Safety is one of the most important requirements when designing an autonomous system. Motivated to find control inputs with formal safety certification, safety-critical controllers can be designed using methods such as model predictive control [1], reference governor [2], or Hamilton-Jacobi-based reachability [3]. Relying on a safety verification tool called barrier certificates [4], control barrier functions (CBFs) provide one such framework, and this has been widely adopted in the recent literature [5], [6]. In simple terms, safety (or set invariance) is defined by staying in safe states corresponding to the positive values of a scalar-valued function h. The CBF framework provides a sufficient condition for safe control in the form of a lower bound on the time derivative ḣ. One of the widely utilized applications of CBFs has been a control design paradigm called safety filters [6], [7], where the deviation from a given controller is penalized in a quadratic program (QP) while subject to a CBF-based safety constraint.
Proven to be a powerful tool in synthesizing safe controllers, the CBF literature has expanded towards various directions, including higher order derivatives to increase feasibility [8], [9], sampled-time systems [10], [11], [12], different time-explicit safety definitions [13], [14], and more general temporal logic specifications [15]. One particular research direction that has gathered much interest is robustness against unmodeled dynamics. CBF-based safety guarantees may degrade if there is a mismatch between the real system and the model used to represent it. This mismatch may emerge from unknown external disturbances [16] or complex internal dynamics omitted to facilitate the implementation.
Two main approaches have arisen for robustness against deterministic uncertainties: input-to-state safety (ISSf) and robust control barrier functions (RCBFs). On one hand, the ISSf framework (which is inspired from input-to-state stability for control Lyapunov functions [17]) can be used to obtain an arbitrarily small (graceful) degradation of safety guarantees in the presence of uncertainty [16], [18], [19], [20]. On the other hand, motivated to obtain zero safety degradation, the RCBF framework investigates conditions to sufficiently ensure the CBF-based safety condition for systems with uncertainty under the worst possible case [21].
This paper advances the theoretical and practical understanding of RCBFs by generalizing their framework to accommodate a wide spectrum of uncertainties. In particular, we present an overview of the sufficient conditions for feasible robust safety-critical control against different forms of uncertainties. Then, we study solutions for specific problem setups with increasing likeness to an oracle controller. Robust safety filters designed based on these principles are implemented on a practical example, and we illustrate the theoretical findings using simulations.
The study of robust optimization in the presence of uncertainty spans back to earlier studies [22], [23], even in the context of barrier-Lyapunov functions [24]. One of the key contributions for the CBF-based controllers was given in [21], where the CBF-based safety constraint was modified, hence the name robust CBF (RCBF). Providing conditions for sufficiently compensating the uncertainty under the worst-case scenario, the RCBF framework proves to be an effective method to guarantee robust safety. The RCBF framework received attention so much so the definition has expanded rapidly to other types of uncertainties ever since. For example, uncertainties with state dependence were addressed in the form of parametric uncertainties [25], [26], [27], or in a more general form [13], [28], [29]. The more challenging case of uncertainties in how control inputs are related to the state dynamics were considered in works [30], [31], [32], [33].
The framework was also adopted by less conservative methods relying on estimators with deterministic or probabilistic residual estimation errors. RCBF definitions in these works took different forms to incorporate the estimator and the error compensation. For example, adaptive control techniques were adopted for parametric uncertainties [25], [26], [27], [34], where limitations in the parameter space were used in the RCBF definition. Various disturbance and state observer approaches were implemented for online uncertainty estimation [29], [35], [36], [37], [38], [39], [40], [41], where bounds on the Euclidean norm of the uncertainty, its derivative or its underlying dynamics were incorporated into the RCBF definition, and various forms of Lipschitz constants were utilized. Learning-based and data-driven extensions of the RCBF framework typically utilize Lipschitz constants or bounded Jacobians regarding the uncertainty [42], [43], [44]. When unknown dynamics are estimated with probabilistic confidence bounds, adding these terms in the RCBF definition provides safety guarantees with high probability [45], [46], [47], [48], [49], [50].
Robustness requirements for deploying safety-critical controllers with specified sampling interval were also addressed within the RCBF framework. In this context, the definition of the RCBF incorporates the Lipschitz constants of the system and constraint functions, along with the bounds of the control space [10], [11], [51]. Other types of imperfections addressed using the RCBF framework are robustness against measurement errors [52] and unmodeled input dynamics [53], which utilize Lipschitz constant and integral quadratic constraints, respectively. The RCBF framework was also extended to higher order CBF formulations [54], [55].
The aforementioned boom in the robust safety-critical control literature inevitably led to a fractured landscape of different RCBF definitions that rely on various assumptions on the system, safe set and uncertainty. Motivated by the lack of such a study, we present an overview of the general robust safety-critical control design principles within the scope of the CBF framework as the first contribution of the paper. In particular, we elevate the RCBF formulation by considering a general form of uncertainty. This generalization not only unifies existing approaches but also establishes a foundation for deriving simplified verification conditions and implementable solutions for robust safety-critical controllers.
The second contribution of the paper demonstrates the utility of the general framework by developing a robust safety filter for a previously unaddressed type of uncertainty. Specifically, we propose a novel sufficient condition to guarantee feasibility and robust safety and to enable the derivation of closed-form controllers in certain scenarios. Additionally, leveraging the generalized framework, we introduce a tunable controller design that incorporates disturbance observers, extending the state of the art by reducing conservativeness. The tunability concept, originally conceived for the ISSf framework, is adapted here to improve flexibility and performance, demonstrating its broad applicability across different RCBF methods.
Finally, the theoretical advancements are validated through application to a physics-based example involving a pendulum with unknown periodic excitation. Numerical simulations showcase the efficacy of the proposed methods, compare their performance metrics to an idealized oracle design and highlight the significant reduction in conservativeness achieved by the proposed controllers. These results underscore the potential of the generalized RCBF framework to unify, extend, and enhance existing approaches of robust safety-critical control.
The paper is organized as follows. Section II provides the theoretical foundation, introducing the general principles of CBFs and extending these concepts to RCBFs to address system uncertainties. Section III presents the detailed design steps of a robust safety filter for a specific set of uncertainty assumptions. In Section IV we extend these principles for a less conservative problem setup with a disturbance observer. Section V introduces a detailed discussion on the performance of previously proposed controllers on a practical application platform. Section VI concludes the paper with a summary and future work.
it is strictly increasing, and lim r→±∞ α(r) = ±∞. The term ∇h : R n → R n denotes the gradient vector of a function h : R n → R. Also, • denotes the 2-norm.
Consider a nonlinear system affine in control:
where terms x ∈ R n , u ∈ U ⊆ R m and t ∈ T [t 0 , ∞) denote the state, input and time from a given initial time t 0 ∈ R, respectively, while functions f : R n × T → R n and g : R n × T → R n×m describe dynamics. Substituting a feedback controller k : R n × T → R m into the input u = k(x, t ) leads to the closed loop system:
If we can find an open set X ⊂ R n on which functions f , g and k are locally Lipschitz continuous in x and piece-wise continuous in t for all t ∈ T, then there exists a time interval I (x 0 , t 0 ) ⊆ T for each initial condition x 0 ∈ X such that (2) has a unique solution x(t ) for all t ∈ I (x 0 , t 0 ) [56]. Throughout the paper we assume that the solution is forward complete, that is, I (x 0 , t 0 ) = T.
Our goal is to obtain a formal guarantee that, initiated from a set, the solution never leaves the set.
Definition 1 (Safety, [6]): The closed loop system (2) is safe w.r.t. a set S ⊂ X ⊂ R n if for all x 0 ∈ S we have that x(t ) ∈ S for all t ≥ t 0 .
In particular, we consider set S defined as the 0-superlevel set of a continuously differentiable function h : X → R:
Here, ∂S and Int(S ) denote the boundary and the interior of S, respectively. Definition 2 (Regular value):
If 0 is a regular value of h, then a non-zero gradient exists for h everywhere on ∂S. Then a vector y ∈ R n is an element of the tangent cone of S at a point x ∈ ∂S if we have ∇h(x) y ≥ 0 [57]. Nagumo's theorem provide a condition for safety by utilizing tangent cones [58], [59]:
Theorem 1 (Nagumo's theorem, [58]): Let S be the 0superlevel set defined as in (3) with a continuously differentiable function h : X → R, and let 0 be a regular value of h. The closed loop system (2) is safe w.r.t. S if and only if:
Remark 1: A proof of Nagumo's theorem is in [57, §4.2]. While this proof is constructed for autonomous systems, it can be extended to nonautonomous ones by introducing the time variable as a fictitious state; see [57, §4.2.2] for details.
Our overarching goal is to design safety-critical controllers k(x, t ) such that the corresponding closed loop system (2) is safe. Control barrier functions provide a sufficient condition for the existence of a safe controller. Note that, hereafter we will utilize the Lie derivative notation L f h and L g h for the time derivative of h along the system:
Definition 3 (Control barrier function [60]): Let S be the 0-superlevel set defined as in (3) with a continuously differentiable function h : X → R, and let 0 be a regular value of h. Then, the function h is called a control barrier function (CBF) for (1) on (X × T) if there exists a α ∈ K e ∞ such that ∀(x, t ) ∈ (X × T):
Defining the point-wise set of controllers:
the existence of h implies that K CBF (x, t ) is not empty ∀(x, t ) ∈ (X × T). Safety is ensured for controllers taking values in K CBF . Lemma 1 ( [60]): Let h be a CBF for (1) on (X × T). A controller k(x, t ), that is Lipschitz continuous in x and piecewise continuous in t, ensures that the system (2) is safe w.r.t. S ⊂ X if k(x, t ) ∈ K CBF (x, t ) holds ∀(x, t ) ∈ (X × T).
Proof: The K e ∞ definition implies α(h(x)) = 0, ∀x ∈ ∂S. Thus, (9) implies that any controller k(x, t ) ∈ K CBF (x, t ) satisfies (6). The regularity conditions on the controller k ensure the existence of a unique solution x(t ), and Theorem 1 completes the proof.
Remark 2: In Definition 3 we look for a strict inequality in the condition (8), whereas the inequality is non-strict in the definition of K CBF in (9). As elaborated in the works [5], [21], [59], [61], the strict inequality in the CBF definition allows us to endow the CBF-based controllers with useful properties such as continuity and Lipschitz continuity.
The following set definition will keep the notation compact throughout the paper:
The set G contains x and t values that the vector valued function L g h(x, t ) ∈ R m vanishes. That is, the input relative degree of h becomes more than one for any (x, t ) ∈ G. Remark 3 ([59]): The condition
is a necessary condition for the inequality (8). This implies that, should (8) hold, then safety can be shown with L f h when the input relative degree of h is more than one. Furthermore, if U = R m , then (11) amounts to a necessary and sufficient condition to verify whether a function h is CBF [59]. This is an easier condition to check whether a given h is a CBF for a system. We will utilize this property to obtain simpler sufficient conditions that ensure the feasibility of the robust safety-critical control problem.
We can utilize CBFs in a pointwise optimization problem under the context of correcting a given-possibly unsafe-nominal controller. In particular, the goal is to ensure safety in a minimally invasive fashion. Consider the controller
Here k d : X × T → U is an existing controller, Lipschitz continuous in x and piecewise continuous in t, with desired guarantees like optimality and stability. The constraint ensures safety, while the cost function penalizes the deviation from k d . As a result, a minimum intervention occurs only when necessary (i.e., when
If U can be represented with affine constraints, this problem becomes quadratic programming (QP). The following theorem summarizes key points about this CBF-based controller scheme (often referred to as safety filter).
Theorem 2 ( [59], [62]): Let S be the 0-superlevel set defined as in (3) with a continuously differentiable function h : X → R, and let 0 be a regular value of h.
r Let h be a CBF for (1) on (X × T), then the QP ( 12) is feasible, and k QP (x, t ) ∈ K CBF (x, t ) for all (x, t ) ∈ (X × T). This implies that the system (2) is safe w.r.t. S when u = k QP (x, t ).
r If U = R m , then the QP has a closed-form solution:
) where the function : X × T → R is defined as:
with the function : X × T → R given as:
Interested reader is referred to works for details [62], [63]. Remark 4: ([62], [63]) For a scalar input system, i.e., m = 1, the safety filter (13) simplifies to:
where QP : X × T → R is given as:
Remark 5: Since the Lipschitz properties are preserved through a max/min operation [64], the safety filter in (13) (and ( 16)) can be shown to be Lipschitz continuous in x if all functions have the same property [21], [65].
Safety guarantees may degrade when the CBF-based control design relies on a partially known system model. Thus, successful implementation of a CBF-based safety-critical controller depends on the resilience of the design against uncertainties emerging from unmodeled dynamics. Next, we investigate conditions to obtain robust safety for the CBFbased safety condition (8) for a general type of uncertainty.
Consider the system
where f and g are the nominal (known) system functions, and
Evaluating ḣ along the open loop system (18) yields:
The uncertainty prevents us from looking for the condition ḣ ≥ -α(h), cf. (7). This motivates the introduction of robust control barrier functions (RCBFs) as follows. The main goal is to find a set of controllers K RCBF (x, t ) ⊆ U such that a controller k(x, t ) ∈ K RCBF (x, t ) implies the condition ḣ ≥ -α(h) under the worst-case scenario. This goal can be achieved by modifying the condition (8) by introducing a compensation term, which will be denoted as σ in this paper. The compensation term takes different forms based on what we know about the system and the uncertainty. For example, if there exists a μ ≥ 0 such that μ(x, u, t ) ≤ μ for all x ∈ X, u ∈ U and t ≥ t 0 , then we can use [21], [66]:
Consider that the uncertainty affects the system dynamics through input channels, that is,
This case is called matched uncertainty. If the input uncertainty d satisfies d (x, u, t ) ≤ d with a d ≥ 0 for all x ∈ X, u ∈ U and t ≥ t 0 , then, instead of ( 21), we can use:
to scale the compensation with L g h(x, t ) which characterizes the effect of d on ḣ. If d (x, u, t ) ≤ d u u for all x ∈ X, u ∈ U and t ≥ t 0 , which can occur if there is a sector-bounded uncertainty in the input [32], then one can use a compensation of the form
The input-to-state safety type of robust controllers utilize a robustifying function of the form [16], [18]:
and
where the latter introduces the 'tunability'. Table I in [66] provides a summary of various forms of σ in the literature as well as the underlying assumptions on the uncertainty. Definition 4 (Robust control barrier function, generalized from [21]): Let S be the 0-superlevel set defined as in (3) with a continuously differentiable function h : X → R, and let 0 be a regular value of h. The function h is called a robust control barrier function (RCBF) for ( 18) on (X × T) if there exist functions α ∈ K e ∞ and σ :
Given a RCBF h with functions α ∈ K e ∞ and σ , we can define the point-wise set of controllers:
The following lemma summarizes the sufficient condition so that controllers from K RCBF guarantee the robust safety:
Lemma 2: Let h be a RCBF for (18) on (X × T) with a function σ . Any controller k(x, t ), that is locally Lipschitz continuous in x and piecewise continuous in t, satisfying k(x, t ) ∈ K RCBF (x, t ) for all (x, t ) ∈ (X × T) ensures that the system ( 19) is safe w.r.t. S if the following condition holds for all u ∈ K RCBF (x, t ) and (x, t ) ∈ (∂S × T)
Proof:
The K e ∞ definition implies α(h(x)) = 0, ∀x ∈ ∂S. Thus, it is evident from ( 27) and ( 28) that any controller k(x, t ) ∈ K RCBF (x, t ) for all (x, t ) ∈ (X × T) ensures that ( 6) is satisfied. The regularity requirements on the controller k ensure the existence of a unique solution x(t ), and Theorem 1 completes the proof.
In general, it is a challenging task to find a proper σ . For example, choosing a function that takes large positive values may satisfy the condition (28) conservatively. However, this decreases the feasibility of the control problem by making the set K RCBF smaller, cf. (27). It is important to construct the compensation compatible with the safety problem (for example by adding ∇h or L g h into σ ) and the uncertainty assumptions to mitigate this trade-off; see e.g. ( 21)- (23).
Furthermore, notice that the condition ( 28) is posed over the boundary of S. Consequent to this observation, robust safety is primarily related to the values that the function σ takes when x ∈ ∂S. This gives us a certain relaxation factor that will be used in the 'tunable' setting in Section IV.
We can update the optimization problem (OP) in (12) based on the RCBF condition (26) to get the robust safety filters:
where k d is the desired controller. Relying on the RCBF definition and Lemma 2, we can summarize conditions such that k OP ensures the closed-loop robust safety. Theorem 3: Let h be a RCBF for ( 18) on (X × T) with functions α ∈ K e ∞ and σ . Then, the OP ( 29) is feasible, and k OP (x, t ) ∈ K RCBF (x, t ) for all (x, t ) ∈ (X × T). Furthermore, the system ( 19) is safe w.r.t. S when u = k OP (x, t ) if k OP is locally Lipschitz continuous in x and piecewise continuous in t, and σ satisfies (28) for all u ∈ K RCBF (x, t ) and (x, t ) ∈ (∂S × T).
Proof: The existence of a RCBF implies that K RCBF (x, t ) is not empty for any (x, t ) ∈ (X × T), thus the constraint in ( 29) is feasible. Furthermore, this ensures k OP (x, t ) ∈ K RCBF (x, t ) for all (x, t ) ∈ (X × T). Since σ satisfies (28), Lemma 2 concludes the proof.
It is noted that the controller should have appropriate regularity properties for closed loop safety. Another design concern for σ is the implementation of the OP (29). In particular, the class of the OP depends on the structure of σ (x, u, t ) with respect to u. For example, if σ is affine in u, and U can be represented with affine constraints, then the problem remains a QP. Other functions can be put into other solution-friendly forms such as second order cone program (SOCP) [32], [67], or mixed-integer quadratic program [43].
In this section, we outline the design process for a novel safety filter tailored to address a specific set of uncertainty assumptions. We derive a sufficient condition to ensure feasibility and establish robust safety guarantees. Then we demonstrate the controller on an application.
We start with the following assumption.
Assumption 1: The matrix g(x, t ) has full column rank for all (x, t ) ∈ (X × T), and thus the left pseudo-inverse g † : X × T → R m×n exists:
Since the number of nonzero singular values of a matrix is equal to its rank, this assumption also implies that there exists a constant ρ > 0 such that min i∈{1,...,m}
where ρ i (x, t ) is the i-th singular value of g(x, t ) at any point (x, t ) ∈ (X × T). Assumption 1 is common in disturbance rejection problems [68], [69]. Using the left pseudo-inverse g † , we can separate matched and unmatched uncertainties:
where d : X × U × T → R m is the uncertainty matched with input, and it is defined as:
The remaining term : X × U × T → R n is called the unmatched uncertainty, where g † (x, t ) (x, u, t ) = 0 holds for all x ∈ X, u ∈ U and t ∈ T.
Consider the following assumption on how much the uncertainty can affect the system dynamics:
Assumption 2:
∀(x, t ) ∈ (∂S × T) and ∀u ∈ U. Remark 6: While ultimate boundedness (d 1 = 1 = 0) is a common assumption in the RCBF literature [13], [21], [50], [70], it may be too restrictive when the uncertainty scales with the control input (an example will be given in the next part). We include the terms d 1 and 1 to incorporate an affine relationship between u and the uncertainty bound. While a similar problem was studied in [32] for d 0 = 0 = 1 = 0, our solution accounts for a more general problem and requires extra conditions to ensure the feasibility.
We consider a compensation of the form:
The set of K RCBF with σ 1 becomes
where (x, t ) L f h(x, t ) + α(h(x)) -∇h(x) 0 . The next theorem provides a novel sufficient condition to ensure the feasibility of the robust safety filter with σ 1 . Theorem 4: Let Assumption 1-2 hold with constants ρ > 0 and d 0 , d 1 , 0 , 1 ≥ 0, and let U = R m . A continuously differentiable function h with a regular value of 0 is a RCBF for the system (18) on (X × T) with σ 1 given as in (35) if
and
where (x, t ) L f h(x, t ) + α(h(x)) -∇h(x) 0 . This implies that, should (37)- (38) hold, the set K σ 1 RCBF (x, t ) is not empty for any (x, t ) ∈ (X × T).
Proof: Our goal is to show that (37)- (38) are sufficient for the RCBF definition (26) with σ = σ 1 . We consider two cases separately: (x, t ) ∈ G and (x, t ) ∈ (X × T) \ G.
For the first case, we have L g h(x, t ) = 0 (cf. ( 10)), and the condition in the RCBF definition (26) becomes
If ∇h(x) 1 = 0, then this condition holds trivially for any u ∈ R m since the left hand side is strictly positive ∀(x, t ) ∈ G per (38). If ∇h(x) 1 > 0, then (39) becomes
Since the right hand side is strictly positive, there exists a δ > 0 such that (40) holds for all u satisfying u ≤ δ. Thus, K σ 1 RCBF (x, t ) is not empty for any (x, t ) ∈ G.
For the second case, (x, t ) ∈ (X × T) \ G implies L g h(x, t ) = 0. Thus, ∇h(x) > 0 and (26) becomes
Since U = R m , we can choose u such that L g h(x, t )u = L g h(x, t ) u (i.e., the same direction as the vector L g h(x, t )). This selection simplifies (41) to
If M(x, t ) > 0, then ∃u ∈ R m satisfying (42) regardless of the sign of χ . Thus, M(x, t ) > 0 is a sufficient condition for the RCBF definition when (x, t ) ∈ (X × T) \ G. Recall that ∇h(x) > 0, which implies M(x,t ) ∇h(x) > 0 where
Here we used L g h(x, t ) = ∇h(x) g(x, t ). Note that 1d 1 > 0 per (37). Since (31) implies
we have
Using (37) we can show that M(x,t ) ∇h(x) > 0. Thus, (37)-( 38) are sufficient for the RCBF condition (26) with σ 1 .
Theorem 4 provides a condition for the existence of a controller ensuring robust safety when U = R m . While it is typically a challenging problem to find such explicit conditions for U ⊂ R m , recent developments led to a rigorous framework for incorporating input bounds implicitly using backup CBFs [71], even for a robust problem [72].
Remark 7: If we consider the case 1 = 0, then the sufficient condition (37) simplifies to d 1 < 1, which is equivalent to the condition found in [32] (given as 0 ≤ d < 1). However, with 1 , the condition (37) includes the case of an unmatched uncertainty changing with u.
Condition (38) implies that when L g h(x, t ) = 0 the barrier function condition ḣ ≥ -α(h) should be attainable merely by f under the worst case scenario. The existence of a α ∈ K e ∞ satisfying (38) with given f and 0 is a property that h should have for the RCBF definition.
Theorem 4 provides sufficient conditions ensuring the point-wise feasibility of the robust safety filter with the compensation σ 1 , which is tailored to cancel the uncertainty in a worst-case manner.
Theorem 5: Let Assumption 1-2 hold with constants ρ > 0 and d 0 , d 1 , 0 , 1 ≥ 0. If h is a RCBF for the system (18) with σ 1 as in ( 35), then the system ( 19) is safe w.r.t. S when u = k OP (x, t ) if k OP is locally Lipschitz continuous in x and piecewise continuous in t.
Proof: Considering Assumption 1 and the compensation σ 1 as in (35), the condition (28) becomes:
Thus, if the uncertainty satisfies Assumption 2 with constants d 0 , d 1 , 0 , 1 ≥ 0, the compensation σ 1 as in (35) satisfies the condition (28). Theorem 3 completes the proof. It is noted that the safety constraint becomes non-smooth due to u , therefore duality conditions cannot be used to calculate the closed-form solution in a general case. Yet, it can be shown that the constraints in the OP (29) can be represented as a rotated second order cone, and thus can be solved effectively using efficient algorithms such as [73]. Moreover, a closed-form solution may exist for the scalar input case.
Remark 8: The lack of a general solution prevents us showing the Lipschitz continuity for the robust safety filter with σ 1 . In [52], authors show that relaxing the safety constraint with a slack variable can ensure Lipschitz property at the expense of losing the safety guarantee. Furthermore, authors in [32] 'conjecture that the solution remains locally Lipschitz continuous when the constraint is described by two second order cone constraints'. Showing the Lipschitz properties for a general case is left for a future work. The scalar input case has the same Lipschitz properties as the QP in (16).
To demonstrate the theoretical concepts we consider a pendulum, depicted in Fig. 1, whose angle from the vertical position denoted as θ . A mass m is carried by the massless rod and its distance from the pivot l changes periodically in time according to a time-dependent constraint. A motor provides the control torque u and G is the gravitational acceleration. This may be considered as the simplest model for a child on a swing who is moving its center of mass up and down to destabilize the hanging down position while the input torque is applied to ensure safe swinging.
The equation of motion is derived in Appendix A using Lagrangian equations. Choosing the angle and angular speed as states, i.e., x [θ, θ ] , we can obtain:
It is noted that the system functions f and g can be calculated explicitly when l (t ) and l (t ) are given. We let U = R.
To enforce physical safety, we want to limit the angle: |θ | ≤ θ max = π/6. Excluding θ from h(x) would imply that G = R 2 × R, and the necessary condition (11) cannot be shown for a general periodic excitation of l (t ). Thus, we enforce the goal using a quadratic function h : R 2 → R:
The corresponding set S ∈ R 2 is an ellipse with a slight tilt in counterclockwise direction for a 2 < 0, see the green domain in Fig. 1 for parameters a 1 = -7.30, a 2 = -0.25 s, a 3 = -1 s 2 and c = 1. Observe that S is a subset of the original safety goal |θ | ≤ θ max (white region). Therefore, ensuring the invariance of S is sufficient. We take the desired controller as k d (x, t ) ≡ 0, and simulate (47) for m = 30 kg and l (t ) ≡ L = 1.75 m (this time-invariant configuration is denoted as case (A)). Starting from x 0 = [0, 1.4 rad/s] , the simulated trajectory (red curve in Fig. 1) leaves S even for a constant l. Below we design safety filters to ensure safety w.r.t. S for two scenarios: ideal and partially known models.
We will use safety filter to keep the system safe. To do this, first we need to show that h is a CBF for the system (48).
Proposition 1: The function h as defined in ( 48) is a CBF for (47) with α(h) = α c h for any α c > 0.
The proof of Proposition 1 is given in Appendix B. Since U = R and m = 1, the closed form solution of the safety filter in ( 16) can be implemented. The system is simulated with the same conditions as above (case (A) and same x 0 ) using α c = 1.5 1/s, see the black trajectory in the left panel of Fig. 2. When θ approaches θ max with a large rate θ , the safe control is activated, i.e., k QP (x, t ) = QP (x, t ), and it slows down the swing to ensure safety. The controller switches back to k d (x, t ) = 0 when state is ensured to be contained in S with no control. This cycle is repeated until the trajectory converges to a stable limit cycle inside S.
The curve where the switch occurs between safe control and no control can be found explicitly using QP (x, t ) = k d (x, t ) = 0. This equation yields two solutions in the form of time-varying parabolas in the state space (depicted in the left panel of Fig. 2 for case (A)). We have k QP (x, t ) ≡ k d (x, t ) inside the curves, and k QP (x, t ) = QP (x, t ) outside. Note that the stable limit cycle that trajectories converge to grazes the switch curves, which implies that its shape can be modified through h and α. We leave the further analysis of the effect of these particular selections on the nonlinear characteristics of the system trajectories as a future work, and focus on improving the resilience of the CBF condition against uncertainties.
Next, we consider the case where a periodic excitation of the form l (t ) = L + r sin(ω t ) is introduced with known amplitude and frequency values (case (B) is for r/L = 0.2 and ω = 4.8 rad/s). Implementing the safety filter ( 16) successfully keeps the system safe, because it has full information of the model f (x, t ) and g(t ), see the middle panel of Fig. 2. The safety results hold for different ω and r values. The right panel in Fig. 2 shows the values max |θ (t )| over all t > t s , where t s denotes the time it takes for trajectories to converge to the limit cycle.
Let us consider the case where the amplitude of the periodic excitation, r, is not known. The uncertainty emerging from the unknown periodic excitation can be separated from the known part in (47) (called the 'nominal system'). We give detailed calculations in Appendix C, where we use Taylor expansion with the assumption r L to obtain:
cf. (47). The function μ represents the uncertainty, and it depends on state, input, and time. When we design the safety filter ( 16) considering μ ≡ 0, the resulting controller becomes indifferent to the periodic excitation. Consequently, we observe θ > θ max for a large enough r at certain ω, see the left panel in Fig. 3. The visual depiction of the safety violation is given in the right panel for case (B).
Our goal is to design a robust safety filter using σ 1 as in (35). To use this framework we check Assumption 1-2. Assumption 1 is satisfied for (49) since g = 0. In addition, in Appendix C we show that
cf. (34), and that assuming r ≤ r and ω ≤ ω we have
We pick r = 0.2L and ω = 6.0 rad/s, which yields d 0 = 310 Nm and d 1 = 0.4. With Assumption 1-2 satisfied, we can utilize σ 1 as in ( 35) for robust safety. Note that the condition (37) holds since 1 = 0 and d 1 < 1. Moreover, since 0 = 0, (38) simplifies to L f h(x, t ) + α(h(x)) > 0, cf. (36). This condition holds since h was shown to be a CBF for (47), see Remark 3. Consequently, Theorem 4 establishes that h is a RCBF.
Proposition 2: The function h in ( 48) is a RCBF for (49) with α(h) = α c h and σ 1 as in (35) for any α c > 0.
The robust safety filter with σ 1 will be called as k SOCP . Implementing k SOCP for different values of α c ∈ [0.75, 7.5] 1/s, r ≤ r and ω ≤ ω, we give simulation results in the left panels of Fig. 4. The trajectory for α c = 1.5 1/s (case C) is depicted in the top panel, which converges to a limit cycle inside S without leaving it. We find the values max |θ (t )| over all t > t s , where t s denotes the settling time of convergence to the limit cycle. Our findings, shown in the bottom two panels, align with the theoretical results.
This section presents more sophisticated methodologies to design less conservative robust safety-critical controllers, leveraging observer-based uncertainty estimation and tunable compensatory mechanisms to improve control performance while maintaining rigorous safety guarantees.
Recall that, with the uncertainty μ, ḣ becomes:
While the function L μ h is unknown, it can be estimated so that the barrier function-based safety condition ḣ ≥ -α(h) can be ensured less conservatively.
Assumption 3: Given a controller k : X × T → U, there exist functions L μ h : X × T → R and : T → R such that:
This assumption implies the existence of an estimator with a deterministic error bound. Some of the well-known observer and estimator techniques were implemented in the CBF framework to satisfy Assumption 3, for example, [29], [36], [37], [38], [39], [40], [41]. In an effort of finding an estimator satisfying Assumption 3, we propose the function σ 2 : X × T → R:
where the first term cancels L μ h, and the second term compensates for the residual error.
Assumption 4: The input relative degree of h is less than or equal to the uncertainty relative degree of h:
This assumption implies that the lowest-order time derivative of h that the uncertainty μ can affect is equal to or higher than the lowest-order time derivative of h that the input u can affect. Consequently, the term L μ h can be canceled in ḣ using u. Assumption 4, which can be relaxed, see Remark 10, allows us to find sufficient conditions such that h is a RCBF. In particular, using (56), the bound (54) implies
Thus, extending Remark 3 for the RCBF definition requires
to hold for the inequality (26). 58) is a necessary and sufficient condition for (26). Theorem 6: Let S be the 0-superlevel set defined as in (3) with a continuously differentiable function h : X → R, and let 0 be a regular value of h. Let the uncertainty μ and functions L μ h and satisfy Assumptions 3 and 4.
r If h is a RCBF for ( 18) on (X × T) with σ 2 , then the system ( 19) is safe w.r.t. S when u = k OP (x, t ). r Substituting σ 2 , the OP in (29) becomes a QP. Further- more, if U = R m , then the QP has a closed-form solution given in the form ( 13)-( 14) with (x, t ) = ob (x, t ) defined as: ob (x, t ) -
Proof: The proof for the first two statements can be extended from the discussion in Remark 3 and the proof of Theorem 5, respectively. Furthermore, since the OP becomes a QP with σ 2 , the last bullet point can be followed from the proof of Theorem 2 (as given in [21], [60], [62]) with simple modifications for σ 2 .
Remark 9: Analogous to the CBF-based QP ( 16), the robust safety filter ( 13)-( 14) with ( 59) can be simplified for the scalar input case (m = 1):
where QP,ob :
Motivated by the estimator-based compensation setup, we consider an observer L μ h : X × T → R utilized in [35], [37]:
where k obs > 0 is the observer gain and ζ (t ) denotes an auxiliary state. In particular, given an initial condition ζ (0) = ζ 0 , ζ (t ) satisfies the following ODE:
Note that ( 63) is a linear ODE, and convolution integral can be used to find the solution:
We can find a deterministic error bound (t ) for the observer (62). Focusing on the explicit time dependency with a slight abuse of notation, we use
Assumption 5: There exist constants L μ h 0 , L ≥ 0 such that:
While (65) accounts for the boundedness of the initial uncertainty, (66) constitutes an upper bound on how fast the effect of the uncertainty changes in time. That is, L is the Lipschitz constant of L μ h in t. Lipschitz bounds are commonly utilized in RCBF formulations [42], [43], [52] and these can be obtained from sampled data using Strongin's estimator [74], [75].
Using the observer error e(t ) L μ h(t ) -L μ h(t ), the following lemma gives us the error bound (t ).
Lemma 3 ([35]): Consider a function h with the time derivative given in (53) and an observer defined in ( 62)-( 64) with a gain k obs > 0 and the initial condition ζ 0 = k obs h(x 0 ). Let the function L μ h satisfy Assumption 5. Then, the following bound holds for the observer error
, ∀t ∈ T.
The proof (which can be seen in [35] in detail) is omitted here. Starting from |e(t 0 )| = L μ h 0 , the error moves into a narrower band determined by L k obs as the time progresses (assuming L μ h 0 > L k obs ). Note that the faster the uncertainty dynamics are (specified by a larger L), the wider the steadystate error band gets. A larger k obs not only shrinks the steady state error band, but it also forces a faster initial decay. Lemma 3 implies that the observer (62) and the error bound (67) satisfy Assumption 3. Under Assumption 4, see Remark 10, Theorem 6 can be used to obtain safety results for the observer-based robust safety filter. We note that, for the observer (62), the necessary condition (58) becomes:
More accurate initial uncertainty guess and smaller rate of change of the uncertainty can alleviate the condition (68).
Remark 10: Assumption 4 can be relaxed for the observer scheme discussed here. Details can be obtained in references [36], [68], yet, in short, the observer can be extended to estimate disturbances on ẋ rather than ḣ. Then, a high relative degree CBF framework [8], [9] can be used to ensure robust safety in the case the input relative degree is more than the uncertainty relative degree.
Remark 11: There is a causality issue hidden when the observer ( 62) is implemented to a control system (18), and at the same time the observed value L μ h is used to calculate a control input u. In particular, calculating the controller u(t ) using (59) requires ζ (t ) (plug ( 62) into (55)). Yet, (64) implies that ζ depends on the function u( t ) over t ∈ [t 0 , t]. We break this causality loop in the implementation by using a delayed input when calculating (64) (single time interval). Investigating the effect of this ad-hoc solution in a mathematically rigorous way using control barrier functionals [76] is left as future work. We note that we observed this effect to be negligible in our examples.
The difference between an oracle safety filter (with full model information) and a robust design emerges from two sources: the uncertainty in the model L μ h, and the term σ used to compensate for it, cf. ( 8) and (26). The observer (62) alleviates both as the observer gain k obs increases. Indeed, for k obs → ∞, we get L μ h → L μ h and → 0. However, in practice, a high observer gain k obs makes the closed-loop system more susceptible to imperfections, e.g., the system may become unstable in the presence of input delay [35].
Even for a limited observer gain it is still possible to decrease the difference between the oracle design and a robust safety filter with observer. To see this, notice that the sufficient condition (28) for robust safety is defined on x ∈ ∂S. Thus, can be reshaped inside S as long as it satisfies (28) on the boundary. Motivated by this observation, as is done in the tunable ISSf case in (25), the compensation can be reduced based on how far away a state is from the boundary of S [18]. In particular, we propose
where, the function : R → R satisfies (r) ≥ 0, ∀r ∈ R, and (1
The second condition in (70) implies that (0) = 1, thus (28) holds for σ 3 with an observer satisfying Assumption 3 since x ∈ ∂S ⇒ h(x) = 0 ⇒ σ 3 (x, t ) ≡ σ 2 (x, t ). The class-K property of 1implies (h(x)) < 1 if h(x) > 0. Therefore, the effect of the error compensation term in (69) gets mitigated inside S. As a result, the tunability modification yields less conservative robust safety filters. Remark 12: Even the necessary condition for the RCBF definition is relaxed with , cf. (58):
Theorem 7: Let S be the 0-superlevel set defined as in (3) with a continuously differentiable function h : X → R, and let 0 be a regular value of h. Let the uncertainty μ and functions L μ h and satisfy Assumptions 3 and 4. Let satisfy (70).
r If U = R m , then h is a RCBF for ( 18) on (X × T) with σ 3 in (69) if and only if (71) holds.
r If h is a RCBF for ( 18) on (X × T) with σ 3 , then the system ( 19) is safe w.r.t. S when u = k OP (x, t ).
r Substituting σ 3 , the OP in (29) becomes a QP. Further- more, if U = R m , then the QP has a closed-form solution given in the form ( 13)-( 14) with (x, t ) = Tob (x, t ) defined as:
Proof: The proof of Theorem 6 can be followed with the only change .
Remark 13: If the function is continuously differentiable on a closed interval, then it is Lipschitz continuous. As a result, the Lipschitz properties of the resulting controller is the same as the observer-based QP.
Remark 14: Similar to the observer-based method, the robust safety filter ( 13)-( 14) with (72) simplifies for scalar input:
where QP,Tob (x, t )=-
Henceforth, we will use an exponential function as :
which satisfies (70) for any λ > 0. Note that λ = 0 returns to the observer-based design with σ 2 as in (55). its worst-case type of compensation, see the right panel of Fig. 5. The input of the tunability-based case, however, is closer to the oracle thanks to its ability to reject the effect of the unknown dynamics in the controller using L μ h. The difference between the robust controllers and the oracle is given in the bottom right panel. Motivated by these observations, we use a performance metric to compare robust controllers. The performance goal for this comparison study is taken as minimizing the deviation from the oracle controller. The logic behind this choice is as follows: if we have the perfect information of a system model, then it may be possible to design a controller minimizing a cost function. Comparing robust controllers to this oracle controller serves as a meaningful and practical comparison metric because it eliminates the necessity of specifying this cost. This metric is merely used for comparing these robust controller design principles and it does not play a specific role in designing these controllers.
The performance goal is quantified as minimizing the cost k s (x, t )k oracle (x, t ) , where k oracle denotes the oracle controller that is designed utilizing the ideal model information, and the index s refers to different robust safety filter designs, i.e., SOCP, QP, ob and QP, Tob. In this comparative study, the oracle is represented with data generated using simulations for random system configurations (initial conditions t 0 ∈ R and x 0 ∈ S, and amplitude r ≤ r and frequency ω ≤ ω of periodic excitation). Overall, we generate M = 1000 episodic runs of length N when u = k oracle (x, t ) is utilized. We collect the state, time and input data from these runs:
where k denotes a time instant in an episode k = {1, . . . , N}, and i denotes the number among all episodic runs i = {1, . . . , M}.
Based on this, we can define the cost:
to represent the average of the deviation in control ũi k along trajectories over all episodes. The term p collects the parameters p = [α c , k obs , λ] .
We start with the evaluation of k SOCP . The only parameter in this case is α c . The blue curve in the top panel of Fig. 6 shows that the cost J SOCP decreases monotonously with α c and it settles around ∼10 Nm for large α c . Next, we evaluate the performance of k QP,ob . There are two parameters for this case: α c and k obs . In particular, k obs increases the rate at which the uncertainty is observed, thus a more accurate cancellation can be obtained in the controller. The cost J QP,ob is depicted in the left panel of Fig. 6 as a function of α c for k obs ∈ {20, 25, 30, 40} 1/s with different colors. Each curve has a minimum value J * QP,ob , which decreases as k obs is increased. This aligns with the discussion that introducing an estimator mitigates the difference between the robust safetycritical controller and the oracle-based design. Finally, we evaluate the tunability modification k QP,Tob which depends on the parameters α c , k obs and λ. We compute the cost J QP,Tob and find the minimum J * QP,Tob over a range of α c . These minima are depicted in the right panel of Fig. 6 as a function of λ for k obs ∈ {20, 25, 30, 40} 1/s. Note that λ = 0 means the observer-based design without tunability. Our findings support the argument that tunability (i.e., increasing λ) reduces the deviation from the oracle-based controller.
This work investigated the means to obtain robust safety guarantees for control barrier function-based safety-critical controllers in the presence of model uncertainties. We first introduced a general framework providing conditions for robust safety. Then, we utilized the general framework to investigate the robust safety conditions of three design methodologies: a worst-case-based approach, an observer-based approach, and a modification to the latter via tunability. The theoretical results were demonstrated on a practical example of a pendulum with unknown periodic excitation. Finally, we compared the designs based on a performance metric defined as their deviation from the oracle-based controller. Our findings showed that improved performance could be obtained by introducing means in the controller to estimate the effects of the uncertainty. Further improvements could be shown by reshaping the error compensation based on how safety-critical the state is.
The main future research direction is the development of a broad and systematic framework for merging different robustifying compensation designs to pick the most appropriate design strategy. This framework can include an online scheme to switch between different compensation strategies to adapt dynamically to changing conditions. Moreover, future efforts will be directed to obtain conditions for Lipschitz continuity of RCBF-based controllers. per the assumptions on A in (48). First, we define the set:
which forms the line x 2 = -a 2 a 3 x 1 in the state space R 2 , see Fig. 1. Choosing α(h) = α c h ∈ K e ∞ with α c > 0, our goal is to show that there exists an open set X ⊂ R 2 such that L f h(x, t ) + α c h(x) > 0 is satisfied ∀(x, t ) ∈ G. Notice that L f h(x, t ) = -(a 1a 2 2 /a 3 )a 2 /a 3 x 2 1 for all x satisfying L g h(x, t ) = 0, thus the condition reduces to
which is time-invariant, thus any T ⊂ R can be selected. We separate cases 0 < α c ≤ 2 a 2 a 3 and α c > 2 a 2 a 3 . For the former, one can show that the coefficient of x 1 becomes nonnegative, thus (84) holds over any X ⊂ R 2 . For latter one, the left hand side of (84) becomes a concave parabola that crosses the horizontal axis at
see Fig. 7. Notice that L f h(x, t ) > 0 for all (x, t ) ∈ G. Thus L f h(x, t ) + α c h(x) = 0 holds if and only if h(x) < 0. This implies that x * 1 ∈ R 2 \ S regardless of α c , thus X can be selected such that S ⊂ X ⊂ R 2 on which (84) holds.
We use l (t ) = L + r sin(ωt ), yielding l (t ) = rω cos(ωt ). Considering the amplitude of the periodic excitation as unknown, we can use Taylor expansion to separate the uncertainty from the known portion of the model. In particular, we represent the functions 1 l (t ) , l (t ) l (t ) and 1 l (t ) 2 using Taylor expansion around r = 0. Assuming r L and ignoring the higher order terms yields (91
Our goal is to look for constants d 0 and d 1 such that (34) is satisfied for a reasonable range of periodic excitation r ≤ r and ω ≤ ω. Since | sin(ωt )| ≤ 1 for any ω and t we have
Next, we look for the bound d 0 on x ∈ ∂S, which is a closed contour of h(x) = 0 in R 2 , see Fig.
2. The bound d 0 can be approximated on this contour using θ max and θmax , where θ max and θmax denote the maximum values that state variables get on this contour. This leads to d 0 = r L mGL sin θ max + 2mL 2 ω θmax , (93) cf. (91), where θ max = -2c a 1a 2 2 /a 3 , θmax = -2c a 3a 2 2 /a 1 . (94) Assuming negligible tilt, that is, a 2 2 a 1 a 3 , we have θ max ≈ 2c -a 1 and θmax ≈ 2c -a 3 . Furthermore, assuming ω G sin θ max 2L θmax
, the second term in d becomes more dominant. Thus, we can get the approximation:
VOLUME 4, 2025