Source-linked AI summary
Guaranteeing Safety of Learned Perception Modules via Measurement-Robust Control Barrier Functions
Sarah Dean, Andrew J. Taylor, Ryan K. Cosner, Benjamin Recht, Aaron D. Ames
TL;DR
Measurement-model uncertainty can degrade safety guarantees when controllers rely on estimated states. The paper proposes MR-CBFs and uses them to connect learned-perception error bounds with data sampling; simulations demonstrate safe perception-based control on a Segway.
Problem
Controllers that rely on state estimates may lose safety guarantees under measurement-model uncertainty, while robust CBF methods and learning-based mitigation of deterministic estimate error remain unaddressed together.
Source: §1 · p. 1Method
Results
Takeaways & Limitations
MR-CBFs connect worst-case learned measurement error and data density to safety conditions for perception-based control.
Source: §6 · p. 8The paper leaves real-world validation, observation noise, targeted trajectory-based data acquisition, controller-solution Lipschitz properties, and non-invertible observation models for future work.
Source: §6 · p. 8
Abstract
from arXiv · showhide
Modern nonlinear control theory seeks to develop feedback controllers that endow systems with properties such as safety and stability. The guarantees ensured by these controllers often rely on accurate estimates of the system state for determining control actions. In practice, measurement model uncertainty can lead to error in state estimates that degrades these guarantees. In this paper, we seek to unify techniques from control theory and machine learning to synthesize controllers that achieve safety in the presence of measurement model uncertainty. We define the notion of a Measurement-Robust Control Barrier Function (MR-CBF) as a tool for determining safe control inputs when facing measurement model uncertainty. Furthermore, MR-CBFs are used to inform sampling methodologies for learning-based perception systems and quantify tolerable error in the resulting learned models. We demonstrate the efficacy of MR-CBFs in achieving safety with measurement model uncertainty on a simulated Segway system.
1 Introduction
The introduction motivates safety guarantees that account for uncertain measurements, especially when state estimates come from learned perception. It identifies a gap in robust CBF methods and presents MR-CBFs as a way to connect robust control with learning and data collection.
1 Introduction
- Uncertain measurement models can make state estimates inaccurate and lead to unsafe behavior if controller design does not account for that uncertainty.Source: §1 · p. 1
- Existing CBF methods often assume perfect state measurements, while prior robust formulations do not address uncertain actuated dynamics or learning to mitigate deterministic state-estimate error.Source: §1 · p. 1
- The paper studies systems whose states are inferred by estimating an inverse map from complex measurements, such as camera images, a setting with little nonlinear-CBF analysis to the authors’ knowledge.Source: §1 · p. 2
- The paper introduces MR-CBFs to make control barrier conditions robust to measurement-model error, incorporate them into online convex-optimization controllers, and guide data sampling for tolerable learned-model error.Source: §1 · p. 2
2 Background
The background formalizes safety as forward invariance of a safe set and reviews how Control Barrier Functions characterize safe control actions. A safety-critical filter can then select a nearby safe action from a nominal controller.
2 Background
- A safe set C is represented as the 0-superlevel set of a continuously differentiable function h, with its boundary at h(x)=0 and interior where h(x)>0.Source: §2 · p. 2
- Safety means the safe set is forward invariant: trajectories starting within it remain there for their existence interval.Source: §2 · p. 2
- A CBF condition provides a set of admissible control inputs, and a locally Lipschitz controller selecting from that set renders the system safe with respect to C.Source: §2 · p. 3
- The safety-critical formulation filters a potentially unsafe nominal controller to find the nearest safe action; a valid CBF makes the optimization feasible and its resulting controller locally Lipschitz.Source: §2 · p. 3
3 Measurement-Robust Control Barrier Functions
Because ordinary CBF conditions require the exact state, this section develops a robust condition and MR-CBF definition for uncertain state estimates. Under bounded estimate error, controllers satisfying the resulting condition guarantee safety; the condition remains convex, though a slack relaxation may not enforce safety.
3 Measurement-Robust Control Barrier Functions
- Measurements are assumed deterministic and invertible, while an estimated inverse map produces the state estimate; its error is bounded by a measurement-dependent compact set.Source: §3 · pp. 3–4
- The sets of possible estimates and possible underlying states describe how the error set relates true states, measurements, and state estimates.Source: §3 · p. 4
- Since the ordinary CBF condition requires exact state knowledge, the robust alternative imposes a condition across possible states associated with a measurement and estimate.Source: §3 · p. 4
- An MR-CBF modifies the usual barrier condition with measurement-dependent terms a(y) and b(y), including an input-norm penalty, to account for measurement uncertainty.Source: §3 · p. 4
- The robust admissible-input constraint remains convex and can be incorporated into an optimization-based controller as a second-order cone program.Source: §3 · pp. 4–5
- Theorem 2 guarantees safety when estimate errors are bounded by ε(y), the relevant barrier Lie derivatives and α∘h are Lipschitz, and the controller selects inputs from the MR-CBF admissible set.Source: §3 · p. 5
- The explicit error-bound condition approaches the ordinary CBF condition as ε(y) decreases, and smaller bounds enlarge the region where the robust condition holds.Source: §3 · p. 5
- A slack-variable relaxation does not necessarily enforce the desired safety constraint, though its impact can be understood through projection-to-state safety when δ remains small.Source: §3 · p. 5
4 Learning for Measurement Model Uncertainty Reduction
This section connects MR-CBF validity to bounds on learned measurement error and to how calibration data are collected. It gives sufficient error conditions and illustrates safe control on a simulated Segway, while identifying limitations and future directions.
4 Learning for Measurement Model Uncertainty Reduction
- Theorem 3 gives a sufficient state-dependent error condition for an MR-CBF, with an additional factor of 2 because the full set of possible state estimates must be considered.Source: §4 · p. 6
- The method treats the learned inverse map’s error as a pointwise bound, while noting that machine-learning analyses often focus instead on mean error.Source: §4 · p. 6
- The paper notes that its learned-model error definition uses a simplified model and points to pointwise error bounds as an area for future work.Source: §4 · p. 6
- The training-data condition yields a density-based sampling rule: data should be sampled non-uniformly according to the right-hand side of (21) for MR-CBF feasibility.Source: §4 · pp. 6–7
- With worst-case measurement error of ε=0.2, the MR-OP filter keeps the Segway trajectory in the safe set, whereas the Standard CBF Filter does not from the same initial condition.Source: Figure 1 · p. 7
5 Simulation Results
The simulations compare standard CBF filtering with the MR-OP Filter under synthetic measurement offsets and learned perception errors on a Segway. With the same initial condition, the MR-OP Filter produces a safe trajectory where the Standard CBF-QP Filter does not.
5 Simulation Results
- The Segway simulation used planar motion, pitch-angle and pitch-rate safety functions, and an ECOS implementation of the MR-OP constraint.The Lipschitz constants were estimated from gridded values around equilibrium; a CBF-QP Filter using both safety functions served as the baseline.Source: §5 · p. 7
- For a constant pitch-angle measurement offset ϵ, the MR-OP Filter is designed to ensure safety for worst-case error up to ϵ.This scenario compares the MR-OP Filter with a standard CBF-QP Filter.Source: §5 · p. 7
- With the same initial condition, the MR-OP Filter generated a safe trajectory while the Standard CBF-QP Filter did not.Figure 2 reports maximum state-estimate errors of 0.183 and 0.201, respectively.Source: Figure 2 · p. 8
- The learned sensor-calibration model used kernel ridge regression trained on 800 labeled images, with noisy position and pitch-angle labels.The labels were corrupted by Gaussian noise with standard deviation 0.1; hyperparameters were selected using an 80%-20% train-test split.Source: §5 · p. 8
6 Conclusion
The paper introduces MR-CBFs to address safety when measurement-to-state estimates are erroneous, and incorporates their safety condition into convex optimization-based control. It also connects worst-case learned-measurement error to data density and demonstrates perception-based control on a simulated Segway.
6 Conclusion
- MR-CBFs provide a tool for ensuring safety despite error in the model relating measurements to state estimates.Their safety condition can be incorporated as a second-order cone constraint while preserving the convexity of typical CBF-based controllers.Source: §6 · p. 8
- The paper explores quantifying worst-case learned-measurement error in terms of data density and demonstrates safe perception-based control using models trained on noisy state data.The demonstration uses a simulated Segway system.Source: §6 · p. 8
- Real-world feasibility on unstable systems such as the Segway, along with theoretical questions about noise, data acquisition, controller regularity, and non-invertible observation models, remains future work.The paper specifically identifies dynamic estimators such as Kalman filters as a case for further study.Source: §6 · p. 8
A Measurement-Robust Control Barrier Function Safety Proof
The proof establishes that the MR-CBF condition yields safety under bounded measurement error, then rewrites the MR-OP optimization in standard second-order cone program form.
A Measurement-Robust Control Barrier Function Safety Proof
- Under the stated Lipschitz and measurement-error assumptions, a controller satisfying the MR-CBF condition renders the safe set forward invariant.The error bound ϵ(y) and the Lipschitz coefficients determine the MR-CBF parameter function.Source: A Measurement-Robust Control Barrier… · p. 11
- The proof lower-bounds the worst-case safety expression using the Lipschitz coefficients and error bound, then uses the controller condition to establish the required inequality.The bound is applied over states consistent with the measurement.Source: A Measurement-Robust Control Barrier… · p. 11
B MR-OP Second Order Cone Conversion
- The MR-OP objective is reformulated with a linear cost and second-order cone constraints to obtain standard SOCP form.The conversion uses an auxiliary variable for the quadratic cost and combines the resulting cone constraints.Source: B MR-OP Second Order Cone Conversion · p. 12
C R-MR-OP Lipschitz Continuity Proof
The appendix proves local Lipschitz continuity of the R-MR-OP controller by expressing its optimization as a conic problem and applying a continuity theorem under stated regularity conditions.
C R-MR-OP Lipschitz Continuity Proof
- The optimization is written as a conic constraint, and Theorem 4 in supplies the continuity result used in the proof.The argument also relies on differentiability and local Lipschitz properties of the relevant functions and derivatives.Source: C R-MR-OP Lipschitz Continuity Proof · p. 13
- The proof assumes a nonzero error bound and uses surjectivity and a coercivity condition to obtain a strict local minimizer with Lipschitz-continuous solutions.The theorem applies locally around the parameter pair.Source: C R-MR-OP Lipschitz Continuity Proof · pp. 13–14
- The controller is locally Lipschitz with respect to the true state when the measurement and estimate arguments are locally Lipschitz.The proof establishes local Lipschitz continuity of the controller in those arguments.Source: C R-MR-OP Lipschitz Continuity Proof · pp. 12, 14
D Learning and Uncertainty Reduction Results
Theorem 3 gives an MR-CBF criterion with uncertainty-dependent parameters; its proof derives a sufficient condition stated in terms of the true state.
D Learning and Uncertainty Reduction Results
- Theorem 3 makes h an MR-CBF under a sufficient condition, with parameters set by the error bound and Lipschitz coefficients.The parameters are (ε(y)(LLf h + Lα◦h), ε(y)LLgh).Source: D Learning and Uncertainty Reduction… · p. 14
- The proof checks feasibility by optimizing over the control input, distinguishing whether its coefficient is positive or nonpositive.When ∥Lgh(bx)∥2 − b(y) is positive, the input magnitude can grow arbitrarily; otherwise, feasibility requires an additional condition.Source: D Learning and Uncertainty Reduction… · p. 14
- Combining the derived expressions yields a sufficient condition depending only on the true state.The proof uses the displayed inequality to relate the barrier condition at the estimate to one at the true state.Source: D Learning and Uncertainty Reduction… · p. 14
D.1 Motivation for Non-Parametric Error Bound
The section connects a nonparametric perception model to a pointwise probabilistic error bound, then uses that bound in the Corollary 1 proof.
D.1 Motivation for Non-Parametric Error Bound
- The Nadarya-Watson regressor locally averages training data to predict the state from system output.The analysis considers smooth maps p and q under the metric ρ and their stated Lipschitz bounds.Source: §D.1 · pp. 14–15
- Under the stated smoothness and noisy-label assumptions, Lemma 1 gives a high-probability error bound for a fixed measurement y.The bound applies when sN(y) is nonzero; the supplied passage states probability at least 1 − δ.Source: §D.1 · p. 15
- Lemma 1 yields a pointwise high-probability error bound of the form used in Definition 4.The application relates the bound to training states within distance α/Lp.Source: §D.1 · p. 15
- Extending the pointwise probabilistic result to a compact set is nontrivial, so this discussion is illustrative and refers to for fuller treatment.Source: §D.1 · p. 15
D.2 Proof of Corollary 1
- The Corollary 1 proof combines the nonparametric error bound with expression (17) and obtains the result by rearranging terms.Source: §D.2 · p. 15
E Further Experimental Details
The experimental appendix gives a feasibility result for the Segway control constraints and explains how measurement error enters its sufficient condition. It also shows the learned model's validation predictions and errors.
E Further Experimental Details
- The Segway experiment constrains both wheel torques to be identical and applies the MR-OP Filter to both safety functions simultaneously.Source: E Further Experimental Details · p. 15
- Figure 3 shows gridded training data over position and pitch angle, validation-set estimated versus actual pitch angles, and empirical model errors.Source: E Further Experimental Details · p. 15, Figure 3 · p. 16
- Proposition 1 gives a sufficient condition for the experimental control constraints to be feasible for every x in C.The passage does not supply the condition's full expression.Source: E Further Experimental Details · p. 16
- The true-state guarantee effectively doubles the error radius to 2ε(x).The proof adapts the constraints from the estimated state to the true state using a smoothness argument.Source: E Further Experimental Details · p. 16
- The proof uses cases to select the control input: it sets u to zero under the first condition, and otherwise considers inputs with the same or opposite sign as a.These cases yield the stated second and third conditions after algebra.Source: E Further Experimental Details · p. 17