Source-linked AI summary
Safety-Critical Control for Autonomous Systems: Control Barrier Functions via Reduced-Order Models
Max H. Cohen, Tamas G. Molnar, Aaron D. Ames
TL;DR
High-dimensional nonlinear dynamics make safety-critical CBF design challenging. This tutorial unifies techniques that construct CBFs for complex systems from reduced-order models, and reports that the approaches tend to perform well in hardware case studies even when standing assumptions are violated.
Problem
Constructing CBFs for high-dimensional nonlinear systems is challenging because their dynamics may be nontrivial or unknown.
Source: §1 · p. 1Method
The tutorial develops techniques that extend CBFs for simpler reduced-order systems to complex systems with layered dynamics.
Source: §8 · pp. 32–33Results
The case studies indicate that the methods tend to perform well on hardware even when assumptions such as unlimited actuation capability are violated.
Source: §8 · p. 33Takeaways & Limitations
The tutorial illustrates these constructions across systems including flying, legged, and wheeled robots through theoretical results, numerical examples, and case studies.
Source: §8 · p. 33The approaches synthesize CBFs under an assumption of unlimited control authority, unlike physical systems with actuator limits.
Source: §8 · p. 33
Abstract
from arXiv · showhide
Modern autonomous systems, such as flying, legged, and wheeled robots, are generally characterized by high-dimensional nonlinear dynamics, which presents challenges for model-based safety-critical control design. Motivated by the success of reduced-order models in robotics, this paper presents a tutorial on constructive safety-critical control via reduced-order models and control barrier functions (CBFs). To this end, we provide a unified formulation of techniques in the literature that share a common foundation of constructing CBFs for complex systems from CBFs for much simpler systems. Such ideas are illustrated through formal results, simple numerical examples, and case studies of real-world systems to which these techniques have been experimentally applied.
1. Introduction
The introduction frames high-dimensional nonlinear dynamics as a barrier to constructing CBFs, then surveys constructive approaches and motivates a unified tutorial on deriving complex-system CBFs from reduced-order models. It previews theoretical foundations, examples, applications, and the paper’s scope and limitations.
1. Introduction
- High-dimensional autonomous systems make CBF construction challenging, motivating reduced-order representations that retain high-level behavior while simplifying safety-critical controller synthesis.The introduction also notes that complex-system dynamics may be nontrivial or unknown.Source: §1 · p. 1
1.1. The Different Flavors of Control Barrier Functions
- Safety is framed through invariant sets, while CBFs are presented among several tools for synthesizing safety-critical controllers for nonlinear systems.Other named tools include model predictive control, reachability analysis, and symbolic control.Source: §1.1 · p. 1
1.2. Constructive Methods for Control Barrier Functions
- Constructive CBF design must find a function whose derivative depends on control; its safe set is controlled invariant, unlike a constraint set, which need not be safe.For example, obstacle distance may define an obstacle-free constraint set without being a CBF when position derivatives do not directly depend on control.Source: §1.2 · p. 2
- Extended CBFs differentiate high-relative-degree constraints until control appears, while other constructive methods exploit system structure; verifying extended conditions can remain challenging.The introduction also describes receding-horizon, offline-optimization, and learning-based routes, which face online computation, state-dimension scaling, or safety-verification burdens.Source: §1.2 · p. 2
1.3. Control Barrier Functions via Reduced-Order Models
- Reduced-order-model methods design safety for simpler dynamics and relate their safe inputs to the full system, including through tracking-certified CBF constructions.The introduction situates these approaches alongside established reduced-order models in mobile and legged robotics.Source: §1.3 · p. 3
1.4. Objective of this Paper
- The paper unifies literature techniques for constructing complex-system CBFs from simpler-system CBFs, illustrating them with formal results, examples, and application overviews.Numerical examples are reported as reproducible using open-source code.Source: §1.4 · p. 3
1.5. Organization and Outline
- The paper moves from CBF foundations and ROM construction challenges to backstepping and specialized robotic constructions, including underactuated systems.These topics are outlined across Sections 2–5.Source: §1.5 · p. 3
- Later sections connect ROM CBFs with tracking and model-free control, review application case studies, and discuss limitations and open research directions.The applications include aircraft, robots, manipulators, and heavy-duty trucks in simulation and hardware experiments.Source: §1.5 · pp. 3–4
2. A Primer on Safety-Critical Control
This primer develops safety-critical control from forward invariance and barrier functions to control barrier functions (CBFs) for safety-enforcing feedback, establishing notation and illustrating CBF-based filtering on an inverted pendulum. It motivates systematic CBF construction from reduced-order models for high-dimensional systems and describes robust, smooth controllers for handling uncertainty and ensuring forward invariance.
2.1. Notation
- The notation defines gradients, Lie derivatives, Jacobians, norms, and set operations used to express safety conditions.It also distinguishes extended class K∞ and class K∞ functions.Source: §2.1 · p. 4
2.2. Foundations of Safety-Critical Control
- Safety is forward invariance; Nagumo’s theorem characterizes it by requiring the dynamics to point into or tangent to the safe set at its boundary.For a set defined by a differentiable function with zero a regular value, the tangent cone at the boundary is characterized by the gradient of that function.Source: §2.2 · pp. 4–5
- For a barrier function, the safe set is forward invariant and is asymptotically stable if it is compact or the vector field is forward complete.For compact sets defined by a regular-value function, forward invariance is also equivalent to the function restricted to the set being a barrier function.Source: §2.2 · p. 5
2.3. Control Barrier Functions
- A CBF guarantees feedback controlled invariance, and a locally Lipschitz controller satisfying its inequality makes the safe set forward invariant.The CBF condition uses a strict inequality; the primer notes this helps ensure synthesized controllers are locally Lipschitz.Source: §2.3 · p. 6
- A CBF constraint can filter a desired policy with minimal correction, and its single-CBF closed-form solution can avoid optimization in the control loop.The tutorial focuses on unconstrained inputs: with input bounds, the stated necessary CBF condition may not be sufficient.Source: §2.3 · pp. 6–7
- For an inverted pendulum, the tutorial verifies a CBF and uses a safety filter with zero nominal policy to keep the angular position within its specified bound.The example uses α0 = 1 and a CBF condition that holds for α0 ∈ (0, 2].Source: §2.3 · pp. 7–8
- For high-dimensional systems, handcrafted CBFs may be intractable, motivating systematic construction of CBFs from reduced-order models and simpler systems.The paper identifies this as its primary objective.Source: §2.3 · p. 8
2.4. Robust Safety-Critical Control
- ISSf-CBFs provide robust safety under uncertainty by imposing a stronger control condition, and qualifying controllers render the closed-loop system ISSf.The additional term involving 1/ε∥L_g h(x)∥² mitigates uncertainty; decreasing ε brings the inflated safe set closer to the original set but generally requires greater control effort.Source: §2.4 · p. 9
2.5. Smooth Safety Filters
- When the dynamics, CBF, and class K∞ function are smooth, a smooth safety filter can be constructed to satisfy the CBF condition and ensure forward invariance.Smooth filters can use over-approximations of the QP multiplier, enforcing strict satisfaction of the CBF inequality.Source: §2.5 · pp. 9–10
3. Reduced-Order Models and Layered Control Architectures
The section frames layered dynamics as a route to constructing CBFs for complex systems from simpler reduced-order models. It explains why full-state barrier construction is difficult, then describes cascaded and robotic systems that fit this approach.
3. Reduced-Order Models and Layered Control Architectures
- Layered architectures let designers recursively construct a CBF for a complex system from one for a simpler system, using lower-layer states as higher-layer inputs.The tutorial focuses on systems whose dynamics can be represented in this layered form.Source: §3.1 · p. 10, §3 · p. 10
3.1. Challenges in Constructing CBFs
- A configuration-only barrier may fail when its relative degree exceeds one; CBFs generally depend on all states, making construction for complex systems intractable.A remedy is to include velocity in the barrier, while ROM-based techniques exploit layered structure to construct a barrier from a simpler model.Source: §3.1 · pp. 10–11
3.2. Multi-layer Cascaded Dynamics
- In cascades, the top-layer state q evolves under bottom-layer state ξ, which acts as its control input and forms a ROM for the full system.The framework also applies to arbitrary-layer strict-feedback systems.Source: §3.2 · pp. 11–12
3.3. Robotic Systems
- Robotic mechanical systems fit the cascade template; their default ROM is a single integrator with generalized velocity as input, though more general ROMs are possible.The tutorial focuses on the single-integrator ROM and notes that results can be modified for alternatives such as unicycle-like dynamics.Source: §3.3 · p. 12
4. Safe Backstepping
Backstepping constructs a full-order control barrier function (CBF) from a simpler top-layer CBF by treating lower-layer states as virtual inputs and tracking the resulting virtual controller. The section establishes this construction for cascaded and mixed-relative-degree systems, compares it with extended CBFs, and illustrates it with double-integrator and unicycle examples.
4.1. Backstepping with Control Barrier Functions
- Theorem 7 guarantees that the constructed function is a CBF on the full-order safe set when the top-layer controller satisfies the stated condition and the lower-layer input matrix is pseudo-invertible.The set C is chosen so that membership in C implies the top-layer state satisfies the original constraint.Source: §4.1 · p. 13
- For the double integrator, increasing µ makes the backstepping safe set approach the position constraint set, but includes larger velocities that may require greater control effort.The plotted zero-level curves use the Softplus universal formula with σ = 0.1.Source: §4.1 · p. 14, Figure 3 · p. 14
- For layered dynamics, the backstepping construction yields a relative-degree-one CBF for the full-order system from a top-layer CBF, given pseudo-invertibility of each layer’s input matrix.The construction can be applied recursively to systems with an arbitrary number of layers.Source: §4.1 · pp. 13–14, §4.2 · p. 15
4.2. Comparison to Extended Control Barrier Functions
- For extended CBFs, the candidate safe set is the intersection of the original constraint set lifted to the full state space and the extended-CBF set; increasing α0 moves it closer to the lifted constraint set.Figure 5 shows boundaries for different α0 choices.Source: §4.2 · p. 15, Figure 5 · p. 16
- Extended CBFs can fail even for simple constraints: the double-integrator candidate condition holds only for bounded velocities and not throughout the candidate safe set.The text notes that tuning α0 and α can move violations to arbitrarily large velocities, but does not eliminate them from the candidate set.Source: §4.2 · p. 15
- Unlike extended CBFs, backstepping constructs a full-order relative-degree-one CBF by design, but requires the full-order dynamics to have a particular cascaded structure.The text presents this structural requirement as the price of the correct-by-construction approach.Source: §4.2 · p. 16
4.3. Mixed Relative Degree Backstepping
- Mixed-relative-degree backstepping allows control inputs to enter at intermediate layers as well as the bottom layer, and Theorem 8 guarantees a full-order CBF under its stated conditions.The theorem’s construction can be recursively applied to mixed-relative-degree systems with arbitrarily many layers.Source: §4.3 · p. 16
- For the unicycle example, the single integrator with planar velocity input serves as the reduced-order model, and its safe velocity command is converted into variables used for backstepping.The example applies this approach to reaching a goal while avoiding an obstacle.Source: §4.3 · p. 17
5. Constructive Safety for Robotic Systems
This section develops constructive control barrier functions for robotic systems from configuration constraints, reduced-order controllers, and robot dynamics, with constructions for fully actuated and underactuated systems. A cartpole example illustrates an underactuated construction that guarantees safety despite a desired pole position that conflicts with the safe set.
5.1. Safe Backstepping for Robotic Systems
- For fully actuated robots, safe backstepping converts a configuration-space controller into an energy-based CBF that guarantees the configuration constraint within its candidate safe set.In the double-pendulum simulation, the system stops before crossing the boundary, then slides along it until reaching the downward position.Source: §5.1 · p. 18, Figure 7 · p. 18
5.2. Energy-based Control Barrier Functions
- Energy-based CBFs for fully actuated robots yield forward-invariant safe sets under controllers satisfying the stated CBF condition, without requiring inversion of the inertia matrix.The construction formalizes an energy-based CBF from the backstepping candidate, and the resulting safety constraint can be imposed in an optimization-based filter.Source: §5.2 · p. 19
- The energy-based candidate with zero desired velocity is not a strict CBF on any set containing the safe set, and relaxing strictness may produce discontinuous controllers when velocity is zero.The section notes that this limitation arises when checking the candidate from the earlier construction.Source: §5.2 · p. 20
5.3. Underactuated Robotic Systems
- For constraints on actuated coordinates, the underactuated system can be reduced to dynamics in actuated-coordinate acceleration, yielding a CBF when the input matrix is pseudo-invertible and the reduced controller satisfies its condition.The reduced inertia term is the Schur complement of the system inertia matrix and is positive definite.Source: §5.3 · pp. 20–21
- For constraints on passive coordinates, a CBF can be constructed when the input matrix is pseudo-invertible and the system is strongly inertially coupled on the safe configuration set.The method rewrites the dynamics in terms of passive-coordinate acceleration and extends non-collocated feedback linearization to safety-critical control.Source: §5.3 · p. 21
- For cos(θ) ≠ 0, the cartpole CBF candidate uses a Softplus-constructed k0,2; inertial coupling on C0 and invertible B1 = 1 establish it as a CBF.The resulting CBF is used in a QP-based safety filter for the nominal controller.Source: §5.3 · p. 22
- Although the desired pole position lies outside C0 and the pole angle is not directly actuated, the carefully constructed CBF guarantees safety.The safety filter is applied to a nominal controller that tracks a desired pole-angle trajectory.Source: §5.3 · p. 22
6. Stable Tracking of Safe Reduced Order Models
This section develops safety guarantees for full-order systems by certifying that they can track safe reduced-order models (ROMs). The guarantees accommodate imperfect tracking and nonsmooth ROM controllers, with conservatism traded against tracking speed and robustness.
6.1. Lyapunov-certified Tracking
- Tracking a safe ROM can guarantee full-order safety when tracking convergence outpaces the ROM’s approach to the constraint boundary, though this may require a more conservative ROM.The safety-critical component can rely on the ROM, while an existing tracking controller follows its commands; tuning that controller may still require model knowledge.Source: §6 · p. 22, §6.1 · p. 23
- With bounded, imperfect tracking, an inflated safe set is forward invariant under the same rate condition, and its margin trades off ROM aggressiveness, tracking speed, and robustness.The additional inflation scales with δ/α; increasing α requires faster tracking, while decreasing ε can bring the set closer to the original constraint set.Source: §6.1 · pp. 23–24
6.2. Safely Tracking Nonsmooth ROMs
- Nonsmooth QP-based ROM controllers can also yield forward-invariant time-varying safe sets when the tracking error satisfies an exponential bound up to δ.The bound reflects tracking up to δ; δ=0 represents perfect tracking, while M=0 represents bounded but non-convergent tracking.Source: §6.2 · p. 25
- In the Segway example, a nonsmooth ROM safety filter produced safe motion using a simple explicit min formula, although choosing tracking gains may require model information.When tracking gains cannot be modified, safety can instead be tuned through ROM parameters, as demonstrated in Example 9.Source: §6.1 · p. 24, §6.2 · pp. 25–26, Figure 10 · p. 26
7. Case Studies
The case studies apply CBFs and reduced-order models across aircraft, robots, manipulators, and trucks. They illustrate safety filters and layered control architectures in simulations, hardware experiments, and real-world applications, including settings with imperfect tracking.
7.1. Run-time Assurance on Fixed-wing Aircraft
- A backstepping-based CBF kept collision-avoidance and geofencing constraints nonnegative during a simulated fixed-wing aircraft maneuver.The run-time assurance system overrides the desired flight controller when needed to avoid aircraft and restricted airspace.Source: §7.1 · pp. 26–27, Figure 11 · p. 27
7.2. Safety-critical Control of Quadrotors
- In indoor quadrotor tests, a single-integrator ROM and obstacle-distance CBF generated safe velocity commands for collision-free flight, including against a human pilot’s intentional approach to obstacles.The onboard flight controller tracked the filtered commands; the safety filter intervened even when the pilot’s desired velocity drove toward obstacles.Source: §7.2 · p. 27, Figure 12 · p. 28
7.3. Safe Flying, Legged and Wheeled Robots
- A shared safe-ROM approach produced safe behavior for a drone and quadruped in hardware experiments and a Segway in high-fidelity simulation.Single-integrator or unicycle kinematics generated CBF-based safe velocities; these results did not include the robustness term ε and required a more restrictive theorem variant.Source: §7.3 · pp. 27–28, Figure 13 · p. 29
7.4. CBFs in Collaborative Robotics
- A layered architecture enabled two interconnected quadrupeds to navigate simple and cluttered environments in simulation and hardware while respecting holonomic and safety constraints.The layers use double-integrator, rigid-body, and high-fidelity models to produce safe trajectories, ground-reaction forces, and torque inputs.Source: §7.4 · p. 29, Figure 14 · p. 30
7.5. Collision-free Food Preparation with Manipulators
- A reduced-order kinematics safety filter enabled collision-free food-basket handling in a dense workspace, with collision-free behavior reported in 100 subsequent test cases.The workspace contained 36 collision objects, and the CBF remained positive during the task.Source: §7.5 · pp. 30–31, Figure 15 · p. 31
7.6. Input-to-state Safety on Connected Automated Trucks
- During emergency braking, the robust safety-critical truck controller guaranteed safety, whereas the desired controller and a filter without a robustness term did not.Imperfect acceleration tracking introduced significant disturbance; the tunable input-to-state safety filter was designed to retain shorter following distances without excessive conservatism.Source: §7.6 · p. 32, Figure 16 · p. 32
8. Discussion and Conclusions
The tutorial constructs CBFs for complex systems by extending CBFs from simpler reduced-order models, using methods suited to systems with layered dynamics. The discussion reports successful hardware case studies while identifying actuation limits and reduced-order-model selection as open challenges.
8. Discussion and Conclusions
- The central approach extends a CBF for a simpler reduced-order model to a complex system whose high-level behavior that model captures.The tutorial presents backstepping and Lyapunov-certified tracking as construction techniques.Source: §8 · pp. 32–33
- The techniques address systems with layered dynamics, including wheeled, legged, and flying robots, and are illustrated with theory, numerical examples, and cross-domain case studies.Source: §8 · p. 33
- Unlimited control authority is a major limitation; the discussion identifies actuator-aware CBF construction as an important direction for future work.It notes that Sec. 6 methods have been combined with backup CBFs to account for actuation limits.Source: §8 · p. 33
- Choosing a suitable reduced-order model remains open, particularly for underactuated systems whose behavior must be replicated by the full-order dynamics.Most results in Secs. 4 and 5 require fully actuated dynamics; Sec. 5.3 treats underactuation only under specific assumptions.Source: §8 · p. 33
- The case studies indicate that the methods tend to perform well on hardware even when assumptions such as unlimited actuation capability are violated.Source: §8 · p. 33
Appendix A. Proofs
The appendix proofs establish that the constructed functions satisfy CBF or barrier-function conditions under their stated assumptions. They use these conditions to infer forward invariance for the corresponding safe sets.
Appendix A. Proofs
- Theorem 8's proof uses pseudo-invertibility and the condition Lgh(x) = 0 to establish that h is a CBF.Source: Appendix A · p. 36
- Theorem 9 establishes forward invariance by showing that h satisfies a barrier-like inequality and applying the comparison lemma.Source: Appendix A · pp. 36–37
- Theorem 10's proof shows that the function h defined in (66) is a CBF for the system in (34).Source: Appendix A · p. 37
- For Theorem 12, condition (77) yields a barrier function with the specified feedback, implying forward invariance of C.Source: Appendix A · p. 37
- For Theorem 14, condition (77) and the bound on d yield forward invariance of the time-varying set C(t).Source: Appendix A · p. 38