Source-linked AI summary
Barrier Functions Against Safety Drift in Shared Control
M. Yusuf Uzun, Yildiray Yildiz
TL;DR
Unsafe assistance can alter the assisted trajectory and the quantities that govern its authority, allowing workload constraints to drift. The paper anchors the workload envelope to an unassisted baseline and uses a deviation barrier and mismatch bound in a feasible safety filter. In F-16 pitch tracking simulations, safety enforcement prevented workload-envelope drift under severe unsafe assistance.
Problem
When arbitration constraints depend on the assisted trajectory, unsafe assistance can change the quantities governing its own authority and cause the constraints to drift.
Source: §1 · p. 2Method
An unassisted baseline generates the workload envelope, while an assistance-induced deviation barrier and mismatch bound support a feasible control-barrier-function safety filter.
Source: §1 · p. 2Results
Safety enforcement prevented workload-envelope drift, reduced RMS and peak workload deviation, and kept tracking error within 14% of the pilot-only baseline across all cases.
Source: §4.3 · p. 14, §5 · p. 16Takeaways & Limitations
The resulting safety filter is always feasible and guarantees forward invariance of the augmented safe set.
Source: §1 · p. 2, §3.6 · p. 9The model assumes a well-trained pilot with Hurwitz A and a plant output of relative degree two with respect to the input.
Source: §3.1 · p. 4, §3.3 · p. 5
Abstract
from arXiv · showhide
Shared-control arbitration mechanisms can fail structurally when they are driven by quantities that evolve on the same automation-assisted trajectory that unsafe automation can corrupt. Under unsafe assistance, arising from faults or flawed design, the arbitration logic can adapt to the corrupted trajectory instead of resisting it. Focusing on workload regulation, this paper proposes a framework that prevents this problem by anchoring the safety constraints to an unassisted pilot trajectory. A baseline model evolving without automation assistance generates the acceptable workload envelope, while an assistance-induced deviation barrier and a closed-form mismatch bound relate actual and baseline workload evolution. The resulting control barrier function based quadratic program is always feasible and guarantees forward invariance of an augmented safe set. Simulations on an F-16 pitch-tracking problem show that the proposed method prevents workload-constraint drift under unsafe assistance.
1 Introduction
Unsafe assistance can corrupt the trajectory-based quantities that regulate automation authority, causing arbitration constraints to drift with the behavior they should constrain. The paper addresses this vulnerability in workload regulation by anchoring the envelope to an unassisted baseline.
1 Introduction
- Inappropriate feedback can delay diagnosis and recovery, while coordination breakdowns may reflect deeper human–machine interaction patterns rather than isolated glitches or operator mistakes.The introduction cites the Boeing 737 MAX MCAS failures as an example involving faulty sensor data and repeated undesired intervention.Source: §1 · p. 1
- Shared-control arbitration adjusts authority online using operator state, trust, or cooperation state, but traditional schemes often rely on hand-tuned, architecture-specific blending functions.A control-barrier-function approach offers systematic, modular constraints and remains feasible because automation disengagement satisfies them.Source: §1 · p. 1
- When arbitration variables depend on the assisted trajectory, unsafe assistance can alter those variables and enable a cycle that continues admitting unsafe assistance.The paper describes this as constraints themselves going sour.Source: §1 · p. 2
- An operator-only baseline generates the workload envelope, while a deviation barrier and mismatch bound support a feasible filter with forward-invariant safety constraints.The method is evaluated under four severe unsafe-assistance scenarios in F-16 pitch tracking.Source: §1 · p. 2
2 Framework
The framework models the coupled human–plant system and applies arbitration control barrier functions to constrain assistance through a quadratic program. The filter preserves feasibility by allowing automation disengagement.
2.1 Coupled Human–Plant Dynamics
- The coupled human–plant model combines human and automation commands at the plant input and assumes the reference and its required derivatives are available.The plant and human dynamics are modeled with locally Lipschitz mappings.Source: §2.1 · p. 2
2.2 Arbitration Control Barrier Functions (ACBFs) and Safety-Filter Quadratic Program (QP)
- ACBF constraints define a safe set and a convex quadratic program for filtered assistance; disengaging automation satisfies the constraints and guarantees feasibility.The barrier condition is evaluated at zero automation assistance.Source: §2.2 · p. 3
3 Pilot-Anchored Arbitration Control Barrier Function (ACBF) Design
The section develops an assistance-arbitration design that anchors workload envelopes to an unassisted pilot baseline, bounds deviations from that trajectory, and combines workload and deviation barriers in a safety-filter QP. The three-barrier ACBF QP provides feasible arbitration that preserves the augmented safe set forward in time when initialized safely, with affine constraints yielding a scalar QP.
3.1 Linear Shared-Control Dynamics
- The linear specialization of the general framework enables closed-form workload barriers and a computable mismatch bound.It specializes the framework to linear plants and a linear pilot model.Source: §3.1 · p. 3
3.2 Baseline Model and Workload Barriers
- A pilot-only baseline starts at the shared state when assistance engages, providing a workload reference independent of automation-assisted evolution.Before engagement, no automation assistance is applied, so the actual and baseline states coincide at initialization.Source: §3.2 · p. 4
3.3 Deviation Barrier
- When HBya ≠ 0, workload depends on the candidate assistance input; an ellipsoidal deviation-tube barrier b3 is an ACBF that limits departure from the baseline.The tube is defined by e^TWo e ≤ η^2, with η controlling its size.Source: §3.3 · pp. 5–6
3.4 Mismatch Bound
- The deviation-tube constraint yields the closed-form mismatch bound |∆(t)| ≤ M(¯x, ρ) = 2ηL(¯x, ρ) + η^2ρQ, a workload-rate margin for envelope dynamics.The matrices used to calculate the bound are precomputed from the system matrices.Source: §3.4 · pp. 7–8
3.5 Fault-Isolated Envelope Dynamics
- Baseline-only envelope dynamics are decoupled from the actual state and filter output; workload barriers are valid ACBFs, and envelope separation remains nonnegative and bounded.The envelope bounds use baseline workload drift and a mismatch margin.Source: §3.5 · p. 8
3.6 Quadratic Program (QP) with Three Barriers
- The QP uses workload bounds and a deviation-tube barrier over an augmented state to define and enforce the combined safe set.The augmented state includes actual and baseline states plus the lower and upper envelope bounds.Source: §3.6 · p. 9
- Each barrier constraint is affine in the scalar assistance input, making the arbitration problem a scalar QP.The formulation uses a compact admissible assistance set containing zero.Source: §3.6 · p. 9
- From any initially safe augmented state, the three QP-enforced barriers remain nonnegative and the safe set is forward invariant.The constraints enforce ˙b1 + γb1 ≥ 0, ˙b2 + γb2 ≥ 0, and ˙b3 + γ3b3 ≥ 0 along the closed-loop trajectory.Source: §3.6 · pp. 9–10
- The QP is always feasible because zero assistance belongs to the admissible set and satisfies all three barrier constraints.Compactness of the assistance set bounds the selected input; together with Hurwitz A and bounded reference, this supports existence of the augmented closed-loop solution for all t ≥ t0.Source: §3.6 · pp. 9–10
4 Case Study: F-16 Pitch Tracking
The F-16 pitch-tracking case study evaluates the safety filter under nominal assistance and four fault scenarios. Across these tests, safety enforcement keeps workload near the pilot-only case and limits tracking degradation; under drifting assistance, the proposed envelope remains unaffected by the corrupted trajectory.
4.1 Shared Control System Description
- The case study uses linearized F-16 longitudinal dynamics around level-flight trim, with pitch angle as output and elevator deflection as input.The pilot model has parameters kp = 3, Tp = 0.2 s, and Tz = 0.6 s; assistance and the safety filter engage at t0 = 10 s.Source: §4.1 · p. 10, §4.2 · p. 10
4.2 Simulations
- The four faults tested were drifting, frozen-at-0.6-rad, sign-reversed, and 35× amplified assistance; the amplified gain destabilized the closed loop.The nominal assistance system replicated the human pilot model.Source: §4.2 · pp. 10–11
- Safety enforcement consistently reduced RMS and peak workload deviation; workload stayed near the pilot-only case across scenarios within an envelope whose shape was identical across all five scenarios.The pilot-anchored bounds depend only on the baseline state and reference, not the filtered assistance output.Source: §4.2 · p. 12, Figure 2 · p. 12, §4.3 · p. 14
4.3 Quantitative Metrics
- In Case 4, unfiltered 35× assistance increased tracking error by 77%, while safety enforcement reduced it by 13% relative to the pilot-only baseline.With safety enforcement, tracking error stayed within 14% of baseline across all fault cases, and the filter was active 67–100% of the time across fault scenarios.Source: §4.3 · p. 14
4.4 Fault Scenario Comparison
- Under drifting assistance, the prior method’s state-evaluated envelope shifted with the corrupted trajectory, while the proposed baseline-evaluated envelope was unaffected.The deviation barrier drove filtered assistance toward zero while maintaining |∆(t)| ≤ M(¯x, ρ).Source: §4.4 · p. 14, Figure 4 · p. 15
5 Conclusion
The conclusion identifies a structural vulnerability in shared-control arbitration: unsafe assistance can corrupt the trajectory used to set constraint boundaries. The proposed framework anchors the envelope to an assistance-independent baseline and uses a deviation barrier; F-16 simulations across four severe unsafe-assistance scenarios show that it prevents workload-envelope drift.
5 Conclusion
- When arbitration constraints use the assisted trajectory, unsafe assistance can corrupt that trajectory and drag the constraint boundaries with it.Source: §5 · p. 16
- The framework decouples the safety envelope from assistance by anchoring it to an assistance-independent baseline and confining the actual trajectory with a deviation barrier.Source: §5 · p. 16
- F-16 pitch-tracking simulations under four severe unsafe-assistance scenarios demonstrate that the method prevents the workload envelope from being dragged by unsafe assistance.Source: §5 · p. 16