In autonomy, the robot repeatedly closes a loop between sensing, decision making, and actuation. From a control perspective, we can view this as a feedback law applied to a dynamical system with uncertainty. Three central concepts are:

• Validation: checking that a proposed autonomous strategy satisfies performance and safety requirements on a sufficiently rich set of operating conditions.
• Generalization: the ability of the autonomous strategy to perform well on new conditions not explicitly used during design, tuning, or testing.
• Failure modes: structured ways in which the closed-loop system can violate requirements, e.g., collisions, task failure, instability, or deadlock.

We consider a discrete-time closed-loop robot model

\[ x_{k+1} = f(x_k,u_k,w_k), \quad u_k = \pi(x_k) \]

where \( x_k \in \mathbb{R}^n \) is the state, \( u_k \in \mathbb{R}^m \) the control input, \( w_k \) an exogenous disturbance or environment variable, and \( \pi \) the autonomous decision rule (which could be hand-coded, optimized, or learned).

Validation asks whether this closed-loop system meets:

• Safety constraints: state must remain in a safe set \( \mathcal{S} \subset \mathbb{R}^n \).
• Performance objectives: cumulative cost (or reward) must be below a target level.

flowchart TD
  R["Requirements (safety, performance)"] --> M["Model of robot + environment set"]
  M --> P["Design or tune policy pi"]
  P --> SGEN["Select test scenarios (simulation + field)"]
  SGEN --> SIM["Run simulations / experiments"]
  SIM --> EVAL["Estimate metrics: success rate, cost, safety margin"]
  EVAL --> DEC["Decision: accept, refine, or redesign"]
        

For this lesson we work with a linear, time-invariant model for the robot dynamics, which matches previous linear control courses:

\[ x_{k+1} = A x_k + B u_k + w_k , \quad u_k = K x_k \]

where \( A \in \mathbb{R}^{n \times n} \), \( B \in \mathbb{R}^{n \times m} \), and \( K \in \mathbb{R}^{m \times n} \) is a fixed feedback gain representing the autonomous rule. The disturbance sequence \( \{w_k\}_{k=0}^{T-1} \) models environment variability (slopes, pushes, sensor errors).

A safety specification is typically given as a constraint set

\[ \mathcal{S} = \{ x \in \mathbb{R}^n \mid h(x) \ge 0 \} \]

where \( h:\mathbb{R}^n \to \mathbb{R} \) is a function encoding obstacle distances, joint limits, or other hardware bounds. A trajectory \( \{x_k\}_{k=0}^{T} \) is safe if \( x_k \in \mathcal{S} \) for all \( k = 0,\dots,T \).

A simple performance objective is an averaged quadratic cost

\[ J_T(K, e) = \mathbb{E}\!\left[ \frac{1}{T} \sum_{k=0}^{T-1} \big( x_k^\top Q x_k + u_k^\top R u_k \big) \,\middle|\, e \right] \]

where \( Q \succeq 0 \) and \( R \succ 0 \) are weighting matrices and \( e \) parameterizes an environment condition (payload mass, slope profile, friction, etc.). The expectation is taken with respect to the disturbances \( w_k \).

A failure event over a horizon \(T\) for environment \(e\) is

\[ F_T(K,e) = \left\{ \exists\,k \in \{0,\dots,T\} : x_k \notin \mathcal{S} \right\} \]

and the corresponding failure probability is

\[ p_{\text{fail}}(K,e) = \mathbb{P}\big( F_T(K,e) \big). \]

Validation aims to ensure both \( J_T(K,e) \le J_{\max} \) and \( p_{\text{fail}}(K,e) \le \varepsilon_{\text{safety}} \) for a sufficiently large set of relevant environments \(e\).

Real robots face a distribution of environments, not a single deterministic case. Let \( p(e) \) denote a probability distribution over environment parameters (payloads, terrains, human behaviors, etc.). The population performance of policy \(K\) is

\[ J_{\text{pop}}(K) = \mathbb{E}_{e \sim p}\!\left[ J_T(K,e) \right]. \]

In practice, we only test the robot on a finite set of scenarios \( e_1,\dots,e_N \), which might come from simulation or experiments. The empirical performance is

\[ \widehat{J}_N(K) = \frac{1}{N} \sum_{i=1}^N J_T(K,e_i). \]

The generalization error is the random quantity

\[ \Delta_N(K) = \widehat{J}_N(K) - J_{\text{pop}}(K). \]

To obtain probabilistic guarantees, we can use classical concentration inequalities. Suppose the cost is normalized so that for every scenario \( J_T(K,e) \in [0,1] \), for example by dividing by a known upper bound. Then Hoeffding's inequality implies

\[ \mathbb{P}\!\left( \left| \widehat{J}_N(K) - J_{\text{pop}}(K) \right| > \varepsilon \right) \le 2 \exp\!\big( -2 N \varepsilon^2 \big). \]

Fix a confidence level \( 1-\delta \). Solving the above for \(N\) yields the sample complexity bound

\[ N \ge \frac{1}{2 \varepsilon^2} \ln\!\left( \frac{2}{\delta} \right) \quad \Longrightarrow \quad \mathbb{P}\!\left( \left| \widehat{J}_N(K) - J_{\text{pop}}(K) \right| \le \varepsilon \right) \ge 1-\delta. \]

In words: if we test on enough independent scenarios sampled from \(p(e)\), then with high probability the empirical performance is within \(\varepsilon\) of the true population performance. The same reasoning applies to safety indicators if we encode them as \(0\)/\(1\) costs.

Consider \(N\) independent closed-loop trials (simulated or real), each from a random environment \(e_i \sim p\) and random disturbances. Define

\[ z_i = \begin{cases} 1 & \text{if the trial fails (constraint violation)} \\ 0 & \text{otherwise,} \end{cases} \quad i=1,\dots,N. \]

For a fixed policy \(K\), these are i.i.d. Bernoulli random variables with parameter \( p_{\text{fail}}(K) \). The empirical failure rate is

\[ \widehat{p}_N(K) = \frac{1}{N} \sum_{i=1}^N z_i. \]

A particularly important case in practice is when no failure is observed, i.e. \( \widehat{p}_N(K) = 0 \). How can we turn this into a bound on the true failure probability?

If \( z_i \sim \text{Bernoulli}(p_{\text{fail}}(K)) \), then

\[ \mathbb{P}\big( \widehat{p}_N(K) = 0 \,\big|\, p_{\text{fail}}(K) \big) = \mathbb{P}(z_1 = 0,\dots,z_N=0) = (1 - p_{\text{fail}}(K))^N. \]

For a desired confidence level \(1-\delta\), the largest failure probability compatible with observing zero failures is obtained by solving

\[ (1 - p_{\text{fail}}^{\max})^N = \delta \quad \Longrightarrow \quad p_{\text{fail}}^{\max} = 1 - \delta^{1/N}. \]

Using the inequality \(\ln(1-x) \le -x\) for \(x \in (0,1)\), we obtain the useful bound

\[ p_{\text{fail}}^{\max} = 1 - \exp\!\left( \frac{1}{N} \ln \delta \right) \le -\frac{1}{N} \ln \delta. \]

For example, with \(N=1000\) trials and \(\delta = 0.05\) (95% confidence), we get \(-\ln(0.05) \approx 3\), hence \( p_{\text{fail}}^{\max} \approx 0.003 \). Even with no observed failure, the robot could still fail with probability about \(0.3\%\); more trials are needed to certify rarer failures.

More advanced scenario-based optimization results extend this reasoning to situations where the policy \(K\) is chosen based on the scenarios \(e_i\), but those are beyond this introductory lesson.

From a systems view, autonomous robot failures almost always arise from a combination of subsystem issues. It is helpful to organize them into a taxonomy aligned with the sense–think–act loop:

• Perception failures: misleading or lost information about the world (mis-detected obstacles, incorrect localization).
• Decision or policy failures: poor closed-loop logic even with correct sensing (unsafe decisions near constraints, oscillations due to poorly tuned gains).
• Actuation and low-level control failures: saturation, delays, or unmodelled dynamics that invalidate stability or tracking assumptions.
• Interaction failures: incorrect assumptions about humans or other agents, leading to deadlocks or unsafe proximity.
• Integration failures: mismatched units, frame inconsistencies, or mis-synchronized data streams.

A compact way to visualize this is as a layered pipeline from sensors to environment:

flowchart TD
  SENS["Sensors and estimation"] --> DEC["Decision and planning / policy"]
  DEC --> CTRL["Low level control and actuation"]
  CTRL --> WORLD["Physical world \n(robot + environment)"]

  SENS -.-> FP["Perception failure \n(wrong state estimate)"]
  DEC  -.-> FD["Decision failure \n(unsafe or suboptimal choice)"]
  CTRL -.-> FA["Actuation failure \n(saturation, delay)"]
  WORLD -.-> FE["Environment mismatch \n(unseen scenario)"]
        

Validation campaigns should be designed such that each category of failure is either rendered extremely unlikely (through design) or detected during testing, not during deployment.

To compare different autonomous strategies \(K\) we need scalar metrics. Typical choices are:

• Expected cost: \(J_{\text{pop}}(K)\) as defined earlier, combining tracking and control effort.
• Probability of failure: \( p_{\text{fail}}(K) = \mathbb{E}_{e}[ p_{\text{fail}}(K,e) ] \).
• Worst-case cost: a robust control metric

  \[ J_{\text{wc}}(K) = \sup_{e \in \mathcal{E}} J_T(K,e) \]

  where \(\mathcal{E}\) is a bounded uncertainty set.
• Risk-sensitive cost: focusing on the tail of the distribution, e.g. the conditional value at risk (CVaR) of the cost distribution.

Safety margins can be formalized geometrically. Let \(\mathcal{O}\) denote an obstacle set. The distance from state \(x\) to the obstacle is

\[ d_{\mathcal{O}}(x) = \inf_{y \in \mathcal{O}} \| x - y \|. \]

One can define a violation margin over a trajectory as

\[ m_{\min}(K,e) = \min_{k=0,\dots,T} d_{\mathcal{O}}(x_k). \]

A policy with larger expected \(m_{\min}(K,e)\) is more robust to small perturbations in sensing and actuation, because it keeps a larger geometric distance from failure.

We now implement a minimal Monte Carlo validation harness for a one-dimensional mobile robot with position and velocity. The dynamics are a discrete-time double integrator:

\[ x_k = \begin{bmatrix} p_k \\ v_k \end{bmatrix}, \quad x_{k+1} = \underbrace{\begin{bmatrix} 1 & \Delta t \\ 0 & 1 \end{bmatrix}}_{A} x_k + \underbrace{\begin{bmatrix} \tfrac{1}{2} \Delta t^2 \\ \Delta t \end{bmatrix}}_{B} u_k + w_k, \quad u_k = K x_k. \]

The safe set bounds position and velocity:

\[ \mathcal{S} = \left\{ x = \begin{bmatrix} p \\ v \end{bmatrix} : |p| \le p_{\max},\; |v| \le v_{\max} \right\}. \]

We estimate the failure probability \(p_{\text{fail}}(K)\) by simulating many random initial conditions and disturbances and counting how often the state leaves \(\mathcal{S}\).

7.1 Python (NumPy)

import numpy as np

dt = 0.05
A = np.array([[1.0, dt],
              [0.0, 1.0]])
B = np.array([[0.5 * dt**2],
              [dt]])

# Simple feedback (e.g., PD-like on position and velocity)
K = np.array([[-2.0, -1.0]])  # shape (1,2)

p_max = 5.0
v_max = 3.0

T = 200                 # horizon length
N_trials = 5000         # number of Monte Carlo trials
sigma_w = 0.05          # disturbance std

def simulate_trial():
    # Random initial position and velocity within a box
    x = np.array([
        np.random.uniform(-4.0, 4.0),
        np.random.uniform(-2.0, 2.0)
    ])
    for k in range(T):
        u = (K @ x.reshape(-1, 1)).item()
        w = sigma_w * np.random.randn(2)
        x = A @ x + (B.flatten() * u) + w
        if abs(x[0]) > p_max or abs(x[1]) > v_max:
            return 1  # failure
    return 0          # success

failures = sum(simulate_trial() for _ in range(N_trials))
p_hat = failures / N_trials
print(f"Empirical failure rate: {p_hat:.4f}")
      

7.2 C++ (Eigen)

#include <iostream>
#include <random>
#include <Eigen/Dense>

int main() {
    using Eigen::Matrix2d;
    using Eigen::Vector2d;

    double dt = 0.05;
    Matrix2d A;
    A << 1.0, dt,
          0.0, 1.0;
    Eigen::Vector2d B(0.5 * dt * dt, dt);
    Eigen::RowVector2d K;
    K << -2.0, -1.0;

    double p_max = 5.0;
    double v_max = 3.0;
    int T = 200;
    int N_trials = 5000;
    double sigma_w = 0.05;

    std::mt19937 gen(42);
    std::normal_distribution<double> normal(0.0, 1.0);
    std::uniform_real_distribution<double> unif_p(-4.0, 4.0);
    std::uniform_real_distribution<double> unif_v(-2.0, 2.0);

    auto simulate_trial = [&]() {
        Vector2d x(unif_p(gen), unif_v(gen));
        for (int k = 0; k < T; ++k) {
            double u = K * x;
            Vector2d w(sigma_w * normal(gen), sigma_w * normal(gen));
            x = A * x + B * u + w;
            if (std::abs(x(0)) > p_max || std::abs(x(1)) > v_max) {
                return 1;
            }
        }
        return 0;
    };

    int failures = 0;
    for (int i = 0; i < N_trials; ++i) {
        failures += simulate_trial();
    }
    double p_hat = static_cast<double>(failures) / N_trials;
    std::cout << "Empirical failure rate: " << p_hat << std::endl;
    return 0;
}
      

7.3 Java (Plain Arrays)

import java.util.Random;

public class MonteCarloValidation {
    public static void main(String[] args) {
        double dt = 0.05;
        double[][] A = { {1.0, dt}, {0.0, 1.0} };
        double[] B = {0.5 * dt * dt, dt};
        double[] K = {-2.0, -1.0};

        double pMax = 5.0;
        double vMax = 3.0;
        int T = 200;
        int N_trials = 5000;
        double sigmaW = 0.05;

        Random rng = new Random(42L);

        int failures = 0;
        for (int i = 0; i < N_trials; ++i) {
            if (simulateTrial(A, B, K, dt, pMax, vMax, T, sigmaW, rng) == 1) {
                failures++;
            }
        }
        double pHat = (double) failures / N_trials;
        System.out.printf("Empirical failure rate: %.4f%n", pHat);
    }

    static int simulateTrial(double[][] A, double[] B, double[] K,
                             double dt, double pMax, double vMax,
                             int T, double sigmaW, Random rng) {
        double p0 = -4.0 + 8.0 * rng.nextDouble();
        double v0 = -2.0 + 4.0 * rng.nextDouble();
        double[] x = {p0, v0};
        for (int k = 0; k < T; ++k) {
            double u = K[0] * x[0] + K[1] * x[1];
            double w0 = sigmaW * rng.nextGaussian();
            double w1 = sigmaW * rng.nextGaussian();
            double pNext = A[0][0] * x[0] + A[0][1] * x[1] + B[0] * u + w0;
            double vNext = A[1][0] * x[0] + A[1][1] * x[1] + B[1] * u + w1;
            x[0] = pNext;
            x[1] = vNext;
            if (Math.abs(x[0]) > pMax || Math.abs(x[1]) > vMax) {
                return 1;
            }
        }
        return 0;
    }
}
      

7.4 MATLAB / Simulink

dt = 0.05;
A = [1 dt; 0 1];
B = [0.5 * dt^2; dt];
K = [-2 -1];

p_max = 5.0;
v_max = 3.0;
T = 200;
N_trials = 5000;
sigma_w = 0.05;

failures = 0;
for i = 1:N_trials
    % Random initial state
    x = [ -4 + 8*rand();
          -2 + 4*rand() ];
    failed = false;
    for k = 1:T
        u = K * x;
        w = sigma_w * randn(2,1);
        x = A * x + B * u + w;
        if abs(x(1)) > p_max || abs(x(2)) > v_max
            failed = true;
            break;
        end
    end
    if failed
        failures = failures + 1;
    end
end

p_hat = failures / N_trials;
fprintf('Empirical failure rate: %.4f\n', p_hat);

% Simulink hint:
% The same dynamics can be implemented using a "State-Space" block with (A,B,[],[])
% plus a gain block for K and a noise source feeding into the state update.
      

These examples implement the same experiment in four languages, emphasizing that validation is a conceptual task: define a model, define safety and performance criteria, then empirically estimate the relevant metrics.

For completeness, we briefly sketch the derivation of Hoeffding's bound for bounded variables, which underpins our generalization guarantees.

Let \(Y_1,\dots,Y_N\) be independent random variables with \( a_i \le Y_i \le b_i \) almost surely and define \( \bar{Y}_N = \frac{1}{N} \sum_{i=1}^N Y_i \). Using the moment generating function and Markov's inequality, for any \(\lambda > 0\) we have

\[ \mathbb{P}\big( \bar{Y}_N - \mathbb{E}[\bar{Y}_N] \ge \varepsilon \big) = \mathbb{P}\big( e^{\lambda N (\bar{Y}_N - \mathbb{E}[\bar{Y}_N])} \ge e^{\lambda N \varepsilon} \big) \le e^{-\lambda N \varepsilon} \, \mathbb{E}\!\left[ e^{\lambda N (\bar{Y}_N - \mathbb{E}[\bar{Y}_N])} \right]. \]

Independence and standard bounds on the moment generating function of a bounded variable yield

\[ \mathbb{E}\!\left[ e^{\lambda N (\bar{Y}_N - \mathbb{E}[\bar{Y}_N])} \right] \le \exp\!\left( \frac{\lambda^2}{8} \sum_{i=1}^N (b_i - a_i)^2 \right). \]

Optimizing over \(\lambda\) gives

\[ \mathbb{P}\big( \bar{Y}_N - \mathbb{E}[\bar{Y}_N] \ge \varepsilon \big) \le \exp\!\left( -\frac{2 \varepsilon^2 N^2}{\sum_{i=1}^N (b_i - a_i)^2} \right). \]

The same bound holds for \(\mathbb{P}( \mathbb{E}[\bar{Y}_N] - \bar{Y}_N \ge \varepsilon )\), and combining the two inequalities yields the standard symmetric form used in Section 3.

In this lesson we connected autonomous robot validation to familiar notions from linear control and probability. By modelling the robot as a closed-loop dynamical system with uncertainty, we formalized safety and performance requirements and expressed them via expected costs and failure probabilities. Using Hoeffding-type bounds and simple Bernoulli models, we saw how finite-sample testing can translate into probabilistic guarantees, and how many trials are needed for a desired confidence.

We also introduced a taxonomy of failure modes in the sense–think–act pipeline and showed a small Monte Carlo validation harness in Python, C++, Java, and MATLAB/Simulink. These concepts form a conceptual foundation for more advanced topics such as formal verification, robust planning, and learning-enabled control in later robotics courses.