Stanford AA203 Optimal and Learning-Based Control ｜ Spring 2026 ｜ Lecture 11： Introduction to MPC — Annotated Lecture Notes & Key Takeaways

Course Information

Institution: Stanford

Original Course: Stanford AA203 Optimal and Learning-Based Control ｜ Spring 2026 ｜ Lecture 11： Introduction to MPC

Instructor Bio: Delivered by Prof. Marco Pavone and Dr. Daniele Gammelli. Model Predictive Control is a core component of their research and teaching portfolio.

Course Description: This introductory session on Model Predictive Control (MPC) covers its basic principle, receding horizon framework and system modeling. It explains the standard MPC workflow and highlights its advantages for constrained system control.

This lecture picks up where the previous class left off, going deeper into reachability theory before shifting into model predictive control (MPC). The main topics covered: computing backward reachable sets with the Hamilton-Jacobi-Isaacs (HJI) equation, encoding binary set membership as a cost function through the level set method, and extending endpoint safety guarantees to full-trajectory safety tubes. These ideas are the theoretical backbone for constraint handling and disturbance robustness in MPC.
 

Reachability recap

 

Last class introduced reachability theory as one of the more useful applications of continuous-time closed-loop optimal control. The core question: given a target set of states, which initial conditions can end up in that set at some future time, even with external disturbances acting on the system? The answer comes as reachable sets, computed through the HJI equation.
 

There are two types of backward reachable sets, distinguished by what the target set represents. "Backward" means working backwards from the target at the final time to map out initial conditions.
 

The first is the avoidance set. Think of it as the danger set of initial states. If you start inside it, there exists some disturbance that will force your system into the target (unsafe) set at the final time, no matter what control you apply. To guarantee safety, you have to start outside this set entirely.
 

The second is the reach set — the favorable one. If you start inside it, there always exists a control input that can drive your system into the target (goal) set by the final time, regardless of what disturbance nature throws at you. You're guaranteed to reach the objective.
 

Both follow the same backward reachable structure. The only difference is whether the target set is something to avoid or something to reach.
 

The level set method: from yes/no membership to a cost function

 

One of the bigger conceptual leaps in this lecture is connecting binary set membership (in or out) to the HJI framework, which is built on continuous cost functions. The solution is the level set method.
 

The idea: define a continuous function h(x) where a state x belongs to the target set exactly when h(x) ≤ 0. If h(x) is positive, the state is outside.
 

The lecturer gives a simple example. Take a circular target set of radius R centered at the origin, with the system state being just x and y position. Define h(x,y) = x² + y² − R². Inside the circle, the squared distance is less than R², so h is negative. Outside, it's positive.
 

The value of h carries more than just in/out information. How negative h is tells you how deep inside the set you are. How positive it is tells you how far from the boundary. This works as a built-in margin metric — you can see at a glance how much buffer you have before crossing the line at h = 0.
 

To plug this into the HJI equation, two adjustments. First, set the running cost to zero — we don't care about cost along the trajectory, only whether we end up in the set at the final time. Second, use h(x) directly as the final cost.
 

Solving the HJI equation with this setup gives a value function. The zero level set of that value function — all states where the value is exactly zero — is exactly the backward reachable set. A binary yes/no problem reduces to a standard optimal control problem.
 

Differential games: two players, adversarial nature

 

Computing these reachable sets isn't a one-sided control problem. It's a two-player differential game. Player one is the controller (us), choosing inputs to meet our objective. Player two is nature, choosing disturbances to work against us.
 

For the avoidance problem, our goal is to stay out of the danger set — we want the final value of h to be as positive as possible. Nature wants the opposite: push us into the set, making h as negative as possible. This plays out as a max-min problem: we pick controls to maximize the minimum possible final cost, and nature picks disturbances to minimize it.
 

For the reach problem, the objectives flip. We want to get into the target set (make h negative), and nature wants to keep us out (make h positive). Now we're minimizing the cost, and nature is maximizing it. The min and max swap places, but the underlying HJI structure stays the same.
 

A student asks a good clarifying question: are we solving just for the set, or also for the control policy? The lecturer confirms we get both. Once you solve the HJI equation for the value function, you can extract the optimal control law directly from it.
 

This matters in practice. Just knowing which states are safe isn't enough. If you start outside the avoidance set but use a sloppy control policy, disturbances can still push you into danger. You need both the safe set and the corresponding optimal control to actually guarantee safety.
 

I found the min/max swapping easy to mix up at first. It helps to pause and ask: what are we trying to do to the cost function, and what is nature trying to do? If you lose track of who's maximizing and who's minimizing, the whole framework stops making sense quickly.
 

Reachable tubes: safety over the whole trajectory

 

The standard backward reachable set has a real limitation: it only checks the state at the final time. It doesn't care what happens in between.
 

The lecturer uses an aircraft near-miss example. Imagine a trajectory that cuts straight through the danger zone but exits right before the final time. Under the endpoint definition, that trajectory counts as safe. In reality, flying that close to another plane — even briefly — is a serious safety violation. The endpoint check misses that risk entirely.
 

The fix is extending reachable sets to reachable tubes (sometimes called safety tubes). Instead of defining cost only at the final time, define it as the minimum value of h(x(t)) across the entire time horizon. If that minimum stays above zero, the trajectory never dips into the danger set at any point. You're safe the whole time.
 

This adds complexity. There's an extra minimization over time embedded in the cost function, which changes how the HJI equation is derived. The lecturer doesn't walk through the full derivation here, noting the class has other material to cover, and points to published references for those who want to go deeper.
 

This is one of the most directly applicable ideas for MPC. MPC operates over a rolling horizon and has to enforce constraints at every step, not just at the end. The safety tube concept maps directly onto that requirement for ongoing constraint satisfaction.
 

None of this reachability theory is abstract for its own sake. It's the foundation for how MPC handles state and input constraints, guarantees robustness to disturbances, and ensures safety over a planning horizon. The level set method and differential game framing give rigorous tools to compute exactly which states are safe and what controls keep them there. The jump from endpoint sets to full-trajectory tubes shows how the theory adapts to realistic safety requirements — exactly the kind MPC is designed to address.
 

---

Content Disclaimer: This article is for general reference only and does not constitute professional R&D guidance, production process advice or quality certification. All material performance data has specific test premises; readers should verify parameters against actual equipment and working conditions.