⚡ electrical engineering

Input-to-State Safe Backstepping: Robust Safety-Critical Control with Unmatched Uncertainties

This paper proposes a constructive framework for ensuring input-to-state safety in nonlinear systems subject to unmatched uncertainties by generalizing the ISSf concept with Optimal Decay Control Barrier Functions and applying it to strict-feedback and dual-relative-degree systems.

Original authors: Max H. Cohen, Pio Ong, Aaron D. Ames

Published 2026-02-04

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Max H. Cohen, Pio Ong, Aaron D. Ames

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are driving a car that needs to stay within a specific lane (the "safe zone") to avoid crashing. Now, imagine two problems:

The Road is Slippery: There are unpredictable gusts of wind or bumps (disturbances) pushing the car.
The Steering is Delayed: You can't just turn the wheel to instantly fix the car's position. Instead, turning the wheel first changes the car's angle, and then the angle changes the car's position. This is called a "mismatched" problem because your control input (steering) doesn't hit the problem (position) directly.

This paper presents a new "smart driving system" (a control algorithm) that guarantees the car stays safe, even when the road is slippery and the steering is delayed.

Here is a breakdown of how they did it, using simple analogies:

1. The Problem: The "Unmatched" Disturbance

In many safety systems, if a wind gust pushes the car, the steering wheel can immediately push back to cancel it out. This is a "matched" problem.
However, in complex machines like drones or robots, the wind might push the body of the drone, but the motors can only control the tilt. The motors have to tilt the drone first, which then moves the body. The disturbance hits the body, but the control only touches the tilt. This is an "unmatched uncertainty." It's like trying to stop a rolling ball by only controlling the floor it's rolling on; you have to move the floor in a specific way to eventually stop the ball.

2. The Solution: A "Safety Net" with a Flexible Spring

The authors use a mathematical tool called a Control Barrier Function (CBF). Think of this as an invisible, elastic safety net surrounding the safe zone.

Standard Safety Net: If you touch the net, it yanks you back.
The New "Optimal Decay" Net: The authors improved this net. They realized that if you are inside the safe zone, you don't need to worry about the net pulling you. You only need to worry if you are touching the edge or outside it. They added a "scaling factor" (a variable they call $\omega$ ) that acts like a smart spring. If the wind is strong, the spring gets stiffer or stretches differently to ensure you don't get pushed out of the safe zone.

3. The Method: "Backstepping" (The Ladder Analogy)

To handle the "delayed steering" problem (where control doesn't hit the safety goal directly), they used a technique called Backstepping.
Imagine you are trying to climb a ladder to reach a safe platform (the goal).

Step 1: You can't jump straight to the top. You first have to get to the bottom rung. The authors design a "virtual controller" that acts as if the bottom rung is the goal. They make sure the system stays safe at this first step.
Step 2: Once the first step is safe, they treat that first step as the new "ground" and design a controller to move the next part of the system to match the first step.
The Result: By building this ladder of safety, step-by-step, they ensure that even though the control input is far away from the safety goal, the whole system remains safe.

4. Two Types of "Ladders"

The paper shows how to build this ladder for two specific types of machines:

Strict-Feedback Systems: Like a strict chain of command. The first part controls the second, which controls the third. (Example: An inverted pendulum or a balancing robot).
Dual-Relative-Degree Systems: Like a drone where the top part (position) is controlled by the bottom part (angle), but the bottom part's ability to control the top depends on the bottom part's current state. (Example: A quadrotor drone).

5. What the Simulations Showed

The authors tested their theory on two digital models:

The Balancing Pendulum: They simulated a stick trying to balance upright while being pushed by random wind. They showed that with their new "smart spring" (the Optimal Decay CBF), the stick stayed upright even when the wind was strong, whereas older methods would let it fall.
The Drone: They simulated a drone flying near a wall while being hit by wind gusts. The drone's computer used their algorithm to tilt itself perfectly to push back against the wind, keeping it from hitting the wall.

Summary

The paper introduces a new way to program robots and machines to stay safe. It combines a flexible safety net (Optimal Decay CBF) with a step-by-step construction method (Backstepping). This allows complex machines to stay safe even when:

They are being pushed by unpredictable forces (wind, friction).
The controls they have don't directly fix the problem (they have to work through intermediate steps).

The result is a system that doesn't just hope to stay safe, but mathematically guarantees it will stay within a safe boundary, even in the face of "unmatched" trouble.

Technical Summary: Input-to-State Safe Backstepping

Problem Statement
Ensuring safety in nonlinear control systems operating under unmatched disturbances remains a significant challenge. Unmatched uncertainties are those that cannot be directly canceled by the control input because they enter the system dynamics through channels distinct from the control authority. While Control Barrier Functions (CBFs) have proven effective for safety-critical control in nominal settings, and Input-to-State Safe (ISSf) CBFs have been developed to handle matched disturbances, constructing ISSf-CBFs for systems with unmatched uncertainties is difficult. Traditional verification conditions for ISSf-CBFs become overly stringent when control authority vanishes at the safety boundary, often failing to hold for systems where disturbances enter through different dynamics than the control input.

Methodology
The paper proposes a constructive framework that unites Input-to-State Safety (ISSf) theory with CBF backstepping to address unmatched uncertainties. The methodology proceeds in three main stages:

Generalization of ISSf via Optimal Decay CBFs (OD-CBFs):
The authors first generalize the ISSf framework by introducing the notion of an Optimal Decay ISSf-CBF (OD-ISSf-CBF). This approach relaxes the standard verification conditions in two ways:
- Optimal Decay Variable: It introduces a scaling factor $\omega$ (bounded below by $\theta_d$ ) on the class- $\mathcal{K}$ function $\alpha$ . This acts as an additional decision variable, providing flexibility in satisfying barrier conditions.
- Generalized Disturbance Model: Instead of assuming disturbances enter through the control channel (matched), the framework utilizes a disturbance input matrix $w(x)$ . The robustness condition is verified only along the projection of the disturbance onto the barrier function gradient ( $L_{wh}$ ), rather than the full gradient.
- Verification Relaxation: A key theoretical result (Lemma 3) shows that for OD-ISSf-CBFs, the condition need only be verified on the boundary and exterior of the safe set ( $h(x) \leq 0$ ), rather than the entire domain. If the control authority is non-zero outside the safe set, the condition is automatically satisfied.
Backstepping Synthesis for Unmatched Uncertainties:
To handle systems where the safety function $h$ does not have direct control authority, the paper employs a backstepping procedure to construct ISSf-CBFs for two specific classes of systems:
- Strict-Feedback Systems: For systems in strict-feedback form, the method treats higher-order states as "virtual" control inputs. A smooth controller is first designed for the top-layer subsystem to satisfy the OD-ISSf-CBF condition. A composite barrier function is then constructed by penalizing the deviation of the actual state from this virtual controller. Theorem 2 establishes that if the control gain matrix of the next layer is full row rank, the composite function is a valid OD-ISSf-CBF for the full system.
- Dual-Relative-Degree (DRD) Systems: For systems resembling differentially flat systems (e.g., quadrotors) where the top-layer dynamics depend on the bottom-layer state via a function $\psi(\eta)$ , the method views the product $\psi(\eta)u_z$ as a virtual input. A virtual controller is designed for the top layer, and a desired bottom-layer state $\eta_d$ is constructed to align the control directions with this virtual input. A composite barrier function combining the top-layer safety and the deviation of $\eta$ from $\eta_d$ is shown to be an OD-ISSf-CBF (Theorem 3), provided specific rank conditions on the system matrices are met.
Controller Implementation:
The framework yields a feedback controller derived from a Quadratic Program (QP). This QP jointly optimizes the control input $u$ and the scaling factor $\omega$ to minimize deviation from a nominal controller while satisfying the relaxed OD-ISSf-CBF condition. The resulting controller is locally Lipschitz continuous and guarantees the forward invariance of an inflated safe set $S_\delta$ , where the inflation size depends on the disturbance magnitude and the chosen parameters $\varepsilon$ and $\theta_d$ .

Key Contributions
The paper claims the following primary contributions:

Generalization of ISSf: A new framework utilizing OD-CBFs and a generalized disturbance-input model that offers increased flexibility in compensating for disturbances, particularly by relaxing verification to the boundary/exterior of the safe set.
Constructive Backstepping Procedure: A systematic method for synthesizing ISSf-CBFs for systems with unmatched disturbances. This includes full technical treatments for strict-feedback systems and dual-relative-degree systems, extending the applicability of backstepping from stabilization to safety-critical control.
Robust Safety Guarantees: Theoretical proofs demonstrating that the synthesized controllers ensure the system remains within a bounded neighborhood of the safe set (ISSf) even in the presence of unmatched uncertainties, with the ability to maintain strict safety if disturbance bounds are sufficiently small.

Results and Simulations
The theoretical results are validated through numerical simulations on two benchmark systems:

Inverted Pendulum: A strict-feedback system subject to unmatched disturbances. Simulations demonstrate that the proposed controller successfully maintains the pendulum within a safe angular range. The results illustrate the trade-off controlled by the parameter $\varepsilon$ : smaller values of $\varepsilon$ provide greater robustness, keeping the trajectory within the safe set, while larger values allow the trajectory to exit the set but remain within a bounded neighborhood, consistent with ISSf theory.
Planar Quadrotor: A dual-relative-degree system subject to wind gusts (unmatched disturbances). The simulation shows the drone successfully navigating toward a wall constraint. As the drone approaches the safety boundary, the controller adjusts the orientation ( $\eta$ ) to align the thrust vector against the disturbance, effectively counteracting the unmatched uncertainty. The results confirm that appropriate selection of $\varepsilon$ ensures safety, whereas larger values lead to safety violations.

Significance
The paper positions this work as a constructive solution to a persistent gap in safety-critical control: the synthesis of CBFs for systems with unmatched uncertainties. By leveraging the structural properties of strict-feedback and DRD systems through backstepping, the authors enable the systematic construction of robust safety filters for practically relevant classes of nonlinear systems. The work bridges the gap between the theoretical robustness of ISSf and the practical synthesis challenges posed by unmatched dynamics, offering a pathway to deploy safety-critical controllers on complex robotic platforms like quadrotors and manipulators operating in uncertain environments.