⚡ electrical engineering

On transferring safety certificates across dynamical systems

This paper introduces a transferred control barrier function (tCBF) framework that enables the systematic enforcement of safety guarantees from a source system onto a target system with mismatched dynamics by utilizing a simulation function and an explicit margin term within a quadratic-program-based safety filter.

Original authors: Nikolaos Bousias, Charalampia Stamouli, Anastasios Tsiamis, George Pappas

Published 2026-03-17

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Nikolaos Bousias, Charalampia Stamouli, Anastasios Tsiamis, George Pappas

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The "Blueprint vs. The Building" Problem

Imagine you are an architect designing a skyscraper. To make sure the building won't collapse, you first draw a simple, perfect blueprint on a piece of paper. In this blueprint, the building is just a simple box. It's easy to calculate: "If the wind blows this hard, the box stays safe." You have a safety certificate (a guarantee) for this simple box.

Now, imagine you have to build the real skyscraper. The real building is a nightmare of complexity: it has swaying glass walls, heavy elevators, wind tunnels, and flexible steel beams. It doesn't move like a simple box.

The Problem: You have a safety guarantee for the simple box, but you need to keep the complex skyscraper safe. If you try to use the simple box's rules directly on the real building, they might fail because the real building behaves differently. Usually, engineers have to start from scratch and do incredibly difficult math to prove the real building is safe.

The Paper's Solution: This paper introduces a clever "translator" called a Transferred Control Barrier Function (tCBF). It's a method that takes your easy safety guarantee from the simple blueprint and "translates" it so it works on the complex real building, without needing to redo all the hard math.

The Core Concept: The "Shadow" and the "Safety Buffer"

The authors use three main ingredients to make this translation work:

1. The Simulation Function (The "Shadow")

Think of the complex real system (the quadrotor drone) and the simple abstract system (a point moving in a straight line) as two dancers.

The Simple Dancer is easy to predict.
The Complex Dancer is doing acrobatics.

The Simulation Function is like a spotlight that projects the Complex Dancer's movements onto the floor to create a Shadow. This shadow always looks like the Simple Dancer. Even if the Complex Dancer is spinning wildly, the shadow is just moving smoothly. This "shadow" allows us to track the complex system using the simple rules.

2. The Margin Term (The "Safety Buffer")

Here is the tricky part: The shadow isn't perfectly on top of the simple dancer. There is a tiny gap (error) between where the shadow is and where the simple dancer should be.

If you tell the Complex Dancer, "Stay inside the circle drawn for the Simple Dancer," they might crash because of that gap.

The paper introduces a Margin Term. Imagine shrinking the "Safe Circle" for the Simple Dancer. You make the safe zone smaller to account for the gap between the shadow and the real dancer.

The Analogy: If you are driving a car on a foggy day (uncertainty), you don't drive right up to the edge of the road. You stay in the middle. The "Margin" is that extra space you keep to be safe, even if your GPS (the simple model) is slightly off.

3. The Transfer (The "Magic Translation")

The paper proves mathematically that if you shrink the safe zone by just the right amount (the Margin), the safety guarantee from the simple model automatically applies to the complex model.

You don't need to invent new safety rules for the complex drone. You just take the old rules, shrink the safe zone a bit, and boom—you have a new, valid safety certificate for the complex machine.

How It Works in Practice: The Quadrotor Experiment

The authors tested this on a Quadrotor (a drone).

The Simple Model: They treated the drone like a Double Integrator. This is a fancy way of saying, "Imagine the drone is just a point that can accelerate up, down, left, or right instantly." This is easy to calculate.
The Real Model: The actual drone is a heavy, spinning machine with propellers, gravity, and wind. It's very hard to calculate.
The Obstacle Course: They put the drone in a room full of floating balloons (obstacles).

The Result:

They designed a safety rule for the "Point Drone" to avoid the balloons.
They used their "Translator" (tCBF) to shrink the safe zone to account for the fact that the real drone is heavy and spins.
They let the real drone fly.
Success: The drone flew safely through the balloons. When it got close to a balloon, the system gently nudged the drone away. When it was far away, the drone flew exactly how the pilot wanted.

Why is this cool?
Usually, making a drone fly safely in a cluttered room requires super-complex math that takes forever to compute. This method allowed them to use the simple math they already had, just with a little "safety buffer" added. It's like using a simple map to navigate a complex city, as long as you remember to stay a few blocks away from the edges just in case the map is slightly wrong.

Summary in One Sentence

This paper provides a mathematical "adapter" that lets engineers take easy safety rules designed for simple models and safely apply them to complex, real-world robots by adding a calculated "safety buffer" to account for the differences.

1. Problem Statement

The core challenge addressed is the mismatch between abstract safety models and complex physical systems.

Context: Control Barrier Functions (CBFs) are powerful tools for enforcing safety (e.g., collision avoidance) by ensuring forward invariance of a safe set. However, designing CBFs directly on high-dimensional, nonlinear, underactuated physical systems (like quadrotors) is computationally expensive and requires significant domain expertise.
Current Limitation: Practitioners often design safety certificates on simplified, tractable "abstract" models (e.g., double integrators) but struggle to transfer these guarantees to the "concrete" physical system without losing safety or requiring complex redesign.
Goal: To develop a rigorous framework that allows safety constraints defined on a low-dimensional abstract system ( $\Sigma_1$ ) to be systematically enforced on a higher-dimensional, mismatched concrete system ( $\Sigma_2$ ) while providing formal safety guarantees.

2. Methodology: The Transferred Control Barrier Function (tCBF)

The authors propose a framework based on Simulation Relations and a Margin Term to bridge the gap between systems.

A. Core Components

Simulation Function ( $V$ ): A Lyapunov-like function $V: X_1 \times X_2 \to \mathbb{R}_{\geq 0}$ that bounds the output mismatch between the abstract state $x_1$ and concrete state $x_2$ . It ensures that if the concrete system follows a control interface $F$ , the distance between the systems decays.
Witness Map ( $\Pi$ ): A mapping $\Pi: X_2 \to X_1$ that assigns the "closest" abstract state to a concrete state, defined as the minimizer of the simulation function: $\Pi(x_2) = \arg\min_{x_1} V(x_1, x_2)$ .
Transferred Barrier Construction: The new barrier function $b_2$ for the concrete system is constructed by shrinking the abstract safe set $b_1$ by a margin term $\phi$ dependent on the simulation error:
$b_2(x_2) := b_1(\Pi(x_2)) - \phi(V(\Pi(x_2), x_2))$
Here, $\phi$ is a class- $\mathcal{K}_\infty$ function acting as a safety margin to compensate for model mismatch and dynamics errors.

B. Theoretical Guarantees

The paper derives conditions under which $b_2$ is a valid CBF for the concrete system:

Dynamics Mismatch: The authors define a mismatch term $\delta$ representing the difference between the concrete dynamics projected onto the abstract space and the actual abstract dynamics.
Margin Synthesis (Assumption 2): To ensure safety, the margin function $\phi$ must grow fast enough to counteract the abstract barrier's growth and the dynamics mismatch. This leads to a scalar Ordinary Differential Inequality (ODI):
$\phi'(s)\alpha_V(s) \geq \alpha_b(\phi(s)) + r(s)$
where $\alpha_V$ is the decay rate of the simulation function, $\alpha_b$ is the CBF decay rate, and $r(s)$ bounds the mismatch.
Theorem 1 & 2: The authors prove that if $\phi$ satisfies this ODI (with specific initial conditions), the resulting $b_2$ satisfies the standard CBF condition ( $\dot{b}_2 \geq -\alpha(b_2)$ ), guaranteeing forward invariance of the safe set for the concrete system.

C. Implementation: tCBF-QP

The framework is implemented via a Quadratic Program (QP) safety filter:

A nominal controller ( $u_{nom}$ ) generates a desired trajectory.
The tCBF constraint is linearized (for control-affine systems) and added as a constraint to the QP.
The QP minimizes the deviation from $u_{nom}$ while satisfying the safety constraint, ensuring minimal invasiveness.

3. Key Contributions

tCBF Formulation: A novel mathematical construction that transfers safety certificates from abstract to concrete systems using simulation functions and explicit margin terms, without requiring the systems to share state dimensions.
Formal Design Guidelines: Explicit conditions for selecting the margin function $\phi$ . The paper provides closed-form solutions for common cases (e.g., linear decay rates), removing the need for exhaustive numerical optimization.
Decoupling of Synthesis and Enforcement: The framework allows safety synthesis to be performed offline on simple models, while the enforcement happens online on complex systems, decoupling the complexity of the two tasks.
Rigorous Proofs: Proof that the transferred barrier guarantees safety for the concrete system under specific assumptions regarding the simulation function and witness map.

4. Experimental Results

The framework was validated on a quadrotor navigation task in a 3D cluttered environment.

Setup:
- Abstract System ( $\Sigma_1$ ): A 3D double integrator (position and velocity).
- Concrete System ( $\Sigma_2$ ): A full 6-DOF rigid-body quadrotor with nonlinear, underactuated dynamics.
- Task: Navigate from a start point to a target while avoiding spherical obstacles.
Procedure:
1. Safety certificates (CBFs) were designed for the double integrator.
2. A simulation function and witness map were constructed based on the error between the quadrotor and the double integrator.
3. The tCBF was computed and enforced via a QP safety filter on the quadrotor.
Findings:
- Collision Avoidance: The quadrotor successfully avoided all obstacles. The true geometric clearance remained strictly positive, even though the abstract model used inflated radii for safety.
- Minimal Invasiveness: The trajectory deviated from the nominal path only when approaching obstacles. In free space, the system followed the nominal trajectory closely.
- Barrier Activation: The transferred barrier values decreased as the robot approached obstacles and activated (approached zero) precisely when safety was at risk, confirming the theoretical behavior.
- Robustness: The margin term successfully compensated for the significant dynamics mismatch between the simple integrator and the complex quadrotor.

5. Significance and Future Work

Significance: This work bridges a critical gap in compositional safety verification. It enables the use of simple, tractable models for safety synthesis while providing rigorous guarantees for complex, real-world robotic platforms. It is particularly valuable for systems with limited onboard compute, where complex safety synthesis cannot be performed in real-time.
Future Directions:
- Data-Driven Learning: A major challenge is analytically deriving simulation functions and interfaces for complex systems. The authors suggest future work on learning these components (simulation functions and policy interfaces) directly from data to broaden applicability to systems where accurate analytical models are unavailable.
- Generalization: Extending the framework to handle time-varying environments and more complex abstraction hierarchies.

In summary, the paper presents a robust, mathematically grounded method to "port" safety guarantees from simple models to complex robots, ensuring safety without sacrificing performance or requiring full-system safety redesign.