Safety-Critical Control Synthesis for network systems with Control Barrier Functions and Assume-Guarantee Contracts

TL;DR

This paper presents a scalable safety-critical control synthesis method for network systems using assume-guarantee contracts, control barrier functions, and robust control invariant sets, ensuring safety even under severe contingencies.

Contribution

It introduces an assume-guarantee contract framework combined with an epigraph algorithm for efficient, scalable control synthesis in large network systems with safety guarantees.

Findings

Successfully guarantees safety constraints in power grid simulations.

Handles topology changes and severe contingencies effectively.

Achieves linear complexity in sparse networks.

Abstract

This paper aims at the safety-critical control synthesis of network systems such that the satisfaction of the safety constraints can be guaranteed. To handle the large state dimension of such systems, an assume-guarantee contract is used to break the large synthesis problem into smaller subproblems. Parameterized signal temporal logic (pSTL) is used to formally describe the behaviors of the subsystems, which we use as the template for the contract. We show that robust control invariant sets (RCIs) for the subsystems can be composed to form a robust control invariant set for the whole network system under a valid assume-guarantee contract. An epigraph algorithm is proposed to solve for a contract that is valid, ---an approach that has linear complexity for sparse networks, which leads to a robust control invariant set for the whole network system. Implemented with control barrier function (CBF), the state of each subsystem is guaranteed to stay within the safe set. Furthermore, we propose a contingency tube Model Predictive Control approach based on the RCI, which is capable of handling severe contingencies, including topology changes of the network. A power grid example is used to demonstrate the proposed method. The simulation result includes both set point control and contingency recovery, and the safety constraint is always satisfied.