# Safe Control Synthesis via Input Constrained Control Barrier Functions

Devansh R. Agrawal and Dimitra Panagou The authors would like to acknowledge
the support of the National Science Foundation under award number 1942907.Both
authors are with the Department of Aerospace Engineering, University of
Michigan, Ann Arbor, MI, USA; {devansh<EMAIL_ADDRESS>
###### Abstract

This paper introduces the notion of an Input Constrained Control Barrier
Function (ICCBF), as a method to synthesize safety-critical controllers for
non-linear control affine systems with input constraints. The method
identifies a subset of the safe set of states, and constructs a controller to
render the subset forward invariant. The feedback controller is represented as
the solution to a quadratic program, which can be solved efficiently for real-
time implementation. Furthermore, we show that ICCBFs are a generalization of
Higher Order Control Barrier Functions, and thus are applicable to systems of
non-uniform relative degree. Simulation results are presented for the adaptive
cruise control problem, and a spacecraft rendezvous problem.

##  I Introduction

Many cyber-physical systems are safety critical, that is, they require
guarantees that safety constraints are not violated during operation. Safety
is often modeled by defining a safe subset of the state space for a given
system, within which the state trajectories must always evolve. Recently, set-
theoretic methods, such as Control Barrier Functions (CBFs) have become
increasingly popular as a means of constructing and verifying such controllers
[1, 2, 3, 4].

Quadratic Programs (QPs) enforcing CBF conditions have become popular for
synthesizing low-level controllers to ensure that system trajectories remain
within the safe set. These QPs can be solved in real-time at the current
state, enabling safety-critical controllers for a wide range of non-linear
systems to be computed efficiently during operation.

Prior work on CBFs has largely focused on systems where a sufficiently large
control authority is available to ensure forward invariance of the safe set.
However in the presence of input constraints, only a subset of the safe set
may be rendered forward invariant. A few methods have been proposed to compute
such subsets of the safe set. These include reachability analysis by solving a
Hamilton-Jacobi partial differential equations over the state-space [5, 3] and
Sum-of-Squares (SOS) based semi-definite programs, which employ the
positivstellensatz theorem to provide a certificate of safety [6, 7]. Both
methods scale poorly with the dimension of the state-space, and SOS methods
assume the dynamics and safety constraints can be expressed as polynomials.
Some methods have also been proposed for dynamical systems of specific
classes, for instance Euler-Lagrange systems [8].

In this paper, we introduce the notion of an Input Constrained Control Barrier
Function (ICCBF). An ICCBF guarantees that an input constrained controller can
render a subset of the safe set forward invariant. We present the construction
of these functions, and define the subset of the safe set, and a corresponding
controller, such that the subset is guaranteed to be forward invariant under
this controller. Furthermore, we show that ICCBFs represent a generalization
of Higher Order CBFs (HOCBFs) [9], enabling synthesis of input-constrained
controllers for safe sets of higher, and non-uniform relative degree. Finally,
the method is applied to an adaptive cruise control problem [10], and a
spacecraft rendezvous problem, demonstrating that ICCBFs define a safe
controller that respects input constraints.

The paper is structured as follows: In Section 2, some preliminaries on set
invariance, as well as the problem statement are presented. Section 3 presents
the definition of ICCBFs, and the synthesis of corresponding feedback
controllers for ensuring safety. Finally, simulation results are presented in
section 4.

##  II Problem Formulation and Preliminaries

###  II-A Notation

We denote the set of real numbers $\mathbb{R}$ and non-negative reals
$\mathbb{R}_{+}$. A continuous function $\alpha:[0,a)\rightarrow[0,\infty)$ is
class-$\mathcal{K}$ if it is strictly increasing on the domain, and
$\alpha(0)=0$. It is class-$\mathcal{K}_{\infty}$ if $a=\infty$ and
$\lim_{r\rightarrow\infty}\alpha(r)=\infty$. A continuous function
$\alpha:(-b,a)\rightarrow(-\infty,\infty)$ is an extended class-$\mathcal{K}$
function, if for some $a,b>0$, if it is strictly increasing and $\alpha(0)=0$.
The Lie derivative of $h(x)$ along $f(x)$ is denoted
$L_{f}h(x)=\frac{dh}{dx}f(x)$. The short hand
$\dot{h}(x)=\frac{dh}{dx}\dot{x}$ will also be used to indicate time
derivatives of $h$ along flows from a state $x$. We denote
$\text{Int}(\mathcal{C})$ and $\partial\mathcal{C}$ as the interior and
boundary of a set $\mathcal{C}$. The empty set is denoted $\emptyset$.

###  II-B Problem Setup

Consider a nonlinear, control-affine dynamical system, with state
$x\in\mathcal{X}\subset\mathbb{R}^{n}$ and control input
$u\in\mathcal{U}\subset\mathbb{R}^{m}$ given as

$\displaystyle\dot{x}=f(x)+g(x)u$ (1)

where $f:\mathcal{X}\rightarrow\mathbb{R}^{n}$,
$g:\mathcal{X}\rightarrow\mathbb{R}^{n\times m}$ are sufficiently smooth, as
discussed in III-B. We will assume these functions are known, and the system
state is available to the controller.

We define a state $x$ as _safe_ if it lies in a set $\mathcal{S}$, which is
defined as the 0-superlevel set of a continuously differentiable function
$h:\mathcal{X}\rightarrow\mathbb{R}$, as follows:

$\displaystyle\mathcal{S}$ $\displaystyle\triangleq\\{x\in\mathcal{X}:h(x)\geq
0\\}$ (2) $\displaystyle\partial\mathcal{S}$
$\displaystyle\triangleq\\{x\in\mathcal{X}:h(x)=0\\}$ (3)
$\displaystyle\text{Int}(\mathcal{S})$
$\displaystyle\triangleq\\{x\in\mathcal{X}:h(x)>0\\}$ (4)

The set $\mathcal{S}$ is referred to as the _safe_ set. We will assume this
set is closed, non-empty and is simply connected.

######  Definition 1.

Under a control input $u\in\mathcal{U}$, the set $\mathcal{S}$ is _forward
invariant_ for the closed-loop system (1) if for all $x(0)\in\mathcal{S}$, it
holds that $x(t)\in\mathcal{S}$ for all $t\geq 0$.

Under input constraints, however, it may be impossible to render the safe set
forward invariant, as in Example 1:

######  Example 1.

Consider the unstable single-input, scalar dynamical system with input
constraints:

$\displaystyle\dot{x}=x+u,\quad u\in\mathcal{U}=[-1,1]$

Let the safety set be

$\displaystyle\mathcal{S}=\\{x\in\mathbb{R}:x\leq 2\\},\quad h(x)=2-x$

Now consider the boundary state $x=2$. In this case,

$\displaystyle\dot{h}(x,u)=-2-u\leq-1$

and therefore under any $u\in\mathcal{U}$, closed-loop trajectories will leave
safe set. Thus $\mathcal{S}$ cannot be rendered forward invariant under the
input constraints. $\triangle$

To address the problem when the safe set cannot be rendered forward invariant,
we define an _inner safe set_ as follows:

######  Definition 2.

A non-empty closed set $\mathcal{C}^{*}$ is an _inner safe set_ of the safe
set $\mathcal{S}$ for the dynamical system (1), if
$\mathcal{C}^{*}\subseteq\mathcal{S}$ and there exists a feedback controller
$u:\mathcal{C}^{*}\rightarrow\mathcal{U}$ such that for the closed-loop system
(1), for all $x(0)\in\mathcal{C}^{*}$, it holds that $x(t)\in\mathcal{C}^{*}$
for all $t\geq 0$.

Now, we can state the main objective of this paper:

######  Problem 1.

Given the system (1), find a closed set $\mathcal{C}^{*}\subseteq\mathcal{S}$
and a feedback controller $u:\mathcal{C}^{*}\rightarrow\mathcal{U}$, such that
for any $x(0)\in\mathcal{C}^{*}$, the closed-loop trajectories of (1) satisfy
$x(t)\in\mathcal{C}^{*}$ for all $t\geq 0$.

In words, the objective is to find a subset of the safe set, and a
corresponding feedback controller that renders the subset forward invariant.

###  II-C Set Invariance

Nagumo’s theorem provides a necessary and sufficient condition for the forward
invariance of a set $\mathcal{S}$.

######  Lemma 1.

_[11, Thm. 3.1]_ Consider the system $\dot{x}=f(x)$, and assume that for each
initial condition $x\in\mathcal{X}$, it admits a globally unique solution.
Then, a closed set $\mathcal{S}\subseteq\mathcal{X}$ is forward invariant for
the system, if and only if

$f(x)\in\hat{T}_{\mathcal{S}}(x)\text{$\forall x\in\partial\mathcal{S}$},$ (5)

where $\hat{T}_{\mathcal{S}}(x)$ is the tangent cone of $\mathcal{S}$ at $x$.

In this work, since $\mathcal{S}$ is defined by $h(x)\geq 0$, Nagumo’s theorem
simplifies to the following statement.

######  Lemma 2.

Consider the system (1). Let the set $\mathcal{S}$ be defined by a
continuously differentiable function $h:\mathcal{X}\rightarrow\mathbb{R}$, as
per (2-4). Consider a controller $u:\mathcal{S}\rightarrow\mathcal{U}$, such
that for any initial condition $x\in\mathcal{S}$, the closed-loop system (1)
admits a globally unique solution. Then set $\mathcal{S}$ is forward invariant
if and only if

$L_{f}h(x)+L_{g}h(x)u(x)\geq 0\text{$\forall x\in\partial\mathcal{S}$}.$ (6)

If $h$ is a Zeroing Control Barrier Function (ZCBF), a controller that renders
$\mathcal{S}$ forward invariant is guaranteed to exist [2, 1]. The focus of
this paper is on scenarios where $h$ is not a ZCBF. In the following section,
we propose Input Constrained Control Barrier Functions (ICCBFs) to address
these cases.

##  III Input Constrained Control Barrier Functions

In this section we define Input Constrained Control Barrier Functions
(ICCBFs). A brief motivation for the construction is provided, followed by the
formal definitions. Finally a method to find ICCBFs is proposed.

###  III-A Motivation

Figure 1: Visual representation of ICCBF method. The safe set $\mathcal{S}$
and two intermediate sets $\mathcal{C}_{1}$ and $\mathcal{C}_{2}$ are drawn.
The final inner safe set $\mathcal{C}^{*}$ is the intersection of each of
these sets, and can be rendered forward invariant.

Suppose the safe set $\mathcal{S}$ associated with $h$ cannot be rendered
forward invariant by any controller $u\in\mathcal{U}$. Then we define a
function $b_{1}:\mathcal{X}\rightarrow\mathbb{R}$ and a set $\mathcal{C}_{1}$
(visualised in Figure 1) as follows

$\displaystyle b_{1}(x)$
$\displaystyle=\inf_{u\in\mathcal{U}}[\dot{h}(x,u)+\alpha_{0}(h(x))]$ (7)
$\displaystyle\mathcal{C}_{1}$ $\displaystyle=\\{x\in\mathcal{X}:b_{1}(x)\geq
0\\}$ (8)

where $\alpha_{0}$ is some user specified extended class-$\mathcal{K}$
function and the shorthand $\dot{h}(x,u)=L_{f}h(x)+L_{g}h(x)u$ is used. Notice
that since an infimum over $\mathcal{U}$ is taken, $b_{1}$ is only dependent
on the state $x$, and not the input $u$.

The set $\mathcal{C}_{1}$ has a useful property: Suppose there exists a point
$x\in\mathcal{X}$ such that $x\in\partial\mathcal{S}$ and
$x\in\mathcal{C}_{1}$, i.e., $h(x)=0$ and $b_{1}(x)\geq 0$. Then, from (7) it
follows, $\inf_{u\in\mathcal{U}}[\dot{h}]\geq 0$, and therefore $\dot{h}\geq
0$ _for any_ $u\in\mathcal{U}$, i.e.,

$\displaystyle
x\in\partial\mathcal{S}\cap\mathcal{C}_{1}\implies\dot{h}(x,u)\geq 0,\forall
u\in\mathcal{U}.$ (9)

Thus the closed-loop vector field $f(x)+g(x)u$ lies in the tangent cone of
$\mathcal{S}$ at $x$, i.e., no closed-loop trajectory can leave $\mathcal{S}$
through such an $x$.

Now suppose there exists a Lipschitz continuous controller $u\in\mathcal{U}$
such that $\mathcal{C}_{1}$ is forward invariant. Then the set
$\mathcal{S}\cap\mathcal{C}_{1}$ is also forward invariant: Consider an
initial condition $x(0)\in\mathcal{S}\cap\mathcal{C}_{1}$. Suppose there
exists a $t>0$ where $h(x(t))<0$. By continuity, there must be some
$\tau\in[0,t)$ where $h(x(\tau))=0$ and $\dot{h}(x(\tau),u)<0$. However, since
the controller renders $\mathcal{C}_{1}$ forward invariant, we have
$x(\tau)\in\partial S$ and $x(\tau)\in\mathcal{C}_{1}$. By (9),
$\dot{h}(x(\tau),u)\geq 0$, which is a contradiction. Therefore, trajectories
cannot reach a state $x\not\in\mathcal{S}$.

To summarise, in systems where $\mathcal{S}$ cannot be rendered forward
invariant, the subset set ${\mathcal{S}\cap\mathcal{C}_{1}}$ is forward
invariant under any controller that renders $\mathcal{C}_{1}$ forward
invariant.

In defining $b_{1}$, we allowed the user to specify the extended
class-$\mathcal{K}$ function $\alpha_{0}$. However not all class-$\mathcal{K}$
functions will admit a controller that renders $\mathcal{C}_{1}$ forward
invariant. Either a different class-$\mathcal{K}$ function could be used, or
we can repeat the same steps: define
$b_{2}(x)=\inf_{u\in\mathcal{U}}[\dot{b}_{1}(x,u)+\alpha_{1}(b_{1}(x))]$ and
$\mathcal{C}_{2}=\\{x\in\mathcal{X}:b_{2}(x)\geq 0\\}$. Now any controller $u$
that renders $\mathcal{C}_{2}$ forward invariant also renders
$\mathcal{C}_{1}\cap\mathcal{C}_{2}$ forward invariant, and therefore the set
$\mathcal{S}\cap\mathcal{C}_{1}\cap\mathcal{C}_{2}$ is also forward invariant
by the same controller. This idea is formalised in the next subsection.

###  III-B ICCBFs

Consider the dynamical system (1) with bounded control inputs
$u\in\mathcal{U}$ and a safe set $\mathcal{S}$ defined by a function
$h:\mathcal{X}\rightarrow\mathbb{R}$, as per (2-4). Assume $h$ is not a ZCBF.
We define the following sequence of functions:

$\displaystyle b_{0}(x)$ $\displaystyle=h(x)$ (10) $\displaystyle b_{1}(x)$
$\displaystyle=\inf_{u\in\mathcal{U}}[L_{f}b_{0}(x)+L_{g}b_{0}(x)u+\alpha_{0}(b_{0}(x))]$
(11) $\displaystyle b_{2}(x)$
$\displaystyle=\inf_{u\in\mathcal{U}}[L_{f}b_{1}(x)+L_{g}b_{1}(x)u+\alpha_{1}(b_{1}(x))]$
(12) $\displaystyle\vdots$ $\displaystyle b_{i+1}(x)$
$\displaystyle=\inf_{u\in\mathcal{U}}[L_{f}b_{i}(x)+L_{g}b_{i}(x)u+\alpha_{i}(b_{i}(x))]$
(13) $\displaystyle\vdots$ $\displaystyle b_{N}(x)$
$\displaystyle=\inf_{u\in\mathcal{U}}[L_{f}b_{N-1}(x)+L_{g}b_{N-1}(x)u$
$\displaystyle{}\quad{}\quad{}\quad{}\quad+\alpha_{N-1}(b_{N-1}(x))]$ (14)

where each $\alpha_{i}$ is some user-specified class-$\mathcal{K}$ function,
and $N$ is a positive integer. We assume the functions $f,g,h$ are
sufficiently smooth such that $b_{N}$ and its derivative are defined. Each
function $b_{i}:\mathcal{X}\rightarrow\mathbb{R}$ is a scalar function that
only depends on the state. The time derivative
$\dot{b}_{i}=\frac{db_{i}}{dx}\dot{x}=L_{f}b_{i}(x)+L_{g}b_{i}(x)u$ is still
affine in $u$.

######  Remark 1.

Higher Order CBFs, as in [9], are a special case of ICCBFs. For instance, in
systems of relative degree 2, $L_{g}h(x)=0$ for all $x\in\mathcal{S}$. In this
case, in the construction of ICCBFs we have

$\displaystyle b_{1}(x)$
$\displaystyle=\inf_{u\in\mathcal{U}}[L_{f}h(x)+L_{g}h(x)u+\alpha_{0}(h(x))]$
(15) $\displaystyle=\inf_{u\in\mathcal{U}}[L_{f}h(x)+\alpha_{0}(h(x))]$ (16)
$\displaystyle=L_{f}h(x)+\alpha_{0}(h(x))$ (17)

which is exactly the function defined in [9]. This repeats for any relative
degree greater than 2, and thus for a system with relative degree $\rho$, the
first $\rho$ expressions of ICCBFs are identical to those of HOCBFs. Moreover,
ICCBFs can handle systems with non-uniform relative degree, by choosing $N$
greater or equal to the largest relative degree of the system in
$\mathcal{S}$.

Next, we define a family of sets,

$\displaystyle\mathcal{C}_{0}$ $\displaystyle=\\{x\in\mathcal{X}:b_{0}(x)\geq
0\\}=\mathcal{S}$ (18) $\displaystyle\mathcal{C}_{1}$
$\displaystyle=\\{x\in\mathcal{X}:b_{1}(x)\geq 0\\}$ (19)
$\displaystyle\vdots$ $\displaystyle\mathcal{C}_{i}$
$\displaystyle=\\{x\in\mathcal{X}:b_{i}(x)\geq 0\\}$ (20)
$\displaystyle\vdots$ $\displaystyle\mathcal{C}_{N}$
$\displaystyle=\\{x\in\mathcal{X}:b_{N}(x)\geq 0\\}$ (21)

and the intersection of these sets

$\displaystyle\mathcal{C}^{*}=\mathcal{C}_{0}\cap\mathcal{C}_{1}\cap...\cap\mathcal{C}_{N}$
(22)

We assume the set $\mathcal{C}^{*}$ is closed, non-empty and has no isolated
points.

######  Definition 3.

For the above construction, if there exists a class-$\mathcal{K}$ function
$\alpha_{N}$ such that

$\displaystyle\sup_{u\in\mathcal{U}}[L_{f}b_{N}(x)+L_{g}b_{N}(x)u+\alpha_{N}(b_{N}(x))]\geq
0\quad\forall x\in\mathcal{C}^{*},$ (23)

then $b_{N}$ is an _Input Constrained Control Barrier Function (ICCBF)_.

Note, this does not require $b_{N}$ to be a ZCBF on $\mathcal{C}_{N}$. The
definition only requires condition (23) to hold for all $x\in\mathcal{C}^{*}$
which is a subset of $\mathcal{C}_{N}$. The main result of this paper can now
be stated:

######  Theorem 1 (Main Result).

Given the input constrained dynamical system (1), if $b_{N}$, defined by (10
\- 14), is an ICCBF, then any Lipschitz continuous controller
$u:\mathcal{C}^{*}\rightarrow\mathcal{U}$ such that $u(x)\in
K_{\text{\scalebox{0.6}{ICCBF}}}(x)$, where

$\displaystyle K_{\text{\scalebox{0.6}{ICCBF}}}(x)$
$\displaystyle=\\{u\in\mathcal{U}:$ $\displaystyle
L_{f}b_{N}(x)+L_{g}b_{N}(x)u\geq-\alpha_{N}(b_{N}(x))\\}$ (24)

renders the set $\mathcal{C}^{*}\subseteq\mathcal{S}$ (22) forward invariant.

###### Proof.

Since $u$ is a Lipschitz continuous controller, the closed-loop system (1) is
also Lipschitz continuous. To show forward invariance of $\mathcal{C}^{*}$, we
use Nagumo’s theorem on the closed-loop system. In particular, we show

$\displaystyle[f(x)+g(x)u(x)]\in\hat{T}_{\mathcal{C}^{*}}(x),$
$\displaystyle\quad\forall u(x)\in K_{\text{\scalebox{0.6}{ICCBF}}}(x),\text{
and }\forall x\in\partial\mathcal{C}^{*},$ (25)

where $\hat{T}_{\mathcal{C}^{*}}(x)$ is the tangent cone of $\mathcal{C}^{*}$
at $x$. At each $x\in\partial\mathcal{C}^{*}$, we have $b_{i}(x)=0$ for some
set, possibly all, of $i$’s in $\\{0,...,N\\}$. Let
$\mathcal{I}(x)=\\{i:b_{i}(x)=0\\}$. Condition (25) is satisfied if,
$\dot{b}_{i}(x,u(x))\geq 0$, for all $i\in\mathcal{I}(x)$, for all
$x\in\mathcal{C}^{*}$, provided $u(x)\in K_{\text{\scalebox{0.6}{ICCBF}}}(x)$.
In other words, we show that for all $x\in\mathcal{C}^{*}$,

$\displaystyle b_{i}(x)=0\implies\dot{b}_{i}(x,u(x))\geq 0,\forall u(x)\in
K_{\text{\scalebox{0.6}{ICCBF}}}(x)$ (26)

for all $i\in\\{0,...,N\\}$.

_Cases $i\in\\{0,...,N-1\\}$_: Consider any
$x\in\mathcal{C}^{*}\cap\partial\mathcal{C}_{i}$. Since
$\mathcal{C}^{*}\subseteq\mathcal{C}_{i+1}$,
$x\in\partial\mathcal{C}_{i}\cap\mathcal{C}_{i+1}$. By (13, 20),

$\displaystyle\inf_{u\in\mathcal{U}}[L_{f}b_{i}(x)+L_{g}b_{i}(x)]$
$\displaystyle\geq 0$ $\displaystyle\therefore L_{f}b_{i}(x)+L_{g}b_{i}(x)$
$\displaystyle\geq 0,\quad\forall u\in\mathcal{U}$

and therefore $\dot{b}_{i}(x,u)\geq 0$, for all $u\in\mathcal{U}$. Since
$K_{\text{\scalebox{0.6}{ICCBF}}}(x)\subseteq\mathcal{U}$, condition (26) is
satisfied.

_Case $i=N$_: Consider $x\in\mathcal{C}^{*}\cap\partial\mathcal{C}_{N}$. Since
$b_{N}$ is an ICCBF and $b_{N}(x)=0$, by (21, 24),

$\displaystyle L_{f}b_{N}(x)+L_{g}b_{N}(x)u(x)\geq 0,\quad\forall u(x)\in
K_{\text{\scalebox{0.6}{ICCBF}}}(x)$

and therefore $\dot{b}_{N}(x,u)\geq 0$ for any $u(x)\in
K_{\text{\scalebox{0.6}{ICCBF}}}(x)$.

In conclusion, we have shown that condition (26) is satisfied for all $i$, and
therefore the conditions of Nagumo’s theorem are satisfied, which completes
the proof.∎

######  Remark 2.

The practical value of this construction is that for a given system, a set
$\mathcal{S}$ of safe states of practical importance can be specified, which
may not be rendered forward invariant under the given system dynamics. By
using ICCBFs, we remove states of the set $\mathcal{S}$, and construct an
inner set for which we can find a controller that renders it forward
invariant.

We would like to note a useful special case, the _simple ICCBF_ :

######  Definition 4.

In the above construction, if $\mathcal{C}^{*}$ is a strict subset of
$\mathcal{C}_{N}$, i.e., $\mathcal{C}^{*}\subset\mathcal{C}_{N}$, then $b_{N}$
is a _simple ICCBF_.

######  Theorem 2.

For the dynamical system (1), if $b_{N}$ is a simple ICCBF, all Lipschitz
continuous controllers $u(x)\in\mathcal{U}$ render the set $\mathcal{C}^{*}$
forward invariant.

###### Proof.

By definition, since $b_{N}$ is a simple ICCBF, $\mathcal{C}^{*}$ is a strict
subset of $\mathcal{C}_{N}$. Then
$\mathcal{C}^{*}\cap\partial\mathcal{C}_{N}=\emptyset$, i.e., there does not
exist a $x\in\mathcal{C}^{*}$ such that $b_{N}(x)=0$. Following Theorem 1, we
do not need to consider case where $i=N$ in condition (26). The remaining
cases, with $i\in\\{0,...,N-1\\}$ satisfy condition (26) for all $u(x)\in
K_{\text{\scalebox{0.6}{ICCBF}}}(x)$. Therefore, any Lipschitz continuous
$u\in\mathcal{U}$ admits globally unique solutions and satisfies condition
(25), completing the proof. ∎

######  Remark 3.

Intuitively, the existence of a simple ICCBF represents a system where the
dynamics at the boundaries of $\mathcal{C}^{*}$ are such that the unforced
dynamics $f(x)$ dominate the forcing term $g(x)u$ in driving the system
towards safety. If a simple ICCBF is found, no safety critical controller is
needed for the system to ensure state trajectories remain within the safe set,
provided the system is initialised within $\mathcal{C}^{*}$.

###  III-C QP-based Control Synthesis

Finally, similar to [2, 3], we define an optimization-based controller that
will render $\mathcal{C}^{*}\subseteq\mathcal{S}$ forward invariant. In this
section, suppose the set $\mathcal{U}$ can be expressed as a convex polytope,
i.e., $\mathcal{U}=\\{u\in\mathbb{R}^{m}:Au\leq B\\}$ where
$A\in\mathbb{R}^{p\times m}$ and $B\in\mathbb{R}^{p}$ for some positive
integer $p$. Then the a controller based on the solution to the following
Quadratic Program (QP) renders the set $\mathcal{C}^{*}$ forward invariant.

######  Theorem 3.

Consider the dynamical system (1). Suppose $b_{N}$ is an ICCBF associated with
the class-$\mathcal{K}$ function $\alpha_{N}$ and inner safe set
$\mathcal{C}^{*}$. Let $H:\mathcal{X}\rightarrow\mathbb{R}^{m\times m}_{+}$,
where $\mathbb{R}^{m\times m}_{+}$ is the set of real $m\times m$ positive
definite matrices, and $F:\mathcal{X}\rightarrow\mathbb{R}^{m}$ be Lipschitz
continuous cost functions. The solution to the following quadratic
optimization problem

$\displaystyle\begin{array}[]{rl}u^{*}(x)=\underset{u\in\mathbb{R}^{m}}{\operatorname*{argmin}}&\frac{1}{2}u^{T}H(x)u+F(x)^{T}u\\\
\text{subject to}&L_{f}b_{N}(x)+L_{g}b_{N}(x)u\geq-\alpha_{N}(b_{N}(x))\\\
&u\in\mathcal{U}\end{array}$ (30)

yields an input-constrained feedback controller
$u^{*}:\mathcal{C}^{*}\rightarrow\mathcal{U}$ that renders $\mathcal{C}^{*}$
forward invariant. Thus, $h(x(t))\geq 0$ for all $t\geq t_{0}$, i.e. the
system trajectories always evolve within the safe set $\mathcal{S}$.

###### Proof.

The constraints in (30) specify that $u^{*}(x)\in
K_{\text{\scalebox{0.6}{ICCBF}}}(x)$. Since the $u^{*}(x)$ is a Lipschitz
continuous controller, (following the same arguments as [12, Thm. 8]), by
Theorem 1, the controller $u^{*}(x)$ obtained as the solution to the
optimization problem (30) renders $\mathcal{C}^{*}$ forward invariant. ∎

######  Remark 4.

Notice the final optimization-based controller only requires $b_{N}$ and its
derivatives. This means the computational complexity of the controller is
almost identical to the CBF-QP based controllers of [10, 2]. 111Computing
$b_{N}$ and its derivative can involve long expressions. In our
implementations, we used Mathematica [13] for symbolic manipulation, for the
ACC case study, and Julia’s auto-differentiation package ForwardDiff.jl [14,
15], for the autonomous rendezvous case study.

To conclude, we have introduced the notion of an ICCBF. Once an ICCBF is
found, the inner safe set $\mathcal{C}^{*}\subseteq\mathcal{S}$ given by (22)
and the quadratic-program based feedback controller
$u^{*}:\mathcal{C}^{*}\rightarrow\mathcal{U}$ given by (30) renders the
$\mathcal{C}^{*}$ forward invariant. In this way, ICCBFs address Problem 1.

##  IV Simulations

###  IV-A Adaptive Cruise Control

Figure 2: Figures (a-d): State-space diagrams indicating the sets (a)
$\mathcal{S}$, (b) $\mathcal{C}_{1}$, (c) $\mathcal{C}_{2}$ and (d)
$\mathcal{C}^{*}$. The horizontal dashed line in (a) indicates $v_{0}$, the
speed of the car in-front. Figure (d) represents the inner safe set
$\mathcal{C}^{*}$ that is rendered forward invariant. Figures (e-g):
Simulation results for speed, control input and safety under the CLF-CBF-QP
controller [10] and the ICCBF-QP.

As a demonstration, we apply ICCBFs to the Adaptive Cruise Control (ACC)
problem of [10]. Consider a point-mass model of a vehicle moving in a straight
line. The vehicle is following a vehicle in-front, which moves at a known
constant speed $v_{0}$. The objective is to design a controller which will
prevent the vehicle from colliding with the vehicle in-front, but will allow
it to accelerate to the speed limit when it is safe to do so.

Using the model defined in [10], the safety constraint is specified as $d\geq
1.8v$, where $d$ is the distance to the vehicle in-front, and $v$ is the speed
of the vehicle. Defining the state of the system $x=[d,v]^{T}$, the dynamical
model is

$\displaystyle\begin{bmatrix}\dot{d}\\\
\dot{v}\end{bmatrix}=\begin{bmatrix}v_{0}-v\\\
-F(v)/m\end{bmatrix}+\begin{bmatrix}0\\\ g_{0}\end{bmatrix}u$

where $F(v)=f_{0}+f_{1}v+f_{2}v^{2}$ models resistive forces on the vehicle,
$m$ is the mass of the vehicle, $g_{0}$ is acceleration due to the gravity.
The control input $u$ is the acceleration of the vehicle, and we suppose it is
constrained to

$\displaystyle\mathcal{U}=\\{u:-0.25\leq u\leq 0.25\\}$

which represents a maximum deceleration of $0.25g$’s. The safe set
$\mathcal{S}$ is defined by the function $h$,

$\displaystyle\mathcal{S}$ $\displaystyle=\\{x\in\mathcal{X}:h(x)\geq 0\\}$
$\displaystyle h(x)$ $\displaystyle=x_{1}-1.8x_{2}$

and we can verify that $\mathcal{S}$ is not forward invariant under the input
constraints. Thus, $h$ is not a ZCBF, and we will apply ICCBFs to find an
inner safe set.

We choose, arbitrarily, $N=2$ and the class-$\mathcal{K}$ functions

$\displaystyle\alpha_{0}(h)=4h,\quad\alpha_{1}(h)=7\sqrt{h},\quad\alpha_{2}(h)=2h,$

to define the functions $b_{1},b_{2}$ and sets
$\mathcal{C}_{1},\mathcal{C}_{2}$.

The sets are visualized in Figure 2. The interior of a set is shaded, and the
boundary of the set is indicated with a thick line. Each boundary is
partitioned into two subsets: the subset where there exists a feasible control
input to keep trajectories within the set are indicated with a solid line, and
the subset where no feasible control input will keep trajectories within the
set are indicated with a dashed line.

To verify that $b_{2}$ is an ICCBF, the following optimization problem was
used:

$\displaystyle\begin{array}[]{rl}\gamma=\underset{x\in\mathcal{X}}{\operatorname*{minimise}}&\sup_{u\in\mathcal{U}}[\dot{b}_{N}(x,u)+\alpha_{N}(b_{N}(x))]\\\
\text{subject to}&x\in\mathcal{C}^{*}\end{array}$

By the definition of ICCBFs, $b_{N}$ is an ICCBF if and only if the
optimization problem is feasible, with solution $\gamma\geq 0$. While this
optimization problem is, in general, non-linear and non-convex, a standard
non-linear optimization software can be used to solve it. Applied to the ACC
problem, we determined $\gamma=2.33\geq 0$, and therefore $b_{2}$ is a valid
ICCBF.

Finally, we define $\mathcal{C}^{*}$ as the intersection of
$\mathcal{S},\mathcal{C}_{1},\mathcal{C}_{2}$. This set is visualised in
Figure 2(d). The following controller renders the set forward invariant:

$\displaystyle\begin{array}[]{rl}u^{*}(x)=\underset{u\in\mathbb{R}}{\text{argmin}}&\frac{1}{2}(u-u_{d}(x))^{2}\\\
\text{subject to}&L_{f}b_{2}(x)+L_{g}b_{2}(x)u\geq-2b_{2}(x)\\\
&u\in\mathcal{U}\end{array}$

where $u_{d}(x)$ is the desired acceleration. The desired acceleration is
computed using the Control Lyapunov Function $V(x)=(x_{2}-v_{max})^{2}$, where
$v_{max}=24$ is the speed limit. Thus, $u_{d}(x)$:

$\displaystyle L_{f}V(x)+L_{g}V(x)u_{d}(x)=-10V(x)$

The inner safe set $\mathcal{C}^{*}$ and the input-constrained feedback
controller $u^{*}$ represent the solution to Problem 1 for the ACC problem.

We compare our controller to the CLF-CBF-QP controller of [10]:

$\displaystyle\begin{array}[]{rl}\underset{u\in\mathbb{R},\delta\in\mathbb{R}_{+}}{\text{argmin}}&\frac{1}{2}u^{2}+0.1\delta^{2}\\\
\text{subject to}&L_{f}V(x)+L_{g}V(x)\leq-10V(x)+\delta\\\
&L_{f}h(x)+L_{g}h(x)u\geq-2h(x)\end{array}$

and clip of the solutions of the QP such that $u^{*}(x)$ lies in the range of
feasible control inputs.

In Figures 2 (e-g), the proposed controller (green) is compared to the CLF-
CBF-QP controller (blue), proposed in [10]. We can see the CLF-CBF-QP reaches
the input-constraint at $t=5.9$ seconds. The input limits force the system to
leave the safe set. The ICCBF-QP remains feasible and safe for the entire
duration, by applying brakes early, at $t=2.9$ seconds, instead of $t=5.0$
seconds. Thus, the ICCBF-QP controller is able to keep the input-constrained
system safe, where the CLF-CBF-QP method fails, because it does not consider
input constraints.

###  IV-B Autonomous Rendezvous

Figure 3: (a, b) Schematic of the rendezvous problem. (a) represents the
Local-Vertical Local-Horizontal frame. (b) details the target and chaser
spacecrafts. The target spacecraft is rotating with constant angular velocity
$\omega$. The red dashed lines indicate the Line-of-Sight cone, which the
chaser spacecraft must remain within. (c-e) show snapshots of the trajectory
at three instances. The green dot represents the initial condition. (f) shows
the 1-norm of the propulsive force and (g) indicates the line of sight angle
$\theta$.

In this section, the ICCBF method is applied to the case study of an
autonomous rendezvous operation between a chaser spacecraft modelled as a
point mass, and a target body, for instance the International Space Station
(ISS), see Figure 3. The target spacecraft is rotating with a constant angular
velocity relative to the Local-Vertical Local-Horizontal (LVLH) frame. The
objective is to determine the appropriate propulsive forces to bring the
chaser spacecraft from a range of 100 m to 3 m. The safety constraint is to
maintain a line-of-sight (LOS) constraint: the spacecraft’s position must
remain within a $\gamma=10^{\circ}$ cone of the docking axis. This model is
adapted from [16], where linearized Model-Predictive-Controllers (LMPC) were
used.

The target is modelled as a disk of radius $\rho=2.4$ m, with a constant
angular velocity $\omega=0.6^{\circ}$/sec relative to the local-vertical
local-horizontal (LVLH) frame, and with a target docking port attached to the
edge of the disk. The system state $x\in\mathbb{R}^{5}$ is 5 dimensional
consisting of the relative position $(p_{x},p_{y})$ and velocity
$(v_{x},v_{y})$ of the spacecraft in the LVLH frame as the first four states,
and angle of the ISS with respect to the LVLH frame $\psi$ as the last state.

Instead of using the linearised Clohessy-Wiltshire equations (as in [16]), we
use the full nonlinear equations of relative motion. In this work, only
gravitational forces due to the Earth and propulsive forces are modelled, but
other non-linear effects like solar radiation pressure or air resistance can
also be included. The dynamical model is then given by

$\displaystyle\frac{d}{dt}\begin{bmatrix}p_{x}\\\ p_{y}\\\ v_{x}\\\ v_{y}\\\
\psi\end{bmatrix}=\begin{bmatrix}v_{x}\\\ v_{y}\\\
n^{2}p_{x}+2nv_{y}+\frac{\mu}{r^{2}}-\frac{\mu(r+p_{x})}{r_{c}^{3}}\\\
n^{2}p_{y}-2nv_{x}-\frac{\mu p_{y}}{r_{c}^{3}}\\\
\omega\end{bmatrix}+\frac{1}{m_{c}}\begin{bmatrix}0\\\ 0\\\ u_{x}\\\ u_{y}\\\
0\end{bmatrix}$ (31)

where $r_{c}=\sqrt{x^{2}+y^{2}}$ is the relative distance to the chaser,
$r=6771$ km is the radius of orbit of the ISS, $\mu=398,600$ km3/s2 is the
gravitational parameter of Earth, $n=\sqrt{\mu/r^{3}}$ is the mean motion of
the target satellite around the Earth, $\omega=0.6^{\circ}$/s is the angular
velocity of the target relative to the LVLH frame, and $m_{c}=1000$ kg is the
mass of the chaser vehicle, assumed constant during the rendezvous. The
control inputs $(u_{x},u_{y})$ are the propulsive forces in the local vertical
and local horizontal directions, respectively. We suppose that these forces
are 1-norm bounded, $|u_{x}|+|u_{y}|\leq 0.25$ kN.

The Line-of-Sight constraint is also non-linear, and can be encoded exactly
using $\theta$, the line of sight angle,

$\displaystyle h(x)$ $\displaystyle=\cos\theta-\cos\gamma$
$\displaystyle=\frac{\vec{r}_{c-p}\cdot\hat{e}}{||\vec{r}_{c-p}||}-\cos(\gamma),$

where $\vec{r}_{c-p}=[(p_{x}-\rho\cos\psi),(p_{y}-\rho\sin\psi)]^{T}$ is the
position vector of the chaser relative to the docking port, and
$\hat{e}=[\cos\psi,\sin\psi]^{T}$ is the direction vector along the docking
axis.

The desired behaviour of the spacecraft is encoded using the Control Lyapunov
function:

$\displaystyle
V(x)=\left(v_{x}+\frac{p_{x}-\rho\cos\psi}{10}\right)^{2}+\left(v_{y}+\frac{p_{y}-\rho\sin\psi}{10}\right)^{2}$

which specifies that the desired velocity $v_{d}$ is along negative
$\vec{r}_{c-p}$.

To construct the ICCBF, again $N=2$ was chosen. The following
class-$\mathcal{K}$ functions were used:

$\displaystyle\alpha_{0}(h)=0.25h,\quad\alpha_{1}(h)=0.85h,\quad\alpha_{2}(h)=(0.05+k)h$

where $k>0$ is a parameter we allow the Quadratic Program to minimize, as in
[4]. Thus, the controller $u^{*}$ is the solution to $u$ in the following
quadratic optimization problem

$\displaystyle\begin{array}[]{rl}\underset{u\in\mathbb{R}^{2};\delta,k\in\mathbb{R}_{+}}{\text{argmin}}&\frac{1}{2}(u_{x}^{2}+u_{y}^{2})+10\delta+50k\\\
\text{subject to}&L_{f}V(x)+L_{g}V(x)u\leq-0.1V(x)+\delta\\\
&L_{f}b_{2}(x)+L_{g}b_{2}(x)u\geq-(0.05+k)b_{2}(x)\\\ &|u_{x}|+|u_{y}|\leq
0.25\end{array}$

Figure 3(c-g) show simulation results of the rendezvous operation. The chaser
is initialized at (100, -10) meters from the target spacecraft, and follows
the trajectories drawn in (c-e), demonstrating a successful transfer. The
1-norm of the computed thrust force is indicated in (f), and (g) shows that
the LOS constraint is satisfied at all times during the transfer. 3D
animations, videos and source code for both case studies are available at
[17].

##  V Conclusion

In this paper, we have presented a framework that allows input constraints to
be explicitly included in the construction of control barrier functions and to
guarantee that safety is maintained with an input-constrained controller. The
construction identifies an inner safe set and a feedback controller to render
the subset safe. The method was demonstrated in two cases, an adaptive cruise
control problem and a spacecraft rendezvous control problem. An optimization
based method was used to verify the conditions of the ICCBF. Directions for
future work include investigating numerically efficient methods to automate
the search of ICCBFs, and to compare the complexity with other reachability
methods, in particular for systems with high-dimensional states. Finally, the
robustness of this controller to noise and model mismatch could also be
investigated.

## References

  * [1] A. D. Ames, S. Coogan, M. Egerstedt, G. Notomista, K. Sreenath, and P. Tabuada, “Control barrier functions: Theory and applications,” in _2019 18th European Control Conference (ECC)_ , 2019, pp. 3420–3431.
  * [2] A. D. Ames, X. Xu, J. W. Grizzle, and P. Tabuada, “Control barrier function based quadratic programs for safety critical systems,” _IEEE Transactions on Automatic Control_ , vol. 62, no. 8, pp. 3861–3876, 2017.
  * [3] T. Gurriet, A. Singletary, J. Reher, L. Ciarletta, E. Feron, and A. Ames, “Towards a framework for realizable safety critical control through active set invariance,” in _2018 ACM/IEEE 9th International Conference on Cyber-Physical Systems (ICCPS)_ , 2018, pp. 98–106.
  * [4] K. Garg and D. Panagou, “Control-lyapunov and control-barrier functions based quadratic program for spatio-temporal specifications,” in _2019 IEEE 58th Conference on Decision and Control (CDC)_ , 2019, pp. 1422–1429.
  * [5] I. M. Mitchell, A. M. Bayen, and C. J. Tomlin, “A time-dependent Hamilton-Jacobi formulation of reachable sets for continuous dynamic games,” _IEEE Transactions on Automatic Control_ , vol. 50, no. 7, pp. 947–957, 2005.
  * [6] G. Blekherman, P. A. Parrilo, and R. R. Thomas, _Semidefinite optimization and convex algebraic geometry_. SIAM, 2012\.
  * [7] X. Xu, J. W. Grizzle, P. Tabuada, and A. D. Ames, “Correctness guarantees for the composition of lane keeping and adaptive cruise control,” _IEEE Transactions on Automation Science and Engineering_ , vol. 15, no. 3, pp. 1216–1229, 2018.
  * [8] W. S. Cortez and D. V. Dimarogonas, “Correct-by-design control barrier functions for euler-lagrange systems with input constraints,” in _2020 American Control Conference (ACC)_ , 2020, pp. 950–955.
  * [9] W. Xiao and C. Belta, “Control barrier functions for systems with high relative degree,” in _2019 IEEE 58th Conference on Decision and Control (CDC)_ , 2019, pp. 474–479.
  * [10] A. D. Ames, J. W. Grizzle, and P. Tabuada, “Control barrier function based quadratic programs with application to adaptive cruise control,” in _53rd IEEE Conference on Decision and Control_ , 2014, pp. 6271–6278.
  * [11] F. Blanchini, “Set invariance in control,” _Automatica_ , vol. 35, no. 11, pp. 1747–1767, 1999.
  * [12] X. Xu, P. Tabuada, J. W. Grizzle, and A. D. Ames, “Robustness of control barrier functions for safety critical control,” _IFAC-PapersOnLine_ , vol. 48, no. 27, pp. 54–61, 2015, analysis and Design of Hybrid Systems ADHS.
  * [13] W. R. Inc., “Mathematica, Version 12.2,” champaign, IL, 2020. [Online]. Available: https://www.wolfram.com/mathematica
  * [14] J. Bezanson, A. Edelman, S. Karpinski, and V. B. Shah, “Julia: A fresh approach to numerical computing,” _SIAM review_ , vol. 59, no. 1, pp. 65–98, 2017.
  * [15] J. Revels, M. Lubin, and T. Papamarkou, “Forward-mode automatic differentiation in Julia,” _arXiv:1607.07892 [cs.MS]_ , 2016. [Online]. Available: https://arxiv.org/abs/1607.07892
  * [16] H. Park, S. Di Cairano, and I. Kolmanovsky, “Model predictive control for spacecraft rendezvous and docking with a rotating/tumbling platform and for debris avoidance,” in _Proceedings of the 2011 American Control Conference_ , 2011, pp. 1922–1927.
  * [17] Source code and animations are available at https://github.com/dev10110/Input-Constrained-Control-Barrier-Functions.