Robustness, Calibration, and Safe Control

A hypothetical warehouse robot learns a world model on a dry floor. Your planner trusts narrow prediction intervals when choosing a maneuver. If the floor becomes wet, the relationship between action and motion can change without the model's confidence changing immediately. You may then choose an action that was reasonable under the old dynamics but inappropriate under the new ones. This is a motivating scenario, not a reported robot experiment; the executable example below uses a synthetic oscillator not a wheel-torque model.

Accuracy on the training regime does not establish accuracy after this change. What failed is the assumption that the old transition law and uncertainty estimates still apply. This chapter examines how to test those assumptions and how to limit reliance on them.

The preceding chapter, Failure Modes and Model Exploitation, concerns how world models break. Here we develop an engineering response through four connected pieces:

• Distribution shift and stress testing: how to evaluate specified changes before deployment and monitor observed mismatches.
• Calibrated uncertainty and abstention: how to make the model's own confidence a usable decision signal, and how to decline to act when it is not.
• Risk-sensitive and constrained planning: how to plan against a distribution of futures rather than a single imagined one.
• Fallback policies and runtime assurance: how to separate a performance controller from a fallback, and what must be proved before calling that fallback safe.

These topics interact. Stress testing identifies specified changes worth evaluating; calibration measures whether predictive probabilities agree with outcomes in an evaluated population. Neither is a universal shift detector. Risk-sensitive planning changes how sampled futures are scored, while runtime assurance checks whether the performance controller may continue operating under independently justified assumptions. Each link needs evidence: a calibration estimate does not prove future coverage, a risk objective does not enforce a hard constraint, and a fallback is not certified merely because its test trajectories stay in bounds.

Throughout, we use a one-dimensional positioning task with a damped oscillator as the plant. The printed tables come from executable code, so you can change the assumptions and observe the consequences. This modest example exposes the distinction between prediction accuracy, uncertainty estimates, and closed-loop outcomes. Larger learned systems introduce additional representation and estimation questions; scale alone does not establish that confidence tracks competence.

Distribution shift is the umbrella term for any mismatch between the distribution the world model was trained on and the distribution it is asked to act in. It is worth being precise about what can shift, because different kinds of shift demand different responses, and because a model's own uncertainty carries different amounts of information about each type.

• Input shift. The distribution of states and actions changes. In pure covariate shift, the conditional transition law given those inputs stays fixed. Observed inputs permit label-free distribution tests, but detection power depends on the change, representation, sample size, and test; visibility does not guarantee detection.
• Dynamics shift (concept shift). The conditional transition law changes, potentially at inputs that initially look familiar. The floor got wet; the payload got heavier; the actuator got slower. The model can be confidently wrong without obvious input novelty, and changed dynamics may alter the states visited later. This is the failure mode that motivates the entire chapter.
• Observation shift. The sensor or observation pathway changes: a new camera, changed calibration, lighting, or noise profile. An inaccurate state estimate can undermine an otherwise adequate transition model. Observation diagnostics and transition residuals can both signal a problem, but residuals alone need not identify its cause.
• Task shift. Goals, rewards, or constraints change. A change from docking to transit may alter the objective and also change visited states and actions. A new operating regime alone is input shift unless the task definition changes too.
• Hidden-parameter shift. A latent parameter value or its distribution changes, abruptly or gradually. Within a parameterized plant family, drifting friction is one mechanism of dynamics shift; it is not a definition covering every structural change.

The distinction affects what ensemble disagreement can reveal. The members may agree on a wrong transition when the conditional dynamics change. Conversely, disagreement can increase on novel inputs, but that response is not guaranteed: shared model bias can keep all members confident outside the data. We measure these responses in a particular synthetic example rather than assuming either is a reliable detector.

Held-out validation measures prediction on its chosen test population. A same-generator split is useful for checking generalization within that generator, but may miss deployment conditions absent from it. Safety-relevant samples can include both rare in-distribution cases and out-of-distribution conditions. A large average RMSE improvement can coexist with serious boundary errors; report conditional and closed-loop outcomes rather than assuming the aggregate captures them.

Stress testing changes the population deliberately: under which plausible conditions does performance degrade, and which consequences follow? It can falsify a claim while also producing measurements. A useful output includes quantitative outcomes and an inventory of tested mechanisms, failures, and untested conditions. Failure to find a problem is evidence about the search performed, not proof of safety or evidence that the search was necessarily inadequate.

Good stress tests are built from a shift taxonomy for the specific domain, in which each category probes a distinct mechanism by which reality can diverge from training:

• Parameter stress. Perturb parameters over an explicitly justified domain, for example reducing friction, increasing mass, or reducing actuator gain. Search for adverse values within that domain; physical constraints may make it bounded.
• Input-distribution stress. Test high velocities, large commands, or near-boundary positions with sparse training coverage. Ensemble disagreement may rise there, but sparse coverage does not guarantee high estimated uncertainty.
• Structural stress. Add an effect outside the model class, such as an unrepresented delay or coupling. More data cannot remove that representational limitation while the class remains fixed. This tests a different limitation from parameter error.
• Temporal stress. Change the control rate, introduce jitter, or hold commands longer. Whether errors remain tolerable depends on the plant, controller, and timing. Evaluate closed-loop consequences rather than assuming a universal relation between rate difference and degradation.

When a plausible stress condition breaks the model, options include broadening data, changing the model class, restricting the operating domain, redesigning the controller or hardware, or adding detection and fallback. These approaches can complement one another but none universally handles rare or unbounded disturbances. A fallback needs its own operating assumptions. Part VI: Learning World Models at Scale covers learning and adaptation; here we evaluate diagnostic and control responses.

Let us set up the running example. The plant is a mass on a spring, integrated with a semi-implicit Euler step at $\Delta t = 0.1\,$s. The state at step $t$ is the pair $(p_t, v_t)$. The update advances velocity first and then uses that new velocity to advance position.

$$\begin{aligned} a_{t+1} &= -k\,p_t - c\,v_t - f\,\mathrm{sign}(v_t) + g\,u_t \\ v_{t+1} &= v_t + \Delta t\, a_{t+1} + \epsilon_t, \qquad \epsilon_t \sim \mathcal{N}(0, \sigma_p^2) \\ p_{t+1} &= p_t + \Delta t\, v_{t+1} \end{aligned}$$

where:

• $p_t$: position at step $t$, the coordinate the safety envelope constrains
• $v_t$: velocity at step $t$
• $a_{t+1}$: the acceleration computed at step $t$ and used to advance the velocity
• $u_t$: the scalar control action applied at step $t$; it is the book's action $a_t$ under a local notation chosen to distinguish it from acceleration
• $\Delta t = 0.1\,$s: integration timestep
• $k$: stiffness, the restoring force per unit displacement; $c$: viscous damping, the drag proportional to velocity; $f$: dry friction, a constant drag opposing motion; $g$: actuator gain, how much acceleration one unit of command produces
• $\epsilon_t \sim \mathcal{N}(0, \sigma_p^2)$: process noise on velocity, the part of the dynamics no deterministic model can capture

The first equation computes acceleration; the second advances velocity and adds its innovation; the third uses that new velocity to advance position. Here $a_{t+1}$ denotes acceleration, not the action: the scalar action is $u_t$. We observe the full simulated state $s_t=(p_t,v_t)$, so no observation model or belief filter is implemented. Mass is normalized to one and action units are abstract; this oscillator is not a wheel-torque model. The simulator permits dry friction, but every experiment here sets $f=0$. Semi-implicit Euler advances velocity before position; its stability depends on the timestep and dynamics, not on the method name alone.

We build two stress sets. The input-shift generator increases initial position and velocity scales and draws abstract actions from $[-0.70,0.70]$, twice the training range, while retaining nominal plant parameter sampling. The dynamics-shift generator retains training-scale initial conditions and commands but draws damping from $[0.00,0.05]$ instead of $[0.70,1.10]$. These are distinct interventions on the generator. Later states can change under either intervention, so a dynamics change does not imply that every encountered input remains in-distribution. The measured response of the ensemble, not input visibility alone, tells us what its diagnostic does here.

The two coordinates have different scales, so an aggregate comparison can hide component-specific behavior. Inspect the earlier per-coordinate output and the reliability curves as well. This plot is a summary of the specified tests, not a general validation of the uncertainty estimator.

A model is calibrated if its stated probabilities match observed frequencies. Concretely: among all the predictions where the model says "there is a 90% chance the true value lies in this interval," roughly 90% should contain the truth. Calibration is a property of the whole predictive distribution, not of any single prediction, so it can only be measured in aggregate. This is a subtle but important point: you cannot ask whether a single interval is calibrated, any more than you can ask whether a single coin flip is fair. You ask it about the set of predictions that share the same confidence level, and you compare the claimed frequency to the realized one.

In Bayesian Filtering and Belief States, a posterior represents state uncertainty; Stochasticity and Uncertainty distinguishes uncertainty sources. Here we additionally approximate predictions by $\mathcal N(\mu(x),\sigma^2(x))$. Producing a mean and variance does not imply Gaussian shape. Quantile-based coverage can be tested without finite moments; standardized residuals using mean and standard deviation require finite moments and a positive scale.

For a Gaussian predictive distribution, the natural diagnostic is the standardized residual. If the model is honest, each observation $y_i$ should look like a draw from $\mathcal{N}(\mu(x_i), \sigma^2(x_i))$, so dividing the raw error by the claimed standard deviation puts every prediction on a common scale:

$$z_i = \frac{y_i - \mu(x_i)}{\sigma(x_i)}.$$

where:

• $y_i$: the observed target for the $i$-th sample
• $\mu(x_i)$: the model's predicted mean at input $x_i$
• $\sigma(x_i)$: the model's predicted standard deviation at input $x_i$
• $z_i$: the standardized residual, measuring how many predicted standard deviations the observation deviates from the mean

For the Gaussian location-scale intervals used here, calibration at all central levels requires the absolute standardized residuals to have the corresponding Gaussian quantiles. Calibration alone does not imply that signed residuals are standard normal. The empirical coverage at nominal level $\alpha$ is:

$$\hat{c}(\alpha) = \frac{1}{N} \sum_{i=1}^{N} \mathbf{1}\!\left[\,|z_i| \le \Phi^{-1}\!\left(\tfrac{1+\alpha}{2}\right) \right] \approx \alpha .$$

where:

• $N$: the number of evaluated samples
• $\alpha \in (0,1)$: the nominal coverage level, the fraction of probability mass the interval is supposed to contain
• $\Phi^{-1}$: the standard normal quantile function, so $\Phi^{-1}\!\left(\tfrac{1+\alpha}{2}\right)$ is the half-width of the central interval containing fraction $\alpha$ of a standard normal
• $\mathbf{1}[\cdot]$: the indicator, equal to $1$ when the inequality holds and $0$ otherwise
• $\hat{c}(\alpha)$: the empirical fraction of samples whose standardized residual falls inside that central interval

Plotting $\hat{c}(\alpha)$ against $\alpha$ gives a reliability diagram. The diagonal represents matching marginal coverage at the displayed levels; curves below it deliver less coverage than claimed, and curves above it deliver more. Sampling uncertainty remains, and the diagram does not establish conditional coverage at every state. Overcoverage may accompany unnecessarily wide intervals; undercoverage matters when decisions rely on margins that are too narrow. Neither direction alone measures controller safety.

Calibration describes predictions on a population. Abstention is a decision rule built on top of an uncertainty score. Here we rank predictions by predictive variance and evaluate only a retained fraction. An informative ranking may reduce retained-set error; it does not entitle a model to act safely. An actual abstention system must also specify what happens to the rejected cases and evaluate that alternative.

Possible designs include a planner that defers high-disagreement proposals, a manipulator that requests confirmation, or a controller that selects a predefined fallback. These are examples of design choices, not claims about every deployed system. A percentile trigger asks whether a score is unusual relative to a reference population; an absolute trigger asks whether a specified tolerance is exceeded. Either can be appropriate when its operating population and consequences have been validated.

One way to evaluate this ranking is the risk-coverage curve. Sweep the retained fraction $\rho$, compute retained-set RMSE, and plot it against $\rho$. The area summarizes this particular loss and population, so report the loss definition and coverage range. An uncertainty score independent of errors gives approximately unchanged expected error under random retention; finite samples fluctuate. Useful rankings often give lower error at lower coverage, but empirical curves need not be monotone.

Everything so far has been about the model. Now we change the objective. Minimizing expected cost is risk-neutral with respect to that cost: a certain cost of 10 and an equally likely cost of 0 or 20 have the same expectation. A point prediction does not force risk neutrality; a controller can still use conservative margins, robust constraints, or nonlinear costs. A predictive distribution permits explicit tail objectives, whose suitability depends on the application's losses and requirements.

Two families of alternatives recur in practice:

• Risk-sensitive objectives use a tail-sensitive functional. For integrable costs, CVaR at level $\alpha$ averages the worst $(1-\alpha)$ probability mass, using fractional boundary mass when necessary. It approaches expected cost as $\alpha$ decreases to zero; near one it emphasizes increasingly extreme upper-tail costs. Here $\alpha=0.75$ selects the worst quarter.
• Constrained objectives separate feasibility requirements from performance. A pointwise constraint limits predicted states; a chance constraint such as $\Pr[|p|>p_{\max}]\le\delta$ imposes a hard bound on violation probability, not a promise that every realized state stays inside. The objective can itself be expected cost or a risk-sensitive functional.

The expected-cost objective summarizes average loss; CVaR summarizes a chosen upper tail. These answer different questions. Expected cost can penalize rare failures heavily if their assigned loss is large, and a hard constraint can reject them without CVaR. Conversely, minimizing CVaR can still permit a safety violation if it improves the chosen tail objective. Specify safety requirements separately from performance preferences.

A risk-sensitive planner needs a distribution of outcomes for a candidate action sequence, not a single rollout. Several sources are available, and they are not equivalent:

• Ensemble members as samples. Run the candidate sequence through each member. This uses variation between fitted models as an approximation to epistemic uncertainty, i.e., uncertainty about the model fit. Its quality depends on both coverage of plausible dynamics and the weights assigned to members; bootstrap ensembles do not by themselves guarantee calibrated tail probabilities. See Part VIII: Decision-Centric Research Lineages for the lineage.
• Residual-noise propagation. Add sampled process noise to each member's predicted transition. In this toy plant, position and velocity noise innovations satisfy $\epsilon_t^{(p)}=\Delta t\,\epsilon_t^{(v)}$, so they must not be sampled independently. This relation concerns the noise contributions, not the full state increments. Combining model fits with this noise defines an approximate rollout distribution; one-step calibration does not validate its multi-step joint distribution.
• Scenario evaluation. Evaluate explicit parameter and disturbance choices. A finite scenario set is inspectable, but checking it does not prove safety for unsampled conditions. Scenario-optimization guarantees require additional sampling, optimization, and support assumptions; merely naming a chosen schedule worst case supplies none.

The code combines alternative fitted models with residual-noise draws. It does not explicitly add total predictive variance on top of ensemble variation. Nevertheless, held-out residual variance can itself include fitting error, so this construction is not a decomposition into independent uncertainty sources. Its joint rollout spread requires validation; over- or under-dispersion and missed model families can affect planning.

The running environment already includes Gaussian process noise. We now add a soft envelope penalty to stage cost when $|p|$ exceeds a chosen threshold. This can amplify expensive excursions, but it is not a control barrier function or a hard constraint. Quadratic costs can also have substantial tails, and neither this penalty nor CVaR guarantees different actions or improved realized tail costs. The experiment measures those outcomes rather than assuming them.

The distinction between averaging across all outcomes and averaging across the worst outcomes is easiest to see directly on a cost distribution. The cell below draws a right-skewed set of synthetic episode costs and computes both summaries, using the same sample estimator the planner optimizes.

At the same state and RNG state, both modes generate the same candidate actions, member assignments, and linked noise draws. Only their cost aggregation changes: mean versus empirical CVaR. Once actions differ, closed-loop states and therefore imagined futures differ too. Using the same seeds pairs the search randomness; it does not make later state-conditioned predictions identical.

We pair environment noise streams and search seeds across controllers. Different actions still lead to different states. Common random numbers reduce the variance of a difference when paired outcomes have positive covariance: $\mathrm{Var}(A-B)=\mathrm{Var}(A)+\mathrm{Var}(B)-2\mathrm{Cov}(A,B)$. They can increase it when covariance is negative. This experiment reports a paired finite comparison, not a measured reduction in required episode count; see Glasserman and Yao's conditions for common random numbers.

A finite soft penalty permits a tradeoff: a violating candidate can win if reductions in other cost terms outweigh its extra penalty. Our zero-target position cost does not make $|p|=0.7$ intrinsically better than $|p|=0.55$. Nor does this example establish that no penalty choice could enforce feasibility in any problem: some bounded or finite problems admit exact penalties. The quadratic penalty here supplies no proof of pointwise safety. If an envelope is a requirement, encode and justify it separately rather than treating a tuned weight as a certificate.

The alternatives each have costs:

• Hard constraints on a nominal rollout enforce $|p|\le p_{\max}$ at modeled steps. Feasibility establishes that modeled property, not automatically the real plant's safety. Connecting the two requires justified error and disturbance assumptions.
• Chance constraints enforce $\Pr[|p|>p_{\max}]\le\delta$ under a specified probability law. Computing or estimating that probability can be difficult. Finite samples can under- or overestimate it, and rare violations can be absent from the sample. A bound on violation probability is a different requirement from all-disturbance invariance.
• Runtime assurance. Check a proposal against an independently justified safety condition and select a verified fallback when necessary. Guarantees require a sound decision module, an appropriate initial condition, and a fallback with proven properties under the declared plant and disturbance assumptions. Our next experiment illustrates the switching architecture without satisfying those proof obligations.

The code above implements a soft penalty and sampled CVaR, not constrained optimization. Zero observed violations among eighteen scenarios does not imply zero violation probability. A predictive safety filter needs justified uncertainty bounds and recursive feasibility; see Wabersich and Zeilinger. For continuous control-affine dynamics $\dot s=f(s)+g(s)a$, a continuously differentiable barrier $h$ describes $h(s)\ge0$ and constrains actions through $\dot h(s,a)+\gamma(h(s))\ge0$, with an appropriate extended class-K function $\gamma$ (for example $\gamma(r)=\lambda r$, $\lambda>0$). Forward invariance additionally needs regularity, feasible actions, correct dynamics or robust error bounds, an admissible initial state, and satisfaction over time. Sampling and delay require additional treatment. Our quadratic penalty is not this condition; see Ames et al..

The architecture we now describe has a history in safety-critical control under various names; a standard formulation is the Simplex pattern. Split the controller into two parts:

• A performance controller, which may be arbitrarily complex, learned, and unverified. It is the thing that does the task well.
• A safety controller (the fallback), which is simple enough to be analyzed, tested exhaustively, or verified. It is the thing that keeps the system inside the safe set.

A monitor decides which controller is in charge. A formal safety result needs more than a simple controller and a threshold: the initial condition must admit a safe continuation, the decision module must be correct, and switching must preserve that continuation under the declared disturbances and timing. A permanently safe command sequence and correct decision module are explicit assumptions in the Black-Box Simplex formulation. This relocates the verification burden rather than removing it. A finite simulation of our proportional-derivative fallback is evidence about tested episodes, not certification.

The sections that follow name the important parameters: the declared parameter bounds $(k, c, g, f)$, the innovation threshold $Z_{\text{threshold}}$, the fallback tail length, and the CVaR level together with the number of draws and candidates.

The monitor should not assume that accurate training predictions imply a valid safety model under shift. Learned models can participate in a certificate when their error is bounded under defensible assumptions; otherwise a model-only safety check can share the planner's blind spots. Our small damping shift changed empirical coverage modestly, not catastrophically, but that result still does not establish future safety. The toy screen below uses a separate declared scenario to illustrate this separation of responsibilities.

We can posit a separate parameter scenario to illustrate the architecture. Its settings are not independently verified bounds on a physical plant, so calling the scenario conservative does not establish containment. In our example, we use

$$k \ge 0.80, \qquad c \ge 0.0, \qquad g \ge 0.90, \qquad f \ge 0,$$

where:

• $k$: stiffness, the restoring force per unit displacement
• $c$: viscous damping, the drag proportional to velocity
• $g$: actuator gain, how much acceleration one unit of command produces
• $f$: dry friction, a constant drag opposing motion

These lower limits alone do not define a finite parameter box or prove a worst-case trajectory. Our code fixes stiffness and friction and selects damping/gain endpoints greedily along one trajectory. Its choices are illustrative engineering settings, not verified physical bounds. Greedy outward acceleration need not maximize the eventual peak because it changes subsequent velocity and position. The resulting value is a scenario peak, not an enclosure of all reachable states.

For a bounded uncertainty set $\mathcal B$, a disturbance set $\mathcal D$, and known initial state $s$, a formal endpoint reachable set would be

$$\mathcal W_H(s)=\{p_H:\ s_0=s,\ s_{t+1}=f_{b_t}(s_t,\pi_{\mathrm{fb}}(s_t),d_t),\ b_t\in\mathcal B,\ d_t\in\mathcal D\},$$

where:

• $\mathcal{W}_H(x)$: the worst-case forward reachable set of positions after $H$ steps from state $x$
• $p_H$: the position at the end of the horizon
• $p_t, v_t$: position and velocity at step $t$ of the rollout
• $(k, c, g, f)$: stiffness, damping, gain, and friction parameter tuple
• $\mathcal{B}$: the box of declared parameter bounds
• $u_t = \pi_{\text{fb}}(p_t, v_t)$: the fallback action at step $t$

Here $f_{b_t}$ is the discrete plant transition with parameter tuple $b_t$ and disturbance $d_t$; $\mathcal D$ states the permitted disturbances. Safety over the horizon needs every intermediate reachable set, not only $\mathcal W_H$, to lie inside the safe envelope. State-estimation error requires an initial set rather than a single $s$. Infinite-time assurance additionally needs a terminal invariant continuation, and a physical plant requires inter-sample and latency analysis. Gaussian process noise in our simulation is unbounded, so no finite deterministic disturbance envelope covers every draw. A bounded-noise proof would describe a different explicit disturbance model, or a probabilistic result with a stated failure level. None is proved by the scenario screen below.

A complementary signal comes from innovation monitoring: compare predicted and observed next states after an action, normalized by predictive standard deviation. This is a reactive diagnostic, not a reachable-set certificate. The toy combines it with a finite scenario screen; a certified architecture would replace that screen with a justified enclosure and safe continuation test.

$$z_t = \sqrt{\frac{1}{d}\sum_{j=1}^{d} \frac{\left( s_{t+1}^{(j)} - \hat{s}_{t+1}^{(j)} \right)^2}{\sigma_{t+1}^{2\,(j)}}} .$$

where:

• $d$: the state dimension (here $d = 2$, for position and velocity)
• $s_{t+1}^{(j)}$: the $j$-th component of the observed next state
• $\hat{s}_{t+1}^{(j)}$: the $j$-th component of the model's predicted mean next state
• $\sigma_{t+1}^{2\,(j)}$: the model's predicted variance for the $j$-th component
• $z_t$: the root-mean-square standardized innovation; under correct componentwise zero means and variances, $\mathbb E[z_t^2]=1$, not generally $\mathbb E[z_t]=1$

The threshold $Z_{\text{threshold}}$ trades sensitivity against false alarms. Changed dynamics may increase the statistic, but benign noise can also trigger it and small changes may remain undetected. This root statistic is not a chi-square innovation test: the position and velocity innovations are correlated by construction, and we do not whiten their full covariance. The code uses a single-transition threshold and a lower reset threshold, not a smoothed window, formal sequential detector, or calibrated false-alarm probability. The earlier filtering material provides context for residual diagnostics, not a guarantee for this heuristic.

Two details matter. The statistic needs an observed transition, so it cannot prevent harm during that first transition. Its scale also depends on the predictive variance, so overestimated variance can hide errors and underestimated variance can create false alarms. There is no universal one- or two-step detection bound here. Logging innovations, threshold crossings, and selected actions is necessary to distinguish detection from scenario-triggered handover.

The two monitors are complementary:

• The consistency monitor is inexpensive and reactive. It needs at least one observed transition and may miss a shift indefinitely.
• A certified reachability monitor can reject a proposal before execution, provided its enclosure and timing assumptions hold. Our finite scenario screen has this prospective timing but not that certification.

A design may combine these signals, but combining heuristics does not produce a proof. A sound safety condition must remain enforced even when residuals look benign; an innovation test should not override it merely to improve performance. The two signals address different evidence, and their switching logic needs explicit analysis. In the experiment the shield checks the candidate sequence followed by a fallback tail in one deterministic scenario and also responds to innovation threshold crossings.

The declared scenario includes zero damping, but it omits process noise and searches neither all parameter paths nor all disturbance paths. It can trigger unnecessary fallback or accept an unsafe plan. The finite tail is thirty steps, not an invariant-set proof. The shield remains useful as an executable architecture example precisely when these limitations are visible; calling it conservative is not evidence that its peak upper-bounds the actual plant.

We run expected-cost MPC, CVaR MPC, and shielded MPC in nominal and zero-damping environments. Episodes start near the envelope with outward velocity, creating a useful braking stress test. Braking is not necessary in every nominal episode: restoring force and damping can already keep some noise-free trajectories inside. Comparing these controllers measures their combined behavior; it does not isolate manual braking from luck or prove which component caused an improvement.

The techniques in this chapter are useful, but each has limitations, and a clear account of those limitations matters more than promotion. You may be worse off if you adopt these tools without understanding their limits, because the tools can create false confidence.

Stress testing depends on the mechanisms and ranges considered. Unanticipated couplings, sensor degradation, and rare conditions can remain outside the suite. Revisit it when incidents, near-misses, operating conditions, or requirements reveal missing cases. A calendar year without growth is not by itself evidence that the suite is inadequate; relevance and coverage matter more than its size.

Calibration is a property of specified forecasts and a population. Deployment may sample a population, but adaptive closed-loop data can be dependent and differ from the calibration population. Marginal coverage can hide subgroup failures, including safety-relevant states that need not be the least densely trained region. Broad aggregate diagrams provide some information, not a substitute for conditional and trajectory-level evaluation; see Angelopoulos and Bates.

Ensemble disagreement is not a general-purpose dynamics-shift detector. The tested input shift increased disagreement more than the damping shift, while aggregate one-step error changed little. This is evidence about one fitted ensemble and two populations, not a universal detector comparison. Resampling old data cannot directly observe a newly changed transition law, although changed trajectories may later create unfamiliar inputs that increase disagreement. Different ensemble constructions or shift sizes can behave differently; test the signal rather than treating it as a certificate.

Risk-sensitive planning depends on its rollout distribution. CVaR over a mis-specified model can optimize the wrong tail. With $M=9$ fits and two draws per fit, $S=18$ samples represent each candidate; at $\alpha=0.75$ the empirical upper-tail mass is $4.5$ samples. Four contribute fully and the fifth half. These samples share fitted members and are not eighteen independent estimates of model uncertainty. Increase draws and evaluate across independent training/evaluation seeds to assess sensitivity. Moderate risk levels reduce tail-estimation demands but do not establish safety.

Runtime assurance makes proof obligations explicit. Empirically tuned fallback behavior and convenient parameter ranges do not constitute a safety proof. An independent safety argument can avoid verifying the learned performance model, but still needs justified plant and disturbance assumptions, initial admissibility, sound decision logic, fallback continuation, and timing. That burden may be difficult rather than small or local. Simplex research illustrates aircraft and robot applications; earlier work also discusses pacemaker models. These are research examples, not a claim of universal certified deployment.

Model errors can affect both performance and safety; their consequences depend on the plant and control architecture. The experiments here distinguish empirical prediction diagnostics, tail-sensitive objectives, and fallback switching. They do not show that consequences are bounded in every deployment. Moving from this prototype to a safety argument requires explicit uncertainty/disturbance bounds or probability levels, validation of the fallback and decision module, and timing and state-estimation analysis. The value of the separation is that these obligations can be stated independently of a leaderboard prediction score.

In Part XI: Evaluation and Understanding, prediction was an evaluation axis. This chapter adds closed-loop consequences under stated stresses. These rankings need not agree. Deployment readiness depends on actual requirements and validated operating conditions, not on a prediction score alone or a universal ranking of survival.

• Input shift changes the input distribution; dynamics shift changes the transition law and may also change subsequently visited inputs. Observation and task changes can co-occur with either, while hidden parameters provide one mechanism of dynamics change.
• Stress testing combines falsification and measurement. Specify plausible interventions, measure their consequences, and record what remains untested. Passing a finite suite does not establish safety outside it.
• Ensemble disagreement is a diagnostic, not a detector guarantee. Our input-shift population produced a larger disagreement increase than the damping-shift population. Aggregate one-step error alone concealed some of the population difference.
• Calibration means coverage matches its specified claim. Reliability diagrams measure empirical marginal coverage at displayed levels; report interval width too. Global rescaling may help a new population but does not automatically transfer. Conformal guarantees need exchangeability and do not imply conditional or trajectory safety.
• Abstention needs an informative ranking and a defined alternative. Risk-coverage curves evaluate retained predictions, not the safety of rejected cases. Neither percentile nor absolute thresholds universally survive shift.
• For integrable costs, CVaR emphasizes a selected upper tail and approaches the mean as its level decreases to zero. Near one it emphasizes extremes. Model mismatch and finite tail samples can prevent realized improvements; a soft penalty is not a hard safety constraint.
• Runtime assurance splits the controller. A performance controller does the task; a certified fallback maintains the invariant; a monitor decides who is in charge and must trigger before the state leaves the recoverable set.
• Separate diagnosis from certification. Innovation checks are reactive diagnostics. A prospective reachable-set check carries a guarantee only with sound enclosures, disturbance and timing assumptions, and a safe continuation. Our scenario-based shield demonstrates switching, not that proof.

The next chapter, Security, Ethics, Privacy, and Governance, extends the scope to adversarial, societal, and institutional concerns. The distinction developed here remains useful: a diagnostic can inform a decision without proving that the decision satisfies an engineering or governance requirement.