Source-linked AI summary
Linear model predictive safety certification for learning-based control
Kim P. Wabersich, Melanie N. Zeilinger
TL;DR
Learning-based controllers often lack safety guarantees needed for safety-critical systems. The paper proposes MPSC, which filters proposed inputs using robust MPC backup trajectories and establishes constraint satisfaction while supporting safe-set enlargement and data-based design.
Problem
Learning-based controllers are difficult to use in safety-critical systems because their safety under state and input constraints is not readily guaranteed.
Method
MPSC evaluates each proposed learning input with a robust MPC backup trajectory toward a safe set and modifies the input when safety is threatened.
Results
The proposed control law is a safe backup controller, with XN ∪Sf as the corresponding safe set under the stated assumptions.
Takeaways & Limitations
MPSC can enhance arbitrary learning-based controllers, combine with known safe sets, and reduce conservatism using generated closed-loop data.
Abstract
from arXiv · showhide
While it has been repeatedly shown that learning-based controllers can provide superior performance, they often lack of safety guarantees. This paper aims at addressing this problem by introducing a model predictive safety certification (MPSC) scheme for polytopic linear systems with additive disturbances. The scheme verifies safety of a proposed learning-based input and modifies it as little as necessary in order to keep the system within a given set of constraints. Safety is thereby related to the existence of a model predictive controller (MPC) providing a feasible trajectory towards a safe target set. A robust MPC formulation accounts for the fact that the model is generally uncertain in the context of learning, which allows proving constraint satisfaction at all times under the proposed MPSC strategy. The MPSC scheme can be used in order to expand any potentially conservative set of safe states for learning and we prove an iterative technique for enlarging the safe set. Finally, a practical data-based design procedure for MPSC is proposed using scenario optimization.
I. INTRODUCTION
Learning-based controllers can achieve strong performance but are difficult to analyze for safety-critical systems. The paper introduces MPSC to add safety guarantees to arbitrary learning-based controllers through robust MPC and data-driven design.
- Learning-based methods are difficult to transfer to safety-critical industrial systems because their complex functioning complicates systematic safety analysis.
- MPSC estimates whether a proposed learning input is safe and searches online for a feasible backup trajectory toward a known safe set.
- The safety filter modifies only inputs that would drive the system outside the safe set, while retaining compatible learning-based control otherwise.
- The scheme enhances any learning-based controller with safety guarantees using scalable offline computations and online robust MPC optimization.
- Unlike methods restricted to learned-model MPC, the concept supports black-box reward optimization and exploration for informative system data.
II. PROBLEM DESCRIPTION
The paper defines safety through a set admitting a feasible backup controller that preserves constraints under arbitrary learning inputs. This framework can enlarge existing safe sets without requiring robust controlled invariance.
- The considered systems are linear with additive disturbances, polytopic state and input constraints, compact disturbance sets, and full state observability.
- The objective is to identify states where a backup strategy can satisfy state and input constraints for all future times.
- A learning input is applied when it remains admissible and its uncertain successor stays in the safe set; otherwise, a safety controller replaces it with backup control.
- Starting from a safe state, the safety control law guarantees that the system state remains within the state-constraint set for every future time.
- The safe set need not be robust controlled invariant, allowing the approach to enlarge existing safe sets and combine with previously proposed safety methods.
III. MODEL PREDICTIVE SAFETY CERTIFICATION
MPSC tests each proposed learning action by checking whether a robust MPC backup trajectory can reach a known safe terminal set. Repeated feasibility checks and tube-based MPC address uncertain dynamics.
- The backup controller is constructed as a finite-horizon MPC trajectory from the current state toward a conservative safe terminal set.
- Each proposed learning input is accepted only if its successor admits a feasible backup sequence reaching the safe terminal set in finite time.
- If the next learning input fails the safety test, the previously computed backup controller can be applied instead.
- Tube-based MPC is used to design the backup controller when the true system dynamics are uncertain.
A. Model predictive safety certification scheme
The MPSC scheme combines tube-based robust MPC with a safe backup policy to test learning inputs online and preserve constraint satisfaction. Its fallback logic yields a certified safe set even when the optimization is temporarily infeasible.
- Robust MPC formulation: The scheme augments a nominal backup trajectory with auxiliary error feedback so the real system remains within a robust tube.The error feedback requires a stabilizing matrix and an RPI set Ω; nominal constraints are tightened to account for the tube.
- Online certification: The MPSC problem minimizes deviation from the proposed learning input while enforcing a feasible trajectory toward the terminal safe set.An auxiliary input ˜u is selected so that, whenever possible, it equals the learning input and certifies its safety.
- Limitation: For general terminal safe sets, the MPSC problem may not be recursively feasible because Sf need not be invariant or contained in the feasible set.The algorithm’s fallback logic is therefore needed for the general formulation.
- Backup policy: When certification is infeasible, the algorithm applies the previously computed backup sequence and then the terminal safe controller after reaching the safe terminal set.This fallback mechanism handles repeated infeasibility while maintaining a safe trajectory from the certified state.
- Safety guarantee: Under Assumptions III.1 and III.3, Algorithm 1 is a safe backup controller on the set XN ∪ Sf.The guarantee covers all future times for initial states in the corresponding safe set.
B. A recursively feasible MPSC scheme
A stronger terminal-set assumption restores recursive feasibility, allowing the MPSC controller to operate directly in receding-horizon form. The resulting feasible set is itself robust positively invariant.
- Recursive feasibility: Requiring the terminal safe set to be invariant for the nominal system gives recursive feasibility of the MPSC problem.This is the standard tube-based MPC terminal-set condition.
- Safety guarantee: Under Assumptions III.1 and III.6, the receding-horizon control law is safe and XN is a robust positively invariant set.Here Sf is constructed as Xf ⊕ Ω.
- Proof mechanism: Recursive feasibility follows by induction from the tube constraint, and it implies that XN remains a safe set.The proof uses the same error-tube argument as the general safety result.
IV. DESIGN OF Sf AND ΩFROM DATA
The paper proposes learning-oriented, low-tuning procedures for designing the tube and terminal safe set. These procedures estimate Ω from data or probabilistic models and enlarge Sf iteratively.
- Design components: The design uses two components: the robust positively invariant set Ω defining the tube and the terminal safe set Sf.These components determine the robust backup trajectory and terminal safety mechanism.
- Design scope: The general terminal-set construction can use any safe set, while standard linear tube-based MPC design methods remain applicable in the invariant special case.The paper positions the learning-oriented procedure as an alternative requiring less manual tuning.
- Data-driven design: The proposed data-driven procedure estimates Ω through scenario optimization and iteratively enlarges a terminal safe set using feasible MPSC solutions.Initialization can use a trivial terminal set such as {0} ⊕ Ω.
A. Scenario based calculation of Ωfrom data
Scenario optimization computes a scalable ellipsoidal RPI set from sampled dynamics or measurements. Its probabilistic guarantee bounds the chance that the robust invariance condition is violated.
- Scenario construction: The method restricts Ω to ellipsoidal sets and uses scenarios sampled from a probabilistic dynamics belief or collected from measurements.The restriction is intended to preserve scalability for larger systems.
- Optimization objective: The design problem selects Ω so it is robustly positively invariant for the error system when the scenario constraint holds for all disturbances.Its objective favors a small RPI set, enlarging the tightened-constraint feasible region and therefore the safe set.
- Probabilistic guarantee: If the scenario problem has a solution, the result is ε-level robustly feasible with probability at least 1 − PΣ_i=0^{ns−1} ε^i(1 − ε)^(Ns−i).The corresponding robust problem requires the invariance condition for every disturbance in W.
- Guarantee basis: The guarantee follows directly from an existing scenario-optimization theorem.The paper cites prior work for the probabilistic result.
B. Iterative enlargement of the terminal safe set Sf
The paper enlarges the terminal safe set using previously feasible MPC solutions, preserving safety under stated assumptions while reducing conservatism over time.
- B. Iterative enlargement of the terminal safe set Sf: Previously calculated feasible solutions of the MPC problem provide data for enlarging the terminal safe set Sf.The construction uses measured states for which the safety optimization was feasible.
- B. Iterative enlargement of the terminal safe set Sf: A larger terminal safe set typically yields a larger feasible set XN and therefore a larger overall safe set S.The paper also notes that an explicit safe-set approximation can inform the learning controller through a safety-boundary feature.
- B. Iterative enlargement of the terminal safe set Sf: Under the theorem’s assumptions and convexity of the MPC problem, the enlarged set remains safe with Algorithm 1 as backup controller.The proof uses convexity of the feasible set and the fact that the union of two safe sets is safe.
- B. Iterative enlargement of the terminal safe set Sf: A practical procedure initializes Sf = {Ω} and enlarges it during closed-loop operation of Algorithm 1.A related construction initializes Xf = {0} under the alternative terminal-set formulation.
- B. Iterative enlargement of the terminal safe set Sf: For the alternative formulation, X^M(k)_f ⊕Ω is a safe set when the stated assumptions hold and the MPC problem is convex.Corollary IV.4 supplies the corresponding safe backup controller through equation (7).
V. APPLICATION TO NUMERICAL EXAMPLES
The numerical examples use scenario-based data to design a robust MPSC for a partially unknown mass-spring-damper system. Simulations show constraint-preserving intervention and substantial safe-set growth during operation.
- V. APPLICATION TO NUMERICAL EXAMPLES: 20% parameter error is incorporated into the approximate mass-spring-damper model, with constraints |u(k)| ≤2.5, |x1(k)| ≤1, and x2(k) ∈[−0.4, 1].The system is studied as a partially unknown discretized mass-spring-damper system.
- V. APPLICATION TO NUMERICAL EXAMPLES: Ns = 600 uniformly sampled measurements support scenario design, yielding an ellipsoidal Ω that satisfies the design condition with probability 0.97.The MPSC uses horizon N = 20 and terminal safe set Sf = Ω.
- V. APPLICATION TO NUMERICAL EXAMPLES: The learning signal combines sinusoids to generate informative measurements during closed-loop operation.It is defined as uL(k) = 2 sin(0.01πk) + 0.5 sin(0.12πk).
- V. APPLICATION TO NUMERICAL EXAMPLES: The safety controller modifies the learning input only near the safe-set boundary, while the unprotected learning trajectory violates state constraints in its first time steps.The simulation starts from x(0) = (−0.7, 1)^⊤; Figure 2 marks modified-input states in red.
- V. APPLICATION TO NUMERICAL EXAMPLES: After k = 115 time steps, iterative enlargement with planning horizon N = 10 covers a significant portion of the state space with the safe terminal set.Figure 3 shows nominal and overall terminal sets at k1 = 0, k2 = 100, and k3 = 115.
VI. CONCLUSION
The paper concludes that MPSC can provide safety guarantees for potentially unsafe learning-based controllers while supporting data-driven design and iterative reduction of conservatism.
- VI. CONCLUSION: MPSC enhances potentially unsafe learning-based control strategies with safety guarantees and can be combined with any known safe set.The conclusion presents this as the paper’s central approach to safe learning-based control.
- VI. CONCLUSION: A parameter-free scenario-based procedure uses available data to design MPSC and reduce its conservatism over time through generated closed-loop data.The conclusion links the procedure to the iterative safe-set enlargement illustrated in Figure 3.
- VI. CONCLUSION: Figure 3 compares nominal terminal sets and the resulting safe terminal sets at k1 = 0, k2 = 100, and k3 = 115.The right panel represents Sf = X^M(k)_f ⊕Ω for the corresponding nominal sets.