Characterization of Safety in Stochastic Difference Inclusions using Barrier Functions

TL;DR

This paper develops a method using barrier functions to analyze safety probabilities in stochastic systems modeled by difference inclusions, simplifying proofs under certain assumptions.

Contribution

It introduces a novel approach that leverages set-valued map properties and expectation substitution to verify safety in stochastic difference inclusions.

Findings

Barrier functions can be effectively used for safety verification.

The approach simplifies proofs under convexity and semi-continuity assumptions.

Numerical examples demonstrate the method's applicability.

Abstract

We study stochastic systems characterized by difference inclusions. Such stochastic differential inclusions are defined by set-valued maps involving the current state and stochastic input. For such systems, we investigate the problem of proving bounds on the worst-case probability of violating safety properties. Our approach uses the well-known concept of barrier functions from the study of stochastic control systems. However, barrier functions are hard to prove in the presence of stochastic inputs and adversarial choices due to the set-valued nature of the dynamics. In this paper, we show that under some assumptions on the set-valued map including upper semi-continuity and convexity combined with a concave barrier function vastly simplifies the proof of barrier conditions, allowing us to effectively substitute each random input in terms of its expectation. We prove key results based on the theory of set-valued maps and provide some interesting numerical examples. The ideas proposed here will contribute to the growing interest in problems of robust control and verification of stochastic systems in the presence of uncertain distributions and unmodeled dynamics.

Equations

$$x^{+}\in F(x),x\in \mathcal{X}\subseteq {\mathbb{R}}^n,$$

$$\Sigma :x^{+}\in G(x,v),x\in \mathcal{X}\subseteq {\mathbb{R}}^n,v\in \mathcal{V}\subseteq {\mathbb{R}}^m,$$

$$\left\{\begin{array}[]{rll}x_{0}&=x_{0}\\ X_{i+1}&=G(x_{i},v_{i})&i=0,\ldots,k-1,\\ x_{i+1}&\in X_{i+1}&i=0,\ldots,k-1\,.\\ \end{array}\right.$$

$$x(t+1)\in x+\mu (t)+\sigma (t)v-[a,b],v\sim N(0,1).$$

$$G(x,\hat{v})=\{\hat{x}|\exists \theta \in \Theta ,\hat{x}=g(x,f(\theta ,\hat{v}))\}.$$

$$\mathbb{P}(G(x,v_0)\cap S\ne \varnothing |x)=\mathbb{E}\left[\underset{y\in G(x,v_0)}{\sup }{\mathcal{I}}_S(y)\right].$$

$$\left.\begin{array}[]{rl}\lambda_{0}^{S}(x)&=\mathcal{I}_{S}(x)\\ \lambda_{1}^{S}(x,v_{0})&=\displaystyle\sup_{x_{1}\in G(x,v_{0})}\lambda^{S}_{0}(x_{1})\\ \lambda_{2}^{S}(x,v_{0},v_{1})&=\displaystyle\sup_{x_{1}\in G(x,v_{0})}\lambda_{1}^{S}(x_{1},v_{1})\\ &\vdots\\ \lambda_{k+1}^{S}(x,v_{0},\ldots,v_{k})&=\displaystyle\sup_{x_{1}\in G(x,v_{0})}\lambda_{k}^{S}(x_{1},v_{1},\ldots,v_{k})\\ \end{array}\right\}$$

$${\lambda }_{k+1}^S$$

$$\underset{y_1\in G(x,v_0)}{\sup }\underset{y_2\in G(y_1,v_1)}{\sup }\cdots \underset{y_{k+1}\in G(y_k,v_k)}{\sup }{\mathcal{I}}_S(y_{k+1}).$$

$$\displaystyle\mathbb{P}\big{(}\exists k\in[1,N],\lambda_{k}^{S}$$

$$\displaystyle\leq\mathbb{E}\big{[}\sup_{k\in[1,N]}\lambda_{k}^{S}(x,v_{0},\cdots,v_{k-1})\mid x\big{]}.$$

$$\displaystyle\mathbb{P}\big{(}\exists k\in[1,N],$$

$$\displaystyle=\mathbb{P}\big{(}\sup_{k\in[1,N]}\lambda_{k}^{S}(x,v_{0},\cdots,v_{k-1})\geq 1\mid x\big{)}$$

$$\displaystyle\leq\mathbb{E}\big{[}\sup_{k\in[1,N]}\lambda_{k}^{S}(x,v_{0},\cdots,v_{k-1})\mid x\big{]}.$$

$$\mathbb{P}(\exists k\in [1,N],{\lambda }_k^{X_u}(x,v_0,\dots ,v_{k-1})\ge 1)<\rho .$$

$$\mathbb{E}\big{[}\sup_{k\in[1,N]}\lambda_{k}^{S}(x,v_{0},\cdots,v_{k-1})\mid x\big{]}\leq\rho.$$

$$K_{\Delta }:=\{x\in \mathcal{X}:B(x)\le \Delta \}.$$

$$\mathbb{P}(G(x,v)\cap K_{\Delta }^C\ne \varnothing \mid x)$$

$$\mathbb{P}\left(\underset{x^{+}\in G(x,v)}{\sup }B(x^{+})>\Delta \mid x\right)\le \frac{1}{\Delta }\mathbb{E}[\underset{x^{+}\in G(x,v)}{\sup }B(x^{+})\mid x].$$

$$\mathbb{E}[\underset{x^{+}\in G(x,v)}{\sup }B(x^{+})\mid x]\le \rho \Delta .$$

$$\left.\begin{array}[]{rl}\lambda_{0}^{B}(x)&=B(x)\\ \lambda_{1}^{B}(x,v_{0})&=\displaystyle\sup_{x_{1}\in G(x,v_{0})}\lambda_{0}^{B}(x_{1})\\ \vdots\\ \lambda_{k+1}^{B}(x,v_{0},\ldots,v_{k})&=\displaystyle\sup_{x_{1}\in G(x,v_{0})}\lambda_{k}^{B}(x_{1},v_{1},\ldots,v_{k})\\ \end{array}\right\}$$

$$\sum _{i=1}^N{\ell }_i(x)\le \rho \Delta .$$

$$x^{+}\in [x-v,x+v]$$

$${\lambda }_1^B(x,v_0)=\underset{x_1\in [x-v_0,x+v_0]}{\sup }{x}_1=x+v_0.$$

$${\lambda }_k^B(x,v_0,\dots ,v_{k-1})=\underset{x_1\in [x-v_0,x+v_0]}{\sup }{x}_1+\sum _{j=1}^{k-1}{v}_j=x+\sum _{j=0}^{k-1}{v}_j.$$

$$\sum _{i=1}^N{\ell }_i^B(x)=Nx+\frac{N(N+1)}{20}.$$

$$x\le \frac{\rho \Delta }{N}-\frac{N+1}{20}$$

$$\theta F(x_{1})+(1-\theta)F(x_{2})\subseteq F\big{(}\theta x_{1}+(1-\theta)x_{2}\big{)}.$$

$$f(x):=\underset{y\in F(x)}{\sup }B(y).$$

$$f$$

$$\ge \underset{y\in \theta F(x_1)+(1-\theta )F(x_2)}{\sup }B(y)$$

$$=\underset{z_1\in F(x_1)}{\sup }\underset{z_2\in F(x_2)}{\sup }B(\theta z_1+(1-\theta )z_2)$$

$$\ge \underset{z_1\in F(x_1)}{\sup }\underset{z_2\in F(x_2)}{\sup }\theta B(z_1)+(1-\theta )B(z_2)$$

$$=\theta \underset{z_1\in F(x_1)}{\sup }B(z_1)+(1-\theta )\underset{z_2\in F(x_2)}{\sup }B(z_2)$$

Full text

In this paper, we show that under some assumptions on the set-valued map including upper semi-continuity and convexity combined with a concave barrier function vastly simplifies the proof of barrier conditions, allowing us to effectively substitute each random input in terms of its expectation. We prove key results based on the theory of set-valued maps and provide some interesting numerical examples. The ideas proposed here will contribute to the growing interest in problems of robust control and verification of stochastic systems in the presence of uncertain distributions and unmodeled dynamics.

††thanks: Will be added in subsequent versions.

,

1 Introduction

Ensuring the safety of dynamical systems is particularly challenging when their dynamics are influenced by uncertainty. This uncertainty may arise from multiple sources with varying mathematical properties and implications on the system behavior. Common types include stochastic uncertainties modeled by random variables with known probability distributions and set-valued uncertainties modeled by a non-deterministic (adversarial) choice from a set of possibilities. In this paper, we consider the analysis of discrete-time dynamical systems that combine uncertainties from two distinct sources: stochastic and set valued uncertainties. We express the dynamics as $x^{+}\in F(x,v)$, wherein $x$ is the current state of the system, $x^{+}$ is the next state, $v$ is a random input drawn from a fixed probability distribution and $F$ is a set valued map. Since $F$ is set valued, we assume that an “adversary” selects a specific next state in the set $F(x,v)$. The combination of two sources allows us to model interesting problems that include (a) systems whose dynamics are influenced by stochastic and set-valued disturbances; (b) systems with unmodeled dynamics that may be incorporated into the set-valued maps; and (c) systems with stochastic inputs drawn from a set (family) of distributions rather than a single fixed distributions wherein the distributions may even be time-varying.

Our goal is to analyze the probability of violating safety properties under these combined uncertainties. Specifically, we investigate the problem of proving bounds on the probability that a system governed by such a set-valued map will enter a given set of unsafe states $X_{u}$ over some finite or infinite time horizon of interest. In this case, we will assume that the adversarial choices will be made at each step to ensure that the system will enter $X_{u}$ within the given time horizon. To do so, we extend the classic notion of a barrier function first introduced for deterministic systems [19], and then extended to stochastic systems [20, 25].

In this paper, we first make assumptions on the set-valued map that will allow us to formally define notions such as the “worst-case” probability of reaching a set $X_{u}$. We demonstrate that if $F$ is chosen to be a bounded and upper semicontinuous set valued map with key measurability properties (Cf. Assumption 4), the worst-case probabilities are well-defined. Likewise, we show that for nonnegative and upper semicontinuous barrier functions, the worst-case expected value at a future time is well-defined and can be used to compute upper bounds on the worst-case probabilities of reaching certain sets in the state-space. As a result, barrier functions provide a general framework for verifying safety. However, the expectations of the barrier functions can be hard to compute, in practice since they involve a supremum over possible choices of the next states from a set of possibilities. To enable easier computation of the bounds, we study the case where the barrier function is assumed to be concave while the set-valued map is assumed convex. We demonstrate that this additional structure leads to stronger and more easily verifiable sufficient conditions for both safety and viability. Following this, we introduce the concept of a supermartingale barrier functions. Supermartingale properties naturally capture the tendency of the barrier function to decrease in expectation, which is well-suited to ensuring safety in stochastic systems. We also show that the concavity assumption with supermartingale leads to a more applicable supermartingale condition that is easy to verify and yields bounds that are valid for an infinite time horizon. The paper demonstrates the key ideas through some numerical results obtained on interesting classes of set-valued stochastic systems.

1.1 Related Work

The analysis of safety and reachability properties of probabilistic systems has been well-studied. Abate et al [1] investigate probabilistic reachability for discrete-time stochastic hybrid systems, employing dynamic programming to compute reachable sets and establish probabilistic safety guarantees. In this paper, we borrow the terminology of $p$-safety, introduced by Wisniewski et al [28], which defines a system as $p$-safe if the probability of the system avoiding an unsafe set is at least $1-p$. This method leverages sum-of-squares techniques to systematically quantify and compute safety probabilities. Recent works, such as Chern et al [7] and Lavaei et al [12], focus on synthesizing control laws to ensure the safety of stochastic dynamical systems.

The area of distributionally robust optimization studies optimization problems with chance constraints wherein the distributions governing the random variables belong to a family of possible distributions [21]. This area has incorporated interesting approaches to model families of distributions including distribution parameters/moments drawn from a set [5, 8] and ideas from optimal transport, including families defined by bounded Wasserstein distances [17]. More recently, there has been a lot of interest on the robust control of stochastic systems, wherein the distributions of the stochastic inputs are drawn from a family rather than a fixed probability distribution [24, 27]. Our approach using set-valued maps can also capture some forms of distributional robustness in the model of the system. For instance, if the distributions range over families defined by a set of possible values of the distribution parameters/moments, it is possible in some cases to express the resulting system as a set-valued map using randomized inputs drawn from a fixed distribution.

Several studies explore the interplay between stochastic disturbances and adversarial inputs. Summers et al [26] propose a stochastic games framework for verification and control of discrete-time stochastic hybrid systems, addressing scenarios where an adversary influences system dynamics with objectives counter to those of the controller. In the presence of distributional uncertainties, Yang et al [29] introduce a dynamic game approach to distributionally robust safety specifications, assuming that the disturbance distribution is only partially known and belongs to an ambiguity set of probability distributions. Furthermore, Chapman et al [6] employ Conditional Value-at-Risk (CVaR) for risk-sensitive safety analysis, capturing rare but harmful outcomes in stochastic systems and quantifying expected losses in worst-case scenarios. The concept of probabilistic invariance has also been explored for enforcing safety in stochastic systems. Methods such as linear programming and mixed-integer linear programming have been utilized to compute invariant sets that ensure safety over both finite and infinite horizons [23].

The problem of reasoning about combinations of “demonic” nondeterminism and probabilistic inputs has been studied by computer scientists seeking to prove properties of programs with random number generating statements and set-valued uncertainties [15, 4]. The reasoning is performed by a systematically propagating logical assertions about the state of the program upon termination backwards through the weakest pre-expectation operator until an assertion over the known initial states of the program is verified. While this approach can be quite general and subsume some of the ideas here, significant modeling and computational difficulties arise when the program involves random variables with an infinite set of support, or non-determinism that can make infinitely many choices. In contrast, the approach taken by systems and control theorists (including the approach of this paper) focuses on systems that work over real-valued system variables and random variables that go beyond finitely many choices. At the same time, the system structure is taken to be a map whose form remains unchanged rather than a computer program that has nontrival control flow and may contain simple/nested loops, function calls and recursion.

The stability of stochastic difference inclusions has also been well studied [18]. Maghenem et al derive sufficient conditions for robust safety in differential inclusions using barrier functions, allowing for unbounded safety regions and nonsmooth barrier functions  [14]. More recently Maghenem and Ghanbarpour have established the equivalence between robust safety and the existence of a barrier function certificate for differential inclusions, constructing a barrier function based on the time-to-impact function with respect to a specifically designed reachable set [13]. The key difference here is that, to our knowledge, there has been no work done on the combination of set-valued maps with probabilistic inputs, which is the main topic of this paper.

Notation. For sets $K,O\subseteq\mathbb{R}^{n}$, $K\backslash O$ denotes the subset of elements of $K$ that are not in $O$. $\mathbb{B}$ denotes the open unit ball centered at the origin. $U(x)$ indicates a neighborhood set around the point $x$. For a function $f:\mathbb{R}^{n}\rightarrow\mathbb{R}^{m}$, $\operatorname{dom}f$ denotes the domain of definition of $f$, and if $f$ is differentiable, $\nabla f$ denotes the gradient of $f$. $\overline{\mathbb{N}}$ represents $\mathbb{N}\cup\{\infty\}$. A set-valued map $F:\mathbb{R}^{m}\rightrightarrows\mathbb{R}^{n}$ associates each element $x\in\mathbb{R}^{m}$ with a subset $F(x)\subseteq\mathbb{R}^{n}$. $S^{n}_{++}$ denotes $n\times n$ matrices which are symmetric positive definite. For matrix $X$, $\operatorname{tr}(X)$ indicates trace of $X$. $\vee$ denotes or, and $[1,N]:=\{1,2,\cdots,N\}$. Given $C\subseteq\mathbb{R}^{n}$, $\mathcal{I}_{C}:\mathbb{R}^{n}\to\{0,1\}$ is the indicator function for the set $C$, defined as $\mathcal{I}_{C}(x):=\begin{cases}1,&\text{if }x\in C,\\ 0,&\text{otherwise}.\end{cases}$

2 Preliminaries

In this section, we present fundamental concepts of continuity, followed by the definition of a stochastic difference inclusion system. We then state the notions of reachability and safety in a probabilistic context.

2.1 Continuity Notions

We recall some of the continuity notions for set-valued and single-valued maps. Let $F:\mathcal{X}\rightrightarrows\mathbb{R}^{m}$ be a set-valued map, where $\mathcal{X}\subseteq\mathbb{R}^{n}$.

Definition 1** (Upper Semicontinuous Maps).**

A set-valued map $F$ is upper semicontinuous at $x\in\mathcal{X}$ if for each $\delta>0$, there exists a neighborhood $U(x)$ of $x$, such that for each $y\in U(x)\cap\mathcal{X}$, $F(y)\subseteq F(x)+\delta\mathbb{B}$; see [3, Definition 1.4.1].

Definition 2** (Locally Bounded).**

A set-valued map $F$ is locally bounded at $x\in\mathcal{X}$, if there exists a neighborhood $U(x)$ of $x$, and a constant $\beta(x)>0$ such that for all $y\in U(x)\cap\mathcal{X}$ and $\zeta\in F(y)$, $\|\zeta\|\leq\beta(x)$.

The map $F$ is said to be upper semicontinuous if it is upper semicontinuous for all $x\in\mathcal{X}$. We will recall the definition of upper semicontinuity for functions (singleton set-valued maps).

Definition 3** (Upper Semicontinuous Functions).**

A scalar function $B:K\rightarrow\mathbb{R}$, where $K\subseteq\mathbb{R}^{n}$ is said to be upper semicontinuous at $x\in K$ if, for every sequence $\left\{x_{i}\right\}_{i=0}^{\infty}\subseteq K$ such that $\lim_{i\rightarrow\infty}x_{i}=x$, we have $\limsup_{i\rightarrow\infty}B(x_{i})\leq B(x)$.

The function $B$ is said to be upper semicontinuous if it satisfies this property for all $x\in K$. Moreover, if $B$ is upper semicontinuous, then $-B$ is lower semicontinuous.

2.2 Difference inclusion, Reachability, and Viability

Consider a difference inclusion written as:

[TABLE]

where $x\in\mathcal{X}$ is the state, $F:\mathcal{X}\rightrightarrows\mathbb{R}^{n}$ is a set-valued map, and $x^{+}$ denotes state in the next time step.

We view set-valued maps in terms of a game played between a system and an adversary. For each $x$, the set $F(x)$ represents all the possible choices available to the adversary for the next time step. I.e, the adversary selects an element $\hat{x}\in F(x)$.

A set $S\subseteq\mathbb{R}^{n}$ is said to be reachable from $x$ in a single time step if $F(x)\cap S\neq\emptyset$. This means that the adversary can choose an element $\hat{x}\in F(x)$ such that $\hat{x}\in S$, ensuring that the next state lies within $S$. Conversely, if $F(x)\cap S=\emptyset$, then no choice from $F(x)$ allows the system to reach $S$ in one step.

Similarly, the solution from $x$ is viable for a single time step in the set $S$ if $F(x)\subseteq S$ for all $x\in S$. In this case, regardless of the adversary’s choice, the system remains within $S$ in the next time step. However, if there exists some $x\in S$ for which $F(x)\not\subseteq S$, then the adversary can choose an element that leads the system out of $S$, violating viability.

2.3 Stochastic Difference Inclusion

A stochastic difference inclusion system is a set-valued map with a stochastic input drawn from a distribution and is given as

[TABLE]

where $G:\mathcal{X}\times\mathcal{V}\rightrightarrows\mathbb{R}^{n}$ is the set-valued map, $x$ is the state, and $v$ is a random input with a measure $\mu$ over a the support $\mathcal{V}$. Here, we study the safety in probability for the system $\Sigma$.

The key assumptions for the system and the solution are given in the following.

Assumption 4**.**

The set-valued mapping $G$ in (2) satisfies the following conditions:

The map $x\mapsto G(x,v)$ is upper semicontinuous for each $v\in\mathcal{V}.$ 2. 2.

The map $G$ is locally bounded (see Definition 2). 3. 3.

For each $(x,v)$, $G(x,v)$ is nonempty, closed, and convex. 4. 4.

The mapping $v\mapsto\operatorname{graph}(G(.,v))=\{(x,y)\in\mathcal{X}\times\mathcal{X}\,:\,y\in G(x,v)\}$ is measurable.

Assumption 5**.**

Let $(\Omega,\mathcal{F},\mathbb{P})$ be a probability space [9]. Consider a sequence of random vectors $(v_{i})_{i\in\mathbb{N}}$, where each $v_{i}:\Omega\to\mathcal{V}\subseteq\mathbb{R}^{m}$. We assume that $(v_{i})_{i\in\mathbb{N}}$ are independent and identically distributed (i.i.d.) with common distribution $\mu$ on $(\mathcal{V},\mathcal{B}(\mathcal{V}))$, where $\mathcal{B}(\mathcal{V})$ denotes the Borel $\sigma$-algebra on $\mathcal{V}$.

Definition 6** (Trajectory).**

Let $v_{0},\ldots,v_{k-1}$ be a finite sequence of samples drawn i.i.d. from the distribution $\mu$. A trajectory of the system starting from state $x_{0}\in\mathcal{X}$, and corresponding to the sequence $v_{0},\ldots,v_{k-1}$ is a sequence of states $x_{0},\ldots,x_{k}$ obtained as follows:

[TABLE]

We will use the notation $X_{0},\ldots,X_{k}$ to denote the sequence of sets that correspond to the solution $x_{0},\ldots,x_{k}$, wherein $X_{0}=\{x_{0}\}$.

Note that since $G(x_{i},v_{i})$ is nonempty (Cf. assumption 4), we can obtain trajectories of any length $k\in\mathbb{N}$ starting from any $x_{0}\in\mathcal{X}$. Also, note that multiple trajectories of length $k+1$ may exist for a fixed sequence of samples $v_{0},\ldots,v_{k}$.

In the following Lemma we show that $G(x_{i},v_{i})$ is measurable for each $i\geq 0$.

Lemma 7** (Measurability).**

Consider the system $\Sigma$ described by (2), and suppose Assumption 4 holds. Then, for each $k\geq 0$, $G(\cdots(G(G(x,v_{0}),v_{1}),v_{2}),\cdots),v_{k})$ is closed and measurable for all $x$.

{pf}

See Appendix 39 for the proof.

We will now present a few illustrative examples of models based on the formalism presented thus far.

Example 8** (Set-Valued Random Walks).**

Consider a state $x\in\mathbb{R}$, modeling the aggregate water level in a large tank that can be filled up by rain water. The total rainfall each month is modeled as a normal random variable with a time-varying mean $\mu(t)$ and time-varying standard deviation $\sigma(t)$. Furthermore, the system is subject to an uncertain monthly demand $w(t)$ which belongs to the set $w(t)\in[a,b]$.

[TABLE]

In this example, the set-valued map formalism combines two sources of uncertainty: one that is stochastic in nature and the other that is nondeterministic. Suppose we were to bound the probability that the tank starting from a level of $x(0)=10$, empties out within $6$ months, or overflows. Rather than assume worst-case rainfall, we would like to treat the rainfall as a stochastic input while treating demand as an adversarial worst-case. For instance, when analyzing the probability of emptying the tank, it is natural to assume that the demand is always $b$ during the time period under consideration. Alternatively, when analyzing the probability of the tank overflowing, the demand is set to $a$, which happens to be the worst case for that scenario. In the presence of more complicated dynamics involving multiple state variables and non-linear maps, the analysis can be more involved.

Example 9** (Distributional Robustness).**

Consider a stochastic system $x^{+}=g(x,v)$ wherein $v$ is a random variable whose distribution is drawn from a family of distributions. For instance, $v$ may be drawn from a set of normally distributed random variables with mean $\mu\in[\mu_{l},\mu_{u}]$ and standard deviation $\sigma\in[\sigma_{l},\sigma_{u}]$. In this instance, we may write $v=\mu+\sigma\hat{v}$, wherein $\hat{v}$ is a standard normal random variable with mean [math] and standard deviation $1$. In fact, many families of random variables have such convenient parameterizations wherein each instance of the family can be modeled as a function $v=f(\theta,\hat{v})$, wherein $\hat{v}$ is a standard random variable and $\theta$ represents parameters that define the family [11].

In our framework, if $\theta\in\Theta$ for a set of possible parameters $\Theta$, we can incorporate our system into a set valued map of the form $x^{+}\in G(x,\hat{v})$, wherein,

[TABLE]

Note that the dynamics defined by the map $G$ is more general in that it can allow the actual distribution parameter $\theta$ to be time-varying rather than fixed. Modeling $\theta$ as a time invariant choice can be achieved if it were incorporated as a state variable in the system description.

2.4 Probabilistic Reachability and Safety

First, we define reaching a set within $k$ time steps.

Definition 10** (Reachability).**

A nonempty set $S\subseteq\mathcal{X}$ is said to be reachable within $k\geq 1$ steps from an initial state $x_{0}\in\mathcal{X}$ if there exists a solution of $\Sigma$ starting at $x_{0}$ that enters the set $S$ in at most $k$ steps.

Consider the system $\Sigma$ in (2). At each step in (3), we iterate between application of the map $G$ yielding a set $X_{i+1}$ and the choice of a state $x_{i+1}\in X_{i}$. This choice is made by an “adversary” whose goal, for the purposes of this paper, is to force the system to enter a designated set of states $S$.

We define a utility function for an adversary as $u(x)=\mathcal{I}_{S}(x)$, where $\mathcal{I}_{S}$ is the indicator function of $S$. In other words, at any state $x$, the adversary derives an utility of $1$ if $x\in S$ and [math] otherwise.

Single Step Reach Probability:

With this definition of utility, we can define the probability of reaching the set $S$ in one step starting from state $x$ as the expectation over the maximum possible utility for an adversary in the next step.

[TABLE]

The lemma below proves the existence of this probability for one-step reachability.

Lemma 11**.**

Given system $\Sigma$ described by (2) satisfying Assmpt. 4–5, let $h:\mathcal{X}\to\mathbb{R}_{\geq 0}$ be a upper semicontinuous function, then $\lambda(x,v):=\displaystyle\sup_{y\in G(x,v)}h(y)$ is measurable.

{pf}

See Appendix 40 for the proof.

As a result, the probability that a given set $S$ is reachable in one step is well-defined, since the expectation $\mathbb{E}\left[\displaystyle\sup_{y\in G(x,v_{0})}\mathcal{I}_{S}(y)\right]$, wherein the function $\mathcal{I}_{S}(y)$ is upper-semicontinuous. Furthermore, the adversary encounters a set $X_{1}=G(x,v_{0})$ and either chooses a state $x_{1}\in X_{1}\cap S$, or fails to do so if $X_{1}\cap S=\emptyset$.

$N$-step reachability:

We define the sequence of functions $\{\lambda_{k}^{S}\}$, which $\lambda_{k}^{S}:\mathcal{X}\times\mathcal{V}^{k}\to\mathbb{R}_{\geq 0}$ indicates the supremum of the indicator function at the step $k$.

[TABLE]

Notice that in the function $\lambda_{k+1}$ supremum is taking from all the regions that the solution to $\Sigma$ can reach at time step $k+1$ starting from $x$, as

[TABLE]

Lemma 12**.**

Consider the system $\Sigma$ described by (2) such that Assumptions 4–5 hold. Let $S\subset\mathcal{X}$ be a closed set. For each $k\in\mathbb{N}$ and for all $x\in\mathcal{X}$, the function $\lambda_{k+1}^{S}(x,v_{0},\ldots,v_{k})$, defined in (6), is measurable.

{pf}

See Appendix 41 for the proof.

Lemma 13**.**

Consider the system $\Sigma$ in (2) such that Assumptions 4–5 hold. Let $S\subset\mathcal{X}$ be a closed set, then the probability of reaching $S$ within $N$ time steps from $x\in\mathcal{X}$ can be bounded as

[TABLE]

{pf}

Using the equation (7), $\lambda_{k}$ is either $1$, or [math]. If there is possibility that a solution starting from $x$ reaches to the set $S$ at step $k$, $\lambda_{k}$ is one otherwise it is zero. Therefore, the probability of reaching the set $S$ within $N$ steps is given as

[TABLE]

Probabilistic safety is defined by bounding the probability of reaching the unsafe set starting from an initial set.

Definition 14**.**

(Probabilistic Safety) The system $\Sigma$ is safe within $N\in\overline{\mathbb{N}}$ time steps with probability $1-\rho$, wherein $\rho\in[0,1)$, with respect to the sets $(X_{o},X_{u})$, where $X_{o}\subseteq\mathcal{X}$ is the initial set and $X_{u}\subseteq\mathcal{X}$ is the unsafe set with $X_{o}\cap X_{u}=\emptyset$, if for any $x\in X_{o}$,

[TABLE]

3 Barrier Functions

In the previous section, we use the indicator function $\mathcal{I}_{S}$ to find a probability of reaching the set $S$. In certifying the safety we wish to bound the probability of reaching the unsafe set. Using indicator function, for bounding the probability of reaching the unsafe set by $\rho$ from $x$ within $N$ times step, we have the following condition

[TABLE]

In this section, we study the use of other nonnegative functions instead of the indicator function. Using such functions may provide better conditions than the one in (10), since we consider the unsafe set as a $\Delta$-superlevel set of these functions, where $\Delta>0$. Consequently, the right-hand side of the condition changes to $\rho\Delta$.

We show how to modify the indicator function using a Barrier function to obtain bounds on the probability of reaching an unsafe set. Consider a nonnegative upper semicontinuous function $B:\mathcal{X}\to\mathbb{R}_{\geq 0}$. The $\Delta$-sublevel set of $B$ for $\Delta\geq 0$ is defined as

[TABLE]

If $B$ is upper semicontinuous, then every sublevel set of $B$ is closed. Therefore, $K_{\Delta}$ is a closed set. Let $K_{\Delta}^{C}$ denote the set $\mathcal{X}\setminus K_{\Delta}$. The condition of one step reachability from $x$ to $K_{\Delta}^{C}$ in $\mathcal{X}$ is $G(x,v)\cap K_{\Delta}^{C}\neq\emptyset$ for a given $v\in\mathcal{V}$, and can be equivalently expressed as $\displaystyle\sup_{x^{+}\in G(x,v)}B(x^{+})>\Delta$.

Starting from $x\in\mathcal{X}$, the probability of reaching $K_{\Delta}^{C}$ in the next time step using the barrier function is given as

[TABLE]

Continuing with the equation (12), and using Markov inequality, we have

[TABLE]

As a result, the sufficient condition for reaching $K_{\Delta}^{C}$ starting from $x$ with probability less than $\rho$ is given as

[TABLE]

For computing the bound of probability of reaching a the set $K_{\Delta}^{C}$ within $N$ time steps, we define sequences of functions, as follows. Let $\lambda_{k}^{B}:\mathcal{X}\times\mathcal{V}^{k}\to\mathbb{R}_{\geq 0}$ be defined recursively as follows:

[TABLE]

By Assumption 4 that the set $G(x,v)$ for each $(x,v)$ is compact, then $\lambda_{k}$ is well-defined for each $k$.

Lemma 15**.**

Consider the system $\Sigma$ in (2) such that Assumptions 4–5 hold. Let $B:\mathcal{X}\to\mathbb{R}_{\geq 0}$ be a upper semicontinuous function with $\Delta$-sublevel set $K_{\Delta}$ is defined in (11). For any $k\in\mathbb{N}$, probability of reaching $K_{\Delta}^{C}$ starting from $x\in\mathcal{X}$ in exactly $k+1$th step is bounded from above by $\frac{1}{\Delta}\mathbb{E}[\lambda_{k+1}^{B}(x,v_{0},\ldots,v_{k})\mid x]$.

{pf}

Proof with Markov’s inequality.

We denote $\ell_{k+1}^{B}(x)=\mathbb{E}[\lambda_{k+1}^{B}(x,v_{0},\ldots,v_{k})\mid x]$.

Lemma 16**.**

Consider the system $\Sigma$ in (2) such that Assumptions 4–5 hold. Let $B:\mathcal{X}\to\mathbb{R}_{\geq 0}$ be a upper semicontinuous function with $\Delta$-sublevel set $K_{\Delta}$ is defined in (11). The following is a sufficient condition for reaching the set $K_{\Delta}^{C}=\mathcal{X}\setminus K_{\Delta}$ within $N$ steps with probability less than $\rho$ starting from $x\in K_{\Delta}$:

[TABLE]

{pf}

Suppose (16) holds. The probability of reaching the $K_{\Delta}^{C}:=\mathcal{X}\backslash K_{\Delta}$ within $N$ steps is bounded by Boole’s inequality by the sum of the probabilities of reaching in precisely $j$ steps for $j$ ranging from [math] to $N$. Trivially, since $x\in K_{\Delta}$, the probability of reaching $K_{\Delta}^{C}$ in [math] steps is [math]. Using Lemma 15, we obtain the upper bound $\frac{1}{\Delta}\sum_{i=1}^{N}\ell_{i}^{B}(x)\leq\frac{1}{\Delta}\Delta\rho\leq\rho$.

Example 17**.**

Consider the following system

[TABLE]

where $x\in\mathbb{R}_{\geq 0}$, and $v\sim\mathcal{U}[0,0.2]$. Let $B(x)=x$, then $\lambda_{0}^{B}(x)=x$, and

[TABLE]

Likewise, we can establish that

[TABLE]

Therefore, $\ell_{k}^{B}(x)=x+\displaystyle\sum_{j=0}^{k-1}\mathbb{E}[v_{j}]=x+k\mathbb{E}[v]$. Hence, $\displaystyle\sum_{i=1}^{N}\ell_{i}^{B}(x)=Nx+\displaystyle\sum_{i=1}^{N}i\mathbb{E}[v]=Nx+\frac{N(N+1)}{2}\mathbb{E}[v]$. Considering that $\mathbb{E}[v]=0.1$, we obtain that

[TABLE]

Consequently, by Lemma 16, choosing an initial state that satisfies

[TABLE]

s is sufficient to ensure that probability of reaching the set $\{x\in\mathbb{R}_{\geq 0}\mid x>\Delta\}$ within $N$ time steps is less than $\rho$. Thus, for $N=4$, $\rho=0.25$, and $\Delta=20$, the condition is $x\leq 1$.

Remark 18**.**

One of the key difficulties of working with a barrier function lies in that of computing $\ell_{k+1}^{B}$ for $i\in\mathbb{N}$. In theory, this requires us to compute a function $\lambda_{k+1}^{B}$ that involves the random choices $v_{0},\ldots,v_{k}$ and computing its expectation. In what follows, we present two key improvements: (a) In Section 4, we will show that when the barrier function $B$ is concave and the set valued map $G$ is convex, we can work with $\mathbb{E}(v_{i})$ rather than $v_{i}$ itself; (b) In Section 5, we will impose a super-martingale condition on $B$ that will allow us to obtain bounds for arbitrary time horizon $k$.

4 Concave Barrier Function

In this section, we consider barrier functions with extra concavity property. We show that we obtain better results for probabilistic safety.

Definition 19** (Convex Set-valued Map).**

A set-valued map $F$ is convex if its graph is convex. Therefore, $F$ is convex iff for each $x_{1},x_{2}\in\operatorname{dom}F$, and $\theta\in[0,1]$

[TABLE]

(See [2, Definition $2.5.1$ and Lemma $2.5.2$ ])

In the following lemma, we aim to show that if $B$ is a concave function, and $F$ is a convex set-valued map, then under specific conditions, the marginal function inherits the concavity of $B$.

Lemma 20**.**

Consider a convex set-valued map $F:\mathcal{X}\rightrightarrows\mathcal{X}$ such that $F$ is upper semicontinuous and $F(x)$ for each $x$ is compact. Let $B:\mathcal{X}\rightarrow\mathbb{R}_{\geq 0}$ be a nonnegative concave upper semicontinuous function. Suppose the function $f:\mathcal{X}\to\mathbb{R}_{\geq 0}$ is defined as

[TABLE]

Then, the following conditions hold:

1. C20.1

$f$* is well-defined, nonnegative and upper semicontinuous.* 2. C20.2

$f$* is concave.*

{pf}

To prove C20.1, since $F(x)$ is compact for each $x\in\mathcal{X}$, the function $f$ is well-defined. As $f$ is defined by taking maximum of nonnegative function $B$ in a compact set, $f$ is itself nonnegative. Considering that $F$ is upper semicontinuous and has compact values, and the fact that $B$ is also upper semicontinuous, Proposition $2.9$ [10] implies that $f$ is upper semicontinuous.

To prove C20.2, let $x_{1},x_{2}\in\mathcal{X}$, and $\lambda\in[0,1]$, then with the assumption that $F$ is convex set-valued map, we have

[TABLE]

In our setting, we are interested on concavity of $\lambda_{i+1}^{B}$ defined in Eq. (15) with respect to random variable $v$. However, even though for concavity $\lambda_{1}^{B}$, it requires that $G$ be convex set-valued with respect to $v$, but for concavity of $\lambda_{i+1}^{B}$ for $i\geq 1$, the convexity of $G$ with respect to both $x$ and $v$ is required.

Assumption 21**.**

$G$* is convex set-valued map.*

The lemma below shows that if $B$ is concave, under Assumption 21, the functions $\lambda^{B}$ are also concave.

Lemma 22**.**

Consider system $\Sigma$ in (2) such that Assumptions 4, 5, and 21 hold. Let $B:\mathcal{X}\rightarrow\mathbb{R}_{\geq 0}$ be a concave upper semicontinuous function, and let $\lambda^{B}$ be functions defined in Eq. (15). Then, $\lambda_{k}^{B}$ is concave for each $k\geq 0$.

{pf}

Using Assumption 21, and by Lemma 20 we have that $\lambda_{1}^{B}$ is concave. For $i\geq 1$, we assume that $\lambda_{i}^{B}$ is concave, and prove that $\lambda_{i+1}^{B}$ is concave by Lemma 20.

The next lemma illustrates the condition for $N$-step reachability of $K_{\Delta}^{C}$ when the barrier function is concave.

Lemma 23**.**

Consider system $\Sigma$ in (2) such that Assumptions 4, 5, and 21 hold. Let $B:\mathcal{X}\rightarrow\mathbb{R}_{\geq 0}$ be a concave upper semicontinuous function, with $\Delta$-sublevel set $K_{\Delta}$. Let $\lambda^{B}$ be as defined in  (15). Then, the set $K_{\Delta}^{C}$ is reachable within $N$-step from $x\in K_{\Delta}$ with probability less than $\rho$, if

[TABLE]

Remark 24**.**

When there exists $j\in[1,N]$ such that

[TABLE]

using Lemma 23, we have that

[TABLE]

Therefore, the condition (21) simplifies to

[TABLE]

Example 25**.**

Consider Example 17. The set-valued map dynamic is convex with respect to $v$, and the barrier function $B(x)=x$ is linear, thus concave. We have $\lambda_{0}=x$, and $\lambda_{1}(x,v_{0})=\sup[x-v_{0},x+v_{0}]=x+v_{0}$. Also,

[TABLE]

Since $v_{k}$ is nonnegative, we have,

[TABLE]

Using $\mathbb{E}[v_{i}]=0.1$ for each $i\geq 0$, we obtain that

[TABLE]

Then, using Lemma 23, a sufficient initial condition for the probability of reaching the set $\{x\in\mathbb{R}_{\geq 0}\mid x>\Delta\}$ within $N$ time steps is less than $\rho$ is given as $x\leq\rho\Delta-\frac{N}{10}$. Thus, for $N=4$, $\rho=0.25$, and $\Delta=20$, the condition is $x\leq 4.6$.

Remark 26**.**

Let $w:=(\phi_{1}(v),\cdots,\phi_{r}(v))$, and suppose that the map $G(x,v)$ can be written as $\hat{G}(x,w)$, and is a convex set-valued map over $w$, then the function $\lambda_{k}^{B}$s are still concave with respect to $w$ provided that $B$ is a concave function. This allows us to improve the applicability of Lemma 23 by considering “higher moments” of the random variables.

Example 27**.**

Consider the following dynamics

[TABLE]

We can define $\zeta:=\begin{pmatrix}v\\ w\end{pmatrix}$, where $w=v^{2}$. Then, replacing $v$ with $\zeta$, we have $G(x,\zeta)=[x+v-w,x+v+w]$, which is convex with respect to $\zeta$. Let $B(x)=x$. Then, we have

[TABLE]

Therefore,

[TABLE]

Then, since $v\sim\mathcal{U}[0,0.2]$, we have that $\mathbb{E}[v_{i}]=0.1$ for each $i\geq 0$, also $\mathbb{E}[w_{i}]=\mathbb{E}[v_{i}^{2}]=\frac{1}{75}$. Therefore,

[TABLE]

Then, using Lemma 23, a sufficient condition for bounding the probability of reaching the set $\{x\in\mathbb{R}_{\geq 0}\mid x>\Delta\}$ within $N$ time steps is less than $\rho$ is given as $x\leq\rho\Delta-\frac{17N}{150}$. Thus, for $N=4$, $\rho=0.25$, and $\Delta=20$, the condition is $x\leq 4.547$.

In the next section, we analyze the safety properties when the barrier function satisfies the supermartingale condition.

5 Concave Supermartingale Barrier Functions

A stochastic process is called a supermartingale if its expected value is nonincreasing with respect to the time. Here, we define the supermartingale barrier function for the system $\Sigma$ in (2).

Definition 28** (Barrier Function Candidate).**

A nonnegative upper semicontinuous function $B:\mathcal{X}\to\mathbb{R}_{\geq 0}$ is said to be a barrier function candidate with respect to initial and unsafe sets $(X_{o},X_{u})$, if

[TABLE]

where $\Delta>\delta\geq 0$.

Definition 29** (Supermartingale Barrier Function).**

Given the system $\Sigma$ in (2), a barrier function candidate $B:\mathcal{X}\to\mathbb{R}_{\geq 0}$ is called supermartingale if for each $x\in\mathcal{X}\backslash X_{u}$

[TABLE]

To ensure safety for an unbounded time horizon, we seek a bound for the expectation of $\lambda_{k+1}^{B}$ functions. Since there is supremum function in defining $\lambda_{k+1}^{B}$ with respect to $\lambda_{k}$, we cannot extend bound of supermartingale to $\lambda_{k+1}^{B}$ for $k\geq 1$. However, when $\lambda_{k+1}^{B}$ is concave, the supermartingale condition can be extended.

The following results, we specify the condition of safety when $B$ is concave and the set-valued map is convex (see Definition 19).

Lemma 30**.**

Consider system $\Sigma$ in (2) such that Assumptions 4, 5, and 21 hold. Let $B:\mathcal{X}\to\mathbb{R}_{\geq 0}$ be a concave barrier function such that for each $x\in\mathcal{X}\backslash X_{u}$, we have

[TABLE]

Then, $B$ is a supermartingale barrier function.

{pf}

The function $B$ is a concave function, and using Assumption 21, $G$ is convex, therefore Lemma 20 implies that $\lambda_{1}^{B}(x,v):=\displaystyle\sup_{x^{+}\in G(x,v)}B(x^{+})$ is concave function. Therefore, we have $\mathbb{E}[\lambda_{1}^{B}(x,v)\mid x]\leq\lambda_{1}^{B}(x,\mathbb{E}[v])$. Using the condition (25), we obtain that $\lambda_{1}^{B}(x,\mathbb{E}[v])\leq B(x)$. Consequently, we conclude that $\mathbb{E}[\sup_{x^{+}\in G(x,v)}B(x^{+})\mid x]\leq B(x)$.

Lemma 31**.**

Consider system $\Sigma$ in (2) such that Assumptions 4, 5, and 21 hold. Let $B$ be a concave barrier function such that the condition (25) is satisfied. Then, for $k\geq 0$ and $x\in\mathcal{X}\backslash X_{u}$, we have

[TABLE]

{pf}

By induction. For $k=0$ it is trivial. For $k=1$, it holds since it is the same condition as (25). Next, suppose the condition holds for $k$ and we show that it holds for $k+1$. Using concavity of $\lambda_{i}^{B}$, we have

[TABLE]

Definition 32** (Supermartingale).**

Given a probability space $(\Omega,\mathcal{F},\mathbb{P})$, the stochastic process $\{X_{t}\}_{t}$ is called a supermartingale with respect to a filtration $\mathcal{M}=\{\mathcal{M}_{t}\}_{t}$ iff the following conditions hold:

• •

$X_{t}$* is $\mathcal{M}_{t}$-measurable for all $t$,*

• •

$\mathbb{E}[|X_{t}|]<\infty$* for all $t$,*

• •

$\mathbb{E}[X_{t}\mid\mathcal{M}_{s}]\leq X_{s}$* for all $t,s$, $t\geq s$ .*

Let $Z_{k}^{x}=\lambda_{k}^{B}(x,v_{0},\cdots,v_{k-1})$. In the following lemma, we show that $\{Z_{k}\}$ has supermartingale property.

Lemma 33**.**

Consider system $\Sigma$ in (2) such that Assumptions 4, 5, and 21 hold. Let $B$ be a concave barrier function such that the condition (25) is satisfied. Then, for $k\geq 0$ and $x\in\mathcal{X}\backslash X_{u}$, the sequence $\{Z_{k}^{x}\}$, where $Z_{k}^{x}=\lambda_{k}^{B}(x,v_{0},\cdots,v_{k-1})$ is supermartingale.

{pf}

Let $k\geq j$. We have that

[TABLE]

Remark 34**.**

Using [16, Definition $10.1.2$] and Lemma 31, we can conclude that $\{\lambda_{k}^{B}\}$ are called supermeanvalued with respect to $v$. Also, [16, page $216$] indicates that the sequence is a supermartingale.

Theorem 35**.**

Consider system $\Sigma$ in (2) such that Assumptions 4, 5, and 21 hold. Let $B$ be a concave nonnegative barrier function candidate with respect to $(X_{0},X_{u})$ such that the condition (25) is satisfied. Then, the probability of reaching $X_{u}$ starting from $X_{0}$ is less than $\frac{\delta}{\Delta}$.

{pf}

Let $N\in\overline{\mathbb{N}}$, and $x_{0}\in X_{0}$. The probability that the solution to the system $\Sigma$ hits the unsafe set $X_{u}$ in less than $N$ time steps is given by

[TABLE]

Next, Lemma 33 implies that $\{\lambda_{k}^{B}\}$ is a supermartingale. Therefore, using supermartingale inequality, and Lemma 22 we have

[TABLE]

Therefore, the probability of reaching $X_{u}$ from $X_{0}$ is less than $\displaystyle\sup_{x_{0}\in X_{0}}\frac{1}{\Delta}B(x_{0})=\frac{\delta}{\Delta}$.

6 Numerical Examples

We illustrate the results with some examples.

Example 36**.**

Consider the following system

[TABLE]

where $A_{1},A_{2}\in\mathbb{R}^{n\times n}$ and $b\in\mathbb{R}^{n}$, with $v$ denoting the random variable. The sate space is denoted by $\mathcal{X}\subseteq\mathbb{R}^{n}$, and the unsafe set is given by $X_{u}\subseteq\mathcal{X}$. We consider a linear barrier function $B(x)=c_{0}+c^{\top}x$, defined over $\mathcal{X}$. Since $B$ is linear, it is also concave. The system dynamic is linear with respect to $(x,v)$, so it is convex. Let $\tilde{A}(\gamma):=\gamma A_{1}+(1-\gamma)A_{2}$, then we have

[TABLE]

[TABLE]

Suppose $X_{u}$ is subset of $\Delta$-superlevel set of $B$:

[TABLE]

then the following condition specifies the safety of $x$ for $N$ time step with probability $1-\rho$:

[TABLE]

Furthermore, the concave supermartingale condition is given as

[TABLE]

Since the objective function in the optimization (29) is linear with respect to $\gamma$, so the optimal value is in the boundary of set $[0,1]$. Then, the supermartingale condition reduces to the following for $x\in\mathcal{X}\backslash X_{u}$

[TABLE]

Hence, if the supermartingale condition in (30) holds, every initial set equals to $\delta$-sublevel set of $B$, where $\delta\leq\Delta$, is safe with probability of $1-\frac{\delta}{\Delta}$.

Suppose $A_{1}=\begin{pmatrix}-0.2&1\\ 0&0.3\end{pmatrix}$ $A_{1}=\begin{pmatrix}0.1&-1\\ 0&1\end{pmatrix}$, $b=\begin{pmatrix}0.1\\ -0.1\end{pmatrix}$, and let $\mathcal{X}=[0,5]^{2}$, $X_{u}=\{x\in\mathcal{X}\mid x_{2}\geq 3\}$. Suppose $v\sim\mathcal{U}[1,2]$. Then, considering $B(x)=x_{2}$, we have that

[TABLE]

Since the above optimization is linear in $\gamma_{0}$, therefore, the answer is either when $\gamma_{0}=0$ or $\gamma_{0}=1$. Thus,

[TABLE]

Then, we have $\lambda_{1}(x,\mathbb{E}[v_{0}])=-0.15+x_{2}$ for $x\in\mathcal{X}$. Since $\lambda_{1}(x,\mathbb{E}[v_{0}])=-0.15+x_{2}\leq B(x)=x_{2}$ for $x\in\mathcal{X}$, therefore, $B$ is a supermartingale for the system. Since $B(x)\geq 3$ for $x\in X_{u}$, then the probability of safety each for $\delta$-sublevel set of $B$, i.e, $X_{0}=\{x\in\mathcal{X}\mid x_{2}\leq\delta\}$, is given as $1-\frac{\delta}{3}$. Figure 1 shows $200$ trajectories for $N=30$ from randomly generated initial points in $X_{0}=[0,5]\times[0,1]$ to the system (36).

Example 37**.**

Consider the following dynamics

[TABLE]

where $X\in S^{n}_{++}$ is the state, $U$ is a unitary matrix, $M(\gamma)\in S^{n}$ is a linear matrix-valued map with respect to $\gamma$. $v$ is a random variable.

Suppose $\mathcal{X}=S^{n}_{++}$, and the unsafe is defined as $X_{u}=\{X\in\mathcal{X}\mid\operatorname{tr}(X)\geq\Delta\}$. Let $B(x)=\operatorname{tr}(X)$, then $B$ is positive on $\mathcal{X}$. Since the dynamics are linear with respect to $X$ and $v$, so it is convex. Also, the barrier function $B$ is linear so it is concave. Then, we have

[TABLE]

Also, $\lambda_{i}$ is given as

[TABLE]

The condition specifies safety of $X$ for $N$ time step with probability $1-\rho$ is given as

[TABLE]

Suppose that $M(\gamma)=\gamma A_{1}+(1-\gamma)A_{2}$, where $A_{1}=\begin{bmatrix}1&0.5\\ 0.5&1\end{bmatrix}$ and $A_{2}=\begin{bmatrix}0&-1\\ -1&0\end{bmatrix}$, and $\gamma\in[0,1]$. The unitary matrix $U$ is expressed as a rotation by $\theta=\frac{\pi}{4}$, and $v\sim\mathcal{U}[-0.2,0.2]$. Let $\Delta=1.2$, and $\delta=0.5$.

Therefore, $\operatorname{tr}(M(\gamma_{j}))=2\gamma_{j}$, and we have

[TABLE]

As a result

[TABLE]

Then, the condition that specifies safety of $X$ for $N$ time step with probability $1-\rho$ is given

[TABLE]

Therefore,

[TABLE]

Hence, the condition is $\operatorname{tr}(X)\leq\rho\Delta$.

Furthermore, the supermartingale condition, namely,

[TABLE]

holds on $\mathcal{X}$ if

[TABLE]

Then, every initial set that is given as a $\delta$-sublevel set of $B$, where $\delta\leq\Delta$, is safe with probability of $1-\frac{\delta}{\Delta}$.

Figure 2 shows trace trajectories of $200$ randomly generated initial $X$ from $\operatorname{tr}(X_{0})<0.3$ for $N=30$. Since $E[v]=0$, then the barrier function $B$ is concave supermartingale, and the probability of reaching unsafe set, $\mathrm{trace}(X_{t})>1.2$, is given by $1-\frac{0.3}{1.2}=0.25$. Figure 2 simulates $200$ trajectories. We note that $12$ of these trajectories have entered the unsafe region.

7 Conclusion

In this work, we study the safety of stochastic difference inclusion systems through the use of barrier functions. The key contribution lies in a framework that allows for the easier verification of barrier functions by the use of concave barrier functions and convex set-valued maps for bounding probabilities of reaching unsafe sets over unbounded time horizons. In the future, we wish to study the application of these notions for other properties including stability and set-valued maps arising from problems with unknown distribution families defined by notions such as the Wasserstein metric.

Appendix A Measurability

Here, we present some useful theorems on the measurability of compositions of set-valued maps from [22] and provide the proofs of Lemmas 7 and 11.

A.1 Measurability of Set-valued Map

Theorem 38** (Composition of Mappings).**

[22, Theorem 14.13(b)]** Let $S:T\rightrightarrows\mathbb{R}^{n}$ be a closed-valued and measurable set-valued map, and for each $t\in T$ consider an outer semicontinuous mapping $M(t,\cdot):\mathbb{R}^{n}\rightrightarrows\mathbb{R}^{m}$. Suppose the graphical mapping $t\mapsto\operatorname{gph}M(t,\cdot)\subset\mathbb{R}^{n}\times\mathbb{R}^{m}$ is measurable. Then the mapping $t\mapsto M(t,S(t))$ is measurable.

Corollary 39** (Composition with Functions).**

[22, Corollary $14.14$]** For each $t\in T$, consider an outer semicontinuous mapping $M(t,\cdot):\mathbb{R}^{n}\rightrightarrows\mathbb{R}^{m}$, and suppose the graphical mapping $t\mapsto\operatorname{gph}M(t,\cdot)\subset\mathbb{R}^{n}\times\mathbb{R}^{m}$ is measurable. Then, whenever $t\mapsto x(t)$ is measurable, the mapping $t\mapsto M(t,x(t))$ is closed-valued and measurable.

{pf}

[Proof of Lemma 7] Under Assumption 4, the map $G$ is upper semicontinuous with respect to $(x,u)$ and has closed values. This implies that $G$ is also outer semicontinuous with respect to $x$. For $k=0$, under Assumption 4, [22, Corollary $14.14$] implies that $G(x,v_{0})$ is measurable and closed. Suppose this is valued for $k$, we show it for $k+1$. Let $H_{k}:=G(\cdots(G(G(x,v_{0}),v_{1}),v_{2}),\cdots),v_{k})$, then $H_{k+1}=G(H_{k},v_{k+1})$. Since $H_{k}$ is measurable ans closed, Theorem 38 implies that $H_{k+1}$ is measurable. Also, the graph of $G$ is closed for every closed domain (see [3, Proposition 1.4.8]), hence $H_{k+1}$ is closed.

A.2 Normal Integrand and Measurability Marginal Function

Definition 40** (normal integrands).**

[22, Definition $14.27$]** A function $f:T\times\mathbb{R}^{n}\to\bar{\mathbb{R}}$ is called a normal integrand if its epigraphical mapping $S_{f}:T\to\mathbb{R}^{n}\times\mathbb{R}$ is closed-valued and measurable, where $S_{f}(t):=\{(x,\alpha)\mathbb{R}^{n}\times\mathbb{R}\mid f(t,x)\leq\alpha\}.$

{pf}

[Proof of Lemma 11] Using $\delta_{C}(x):=\begin{dcases}0&x\in C\\ -\infty&\text{otherwise}\end{dcases}$, the function $\lambda$ can be written as $\lambda(x,v):=\displaystyle\sup_{y\in G(x,v)}h(y)=\displaystyle\sup_{y}\{h(y)+\delta_{G(x,v)}(y)\}$. Let $\bar{\lambda}(x,v):=-\lambda(x,v)=\inf_{y}\{-h(y)-\delta_{G(x,v)}(y)\}$. Since $h$ is upper semicontinuous, then $-h$ is lower semicontinuous, then [22, Example $14.31$] implies that $-h$ is a normal integrand. Next, since Lemma 7 implies that $G(x,v)$ is measurable, then [22, Example $14.32$] implies that $-\delta_{G(x,v)}(y)=\begin{dcases}0&x\in G(x,v)\\ \infty&\text{otherwise}\end{dcases}$ is normal integrand. Since the summation of normal integrands is normal integrand, [22, Proposition $14.44(c)$], $f(x,v,y)=-h(y)-\delta_{G(x,v)}(y)$ is normal integrand. Since $h$ is upper semicontinuous, and $G$ is also upper semicontinuous with compact values, [10, Proposition $2.9$] implies that $\lambda$ is upper semicontinuous with respect to $x$. Then, $\bar{\lambda}(x,v)$ is lower semicontinuous with respect to $x$. As a result, [22, Proposition $14.47$] implies that $\bar{\lambda}$ is normal integrand. Therefore, it is measurable [22, Proposition $14.34$]. Consequently, $\lambda$ is measurable. Moreover, since $h$ is nonnegative, $\lambda$ is nonnegative. Therefore $I_{\lambda}[x]$ is well-defined in $[0,+\infty]$ for each $x\in\mathcal{X}$.

A.3 Measurability of $\lambda_{k+1}$

Consider the set valued map $G:\mathcal{X}\rightrightarrows\mathbb{R}^{n}$. For finite $N\in\mathbb{N}$, let $F_{N}:\mathcal{X}\rightrightarrows\mathbb{R}^{n}$ be a set-valued map which is defined as

[TABLE]

Lemma 41**.**

Let $G:\mathcal{X}\rightrightarrows\mathbb{R}^{n}$ be a upper semicontinuous map which is locally bounded with closed values. For finite $N\in\mathbb{N}$, consider the set-valued map $F_{N}:\mathcal{X}\rightrightarrows\mathbb{R}^{n}$ in (34). The map $F$ is upper semicontinuous map with compact values.

{pf}

Using [22, Proposition $5.52$ (b)], we conclude that $F_{N}$ is upper semicontinuous. Since $G$ has compact values, then using [10, Proposition $2.6$], for every compact set $K\subset\mathcal{X}$, $G(K)$ is compact. Therefore, $F_{N}(x)$ is compact.

{pf}[Proof of Lemma 12] Using that indicator function is upper semicontinuous for a closed set $S$, Lemma 11 implies that $\lambda_{1}$ is measurable. We can formulate the function $\lambda_{k+1}$ as

[TABLE]

Let $H(x,v_{0},\cdots,v_{k}):=G(\cdots(G(x,v_{0}),v1),\cdots,v_{k})$. Using Lemma 41, we conclude that $H$ is upper semicontinuous with respect to $x$. Also, Lemma 7 implies that $H$ is measurable with closed values. Therefore, Lemma 11 implies that $\lambda_{k+1}$ for $k\in\mathbb{N}$ is measurable.