Control Barrier Functions: Theory and Applications

TL;DR

This paper reviews recent advances in control barrier functions, highlighting their theoretical foundations and practical applications in ensuring safety in safety-critical control systems, especially in robotics.

Contribution

It offers a comprehensive survey of control barrier functions, summarizing key theoretical results and demonstrating their applications across various domains.

Findings

Control barrier functions effectively verify safety properties.

They enable the design of safety-critical controllers.

Applications include robotic systems and other safety-critical domains.

Abstract

This paper provides an introduction and overview of recent work on control barrier functions and their use to verify and enforce safety properties in the context of (optimization based) safety-critical controllers. We survey the main technical results and discuss applications to several domains including robotic systems.

Figures

Equations

$$\mathcal{C}\mathrm{is}\mathrm{invariant}\iff \dot{h}(x)\ge 0\forall x\in \partial \mathcal{C}.$$

$$\dot{B}(x)\le 0\Rightarrow \mathcal{C}\mathrm{is}\mathrm{invariant}$$

$$\exists us.t.\dot{h}(x,u)\ge 0\Rightarrow \mathcal{C}\mathrm{is}\mathrm{invariant}$$

$$\exists us.t.\dot{h}(x,u)\ge -\alpha (h(x))\iff \mathcal{C}\mathrm{is}\mathrm{invariant}$$

$$\dot{x}=f(x)+g(x)u,$$

$$\exists u=k(x)s.t.\dot{V}(x,k(x))\le -\gamma (V(x)),$$

$$\dot{V}(x,k(x))=L_{f}V(x)+L_{g}V(x)k(x),$$

$$\underset{u\in U}{\inf }\left[L_{f}V(x)+L_{g}V(x)u\right]\le -\gamma (V(x)),$$

$$K_{\mathrm{clf}}(x):=\{u\in U:L_{f}V(x)+L_{g}V(x)u\le -\gamma (V(x))\}.$$

$$L_{g}V(x)=0$$

$$\mathcal{C}$$

$$\partial \mathcal{C}$$

$$\mathrm{Int}(\mathcal{C})$$

$$\dot{x}=f_{\mathrm{cl}(x)}:=f(x)+g(x)k(x)$$

$$\underset{u\in U}{\sup }\left[L_{f}h(x)+L_{g}h(x)u\right]\ge -\alpha (h(x)).$$

$$\underset{x\in \mathrm{Int}(\mathcal{C})}{\inf }B(x)\ge 0,\underset{x\to \partial \mathcal{C}}{\lim }B(x)=\infty .$$

$$\underset{u\in U}{\inf }\left[L_{f}B(x)+L_{g}B(x)u\right]\le \alpha \left(\frac{1}{B(x)}\right).$$

$$K_{\mathrm{cbf}}(x)=\{u\in U:L_{f}h(x)+L_{g}h(x)u+\alpha (h(x))\ge 0\}.$$

$$u(x)=\underset{u\in {\mathbb{R}}^m}{\mathrm{argmin}}$$

$$s.t.$$

$$u(x)=\underset{(u,\delta )\in {\mathbb{R}}^{m+1}}{\mathrm{argmin}}$$

$$s.t.$$

$$L_{f}h(x)+L_{g}h(x)u\ge -\alpha (h(x))$$

$$\{x\in D:h(x)\ge 0\}\subseteq \{x\in D:\rho (x)\ge 0\},$$

$$h(x)=\underset{\tau \in [0,\infty )}{\inf }\rho ({\varphi }_{\beta }(\tau ,x)),$$

$$-h(x)-ϵ+s_1(x)\rho (x)$$

$$L_{f}h(x)+L_{g}h(x)\beta (x)+ah(x)-s_2(x)h(x)$$

$$h^{(r)}(x,u)=L_f^{r}h(x)+L_g{L}_f^{r-1}h(x)u,$$

$${\eta }_b(x):=\left[\begin{array}{c}h(x)\\ \dot{h}(x)\\ \ddot{h}(x)\\ ⋮\\ h^{(r-1)}(x)\end{array}\right]=\left[\begin{array}{c}h(x)\\ L_{f}h(x)\\ L_f^{2}h(x)\\ ⋮\\ L_f^{r-1}h(x)\end{array}\right],$$

$${\dot{\eta }}_b(x)$$

$$h(x)$$

$$F$$

$$C$$

$$\underset{u\in U}{\sup }\left[L_f^{r}h(x)+L_g{L}_f^{r-1}h(x)u\right]\ge -K_{\alpha }{\eta }_b(x)$$

Full text

I Introduction

It is easy to agree that any engineered system should be designed to be safe. In fact, the term safety-critical system is many times used to distinguish those systems for which safety is a major design consideration. But what exactly is safety? How do we define it and how can we design systems to achieve it? The notion of safety was first introduced in 1977 in the context of program correctness by Leslie Lamport [1] and formalized in [2], see also [3]. Intuitively, safety requires that “bad” things do not happen while liveness requires that “good” things eventually happen, e.g., asymptotic stability can be seen as an example of a liveness property in the sense that an asymptotically stable equilibrium point is eventually reached. Dually, invariance can be seen as an example of a safety property in the sense that any trajectory starting inside an invariant set will never reach the complement of the set, describing the locus where bad things happen. Based on the identification of liveness with asymptotic stability and safety with invariance, it can be argued that safety has received much less attention in control theory than liveness. Moreover, the notion of Lyapunov function has played a predominant role in the investigation of liveness properties.

The objective of this paper is to refocus the discussion on safety by introducing control barrier functions that play a role equivalent to Lyapunov functions in the study of liveness properties. There are two main reasons driving a surge in research related to safety and control barrier functions: 1) the recent interest in autonomous systems has brought safety to the forefront of systems’ design. In particular, autonomous systems are expected to operate in unknown and unstructured environments which makes it considerably harder to enforce safety properties; 2) the recent introduction of control barrier functions suggests that many control design techniques based on Lyapunov and control Lyapunov functions can be suitably transposed to address safety considerations. Hence, we have both the societal need for safety as well as the tools to raise safety to the same level of maturity than liveness in the design of control systems.

I-A Brief History of Barrier Functions

The study of safety in the context of dynamical systems dates back to the 1940’s when Nagumo provided necessary and sufficient conditions for set invariance [4] (see [5] for a more detailed historical account, and [6] for a modern proof). In particular, given a dynamical system $\dot{x}=f(x)$ with $x\in\mathbb{R}^{n}$, assuming that the safe set $\mathcal{C}$ is the superlevel set of a smooth function $h:\mathbb{R}^{n}\to\mathbb{R}$, i.e., $\mathcal{C}=\{x\in\mathbb{R}^{n}~{}:~{}h(x)\geq 0\}$, and that $\frac{\partial h}{\partial x}(x)\neq 0$ for all $x$ such that $h(x)=0$, then Nagumo’s Theorem gives necessary and sufficient conditions for set invariance based upon the derivative of $h$ on the boundary of $\mathcal{C}$:

[TABLE]

These conditions have been independently re-discovered on multiple occasions; in particular, around the 1970s by Bony and Brezis [7, 8] (the proof in [6] follows Brezis).

In the 2000’s we saw another change of perspective brought by the need to verify hybrid systems. Barrier certificates were introduced as a convenient tool to formally prove safety of nonlinear and hybrid systems [9, 10]; these results, again, seemed to independently discover Nagumo’s theorem. The choice of the term “barrier” was motivated by its use in the optimization literature where barrier functions are added to cost functions to avoid undesirable regions. In the case of barrier certificates, one considers an unsafe set $\mathcal{C}_{u}$ and a set of initial conditions $\mathcal{C}_{0}$ together with a function $B:\mathbb{R}^{n}\to\mathbb{R}$ where $B(x)\leq 0$ for all $x\in\mathcal{C}_{0}$ and $B(x)>0$ for all $x\in\mathcal{C}_{u}$. Then $B$ is a barrier certificate if

[TABLE]

In the notation for $\mathcal{C}$ above, by picking the safe set to be the complement of the unsafe set $\mathcal{C}=\mathcal{C}_{u}^{c}$, with $B(x)=-h(x)$ the barrier certificate conditions become: $\dot{h}(x)\geq 0$ which implies that $\mathcal{C}$ is invariant. Therefore, these conditions reduce to those of Nagumo’s theorem on the boundary. Importantly, the necessity of barrier certificates were studied [11] along with their extension to a stochastic setting [12].

As a means to extend the safety guarantees beyond the boundary of the set, there have been a variety of approaches that can be best described as “Lyapunov-like.” That is, Lyapunov functions yield invariant level sets so, if these level sets are contained in the safe set one can guarantee safety—importantly, these conditions can be applied over the entire set and not just on the boundary. In this case, as developed in [13], one constructs a “barrier Lyapunov function” $B$ much as above but with the additional requirement that it is, for all intents and purposes, positive definite. Then, by enforcing the condition that $\dot{B}\leq 0$ over the set $\mathcal{C}$, it ensures invariance of this set and thus safety. The major limitation is that, while these conditions ensure safety they also enforce invariance of every level set. Thus, they are overly strong and conservative.

While the above results addressed closed dynamical systems, i.e., systems without inputs, the work on viability theory [14, 15, 16] extended them to open dynamical systems, e.g., control systems given by $\dot{x}=f(x)+g(x)u$ for $u\in U\subset\mathbb{R}^{m}$. This required moving from invariant sets to controlled invariant sets: sets that can be made invariant by suitably designing a controller.

The notion of a barrier certificate was extended to a “control” version to yield the first definition of a “control barrier function” [17]—although this definition is different than the one considered in this paper. In particular, given a control system and a safe set $\mathcal{C}$ as defined above by a function $h$, the conditions in [17] are effectively:

[TABLE]

These ideas were built upon so as to explicitly combine barrier functions with control Lyapunov functions [18]—this was done contemporaneously with the development of the methods presented in this paper which use optimization based controllers to unify Lyapunov and barrier functions. In particular, as further developed in [19], conditions were given on creating “control Lyapunov barrier functions” that jointly guarantee safety and stability. Yet, in these cases the conditions in the end reduce to enforcing $\dot{h}(x,u)\geq 0$. However, these conditions are stronger than necessary, and thus motivate the “modern” version of control barrier functions.

The aforementioned methods all led to the most recent formulation of certificates of safety, termed control barrier functions, as recognition of the historical developments outlined above—these were first introduced in [20], and later refined in [21]. In particular, the idea was to extend the barrier function conditions (e.g., those discovered by Nagumo) to the entirety of the safe set. For a control system, and a safe set $\mathcal{C}$ defined by a function $h$, this new form of control barrier functions are defined by the condition:

[TABLE]

for $\alpha$ an (extended) class $\mathcal{K}$ function. Importantly, this condition is necessary and sufficient (for compact sets) and thus is minimally restrictive. Finally, because these conditions are true over the entire set $\mathcal{C}$ they give a way to synthesize safe controllers—in this case, through the use of optimization-based control methods that modify the desired controller again in a minimally invasive fashion. This formulation, therefore, provides a foundational framework for safety-critical control.

The utility of this new formulation of control barrier functions is evidenced by the application domains it has been applied to since its inception, including: automotive systems [22, 23, 24], mulit-robot systems [25, 26, 27], quadrotors [28, 29] and robotic systems including walking robots [30, 31, 32], to name a few. Additionally, it allows for the unification of safety (via a control barrier function) and stability (via a control Lyapunov function) in the context of an optimization based controller—in fact, it was optimization based controllers using control Lyapunov functions that motivated the development of this new form of barrier function. This formulation of control barrier functions will be the focus of this paper, as motivated by the conceptual connections with control Lyapunov functions together with a recognition of the basic differences between control barrier and Lyapunov functions.

I-B Overview of Paper

Building upon the history of barrier functions, and motivated by the new developments, this paper aims to establish the basic theory of safety-critical control and highlight some important applications.

**Theory: ** We begin in Section II by establishing the foundations of control barrier functions. This is motivated from the perspective of stabilization with control Lyapunov functions, leading to the “dual” of stability: safety as enforced by control barrier functions. The properties of these functions are discussed, along with the synthesis of optimization-based controllers. In Section III, the application of CBFs to systems with actuation constraints is considered. Finally, in Section IV, the extension of CBFs to constraints with higher relative degree is considered.

**Application: ** The discussion of the application of CBFs begins in Section V with the consideration of robotic systems. In particular, we begin by considering the “stepping stone” problem, wherein a robot must walk safely on a series of stepping stones. This is followed by a brief discussion of the experimental implementation of barriers in the context of automotive safety systems and dynamic robotic systems. Additionally, the application of CBFs in the context of long duration autonomy is formulated and demonstrated experimentally.

II Foundations of Control Barrier Functions

In this section, we introduce the fundamentals of control barrier functions. That is, we introduce safety, safety sets, and a means in which to enforce safety in a minimally invasive fashion. To motivate these considerations, we will begin by reviewing control Lyapunov functions (CLFs) and discuss how they can be used to synthesize controllers that enforce stability. This naturally leads to the “dual” for safety: control barrier functions (CBFs). We will formulate optimization based controllers from CBFs and conclude by describing how they can be unified with CLFs.

Throughout this paper, we will suppose that we have a nonlinear affine control system:

[TABLE]

with $f$ and $g$ locally Lipschitz, $x\in D\subset\mathbb{R}^{n}$ and $u\in U\subset\mathbb{R}^{m}$ is the set of admissible inputs.

II-A Motivation: Control Lyapunov Functions

To motivate safety for systems of this form, and hence control barrier functions, we begin by considering the familiar objective of stabilizing the system. Suppose we have the control objective of (asymptotically) stabilizing the nonlinear control system (1) to a point $x^{*}=0$, i.e., driving $x(t)\to 0$. In a nonlinear context, this can be achieved—and, in fact, understood—by equivalently finding a feedback control law that drives a positive definite function, $V:D\subset\mathbb{R}^{n}\to\mathbb{R}_{\geq 0}$, to zero. That is, if

[TABLE]

where

[TABLE]

then the system is stabilizable to $V(x^{*})=0$, i.e., $x^{*}=0$. Note that here $\gamma:\mathbb{R}_{\geq 0}\to\mathbb{R}_{\geq 0}$ is a class $\mathcal{K}$ function defined on the entire real line for simplicity, i.e., $\gamma$ maps zero to zero, $\gamma(0)=0$, and it is strictly monotonic: for all $r_{1},r_{2}\in\mathbb{R}_{\geq 0}$, $r_{1}<r_{2}$ implies that $\gamma(r_{1})<\gamma(r_{2})$. Thus, the process of stabilizing a nonlinear system can be understood as finding an input that creates a one-dimensional stable system given by the Lyapunov function: $\dot{V}\leq-\gamma(V)$, wherein the comparison lemma (see, e. g., [33]) implies that the full-order nonlinear system (1) is thus stable under the control law $u=k(x)$.

The above observations motivate the notion of a control Lyapunov function wherein a function $V$ is shown to stabilize the system without the need to explicitly construct the feedback controller $u=k(x)$. That is, as first observed by Sontag and Artstein [34, 35, 36], we only need a controller to exist that results in the desired inequality on $\dot{V}$. Concretely, $V$ is a control Lyapunov function (CLF) if it is positive definite and satisfies:

[TABLE]

where $\gamma$ is again a class $\mathcal{K}$ function. The importance of this definition is that it allows for us to consider the set of all stabilizing controllers for every point $x\in D$:

[TABLE]

This is an affine constraint in $u$ and thus will allow for the formulation of optimization based controllers. It also elucidates conditions on when $V$ is a CLF; for example, if $U=\mathbb{R}^{m}$, it is easy to verify that

[TABLE]

and thus there are stabilizing controllers. More generally, we have the following central stabilization result for CLFs [37].

Theorem 1**.**

For the nonlinear control system (1), if there exists a control Lyapunov function $V:D\to\mathbb{R}_{\geq 0}$, i.e., a positive definite function satisfying (3), then any Lipschitz continuous feedback controller $u(x)\in K_{\mathrm{clf}}(x)$ asymptotically stabilizes the system to $x^{*}=0$.

II-B Control Barrier Functions

Unlike stability which involves driving a system to a point (or a set), safety can be framed in the context of enforcing invariance of a set, i.e., not leaving a safe set. In particular, we consider a set $\mathcal{C}$ defined as the superlevel set of a continuously differentiable function $h:D\subset\mathbb{R}^{n}\to\mathbb{R}$, yielding:

[TABLE]

We refer to $\mathcal{C}$ as the safe set.

**Safety. ** Let $u=k(x)$ be a feedback controller such that the resulting dynamical system

[TABLE]

is locally Lipschitz. To formally define safety, due to the locally Lipschitz assumption, for any initial condition $x_{0}\in D$ there exists a maximum interval of existence $I(x_{0})=[0,\tau_{\mathrm{max}})$ such that $x(t)$ is the unique solution to (6) on $I(x_{0})$; in the case when $f_{\mathrm{cl}}$ is forward complete [33], $\tau_{\mathrm{max}}=\infty$. This allows us to define safety:

Definition 1**.**

The set $\mathcal{C}$ is forward invariant if for every $x_{0}\in\mathcal{C}$, $x(t)\in\mathcal{C}$ for $x(0)=x_{0}$ and all $t\in I(x_{0})$. The system (6) is safe with respect to the set $\mathcal{C}$ if the set $\mathcal{C}$ is forward invariant.

**Control Barrier Functions (CBFs). ** Using control Lyapunov functions as motivation, we wish to generalize to the concept of safety. Yet, one must be careful about directly generalizing Lyapunov (as done, in particular, in [38]). If there exists a CLF $V$ such that $V(x)=0\implies x\in\mathcal{C}$ and $V$ has a superlevel set $\Omega_{c}=\{x\in D~{}:~{}V(x)\leq c\}\subset\mathcal{C}$, then the corresponding controllers in (4) will render $\Omega_{c}$ invariant, and hence $\mathcal{C}$ safe. Nevertheless, this is overly restrictive as it would render every sublevel set invariant, i.e., $\Omega_{c^{\prime}}$ for all $c^{\prime}<c$. Rather, we wish to enforce set invariance without requiring a positive definite function, i.e., for $h$ to be a control barrier function it should render $\mathcal{C}$ invariant but not its sublevel sets.

This motivates the formulation of control barrier functions. Before defining these, we note that an extended class $\mathcal{K}_{\infty}$ function is a function $\alpha:\mathbb{R}\to\mathbb{R}$ that is strictly increasing and with $\alpha(0)=0$; that is, extended class $\mathcal{K}_{\infty}$ functions are defined on the entire real line: $\mathbb{R}=(-\infty,\infty)$. This allows us to define [21, 22]:

Definition 2**.**

Let $\mathcal{C}\subset D\subset\mathbb{R}^{n}$ be the superlevel set of a continuously differentiable function $h:D\to\mathbb{R}$, then $h$ is a control barrier function (CBF) if there exists an extended class $\mathcal{K}_{\infty}$ function $\alpha$ such that for the control system (1):

[TABLE]

for all $x\in D$.

Remark 3**.**

Note that, as discussed in Section I, the first notion of a control barrier function [20] was defined in terms of what are now termed reciprocal barrier functions. These blow-up on the boundary, hence the use of the term “barrier”:

[TABLE]

wherein the control barrier function condition (7) becomes:

[TABLE]

This class of barrier functions can be more suitable for some applications, but typically barrier functions, $h$, are preferable since they are well defined outside of $\mathcal{C}$. **

Remark 4**.**

The idea of extending set invarience conditions, i.e., the condition that $\dot{h}\geq 0$ for all $x\in\partial\mathcal{C}$, to all of $\mathcal{C}$ was first considered in [14] in the form of the following condition: $\dot{h}\geq-h$ for all $x\in\mathcal{C}$. This can be viewed as a very special case of a CBF wherein $\alpha(r)=r$ in (7). **

**Guaranteed Safety via CBFs. ** We can consider the set consisting of all control values that render $\mathcal{C}$ safe:

[TABLE]

That is, as in the case of CLFs, we can quantify the set of all control inputs at a point $x\in D$ that keep the system safe.

The main result of [21], and the main result with regard to control barrier functions, is that the existence of a control barrier function implies that the control system is safe:

Theorem 2**.**

Let $\mathcal{C}\subset\mathbb{R}^{n}$ be a set defined as the superlevel set of a continuously differentiable function $h:D\subset\mathbb{R}^{n}\to\mathbb{R}$. If $h$ is a control barrier function on $D$ and $\frac{\partial h}{\partial x}(x)\neq 0$ for all $x\in\partial\mathcal{C}$, then any Lipschitz continuous controller $u(x)\in K_{\mathrm{cbf}}(x)$ for the system (1) renders the set $\mathcal{C}$ safe. Additionally, the set $\mathcal{C}$ is asymptotically stable in $D$.

Remark 5**.**

The condition that the gradient of $h$ not vanish on the boundary is equivalent to requiring that [math] is a regular value of $h$ [6]. Note that this condition was not explicitly stated in [21], but the proof of this result utilizes Nagumo’s theorem [4] which requires this regularity condition [6]. **

Remark 6**.**

It is important to stress that this result not only guarantees that the safe set $\mathcal{C}$ is invariant, but makes the set $\mathcal{C}$ asymptotically stable. This has beneficial consequences with regard to practical implementation. While a system will not formally leave the safe set $\mathcal{C}$, noise and modeling errors might force the system to leave this set. As a result of the main CBF theorem, controllers in $K_{\mathrm{cbf}}(x)$ will drive the system back to the set $\mathcal{C}$. **

**Necessity for Safety. ** Finally, we note that control barrier functions provide the strongest possible conditions for safety in that they are necessary and sufficient given reasonable assumptions on $\mathcal{C}$ [21]:

Theorem 3**.**

Let $\mathcal{C}$ be a compact set that is the superlevel set of a continuously differentiable function $h:D\to\mathbb{R}$ with the property that $\frac{\partial h}{\partial x}(x)\neq 0$ for all $x\in\partial\mathcal{C}$. If there exists a control law $u=k(x)$ that renders $\mathcal{C}$ safe, i.e., $\mathcal{C}$ is forward invariant with respect to (6), then $h|_{\mathcal{C}}:\mathcal{C}\to\mathbb{R}$ is a control barrier function on $\mathcal{C}$.

II-C Optimization Based Control

Having established that control barrier functions give (necessary and sufficient) conditions on safety, the question becomes: how does one synthesize controllers? Importantly, we wish to do so in a minimally invasive fashion, i.e., modify an existing controller in a minimal way so as to guarantee safety. This naturally leads to optimization based controllers:

**Safety-Critical Control. ** Suppose we are given a feedback controller $u=k(x)$ for the control system (1) and we wish to guarantee safety. Yet it may be the case that $k(x)\notin K_{\mathrm{cbf}}(x)$ for some $x\in D$. To modify this controller in a minimal way so as to guarentee safety, we start by noticing that the conditions on safety given in (10) are affine in $u$. Thus, we can consider the following Quadratic Program (QP) based controller that finds the minimum perturbation on $u$:

[TABLE]

where here we assumed that $U=\mathbb{R}^{m}$. Thus, when there are no input constraints, since we have a single inequality constraint the CBF-QP has a closed-form solution (per the KKT conditions [39]) given by the min-norm controller; this was first utilized in the context of CLFs [40, 37].

**Unifying with Lyapunov. ** The QP based formulation of safety-critical controllers suggests a means in which to unify safety and stability. In fact, optimization-based controllers were first utilized in the context of CLFs exactly for the purpose of multi-objective nonlinear control [41], e.g., combining stability with torque constraints [42]. Concretely, we consider the following QP based controller:

[TABLE]

where here $H(x)$ is any positive definite matrix (pointwise in $x$), and $\delta$ is a relaxation variable that ensures solvability of the QP as penalized by $p>0$ (i.e., to ensure the QP has a solution one must relax the condition on stability to guarantee safety). In [21] it was established that this controller is Lipschitz continuous.

III CBFs for Systems with Actuation constraints

Consider again the nonlinear affine control system (1) and assume there exists an allowable set of states $A=\{x\in D:\rho(x)\geq 0\}$ defined via some performance function $\rho:{D}\to\mathbb{R}$. Our objective is to construct a CBF $h:{D}\to\mathbb{R}$ such that

[TABLE]

that is, such that the safe set $\mathcal{C}$, corresponding to the superlevel set of the CBF $h$, is contained within the set of allowed states $A$. Of course, it may be possible to take $h(x)=\rho(x)$ if this choice satisfies (7) for an appropriate function $\alpha$, in which case our objective is met.

However, in this section, we focus on the case when ${A}$ cannot be rendered invariant and instead we must find a safe subset that is a strict subset of the allowable set. The inability of ${A}$ itself to be rendered forward invariant could be due to, e.g., a control set ${U}$ that restricts the available control actions or due to dynamics with higher relative degree; an alternative approach to accommodate the latter is proposed in Section IV.

We assume that a locally Lipschitz nominal controller $\beta:D\to U$ (called nominal evading maneuver in [43]) is known. Intuitively, $\beta$ encapsulates a controller that, for some initial conditions, is expected to keep the system within the allowable set, although no guarantees on the ability of $\beta$ to ensure safety are required a priori. For example, for an autonomous mobile agent, $\beta$ might be a swerving maneuver or a rapid deceleration maneuver.

For any $t\geq 0$ and $x\in D$, let $\phi_{\beta}(t,x)$ denote the state of the control system (1) at time $t$ when $\beta$ is used as input and the system is initialized at $x$, that is, $\phi_{\beta}(t,x)$ satisfies $\dot{\phi}_{\beta}(t,x)=f(\phi_{\beta}(t,x))+g(\phi_{\beta}(t,x))\beta(\phi_{\beta}(t,x))$ with initial condition $\phi_{\beta}(0,x)=x$.

A barrier function can be computed from $\rho$ and $\beta$ as

[TABLE]

that is, the barrier $h$ is constructed by assigning to each point $x\in D$ the infimum value of the performance function $\rho$ attained along the trajectory initialized at $x$ when the nominal control strategy $\beta$ is used. Under mild conditions on $\rho$ and $\beta$, $h$ is indeed a CBF [43].

Theorem 4**.**

Let $\rho(x)$ be a continuously differentiable performance function and let $\beta(x)$ be a nominal controller such that $f(x)+g(x)\beta(x)$ is continuously differentiable. Define $h$ as in (12) with $\mathcal{C}$ the corresponding superlevel set of $h$ and suppose for each $x$ there exists a unique $x^{*}$ such that $h(x)=\rho(x^{*})$ and $\phi_{\beta}(\tau,x)=x^{*}$ for some $\tau\geq 0$. Then

$h$* is a CBF;* 2. 2.

$\mathcal{C}\subseteq A$, that is, the safe set is a subset of the allowable set; and 3. 3.

$\beta(x)\in K_{\mathrm{cbf}}(x)$* for all $x\in\mathcal{C}$.*

In some cases, computing $h$ given in (12) is possible in closed form; see [43] for examples.

Alternatively, one could approximate $h$ by simulating the system trajectory for a finite horizon and computing the infimum in (12) numerically. However, notice that to use $h$ in a resulting quadratic program as in (CBF-QP) requires computing the gradient of $h$, thus such an approach would also require numerically approximating the gradient of $h$, and therefore this approach becomes computationally challenging as the dimension of the system grows.

Another approach is to parameterize $h$ and search for a potentially conservative CBF satisfying (11). For example, we could parameterize $h$ as a fixed degree polynomial and use sums-of-squares (SOS) programming [44] to enforce the required conditions on $h$. To this end, a polynomial $s(x)$ is a SOS polynomial if $s(x)=\sum_{i=1}^{r}(g_{i}(x))^{2}$ for some polynomials $g_{i}(x)$ for $i=1,\ldots,r$. Let $\Sigma[x]$ denote the set of SOS polynomials in $x$. The following Proposition is closely related to results presented in [24, 45].

Proposition 5**.**

Given the affine control system (1), assume $f(x)$ and $g(x)$ are polynomials. Let $\rho(x)$ be a polynomial performance function and let $\beta(x)$ be a polynomial nominal controller. A polynomial $h(x)$ is a CBF if there exists positive constants $a>0,\epsilon>0$ and SOS polynomials $s_{1}(x)$, $s_{2}(x)$ such that

[TABLE]

Moreover, $\mathcal{C}\subseteq A$ and $\beta(x)\in K_{\mathrm{cbf}}(x)$ for all $x\in\mathcal{C}$.

Condition (13) is sufficient for ensuring that $h(x)<0$ for all $x$ such that $\rho(x)<0$, thereby implying $\mathcal{C}\subseteq A$. Likewise, (14) is sufficient for ensuring that $L_{f}h(x)+L_{g}h(x)\beta(x)+ah(x)\geq 0$ for all $x\in\mathcal{C}$. Since $\beta(x)\in U$ for all $x\in D$, this in turn implies (7) with the choice $\alpha(s)=as$.

There exist efficient computational toolboxes that convert certain SOS constraints into semidefinite programs such as [46]. However, viewing $h(x)$, $a$, $s_{1}(x)$, and $s_{2}(x)$ as decision variables in the above, the products $ah(x)$ and $s_{2}(x)h(x)$ are bilinear in the decision variables and prevent such a conversion.

Nonetheless, a common approach for accommodating such bilinearities is to propose an iteration of constraints so that in each iteration, one element of each problematic product is fixed, i. e., in each iteration, either $a$ and $s_{2}(x)$ are fixed or $h(x)$ is fixed, leading to an efficient numerical procedure for finding a CBF $h$. For example, in [24], a sequence of SOS programs is proposed to compute a CBF for lane-keeping and adaptive cruise control in an autonomous vehicle, and in [45], a sequence of SOS programs is proposed to compute a region of safe stabilization.

Variants of the SOS-based approach proposed in Proposition 5 are possible and have been explored in related contexts, e. g., [24, 45]. For example, it is possible to compute a new nominal controller after computing a barrier $h(x)$. Further, the constraints (13)–(14) can be augmented with an objective function that, e. g., seeks to maximize the volume of the safe set $\mathcal{C}$. In addition, it is possible to consider an allowable set characterized as the intersection of the superlevel sets of multiple performance functions by including a constraint like (13) for each performance function.

IV Exponential Control Barrier Functions

In the previous sections we have seen how control barrier functions (CBFs) can be (i) used to enforce safety-critical constraints for nonlinear (control affine) systems, (ii) combined with control Lyapunov functions to arbitrate between stability and safety, and (iii) used for systems with actuator constraints. While CBFs offer a powerful methodology, there is one critical restriction: the safety-critical constraints have been so far assumed to be of relative-degree one, i.e., the first time-derivative of the CBF has to depend on the control input. However, this is a restrictive assumption that is typically not held for most safety constraints for robotic systems. We therefore need a way to enforce arbitrarily high relative-degree safety constraints. In this section, we introduce a special type of CBFs called Exponential CBFs that enable this functionality.

Control barrier functions for high-relative degree safety constraints were initially studied simultaneously in [47, 30]. However, the results in [47] only extended to position based safety constraints with relative-degree 2. On the other hand, the results in [30] extended to arbitrary high relative-degree using a backstepping based method. However, backstepping based CBF design for higher relative-degree systems (greater than 2) is challenging and has not been attempted. Building off the work in [47], exponential control barrier functions were first introduced in [48] as a way to easily enforce high relative-degree safety constraints. The rest of this section provides an introduction to exponential CBFs.

IV-A High Relative-Degree Safety Constraints

Consider the nonlinear dynamical system in (1) with initial condition $x_{0}$ with the goal to enforce the forward invariance of the safe set $\mathcal{C}$ defined in (II-B). However, unlike in earlier sections, we relax the relative-degree 1 assumption on $h(x)$ and assume $h(x)$ has arbitrarily high relative-degree $r\geq 1$. This translates to the $r^{\text{th}}$ time-derivative of $h(x)$ being,

[TABLE]

with $L_{g}L_{f}^{r-1}h(x)\neq 0$ and $L_{g}L_{f}h(x)=L_{g}L_{f}^{2}h(x)=\cdots=L_{g}L_{f}^{r-2}h(x)=0,\forall x\in D$. Next, we define,

[TABLE]

and assume for a given $\mu\in U_{\mu}\subset\mathbb{R}$, $u$ can be chosen such that $L_{f}^{r}h(x)+L_{g}L_{f}^{r-1}h(x)u=\mu$. This choice of $u$ is possible since by the relative degree of $h(x)$ we have $L_{g}L_{f}^{r-1}h(x)\neq 0,\forall x$ and moreover $\mu$ is a scalar (while $u\in U\subset\mathbb{R}^{m}$). With this, the above dynamics of $h(x)$ can be written as the linear system,

[TABLE]

where

[TABLE]

Clearly, if we choose a state feedback style $\mu=-K_{\alpha}\eta_{b}(x)$, then $h(x(t))=Ce^{(F-GK_{\alpha})t}\eta_{b}(x_{0})$. Moreover, by the comparison lemma, if $\mu\geq-K_{\alpha}\eta_{b}(x)$, then $h(x(t))\geq Ce^{(F-GK_{\alpha})t}\eta_{b}(x_{0})$.

We now have everything setup to define exponential control barrier functions.

Definition 7**.**

Given a set $\mathcal{C}\subset D\subset\mathbb{R}^{n}$ defined as the superlevel set of a $r$-times continuously differentiable function $h:D\to\mathbb{R}$, then $h$ is an exponential control barrier function (ECBF) if there exists a row vector $K_{\alpha}\in\mathbb{R}^{r}$ such that for the control system (1),

[TABLE]

$\forall$* $x\in\mathrm{Int}(\mathcal{C})$ results in $h(x(t))\geq Ce^{(F-GK_{\alpha})t}\eta_{b}(x_{0})\geq 0$ whenever $h(x_{0})\geq 0$.*

Remark 8**.**

Note that $K_{\alpha}$ in the above definition needs to satisfy certain specific properties. As we will see, we will require $K_{\alpha}$ to make the closed-loop system matrix stronger than Hurwitz (total negative) and additionally satisfy a condition based on the initial conditions $\eta_{b}(x_{0})$. These will be presented in more detail in the subsequent subsection on designing ECBFs. **

Remark 9**.**

Note that when the relative-degree $r=1$, $-K_{\alpha}\eta_{b}(x)$ in (19) reduces to $-\alpha h(x)$ with $\alpha>0$. Thus, Definition 2 defines a relative-degree 1 exponential CBF when $\alpha(h(x))=\alpha h(x)$ (with a small abuse of notation), $\alpha>0$. In this sense, the above definition is a generalization of the definition of CBFs for higher relative-degree functions $h(x)$. **

Given an ECBF, we can implement a controller that enforces the condition given in Definition 7 by extending the optimization based control methodology presented earlier. Concretely, we can consider the following QP based controller:

[TABLE]

IV-B Designing Exponential Control Barrier Functions

In order to design an exponential CBF, we begin by noting that (IV-A) is in controllable canonical form and if $K_{\alpha}=\begin{bmatrix}\alpha_{1}&\cdots&\alpha_{r}\end{bmatrix}$ then the characteristic polynomial of $F-GK_{\alpha}$ is $\lambda^{r}+\alpha_{r}\lambda^{r-1}+\cdots+\alpha_{2}\lambda+\alpha_{1}=0$, whose roots we will denote by $p_{1},\cdots,p_{r}$. Note that there is a well established relation between the coefficients of a polynomial and its roots.

We next define a family of functions $\nu_{i}:D\to\mathbb{R}$ and corresponding superlevel sets $\mathcal{C}_{i}$ for $i=0,\cdots,r,$ as follows:

[TABLE]

Note that $\mathcal{C}_{0}$ is identical to $\mathcal{C}$. Our goal is to design $K_{\alpha}$ to ensure $\mathcal{C}$ is forward invariant. We begin with the following result.

Proposition 6** ([48]).**

For a given $i\in\{1,\cdots,r\}$, if $\mathcal{C}_{i}$ is forward-invariant then $\mathcal{C}_{i-1}$ is forward-invariant whenever $p_{i}>0$ and $x_{0}\in\mathcal{C}_{i}\cap\mathcal{C}_{i-1}$.

The above result follows from noting that under the given conditions when $x(t)$ reaches the boundary of $\mathcal{C}_{i-1}$, we have $\dot{\nu}_{i-1}\geq 0$ resulting in forward invariance of $C_{i-1}$. The recursive application of the above proposition then motivates the following result:

Theorem 7** ([48]).**

If $\mathcal{C}_{r}$ is forward-invariant and $x_{0}\in\bigcap_{i=0}^{r}C_{i}$ then $\mathcal{C}$ is forward-invariant.

From the above results, for invariance of $\mathcal{C}$, we require two conditions for each $i$: (a) $p_{i}>0$ and (b) $x_{0}\in\mathcal{C}_{i}$. The first condition on $p_{i}$ implies that the poles of the closed-loop $F-GK_{\alpha}$ need to be real and negative. The second condition on $x_{0}$ and the definition of $\mathcal{C}_{i}$ implies we require $\nu_{i}(x_{0})\geq 0\iff\dot{\nu}_{i-1}(x_{0})+p_{i}\nu_{i-1}(x_{0})\geq 0\iff p_{i}\geq-\frac{\dot{\nu}_{i-1}(x_{0})}{\nu_{i-1}(x_{0})}$. Both these conditions can be achieved by choosing $K_{\alpha}$ as specified in the main result below.

Theorem 8** ([48]).**

Suppose $K_{\alpha}$ is chosen such that $F-GK_{\alpha}$ is Hurwitz and total negative (resulting in negative real poles) and the eigenvalues satisfy $\lambda_{i}(F-GK_{\alpha})\geq-\frac{\dot{\nu}_{i-1}(x_{0})}{\nu_{i-1}(x_{0})}$, then $\mu\geq-K_{\alpha}\eta_{b}(x)$ guarantees $h(x)$ is an exponential CBF.

Thus, an exponential CBF can be designed using classical pole placement strategies from linear feedback theory. The location of the poles is specified to be both real and negative as well as dependent on the higher time-derivatives of the barrier function at initial time.

V Applications: CBFs for Robotic Systems

Having seen the theoretical development of control barrier functions in the earlier sections, we will now present practical uses of CBFs in various robotic application domains. Sections V-A to V-C will introduce CBFs for single-agent robotic systems: we will look at three sufficiently different types of robotic systems, i. e. walking robots, cars, and Segways. Section V-D will introduce CBFs for multi-agent robotic systems.

V-A Dynamic Walking on Stepping Stones

Legged robots are unique in the sense that these systems are able to locomote over discrete terrains - such as a terrain with steeping stones with discrete gaps between the steps (see Fig. 1a). Precisely stepping on the footholds is critical and missing the foothold even by a few centimeters will cause a dramatic fall of the robotic system. In this sense, stepping stones are examples of safety-critical control that have to be strictly enforced. While this is challenging, in the preceding sections we have developed the theory to specifically attack such safety-critical problems. Dynamic walking over stepping stones using CBFs was first demonstrated in [49]. Here, we present results on the DURUS bipedal robot reported in [31].

Legged systems are modeled as multi-domain hybrid systems with walking consisting of a single-support phase when one (stance) foot is in contact with the ground and an instantaneous double-support phase when the swing foot impacts ground. The single-support phase is modeled as a continuous-time differential equation while the double-support phase is modeled as an instantaneous impact due to the swing foot impacting on the ground. The impact causes an instantaneous jump in the system state. Mathematically, this is represented as the hybrid system

[TABLE]

with $S$ representing the switching surface that denotes swing foot contact with the ground.

For the above system, a hybrid zero dynamics (HZD) based approach (see [50] for details) is used to design a stable periodic orbit—representing walking—by means of an offline nonlinear constrained optimization, in order to find a set of outputs $y:\mathbb{R}^{n}\to\mathbb{R}^{m}$ that are then regulated by constructing a Lyapunov function $V(x)=\begin{bmatrix}y&\dot{y}\end{bmatrix}P\begin{bmatrix}y&\dot{y}\end{bmatrix}^{T}$ such that driving $V(x)\to 0$ results in driving the outputs to zero, resulting in stable walking. This is achieved by the CLF based approach detailed in Section II-A, with the difference for a hybrid system being that rapid exponential stability is sought through a RES-CLF [37] s.t. $\dot{V}(x,u)\leq-\frac{1}{\epsilon}\gamma(V(x))$, where $0<\epsilon<1$. This ensures that the controller contracts faster than the potential expansion that happens at impacts. See [37, 42] for more details.

Now, let us look into the problem of how we can guarantee the safety-critical constraint of precisely placing the feet on the stepping stone on each step. In Fig. 1b, the start of the step is shown as the dotted stick-figure with the stance foot at $O$. The goal is to move the swing leg and precisely impact the ground within the solid red foothold at the end of the step. This is a constraint at the step end-time which can not be directly enforced as a barrier. We convert this end-time constraint into a barrier constraint that is enforced point-wise in time. In particular, if the swing foot position, denoted by $F$ in the Fig. 1b, is maintained within the outer circle (with center $O_{1}$ and radius $R_{1}$) and outside the inner circle (with center $O_{2}$ and radius $R_{2}$), then the foot follows the red trajectory and impacts the foothold at the end of step. This can be formulated through enforcing the nonnegativity of the following CBFs:

[TABLE]

where $O_{1}F(x)$ and $O_{2}F(x)$ are the distances between the swing foot $F$ and the centers of the two circles at $O_{1}$ and $O_{2}$ respectively. Since $h_{i}(x),i\in\{1,2\}$ are position constraints, they have relative-degree 2. We thus use the tools of the exponential CBF to design $\alpha_{i,1},\alpha_{i,2}$ and pick $u$ s.t., $L_{f}^{2}h_{i}(x,u)+L_{g}L_{f}h_{i}(x)u\geq-\alpha_{i,1}h_{i}(x)-\alpha_{i,2}\dot{h}_{i}(x)$. This results in enforcing $h_{i}(x)\geq 0$ resulting in dynamic walking on stepping stones. Fig. 2a shows $h_{1},h_{2}$ plotted against time to illustrate that they are non-negative. Fig. 2b illustrates snapshots from simulation of walking over a stepping stone terrain with different step lengths. This method can also be used to walk over a terrain of stepping stones with changing step width or step height.

V-B Automotive Systems: Automatic Cruise Control and Lane Keeping

Our next example is from the automotive domain. Many modern Advanced Driver Assistance Systems (ADAS) provide prime examples of safety-critical constraints. For instance, in Adaptive Cruise Control (ACC) the vehicle’s speed is regulated to a user-set speed when there is no vehicle immediately ahead in the lane, yet if a vehicle is detected ahead then a safe following distance is maintained. On the other hand, in Lane Keeping (LK) the vehicle’s steering is controlled so as to maintain the vehicle within a lane. Furthermore, two or more ADAS control modules can be simultaneously activated and designing provably correct controllers for simultaneous operation becomes critical; this subsection follows from [23], but see also [21].

In order to demonstrate adaptive cruise control and lane keeping in an experimental setting, we will consider a Khepera robot modeled as a unicycle model

[TABLE]

where $(p_{x},p_{y}),\psi,v,\omega$ represent the 2D position, orientation, and longitudinal and angular velocities of the robot respectively, with $x\in\mathbb{R}^{5}$ the resulting state vector. Further, $u_{l}$ is the longitudinal force and $u_{a}$ is the angular torque and serve as control inputs. The mass and inertia are $m,I_{z}$ respectively and $a$ represents the distance from the center of the wheel-base to the point of interest $(p_{x},p_{y})$. This model can be written as a nonlinear control affine system as given in (1).

As mentioned, adaptive speed regulation comprises of following a user-set speed when there is no vehicle ahead in the lane. This will be formulated as a soft constraint through a CLF. However, when there is a vehicle ahead, the speed needs to be adaptively reduced so as to maintain a fixed time-headway based follow distance. This will be enforced as a safety-critical constraint through the following CBF:

[TABLE]

Here, $D$ is the distance to the vehicle ahead, $\tau$ is minimum time-headway to be maintained, and $v_{f}$ is the velocity of the vehicle (follower)—see [20] for the derivation.

Similarly, the objective of lane keeping is to maintain the vehicle within the lane. We need to enforce a safety-critical constraint of the form $y_{lat}\leq d_{max}$, where $y_{lat}$ is the lateral distance w.r.t. the center of the lane and $d_{max}$ is the distance from the center of the lane to either end of the lane that captures the lane width. We enforce this safety constraint through the following CBF:

[TABLE]

Here, $a_{max}$ is the maximum lateral acceleration and $v_{lat}$ is the lateral velocity of the vehicle. More details about the properties of this CBF are detailed in [21, 23].

Finally, the performance objectives such as driving the longitudinal velocity to a user-defined velocity ($v\to v_{d}$), creating a smoother path following ($\omega\to 0$), and following the desired path ($(x,y)\to R_{d}$) are specified through output functions that are regulated to zero through CLFs. As earlier, the CLF and CBF conditions are unified into a single controller via (CLF-CBF QP) given in Section II-C. Fig. 3a shows experimental results on the Khepera robot where simultaneous enforcement of lane keeping and adaptive speed regulation safety constraints are enforced. Fig. 3b illustrates the value of the CBFs in experiments and simulation.

V-C Dynamic Balancing on Segways

To demonstrate the application of control barrier functions as “safety filters,” we will consider their experimental realization on a Segway type robot, i.e., a two-wheeled inverted pendulum. In particular, this subsection summarizes the results of [32] which provided the first experimental evaluation of CBFs on a robotic system that is not statically stable. To realize these results, a Ninebot Segway was rebuilt, with only the original chassis and motors remaining—all of the electronics were customized to allow for the real-time control of the system via optimization based controllers. The objective is to ensure “safe” operation of the Segway, defined in this case as the robot not tipping over, i.e., always staying upright. Additionally, the goal is to achieve this safety condition even while using a nominal controller for the system (that may not be safe) and thus modifying the controller in a minimally invasive fashion so as to ensure safety. The result will be a safety filter, or an Active Set Invariance Filter (ASIF) of the form illustrated in Fig. 4, where the nominal control input, $u_{\mathrm{des}}$, is filtered through a QP of the form (CBF-QP) to ensure safety in the system.

The dynamics of the Segway can be written in the standard form given in (1), where in this case the input, $u$, is the voltage input into the motors and $x=(v,\phi,\dot{\phi})^{T}$, where $v$ is the forward velocity of the Segway, $\phi$ is the angle of the pendulum from upright, and $\dot{\phi}$ is the rate of change of this angle. Correspondingly, there are input bounds on the system of the following form: $u\in[-15,15]\mathrm{V}$ (this input bounds will play a role in determining the CBF that will be implemented on hardware). The safety constraint for the system is that the pendulum component of the robot stays upright, i.e., that the Segway does not tip over. This can be captured by the condition that the angle of the pendulum, $\phi$, stays within a bounded region, in this case chosen to be $\phi\in[-\frac{\pi}{12},\frac{\pi}{12}]\mathrm{rad}$. Finally, to ensure valid inputs, we also restrict the rate of change of the angle of the pendulum to be $\dot{\phi}\in[-2\pi,2\pi]\mathrm{rad/s}$, and the forward velocity of the Segway to be $v\in[-5,5]\mathrm{m/s}$. Finally, the nominal controller for the system, $u_{\mathrm{des}}=k(x)$, is chosen to be a standard PD controller that tracks a desired signal, i.e., an angle of the pendulum and velocity for the wheels.

Since the safety constraint is to keep the Segway upright, i.e., keep $\phi\in[-\frac{\pi}{12},\frac{\pi}{12}]\mathrm{rad}$, one might be tempted to simply utilize two control barrier functions of the form:

[TABLE]

Yet, while these could be implemented via a CBF-QP to enforce these conditions, they will not enforce all of the additional constraints necessary to guarantee experimental implementation. Therefore, the Hamilton-Jacobi method [51] was utilized to determine the safe set $\mathcal{C}$ resulting by enforcing all the above-mentioned constraints. In particular, a reachability analysis was performed over a 75x75x75 grid of the state space with the edges of the grid at the state constraints given in the previous paragraph. The resulting safe set can be seen in Fig. 5a. A control barrier function can then be synthesized from this set—in this case, polynomial regression was used to create an analytic expression that can be used in the safety filter.

The safety filter was implemented on hardware using the general framework indicated in Fig. 4. In particular, the CLF-QP was solved onboard the hardware on a BeagleBone Black with an average computation time of 0.4 ms, with the resulting signal $u_{\mathrm{act}}$ passed to the motor controller. To demonstrate the ability of the ASIF to enforce safety, the desired pendulum angle was passed to the system in the form of a sinusoidal signal with an amplitude exceeding the $\frac{\pi}{12}$ angle constraint. Two experiments were then performed, one without and one with the ASIF, i.e., the CLF-QP active. The results can be seen in Fig. 5b, wherein the system remains safe only when the safety filter, implementing the CBF, is active. Finally, to show the potential power of CBFs, a disturbance is added to the system in the form of a kick—the system is able to stay upright, and hence safe, with CBFs while the systems fails without them (illustrated in Fig. 5c).

V-D Long Duration Autonomy

Another robotic application of CBFs involves the long duration autonomy problem for multi-robot systems. This problem considers a team of robots deployed over long time scales which are asked to execute tasks (such as environmental monitoring, search and rescue, or precision agriculture) that require more than a single charge of the battery of the robots. An effective control paradigm to use in this case is the constraint-based control [52], where survivability constraints, i.e., conditions for the robots to remain operational over long temporal scales, can be enforced by means of CBFs and included in a single constrained optimization problem.

Consider a collection of $N$ mobile robots, whose dynamics are modeled by the following control affine system:

[TABLE]

where $x_{i}\in\mathbb{R}^{n}$ and $u_{i}\in\mathbb{R}^{m}$, $i=1,\ldots,N$, are the state and the input of robot $i$, respectively, and $f$ and $g$ are locally Lipschitz. As the energy plays an important role in ensuring persistent operation, we augment the state $x_{i}$ by the energy $E_{i}$ stored in robot $i$’s battery obtaining: $\chi_{i}=[x_{i}^{T},E_{i}]^{T}$. The energy dynamics are given by

[TABLE]

where $\hat{f}$ and $\hat{g}$ are also assumed to be locally Lipschitz. The dynamics of the augmented state $\chi_{i}$ are then:

[TABLE]

We assume the robot workspace is endowed with charging stations, interpreted as regions of the state space where robots can charge their batteries. Letting

[TABLE]

be a static mapping from robot $i$’s state to its position $p_{i}\in\mathbb{R}^{d}$, $d=2$ for ground robots or $d=3$ for aerial robots, we define

[TABLE]

as the function that evaluates the energy that robot $i$ requires to reach a charging station starting from position $p_{i}$.

We are now ready to encode the survivability constraints mentioned above. Following what has been done in [53], survivability, realized by ensuring that each robot never gets stranded away from a charging station, is encoded by ensuring that the following always holds:

[TABLE]

i. e. each robot always has enough energy to reach a charging station with a minimum desired amount of energy, $E_{min}$. Moreover, to prevent overcharging, we also want the following inequality to be always satisfied:

[TABLE]

We can combine these two objectives by defining the logical and of these constraints, $h_{e,i}=h_{c,i}\land h_{o,i}$, as

[TABLE]

and enforcing differential constraints affine in the control variable $u_{i}$, which are analogous to (7), as shown in [54].

Considering the environmental monitoring task, we reformulate the task itself using CBFs which can be then combined with the ones related to survivability introduced above in order to implement persistent environmental monitoring [55]. Consider $N$ robots tasked with monitoring a compact and convex set $\Omega\subset\mathbb{R}^{d}$. We can define a measure of the coverage quality by [56]:

[TABLE]

where $x$ is the ensemble state of the robots, $\{\Omega_{1},\ldots,\Omega_{N}\}$ is the Voronoi tessellation of the set $\Omega$, the value $\phi(q)\in\mathbb{R},~{}\phi(q)\geq 0~{}\forall q\in\Omega$, encodes the importance of the point $q$, and where the quality of the sensor coverage associated with the point $q$ decreases quadratically with the distance $\|p(x_{i})-q\|$. The further away the point to monitor is, the worse the coverage is, and the higher the coverage cost $J$ is. Defining the barrier function related to the task as $h_{t}(\chi)=-J(x)$, where $\chi$ represents the ensemble compound state of the robots, containing $x_{i}$ and $E_{i}$ of each robot, we can express the constraint (7) as

[TABLE]

As shown in [22], the constraint (24) ensures that the zero superlevel set of the function $h_{t}(\chi)$ is asymptotically stable, with the effect of minimizing the coverage cost $J$ defined above [55].

Additionally, safety, specifically intended as collision avoidance, can be guaranteed by ensuring that

[TABLE]

$\forall~{}i,j\in\{1,\ldots,N\},i\neq j$, where $\Delta>0$ is the safety distance to be maintained between any two robots, $i$ and $j$, located at positions $p(x_{i})$ and $p(x_{j})$. Similarly to what has been done to obtain (22), we can define

[TABLE]

which combines energy and safety constraints, in order to formulate a differential constraint analogous to (24).

Thus, each robot executes the input $u_{i}$ solution of the following QP:

[TABLE]

where $\kappa>0$ is a weighting factor and the gradients involved in the computation of the Lie derivatives are intended as a particular class of generalized gradients (see [54]). Note that introducing the relaxation variable $\delta$, as discussed in Section II, allows us to trade the execution of the coverage task for safety and energy, i. e., survivability.

The persistent environmental monitoring strategy has been implemented on the Robotarium [27], where six ground mobile robots have been asked to monitor a given domain over a time horizon that is longer than their (simulated) battery life (see Fig. 6). The robots perform coverage control by minimizing the cost (23) by enforcing the constraint (24). Additionally, they have to avoid two obstacles moving in the environment (robots circled in red in Fig. 6) and never run out of energy. This is realized by means of the constraint (26). Six charging stations (blue circles, which turn yellow when the robots are charging) allow the robots to recharge their battery. The charging stations are projected onto the testbed, together with the boundary of the Voronoi tessellation of the domain to cover. The execution of the controller solution of (25) is summarized in Fig. 6.

VI Conclusions

This paper presented a summary of recent results in safety-critical control based upon a novel form of control barrier functions. The basis theoretic foundations of this formulation were reviewed, all with selected application domains. Due to the recent activity in this domain, and the pressing need for safety in the context of autonomous systems, the authors imagine control barrier functions to become an essential component of modern control system design.