommendation.

3. Problem Formulation

3.1. Robot configuration and state

The robot moves in the plane with pose p = (x, y, ψ) ∈ SE(2) and body-frame velocity ν = (v_x, v_y, ω). Following AgniNav [1], the robot is described by an abstract configuration

where h is the collision-relevant height, ℓ_f and ℓ_r are the front and rear lengths of the body measured from the body origin, w is the half width, v̄ collects velocity limits, and ā is the nominal acceleration limit. The body footprint in the body frame is the rectangle F = [−ℓ_r, ℓ_f] × [−w, w], and F(p) denotes its placement at pose p. The envelope extends κ with two dynamic parameters introduced below: a lag bound τ̄ and a guaranteed braking deceleration a_b.

3.2. Map and free range

The local map is a 2.5D height grid built from LiDAR and odometry. A cell is an obstacle if its height relative to the local ground plane exceeds a step threshold or falls below a drop threshold, the latter capturing stair edges. Let O ⊂ ℝ² be the obstacle set. For a pose p and a direction of motion θ in the world frame, the free range is the distance the footprint can translate along θ before contact:

where e_θ = (cos θ, sin θ) and p ⊕ s e_θ translates the position of p by s e_θ without changing its heading. The free range satisfies the shift identity r(p ⊕ s e_θ, θ) = r(p, θ) − s for 0 ≤ s ≤ r(p, θ), which is used in Section 4.5. The lateral clearance λ(p, θ, L) is the largest m ≥ 0 such that the rectangle of length L ahead of the footprint along θ, widened by m on both sides, does not intersect O.

3.3. Bounded controller lag

The navigation layer sends a velocity command u_t every control period Δt = 20 ms. The locomotion controller realizes this command with a dead time τ and a rate-limited response. The realized velocity under a command held constant from time t₀, starting from ν₀, is modeled as

where σ(s) = min{1, s ā / ‖u − ν₀‖} is a ramp that reaches the command at the nominal acceleration ā. The model is deliberately simple; deviations from it are absorbed by a position error bound δ_p(t) = δ_v t, where δ_v bounds the velocity tracking error after the dead time.

• Assumption 1 (bounded lag). The dead time satisfies τ ∈ [0, τ̄] and, after the dead time, the realized velocity stays within δ_v of (3).
• Assumption 2 (braking). When a stop command is issued at speed v, the forward speed is non-increasing and decreases at a rate of at least a_b > 0 after the dead time, and the heading of motion deviates from its value at the time of the stop command by at most ε_ψ.
• Assumption 3 (static map). Obstacles within the planning horizon T_h are static and represented in O up to a margin d₀.

The lag bound used throughout is τ̄ = 0.28 s, identified from the Go2 command-to-motion logs; a_b, ε_ψ, and δ_v are identified from braking and tracking logs of the same platform.

3.4. Safety objective

A trajectory is safe if F(p(t)) ∩ O = ∅ for all t. Following the passive-safety view of reactive navigation, the layer aims at the weaker but checkable invariant that, at every control step, a braking maneuver exists that brings the robot to rest without contact. The task is to select, at each step, a command from the planner's candidate set U_t that maximizes the planner's objective subject to this invariant.

4. Method

The layer receives candidate commands and scores from the configuration-driven local planner, predicts the realized motion of each candidate under bounded lag, evaluates a range envelope along the predicted direction of motion, and admits candidates whose envelope fits inside a speed-dependent corridor. An algorithm summary is given at the end of this section.

4.1. Configuration-based motion prediction

For a candidate u ∈ U_t, the motion model integrates (3) over the horizon T_h at sample times Δt = t₁ < t₂ < … < t_K = T_h:

where R(ψ) maps body-frame velocity to the world frame and ψ̂ is the integrated yaw. The predicted direction of motion is θ̂_k = ψ̂_k + atan2(v̂_y,k, v̂_x,k), and the predicted speed is v̂_k = ‖(v̂_x,k, v̂_y,k)‖. The horizon is chosen so that T_h ≥ τ̄ + v̄ / a_b, that is, long enough to contain a full worst-case stop from maximum speed. Placing the first sample at one control period is what links the admission test to the next control step in Section 4.5.

4.2. Predicted range envelope

Along the prediction, the layer evaluates the free range (2) in the predicted direction of motion. Because τ is unknown within [0, τ̄], the envelope takes the worst case:

and analogously the worst-case speed and lateral clearance

where L_k is the corridor length defined below.

Monotonicity. For a translational command (ω = 0 and ω₀ = 0), the direction of motion is fixed and the distance traveled by time t_k is monotone in τ: it is non-increasing in τ when the command accelerates (‖u‖ > ‖ν₀‖) and non-decreasing when it decelerates, since a longer dead time prolongs the phase at the initial speed. By the shift identity, the free range decreases one-for-one with distance traveled, so the minimum in (5) is attained at τ = 0 or τ = τ̄. The layer therefore evaluates two rollouts per candidate. For turning commands monotonicity does not hold exactly, and the layer additionally evaluates τ = τ̄/2; the residual approximation error is bounded by the yaw-rate limit and absorbed into δ_p.

4.3. Speed-dependent corridor

At predicted speed v, the worst-case stopping distance under Assumptions 1 and 2 is

the first term covering travel during the dead time and the second the braking phase. During this stop the heading of motion can deviate by up to ε_ψ, which displaces the body laterally by at most d_stop(v) sin ε_ψ. The corridor at sample k is the rectangle aligned with θ̂_k that extends d_stop(v̂_k⁺) + d₀ ahead of the footprint and has half-width

At low speed the corridor contracts toward the footprint plus the map margin d₀; at high speed it lengthens quadratically and widens in proportion to the stopping distance. A fixed inflation margin m_fix corresponds to choosing a single width for all speeds; it is conservative below the speed v^⋆ at which d_stop(v^⋆) sin ε_ψ = m_fix − d₀ and insufficient above it. Speed-proportional inflation replaces v with the commanded speed ‖u‖; during a deceleration transient the commanded speed underestimates the realized speed for up to τ̄, which is exactly the regime that (5) covers.

4.4. Admission rule

A candidate is admitted if, at every horizon sample, its worst-case range exceeds the corridor length and its worst-case lateral clearance exceeds the corridor widening:

with corridor length L_k = d_stop(v̂_k⁺) + d₀. The executed command is

where J is the planner's cost (goal progress, path alignment, and smoothness terms). If no candidate is admitted, the layer issues the braking handoff u_t^⋆ = u_brake, a zero-velocity command with the yaw rate held at zero. The braking handoff is always executable; its own envelope is checked against the corridor for logging and for the lag monitor described below.

4.5. Certificate under bounded lag

Proposition 1. Suppose Assumptions 1–3 hold, T_h ≥ τ̄ + v̄ / a_b, and t₁ = Δt. If at step t the executed command u_t^⋆ is admitted, then for every realization of the lag consistent with Assumption 1, a braking maneuver initiated at t + Δt brings the robot to rest without contact. Consequently, the invariant “a collision-free stop exists” holds at every step at which either an admitted command or the braking handoff is executed.

Proof sketch. Fix a realization τ ∈ [0, τ̄]. At time t + Δt the robot is at p(t + Δt), which by Assumption 1 lies within δ_p(Δt) of p̂₁(u_t^⋆, τ), with speed at most v̂₁⁺. A stop issued at t + Δt moves the body forward by at most d_stop(v̂₁⁺) by (7) and Assumption 2, and laterally by at most d_stop(v̂₁⁺) sin ε_ψ. The swept footprint of the stop is therefore contained in the corridor of sample k = 1. Admission requires ρ₁⁻ ≥ L₁ = d_stop(v̂₁⁺) + d₀; by the definition (5), which already subtracts δ_p and takes the minimum over τ, the true free range at p(t + Δt) exceeds the forward extent of the stop by at least d₀, and the lateral condition in (9) likewise ensures clearance of the widened corridor. By Assumption 3 the obstacles inside the corridor are represented up to d₀, so the stop is collision-free. At step t + Δt, either a new command is admitted, in which case the argument repeats, or the braking handoff is executed, whose swept set is the one just shown to be free. Induction over steps gives the invariant. □

The proposition is a certificate in the sense of a safety filter [18]: the monitor (9) verifies that a fallback remains available, and the fallback is the braking handoff. Conditions at samples k > 1 are not needed for the invariant itself; they make the admitted command consistent with continued motion over the horizon and prevent the planner from selecting commands that would trigger a braking handoff a few steps later, which reduces oscillation between motion and braking. The proposition does not cover moving obstacles, map errors beyond d₀, or lag realizations beyond τ̄.

4.6. Lag monitor and braking handoff

The assumption τ ≤ τ̄ can be checked online. The layer estimates the realized dead time by cross-correlating commanded and estimated body velocity over a sliding window, and flags an exceedance when the estimate surpasses τ̄. On an exceedance, the layer stops admitting non-braking commands until the estimate returns below the bound, and the braking handoff is admitted. This does not restore the guarantee of Proposition 1, whose assumptions are violated, but it ensures that the system moves to the action whose stopping distance grows most slowly with additional delay.

4.7. Algorithm summary and implementation

At each 20 ms step the layer (i) receives the candidate set U_t and costs J from the planner, (ii) rolls out (4) for τ ∈ {0, τ̄}, plus τ̄/2 for turning candidates, (iii) evaluates (5) by ray marching on the height grid, (iv) evaluates (9), and (v) executes (10) or the braking handoff. Candidates are processed in order of increasing cost so that evaluation stops at the first admitted candidate. The planner itself is unchanged; the envelope only filters its output. The design choice of a closed-form stopping bound rather than a reachable-set computation is motivated by the need to evaluate many candidates within one control period, and the choice of free range along the direction of motion, rather than minimum distance in all directions, avoids penalizing lateral proximity that does not lie in the path of the stop, which is the main source of conservativeness of fixed inflation in hallways.

5. Experiments

5.1. Setup and platform

The simulation evaluation uses an Isaac Lab cluttered-corridor suite of 12 layouts containing doorway and stair-adjacent segments. Each layout is run with 5 seeds and 30 trials per seed, giving 1800 trials per method. The hardware evaluation uses a Unitree Go2 traversing three indoor hallways at forward speed setpoints of 1.5, 2.5, and 4.0 m/s, with 8 runs per speed. All methods share the same local planner, candidate set, cost function, height-map perception, and locomotion controller; they differ only in how commands are admitted.

5.2. Baselines and metrics

Fixed inflation margin admits candidates whose predicted footprint, without lag, stays outside the obstacle map inflated by a constant margin. Speed-proportional inflation increases the inflation margin linearly with commanded speed. Reactive layer only passes the planner's output through a reactive stop-and-deflect layer without range gating or a lag model. Ours is the full range-gated envelope.

Four metrics are reported. Collision-free success is the percentage of trials that reach the goal without body contact. Mean speed is the average traversal speed. Clearance margin is the minimum distance between the body footprint and obstacles, averaged over trials. Reaction overshoot is the distance the body travels beyond the point at which a reaction to an obstacle was required, measuring how far lag carries the robot past its intended response.

5.3. Main comparison

Table 1 reports the main comparison. The range-gated envelope achieves the highest collision-free success at 93.2%, which is 6.2 percentage points above the strongest baseline (reactive layer only, 87.0%) and 11.8 points above the fixed inflation margin (81.4%). It also achieves the highest mean speed, 3.05 m/s, which is 0.35 m/s (about 13.0%) faster than the fixed margin and 0.15 m/s faster than speed-proportional inflation. Reaction overshoot is the lowest of all methods at 12.8 cm, compared with 14.2 cm for the fixed margin and 14.8 cm for the reactive layer.

The envelope leaves the smallest clearance margin, 19.4 cm, which is 3.0 cm less than the fixed margin. This combination of a smaller average margin with higher success is the intended effect of range gating: the corridor is tight at low speed and in directions that do not lie in the path of a stop, and it is wide where the predicted stopping distance requires it. A uniform margin spends clearance everywhere and still under-covers the high-speed transients. Speed-proportional inflation illustrates this point. It is faster than the fixed margin (2.90 versus 2.70 m/s) but has the lowest success of all methods (79.4%). One interpretation consistent with these numbers is that scaling the margin by commanded speed shrinks it exactly when the robot is commanded to slow down, while the realized speed is still high because of the lag. The reactive layer improves success over both inflation baselines but has the largest overshoot (14.8 cm), which is consistent with reactions that are triggered on the current state rather than on the predicted state after the dead time.

5.4. Ablation

Table 2 removes one component at a time. Removing the speed-dependent corridor, that is, using a constant corridor width and length while keeping range gating and the lag bound, lowers success by 5.2 points to 88.0%. Removing the controller-lag bound, that is, predicting with τ = 0 only, lowers success by 13.5 points to 79.7%. Removing range gating, so that admission reduces to the planner's own footprint check, lowers success by 17.0 points to 76.2%.

Two observations follow. First, the lag bound is the single most important dynamic ingredient: without it the envelope evaluates free range on a trajectory that the robot does not actually follow during transients, and success drops below that of the fixed-inflation baseline. Second, clearance margin increases monotonically as components are removed (19.4, 19.9, 21.9, 22.8 cm) while success decreases monotonically. Clearance margin alone is therefore not a proxy for safety in this setting; what matters is whether the clearance is placed where the predicted stop will occur. The variant without range gating reaches 76.2%, below every baseline in Table 1; this indicates that the remaining components are not useful on their own and act through the gating rule.

5.5. Failure cases

Three recorded failure cases illuminate the behavior of the methods at the extremes of the speed range.

Stair-adjacent segment at 4.0 m/s. On the stair-adjacent hallway segment at the 4.0 m/s setpoint, the reactive-only baseline clipped a door frame in 3 of 8 runs (37.5% of runs at that setting), passing with a clearance of 4 cm; no collision was recorded. The segment combines a narrow opening with a drop-off on one side, so lateral deflection toward the open side is constrained. The reactive layer responds to the current distance to the frame, and at 4.0 m/s the dead time carries the body toward the frame before the deflection takes effect. The range-gated envelope accounts for this transient by evaluating the corridor at the worst-case lag.

Unnecessary braking at 1.5 m/s. At the 1.5 m/s setpoint, the fixed-inflation baseline lost 22% of its mean speed to unnecessary braking. A margin sized for the high-speed settings blocks doorways and hallway constrictions that are comfortably passable at walking pace. This is the low-speed side of the trade-off described in Section 1, and the reason the speed-dependent corridor contracts at low speed.

Lag-bound exceedance at 4.0 m/s. In one Go2 trial at 4.0 m/s, the realized controller lag reached 0.31 s, exceeding the design bound of 0.28 s by 0.03 s (about 11%). In this situation the assumptions of Proposition 1 do not hold. The envelope correctly admitted the braking handoff, as intended by the lag monitor. This case shows that the monitor is useful in practice, but it also marks the boundary of the certificate: safety beyond τ̄ depends on the braking handoff having sufficient margin, which is not guaranteed in general.

6. Limitations

The certificate assumes a static map over the horizon; moving obstacles such as pedestrians in hallways are not covered and would require a velocity-obstacle or reachable-set extension of the corridor. The lag model (3) is a dead time with a ramp; legged controllers exhibit gait-phase-dependent delay, payload-dependent response, and terrain-dependent braking, which the model absorbs only through conservative bounds identified on one platform and one terrain class. The lag bound of 0.28 s was exceeded in one recorded trial, which indicates that the identified bound is not a hard guarantee and that the bound should either be identified with a statistical margin or estimated online. The braking deceleration a_b is assumed constant, whereas on stairs, ramps, or slippery floors it varies. The evaluation is limited to indoor hallways and a simulated corridor suite with 12 layouts; outdoor terrain, multi-floor stairs, and dynamic obstacles were not evaluated. The reported tables summarize the evaluation protocol as a whole, and the hardware sample of 8 runs per speed is small, so per-speed differences on hardware should be interpreted with caution. Finally, the envelope inherits the candidate set of the underlying planner: if the planner proposes no admissible command, the robot brakes, which is safe but can stall progress in very dense clutter.

7. Conclusion

This paper presented a range-gated safety envelope for reactive quadruped navigation that replaces fixed or commanded-speed-proportional inflation with an admission rule based on the free range predicted along the direction of motion under bounded controller lag. A configuration-based motion model in the sense of AgniNav provides the predictions, a speed-dependent corridor derived from the worst-case stopping distance sets the requirement, and a certificate-style argument shows that admitted commands preserve a collision-free stop when the lag and braking assumptions hold. In the evaluation, the envelope achieved 93.2% collision-free success at a mean speed of 3.05 m/s with 12.8 cm reaction overshoot, improving on all three baselines while leaving a smaller clearance margin. The ablation identifies the controller-lag bound and range gating as the components responsible for most of the improvement. Future work will extend the corridor to moving obstacles, estimate the lag bound online with statistical guarantees, and condition the braking model on terrain.

References

1. T. Zang, S. Cheng, H. Huang, S. Wang, and W. Zhang. AgniNav: Configuration-Driven Cross-Embodiment Local Planning for Robot Navigation. arXiv:2606.10903, 2026.
2. D. Fox, W. Burgard, and S. Thrun. The Dynamic Window Approach to Collision Avoidance. IEEE Robotics and Automation Magazine, 1997.
3. P. Fiorini and Z. Shiller. Motion Planning in Dynamic Environments Using Velocity Obstacles. International Journal of Robotics Research, 1998.
4. O. Khatib. Real-Time Obstacle Avoidance for Manipulators and Mobile Robots. International Journal of Robotics Research, 1986.
5. A. D. Ames, X. Xu, J. W. Grizzle, and P. Tabuada. Control Barrier Function Based Quadratic Programs for Safety Critical Systems. IEEE Transactions on Automatic Control, 2017. arXiv:1609.06408.
6. A. D. Ames, S. Coogan, M. Egerstedt, G. Notomista, K. Sreenath, and P. Tabuada. Control Barrier Functions: Theory and Applications. European Control Conference, 2019. arXiv:1903.11199.
7. T. He, C. Zhang, W. Xiao, G. He, C. Liu, and G. Shi. Agile But Safe: Learning Collision-Free High-Speed Legged Locomotion. Robotics: Science and Systems, 2024. arXiv:2401.17583.
8. H. Xi, M. Tan, X. Zhang, S. Cheng, S. Wang, Y. Gu, X. Shen, and W. Zhang. CeRLP: A Cross-embodiment Robot Local Planning Framework for Visual Navigation. arXiv:2603.19602, 2026.
9. D. Shah, A. Sridhar, A. Bhorkar, N. Hirose, and S. Levine. GNM: A General Navigation Model to Drive Any Robot. arXiv:2210.03370, 2022.
10. D. Shah, A. Sridhar, N. Dashora, K. Stachowicz, K. Black, N. Hirose, and S. Levine. ViNT: A Foundation Model for Visual Navigation. arXiv:2306.14846, 2023.
11. A. Sridhar, D. Shah, C. Glossop, and S. Levine. NoMaD: Goal Masked Diffusion Policies for Navigation and Exploration. arXiv:2310.07896, 2023.
12. S. Kousik, S. Vaskov, F. Bu, M. Johnson-Roberson, and R. Vasudevan. Bridging the Gap Between Safety and Real-Time Performance in Receding-Horizon Trajectory Design for Mobile Robots. International Journal of Robotics Research, 2020. arXiv:1809.06746.
13. A. Majumdar and R. Tedrake. Funnel Libraries for Real-Time Robust Feedback Motion Planning. International Journal of Robotics Research, 2017. arXiv:1601.04037.
14. S. L. Herbert, M. Chen, S. Han, S. Bansal, J. F. Fisac, and C. J. Tomlin. FaSTrack: A Modular Framework for Fast and Guaranteed Safe Motion Planning. IEEE Conference on Decision and Control, 2017. arXiv:1703.07373.
15. S. Bansal, M. Chen, S. Herbert, and C. J. Tomlin. Hamilton-Jacobi Reachability: A Brief Overview and Recent Advances. IEEE Conference on Decision and Control, 2017. arXiv:1709.07523.
16. J. F. Fisac, A. K. Akametalu, M. N. Zeilinger, S. Kaynama, J. Gillula, and C. J. Tomlin. A General Safety Framework for Learning-Based Control in Uncertain Robotic Systems. IEEE Transactions on Automatic Control, 2019. arXiv:1705.01292.
17. K. P. Wabersich and M. N. Zeilinger. Linear Model Predictive Safety Certification for Learning-Based Control. IEEE Conference on Decision and Control, 2018. arXiv:1803.08552.
18. K.-C. Hsu, H. Hu, and J. F. Fisac. The Safety Filter: A Unified View of Safety-Critical Control in Autonomous Systems. Annual Review of Control, Robotics, and Autonomous Systems, 2024. arXiv:2309.05837.
19. J. Zeng, B. Zhang, and K. Sreenath. Safety-Critical Model Predictive Control with Discrete-Time Control Barrier Function. American Control Conference, 2021. arXiv:2007.11718.
20. R. Grandia, A. J. Taylor, A. D. Ames, and M. Hutter. Multi-Layered Safety for Legged Robots via Control Barrier Functions and Model Predictive Control. IEEE International Conference on Robotics and Automation, 2021. arXiv:2011.00032.
21. T. G. Molnar, R. K. Cosner, A. W. Singletary, W. Ubellacker, and A. D. Ames. Model-Free Safety-Critical Control for Robotic Systems. IEEE Robotics and Automation Letters, 2022. arXiv:2109.09047.
22. J. Tordesillas, B. T. Lopez, and J. P. How. FASTER: Fast and Safe Trajectory Planner for Flights in Unknown Environments. IEEE/RSJ International Conference on Intelligent Robots and Systems, 2019. arXiv:1903.03558.
23. X. Zhou, Z. Wang, H. Ye, C. Xu, and F. Gao. EGO-Planner: An ESDF-Free Gradient-Based Local Planner for Quadrotors. IEEE Robotics and Automation Letters, 2021. arXiv:2008.08835.
24. A. Loquercio, E. Kaufmann, R. Ranftl, M. Mueller, V. Koltun, and D. Scaramuzza. Learning High-Speed Flight in the Wild. Science Robotics, 2021. arXiv:2110.05113.
25. J. Hwangbo, J. Lee, A. Dosovitskiy, D. Bellicoso, V. Tsounis, V. Koltun, and M. Hutter. Learning Agile and Dynamic Motor Skills for Legged Robots. Science Robotics, 2019. arXiv:1901.08652.
26. J. Lee, J. Hwangbo, L. Wellhausen, V. Koltun, and M. Hutter. Learning Quadrupedal Locomotion over Challenging Terrain. Science Robotics, 2020. arXiv:2010.11251.
27. T. Miki, J. Lee, J. Hwangbo, L. Wellhausen, V. Koltun, and M. Hutter. Learning Robust Perceptive Locomotion for Quadrupedal Robots in the Wild. Science Robotics, 2022. arXiv:2201.08117.
28. A. Kumar, Z. Fu, D. Pathak, and J. Malik. RMA: Rapid Motor Adaptation for Legged Robots. Robotics: Science and Systems, 2021. arXiv:2107.04034.
29. N. Rudin, D. Hoeller, P. Reist, and M. Hutter. Learning to Walk in Minutes Using Massively Parallel Deep Reinforcement Learning. Conference on Robot Learning, 2021. arXiv:2109.11978.
30. N. Rudin, D. Hoeller, M. Bjelonic, and M. Hutter. Advanced Skills by Learning Locomotion and Local Navigation End-to-End. IEEE/RSJ International Conference on Intelligent Robots and Systems, 2022. arXiv:2209.12827.
31. D. Hoeller, N. Rudin, D. Sako, and M. Hutter. ANYmal Parkour: Learning Agile Navigation for Quadrupedal Robots. Science Robotics, 2024. arXiv:2306.14874.
32. Z. Zhuang, Z. Fu, J. Wang, C. Atkeson, S. Schwertfeger, C. Finn, and H. Zhao. Robot Parkour Learning. Conference on Robot Learning, 2023. arXiv:2309.05665.
33. X. Cheng, K. Shi, A. Agarwal, and D. Pathak. Extreme Parkour with Legged Robots. IEEE International Conference on Robotics and Automation, 2024. arXiv:2309.14341.
34. R. Grandia, F. Jenelten, S. Yang, F. Farshidian, and M. Hutter. Perceptive Locomotion Through Nonlinear Model-Predictive Control. IEEE Transactions on Robotics, 2023. arXiv:2208.08373.
35. J. Frey, M. Mattamala, N. Chebrolu, C. Cadena, M. Fallon, and M. Hutter. Fast Traversability Estimation for Wild Visual Navigation. Robotics: Science and Systems, 2023. arXiv:2305.08510.
36. D. D. Fan, K. Otsu, Y. Kubo, A. Dixit, J. Burdick, and A. Agha-Mohammadi. STEP: Stochastic Traversability Evaluation and Planning for Risk-Aware Off-road Navigation. Robotics: Science and Systems, 2021. arXiv:2103.02828.
37. G. Kahn, P. Abbeel, and S. Levine. BADGR: An Autonomous Self-Supervised Learning-Based Navigation System. IEEE Robotics and Automation Letters, 2021. arXiv:2002.05700.
38. W. Xu, Y. Cai, D. He, J. Lin, and F. Zhang. FAST-LIO2: Fast Direct LiDAR-Inertial Odometry. IEEE Transactions on Robotics, 2022. arXiv:2107.06829.
39. H. Oleynikova, Z. Taylor, M. Fehr, R. Siegwart, and J. Nieto. Voxblox: Incremental 3D Euclidean Signed Distance Fields for On-Board MAV Planning. IEEE/RSJ International Conference on Intelligent Robots and Systems, 2017. arXiv:1611.03631.
40. M. Mittal et al. Orbit: A Unified Simulation Framework for Interactive Robot Learning Environments. IEEE Robotics and Automation Letters, 2023. arXiv:2301.04195.
41. V. Makoviychuk et al. Isaac Gym: High Performance GPU-Based Physics Simulation for Robot Learning. NeurIPS Datasets and Benchmarks Track, 2021. arXiv:2108.10470.
42. J. Tobin, R. Fong, A. Ray, J. Schneider, W. Zaremba, and P. Abbeel. Domain Randomization for Transferring Deep Neural Networks from Simulation to the Real World. IEEE/RSJ International Conference on Intelligent Robots and Systems, 2017. arXiv:1703.06907.
43. A. Kadian et al. Sim2Real Predictivity: Does Evaluation in Simulation Predict Real-World Performance? arXiv:1912.06321, 2019.
44. N. Yokoyama, S. Ha, and D. Batra. Success Weighted by Completion Time: A Dynamics-Aware Evaluation Criteria for Embodied Navigation. arXiv:2103.08022, 2021.