PaperlayerView exact revision on arXiv

Source-linked AI summary

Control Barrier Functions and Input-to-State Safety with Application to Automated Vehicles

Anil Alan, Andrew J. Taylor, Chaozhe R. He, Aaron D. Ames, Gabor Orosz

arXiv:2206.03568v1eess.SYcs.RO

TL;DR

The paper addresses how to enforce safety in control systems without unnecessarily sacrificing performance, especially when model discrepancies create input disturbances. It develops CBF and ISSf-based controller synthesis through an inverted-pendulum tutorial and applies it to a heavy-duty CAV. The resulting robust controller achieves the safety requirement experimentally while retaining performant behavior.

  • Problem

    Safety and performance can conflict, while model discrepancies in automotive actuation can degrade CBF safety guarantees.

  • Method

    The paper filters a nominal controller with CBFs and uses ISSf to robustify the design against input disturbances, illustrated through an inverted-pendulum tutorial and CAV application.

  • Results

    The robust safety-critical controller consistently satisfies the original safety requirement in experiments despite larger standard deviation across runs.

  • Takeaways & Limitations

    ISSf-CBFs provide a practical tool for combining performant behavior with meaningful theoretical safety guarantees on an automated truck.

Abstract

from arXiv · show

Balancing safety and performance is one of the predominant challenges in modern control system design. Moreover, it is crucial to robustly ensure safety without inducing unnecessary conservativeness that degrades performance. In this work we present a constructive approach for safety-critical control synthesis via Control Barrier Functions (CBF). By filtering a hand-designed controller via a CBF, we are able to attain performant behavior while providing rigorous guarantees of safety. In the face of disturbances, robust safety and performance are simultaneously achieved through the notion of Input-to-State Safety (ISSf). We take a tutorial approach by developing the CBF-design methodology in parallel with an inverted pendulum example, making the challenges and sensitivities in the design process concrete. To establish the capability of the proposed approach, we consider the practical setting of safety-critical design via CBFs for a connected automated vehicle (CAV) in the form of a class-8 truck without a trailer. Through experimentation we see the impact of unmodeled disturbances in the truck's actuation system on the safety guarantees provided by CBFs. We characterize these disturbances and using ISSf, produce a robust controller that achieves safety without conceding performance. We evaluate our design both in simulation, and for the first time on an automotive system, experimentally.

I. INTRODUCTION

The paper presents CBF-based safety-critical control as a way to preserve nominal performance while enforcing safety, then extends it with ISSf to address model disturbances. It develops the methodology through an inverted-pendulum tutorial and applies it to a heavy-duty connected automated vehicle.

  • Motivation and CBF methodology: CBF safety filters modify hand-designed controllers only when needed to preserve safety while retaining performance.The approach uses convex optimization to minimally modify a nominal controller and enforce set invariance.
  • Robustness to disturbances: ISSf characterizes how disturbances enlarge the invariant safe set and provides a way to control that growth without unnecessary conservativeness.The framework connects disturbance magnitude to degraded safety guarantees and supports robust controller modification.
  • Motivation and CBF methodology: Model discrepancies can appear as input disturbances in heavy-duty CAV braking systems, creating safety violations when actuator interactions are ignored.The paper identifies simplified braking models and harsh braking by a preceding vehicle as a practical challenge.
  • Tutorial development: The paper combines a tutorial treatment of CBFs and ISSf with an inverted-pendulum example that makes theoretical and design challenges concrete.The presentation emphasizes practical design trade-offs and supplies details needed to recreate the pendulum simulations.
  • Automated-vehicle application: The heavy-duty CAV study follows modeling, safety specification, nominal controller design, simulation, and experimental testing on a full-scale automated class-8 tractor.The design process uses experimental disturbance measurements to robustify the safety-critical controller.

B. Safety-Critical Controller

The safety-critical controller filters a nominal performance controller through CBF constraints, changing it only when needed to satisfy safety. For the inverted pendulum, this construction preserves safety while the nominal stabilizing controller alone can leave the safe set.

  • The nominal controller stabilizes the pendulum but causes its state to leave the safe set C.
  • CBFs modify a performance-oriented controller to explicitly enforce safety.
  • The optimization-based controller equals the nominal input when it satisfies the CBF constraint and otherwise minimizes deviation from it.
  • The quadratic-program controller is continuous and feasible for every state under the stated CBF assumptions.
  • The correction term is positive only when the nominal controller violates safety requirements, while the construction handles the L_gh(x)=0 singularity without an input jump.
  • For the inverted pendulum, the CBF-filtered controller keeps the trajectory within C by deviating from the nominal controller when necessary.

III. ROBUSTNESS TO DISTURBANCE

Real-world implementation can make the received input differ from the commanded input, weakening model-based safety guarantees. The disturbance model represents this mismatch as a bounded, piecewise-continuous additive input disturbance.

  • Commanded and received inputs can differ because of actuator dynamics, delays, quantization, saturation, noise, or state-measurement errors.
  • The actual system input is modeled as u+d(t), where d is a bounded, piecewise-continuous time-varying disturbance.
  • The disturbed closed-loop system assumes a unique solution for every initial state and bounded, piecewise-continuous disturbance signal.
  • The inverted-pendulum example uses a Heaviside-based disturbance signal with ||d||_∞=M and M=0.75 [N·m].The corresponding signal is depicted in Fig. 5.

A. Input-to-State Safety

Input-to-state safety replaces exact invariance under disturbances with forward invariance of a disturbance-dependent enlarged set. ISSf-CBFs provide a controller design mechanism whose safety degradation can be tuned through the function ϵ.

  • ISSf captures safety when disturbances prevent the original set C from remaining forward invariant, by considering a larger disturbance-dependent set.
  • The enlarged set is defined by Int(C_δ)={x∈R^n:h(x)+γ(h(x),δ)>0}, with C_δ reducing to C when δ=0.
  • An ISSf-CBF yields a nonempty admissible control set and guarantees safety with respect to C_δ for disturbances satisfying ||d||_∞≤δ.
  • Increasing disturbance magnitude makes h* more negative, moving the boundary of C_δ farther from the boundary of C.
  • The choice of ϵ controls safety degradation, and the green parameter set in Table I produces a larger C_δ than the black and red sets.

B. Robust Safety-Critical Controller

ISSf-CBFs extend safety-critical control to disturbances by rendering an enlarged set forward invariant, while parameter choices tune conservativeness. The resulting controller is continuous, feasible, and preserves the nominal controller when the barrier input effect vanishes.

  • Robust safety: ISSf-CBFs render an enlarged set Cδ forward invariant, making the original set C input-to-state safe under disturbances.The enlargement quantifies disturbance effects and can be tuned through the design parameters.
  • Controller synthesis: The optimization problem defining the robust safety-critical controller is feasible for every state and has a closed-form solution.The solution produces a controller that belongs to the ISSf-safe controller set.
  • Controller synthesis: The robust controller is continuous and remains within the admissible ISSf controller set for all states.This provides the stated safety property of the optimization-based synthesis.
  • Single-input implementation: For single-input systems, the controller switches between closed-form expressions according to the sign of Lgh(x), using the nominal controller when Lgh(x)=0.The switching structure separates the cases Lgh(x)>0 and Lgh(x)<0.
  • Inverted pendulum example: In the disturbed inverted-pendulum example, the non-robust controller leaves the safe set, whereas ISSf-based controllers remain within a forward-invariant enlarged set.Different parameter choices can produce the same invariant set while differing in conservativeness.

IV. SAFETY-CRITICAL CONTROLLER DESIGN FOR A CONNECTED AUTOMATED TRUCK

The truck design combines a Control Barrier Function defining safety with a performance-oriented nominal controller, then minimally modifies that controller to enforce safety.

  • Controller architecture: The connected automated truck design defines a safe set with a CBF and combines it with a nominal performance-based controller.The synthesis is presented as a safety-critical longitudinal controller for the truck.
  • Controller architecture: The synthesized controller modifies the nominal controller in a minimally invasive way while ensuring safety.This construction unifies performance objectives with the barrier-based safety requirement.

A. Modeling Longitudinal Dynamics

The truck model describes rear-axle longitudinal motion under no-slip, flat-road, and no-headwind assumptions, then augments it with connected-vehicle following dynamics and V2V measurements.

  • Truck model: The longitudinal truck dynamics assume a rear-axle-driven truck without a trailer, with tires rolling without slipping on a flat road without headwind.These assumptions define the physical setting of the model.
  • Truck model: The truck state is longitudinal speed v, the input is rear-axle torque T, and the model includes mass, inertia, tire radius, drag, gravity, and rolling resistance parameters.The effective mass includes the vehicle mass and rotating-element inertia.
  • Connected-system model: When following a connected vehicle, the state is x=[D, v, vL]⊤, combining headway distance with truck and leader speeds.The leader’s speed and acceleration enter the connected-system dynamics.
  • Connected-system model: V2V communication provides the truck with the leader’s distance, speed, and acceleration information.The distance is obtained from the leader’s GPS position.

B. Safety and Control Barrier Function

The truck’s CBF encodes a velocity-dependent safe following distance, while a connected cruise controller targets performance; their combination intervenes only when needed to preserve safety.

  • Safety barrier: The truck’s safety task is to maintain a safe distance behind the leader using a CBF based on a headway function ρ(v,vL).The headway function specifies the minimum safe distance for the current truck and leader velocities.
  • Safety barrier: The headway function is parameterized by coefficients ci and visualized as a function of leader and truck velocity.The resulting safe set is defined by the barrier function h.
  • CBF verification: For αc=0.1 [1/s], graphical evaluation shows the CBF condition is strictly positive over the tested distance and leader-velocity range.The evaluation uses the worst-case leader acceleration while satisfying the constraint relating c1, c3, c4, v, and vL.
  • Nominal performance controller: The nominal connected cruise controller uses a distance-based range policy and a relative-speed policy to prioritize performance.The range policy produces a desired speed from distance, while the speed policy bounds speed error when the leader violates the assumed speed limit.
  • Safety-critical synthesis: The safety-critical controller applies the minimum of the nominal and safe controllers, yielding a continuous controller that belongs to the CBF-admissible set.In the application domain, the barrier input term is negative, so the switch structure selects the safety-enforcing value when necessary.
  • Simulation: In simulation, both controllers avoid a crash, but only the safety-critical controller maintains the required safe following distance during hard braking.The nominal controller brakes less aggressively and violates the safe-distance condition, whereas the safety-critical controller preserves hQP(x(t))≥0.

V. EXPERIMENTAL RESULTS & ROBUST DESIGN

Experiments on a Class-8 automated truck exposed failures of both nominal and safety-critical controllers under unmodeled actuation delays. The study characterized the commanded-to-actual acceleration discrepancy as an input disturbance for robust redesign.

  • Experimental configuration: The experiments deployed nominal and safety-critical controllers on an automated Class-8 truck using repeatable lead-vehicle braking data.The truck and lead vehicle exchanged motion data through V2X onboard units, while a prerecorded lead-vehicle profile reduced variation across runs.
  • Observed failures: Both nominal and safety-critical controllers consistently violated the CBF safety requirement in truck experiments.The safety-critical controller therefore did not preserve its modeled safety guarantee on the physical vehicle.
  • Observed failures: Acceleration delay arose from nonlinear truck power-generation dynamics imperfectly represented by the simplified feed-forward model.The discrepancy between commanded and achieved acceleration was modeled as a disturbance d in the simplified dynamics.
  • Disturbance characterization: Approximately 4 m/s^2 was the largest observed commanded-to-actual acceleration difference, motivating an empirical disturbance bound δ = 4.5 m/s^2.The bound was chosen slightly above the largest measured discrepancy.

C. Robust Design

The robust design augments the CBF with ISSf parameters that trade robustness against performance. Simulation and truck experiments show that suitable parameter choices restore safety while limiting tracking-distance changes.

  • Robust controller design: ISSf-CBFs address the measured input disturbance by modifying the CBF condition with parameters ϵ0 > 0 and λ ≥ 0.The resulting invariant set guarantees h(x(t)) ≥ h*, where h* depends on the disturbance and parameter choices.
  • Simulation and experiment: Disturbed simulation reproduced the nominal and safety-critical controller failures and showed improved behavior under the robust safety-critical controller.The simulation used the experimentally observed disturbance signal and the truck model's initial condition.
  • Simulation and experiment: ϵ0 = 0.5 s^3/m and λ = 0.4 1/m produced experimental runs in which h remained nonnegative.The robust controller satisfied the original safety requirement, although its run-to-run standard deviation was larger.
  • Parameter effects: Parameter sweeps showed that the original safety requirement can hold for sufficiently small ϵ0 or small positive λ.Green parameter markers denote experiments meeting h ≥ 0, while red markers denote violations.
  • Parameter effects: λ > 0 provided order-of-magnitude stronger theoretical guarantees without greatly increasing the steady-state tracking-distance shift.With λ = 0, stronger guarantees required dramatically increasing the tracking-distance shift; the desired steady-state distance was D* = 25 m at v* = 16 m/s.
  • Conclusion: The paper concludes that ISSf-CBFs can combine meaningful theoretical safety guarantees with performant behavior in an experimentally deployed automated truck.The approach was also developed tutorial-style using an inverted pendulum example.

A. Proof of Theorem 2

The proof establishes that the optimization-based CBF controller is feasible, has a closed-form solution, and is continuous. It uses convexity and KKT conditions, then handles all sign cases of the switching function.

  • Feasibility and closed form: The optimization problem has a closed-form solution feasible for every x ∈ R^n, with kQP(x) ∈ KCBF(x).The proof begins by establishing feasibility and the admissibility of the resulting controller.
  • Feasibility and closed form: When Lgh(x) = 0, the minimizing input is the nominal controller kn(x), so kQP(x) = kn(x).The norm-based cost is minimized by the nominal input when the inequality constraint is satisfied for every input.
  • KKT derivation: For Lgh(x) ≠ 0, convexity and Slater’s condition make the KKT conditions necessary and sufficient for optimality.The proof derives the optimizer using primal feasibility, dual feasibility, complementary slackness, and stationarity.
  • Continuity: The three-case argument proves that kQP is continuous at every state.The conclusion combines the local continuity results for all possible values of ψ(x).
Loading 2206.03568v1…