PaperlayerView exact revision on arXiv

Source-linked AI summary

Control Barrier Functions and Input-to-State Safety with Application to Automated Vehicles

Anil Alan, Andrew J. Taylor, Chaozhe R. He, Aaron D. Ames, Gabor Orosz

arXiv:2206.03568v1eess.SYcs.RO

TL;DR

The paper addresses how to enforce safety in control systems without unnecessarily sacrificing performance, especially when model discrepancies create input disturbances. It develops CBF and ISSf-based controller synthesis through an inverted-pendulum tutorial and applies it to a heavy-duty CAV. The resulting robust controller achieves the safety requirement experimentally while retaining performant behavior.

  • Problem

    Safety and performance can conflict, while model discrepancies in automotive actuation can degrade CBF safety guarantees.

    Source: §I · p. 1, §III · p. 5

  • Method

    The paper filters a nominal controller with CBFs and uses ISSf to robustify the design against input disturbances, illustrated through an inverted-pendulum tutorial and CAV application.

    Source: §I · p. 2, A. Control Barrier Functions · p. 4, §III · p. 5

  • Results

    The robust safety-critical controller consistently satisfies the original safety requirement in experiments despite larger standard deviation across runs.

    Source: D. Robust Experimental Results · p. 12

  • Takeaways & Limitations

    ISSf-CBFs provide a practical tool for combining performant behavior with meaningful theoretical safety guarantees on an automated truck.

    Source: §VI · p. 13

Abstract

from arXiv · show

Balancing safety and performance is one of the predominant challenges in modern control system design. Moreover, it is crucial to robustly ensure safety without inducing unnecessary conservativeness that degrades performance. In this work we present a constructive approach for safety-critical control synthesis via Control Barrier Functions (CBF). By filtering a hand-designed controller via a CBF, we are able to attain performant behavior while providing rigorous guarantees of safety. In the face of disturbances, robust safety and performance are simultaneously achieved through the notion of Input-to-State Safety (ISSf). We take a tutorial approach by developing the CBF-design methodology in parallel with an inverted pendulum example, making the challenges and sensitivities in the design process concrete. To establish the capability of the proposed approach, we consider the practical setting of safety-critical design via CBFs for a connected automated vehicle (CAV) in the form of a class-8 truck without a trailer. Through experimentation we see the impact of unmodeled disturbances in the truck's actuation system on the safety guarantees provided by CBFs. We characterize these disturbances and using ISSf, produce a robust controller that achieves safety without conceding performance. We evaluate our design both in simulation, and for the first time on an automotive system, experimentally.

I. INTRODUCTION

The paper presents CBF-based safety-critical control as a way to preserve nominal performance while enforcing safety, then extends it with ISSf to address model disturbances. It develops the methodology through an inverted-pendulum tutorial and applies it to a heavy-duty connected automated vehicle.

Motivation and CBF methodology

  • CBF safety filters modify hand-designed controllers only when needed to preserve safety while retaining performance.The approach uses convex optimization to minimally modify a nominal controller and enforce set invariance.Source: §I · p. 1, A. Control Barrier Functions · p. 4

Robustness to disturbances

  • ISSf characterizes how disturbances enlarge the invariant safe set and provides a way to control that growth without unnecessary conservativeness.The framework connects disturbance magnitude to degraded safety guarantees and supports robust controller modification.Source: §I · pp. 1–2

Motivation and CBF methodology

  • Model discrepancies can appear as input disturbances in heavy-duty CAV braking systems, creating safety violations when actuator interactions are ignored.The paper identifies simplified braking models and harsh braking by a preceding vehicle as a practical challenge.Source: §I · p. 2

Tutorial development

  • The paper combines a tutorial treatment of CBFs and ISSf with an inverted-pendulum example that makes theoretical and design challenges concrete.The presentation emphasizes practical design trade-offs and supplies details needed to recreate the pendulum simulations.Source: §I · p. 2, §II · p. 3, A. Control Barrier Functions · p. 3

Automated-vehicle application

  • The heavy-duty CAV study follows modeling, safety specification, nominal controller design, simulation, and experimental testing on a full-scale automated class-8 tractor.The design process uses experimental disturbance measurements to robustify the safety-critical controller.Source: §I · p. 2

B. Safety-Critical Controller

The safety-critical controller filters a nominal performance controller through CBF constraints, changing it only when needed to satisfy safety. For the inverted pendulum, this construction preserves safety while the nominal stabilizing controller alone can leave the safe set.

III. ROBUSTNESS TO DISTURBANCE

Real-world implementation can make the received input differ from the commanded input, weakening model-based safety guarantees. The disturbance model represents this mismatch as a bounded, piecewise-continuous additive input disturbance.

  • Commanded and received inputs can differ because of actuator dynamics, delays, quantization, saturation, noise, or state-measurement errors.Source: §III · p. 5
  • The actual system input is modeled as u+d(t), where d is a bounded, piecewise-continuous time-varying disturbance.Source: §III · p. 5
  • The disturbed closed-loop system assumes a unique solution for every initial state and bounded, piecewise-continuous disturbance signal.Source: §III · p. 5
  • The inverted-pendulum example uses a Heaviside-based disturbance signal with ||d||_∞=M and M=0.75 [N·m].The corresponding signal is depicted in Fig. 5.Source: §III · pp. 5–6

A. Input-to-State Safety

Input-to-state safety replaces exact invariance under disturbances with forward invariance of a disturbance-dependent enlarged set. ISSf-CBFs provide a controller design mechanism whose safety degradation can be tuned through the function ϵ.

B. Robust Safety-Critical Controller

ISSf-CBFs extend safety-critical control to disturbances by rendering an enlarged set forward invariant, while parameter choices tune conservativeness. The resulting controller is continuous, feasible, and preserves the nominal controller when the barrier input effect vanishes.

Robust safety

  • ISSf-CBFs render an enlarged set Cδ forward invariant, making the original set C input-to-state safe under disturbances.The enlargement quantifies disturbance effects and can be tuned through the design parameters.Source: B. Robust Safety-Critical Controller · p. 7

Controller synthesis

  • The optimization problem defining the robust safety-critical controller is feasible for every state and has a closed-form solution.The solution produces a controller that belongs to the ISSf-safe controller set.Source: B. Robust Safety-Critical Controller · p. 7
  • The robust controller is continuous and remains within the admissible ISSf controller set for all states.This provides the stated safety property of the optimization-based synthesis.Source: B. Robust Safety-Critical Controller · p. 7

Single-input implementation

  • For single-input systems, the controller switches between closed-form expressions according to the sign of Lgh(x), using the nominal controller when Lgh(x)=0.The switching structure separates the cases Lgh(x)>0 and Lgh(x)<0.Source: B. Robust Safety-Critical Controller · p. 7

Inverted pendulum example

  • In the disturbed inverted-pendulum example, the non-robust controller leaves the safe set, whereas ISSf-based controllers remain within a forward-invariant enlarged set.Different parameter choices can produce the same invariant set while differing in conservativeness.Source: B. Robust Safety-Critical Controller · p. 7, Figure 7 · p. 8

IV. SAFETY-CRITICAL CONTROLLER DESIGN FOR A CONNECTED AUTOMATED TRUCK

The truck design combines a Control Barrier Function defining safety with a performance-oriented nominal controller, then minimally modifies that controller to enforce safety.

Controller architecture

  • The connected automated truck design defines a safe set with a CBF and combines it with a nominal performance-based controller.The synthesis is presented as a safety-critical longitudinal controller for the truck.Source: §IV · p. 8
  • The synthesized controller modifies the nominal controller in a minimally invasive way while ensuring safety.This construction unifies performance objectives with the barrier-based safety requirement.Source: §IV · p. 8

A. Modeling Longitudinal Dynamics

The truck model describes rear-axle longitudinal motion under no-slip, flat-road, and no-headwind assumptions, then augments it with connected-vehicle following dynamics and V2V measurements.

Truck model

  • The longitudinal truck dynamics assume a rear-axle-driven truck without a trailer, with tires rolling without slipping on a flat road without headwind.These assumptions define the physical setting of the model.Source: A. Modeling Longitudinal Dynamics · p. 8
  • The truck state is longitudinal speed v, the input is rear-axle torque T, and the model includes mass, inertia, tire radius, drag, gravity, and rolling resistance parameters.The effective mass includes the vehicle mass and rotating-element inertia.Source: A. Modeling Longitudinal Dynamics · p. 8

Connected-system model

  • When following a connected vehicle, the state is x=[D, v, vL]⊤, combining headway distance with truck and leader speeds.The leader’s speed and acceleration enter the connected-system dynamics.Source: A. Modeling Longitudinal Dynamics · p. 8
  • V2V communication provides the truck with the leader’s distance, speed, and acceleration information.The distance is obtained from the leader’s GPS position.Source: A. Modeling Longitudinal Dynamics · p. 8

B. Safety and Control Barrier Function

The truck’s CBF encodes a velocity-dependent safe following distance, while a connected cruise controller targets performance; their combination intervenes only when needed to preserve safety.

Safety barrier

CBF verification

  • For αc=0.1 [1/s], graphical evaluation shows the CBF condition is strictly positive over the tested distance and leader-velocity range.The evaluation uses the worst-case leader acceleration while satisfying the constraint relating c1, c3, c4, v, and vL.Source: B. Safety and Control Barrier Function · p. 9, Figure 10 · p. 9

Nominal performance controller

  • The nominal connected cruise controller uses a distance-based range policy and a relative-speed policy to prioritize performance.The range policy produces a desired speed from distance, while the speed policy bounds speed error when the leader violates the assumed speed limit.Source: C. Controller Design · p. 9, Figure 11 · p. 9

Safety-critical synthesis

  • The safety-critical controller applies the minimum of the nominal and safe controllers, yielding a continuous controller that belongs to the CBF-admissible set.In the application domain, the barrier input term is negative, so the switch structure selects the safety-enforcing value when necessary.Source: C. Controller Design · p. 10

Simulation

  • In simulation, both controllers avoid a crash, but only the safety-critical controller maintains the required safe following distance during hard braking.The nominal controller brakes less aggressively and violates the safe-distance condition, whereas the safety-critical controller preserves hQP(x(t))≥0.Source: C. Controller Design · p. 10, Figure 12 · p. 10

V. EXPERIMENTAL RESULTS & ROBUST DESIGN

Experiments on a Class-8 automated truck exposed failures of both nominal and safety-critical controllers under unmodeled actuation delays. The study characterized the commanded-to-actual acceleration discrepancy as an input disturbance for robust redesign.

Experimental configuration

  • The experiments deployed nominal and safety-critical controllers on an automated Class-8 truck using repeatable lead-vehicle braking data.The truck and lead vehicle exchanged motion data through V2X onboard units, while a prerecorded lead-vehicle profile reduced variation across runs.Source: §V · p. 10, A. Experimental Setup and Procedure · p. 11

Observed failures

  • Both nominal and safety-critical controllers consistently violated the CBF safety requirement in truck experiments.The safety-critical controller therefore did not preserve its modeled safety guarantee on the physical vehicle.Source: B. Input Disturbances · p. 11
  • Acceleration delay arose from nonlinear truck power-generation dynamics imperfectly represented by the simplified feed-forward model.The discrepancy between commanded and achieved acceleration was modeled as a disturbance d in the simplified dynamics.Source: B. Input Disturbances · p. 11

Disturbance characterization

  • Approximately 4 m/s^2 was the largest observed commanded-to-actual acceleration difference, motivating an empirical disturbance bound δ = 4.5 m/s^2.The bound was chosen slightly above the largest measured discrepancy.Source: B. Input Disturbances · p. 11

C. Robust Design

The robust design augments the CBF with ISSf parameters that trade robustness against performance. Simulation and truck experiments show that suitable parameter choices restore safety while limiting tracking-distance changes.

Robust controller design

  • ISSf-CBFs address the measured input disturbance by modifying the CBF condition with parameters ϵ0 > 0 and λ ≥ 0.The resulting invariant set guarantees h(x(t)) ≥ h*, where h* depends on the disturbance and parameter choices.Source: C. Robust Design · pp. 11–12

Simulation and experiment

  • Disturbed simulation reproduced the nominal and safety-critical controller failures and showed improved behavior under the robust safety-critical controller.The simulation used the experimentally observed disturbance signal and the truck model's initial condition.Source: C. Robust Design · p. 12, Figure 15 · p. 12
  • ϵ0 = 0.5 s^3/m and λ = 0.4 1/m produced experimental runs in which h remained nonnegative.The robust controller satisfied the original safety requirement, although its run-to-run standard deviation was larger.Source: D. Robust Experimental Results · p. 12

Parameter effects

  • Parameter sweeps showed that the original safety requirement can hold for sufficiently small ϵ0 or small positive λ.Green parameter markers denote experiments meeting h ≥ 0, while red markers denote violations.Source: D. Robust Experimental Results · pp. 12–13, Figure 16 · p. 13
  • λ > 0 provided order-of-magnitude stronger theoretical guarantees without greatly increasing the steady-state tracking-distance shift.With λ = 0, stronger guarantees required dramatically increasing the tracking-distance shift; the desired steady-state distance was D* = 25 m at v* = 16 m/s.Source: D. Robust Experimental Results · p. 13

Conclusion

  • The paper concludes that ISSf-CBFs can combine meaningful theoretical safety guarantees with performant behavior in an experimentally deployed automated truck.The approach was also developed tutorial-style using an inverted pendulum example.Source: §VI · p. 13

A. Proof of Theorem 2

The proof establishes that the optimization-based CBF controller is feasible, has a closed-form solution, and is continuous. It uses convexity and KKT conditions, then handles all sign cases of the switching function.

Feasibility and closed form

  • The optimization problem has a closed-form solution feasible for every x ∈ R^n, with kQP(x) ∈ KCBF(x).The proof begins by establishing feasibility and the admissibility of the resulting controller.Source: A. Proof of Theorem 2 · p. 13
  • When Lgh(x) = 0, the minimizing input is the nominal controller kn(x), so kQP(x) = kn(x).The norm-based cost is minimized by the nominal input when the inequality constraint is satisfied for every input.Source: A. Proof of Theorem 2 · p. 13

KKT derivation

  • For Lgh(x) ≠ 0, convexity and Slater’s condition make the KKT conditions necessary and sufficient for optimality.The proof derives the optimizer using primal feasibility, dual feasibility, complementary slackness, and stationarity.Source: A. Proof of Theorem 2 · pp. 13–14

Continuity

  • The three-case argument proves that kQP is continuous at every state.The conclusion combines the local continuity results for all possible values of ψ(x).Source: A. Proof of Theorem 2 · p. 14

Related papers

Loading 2206.03568v1…