⚡ electrical engineering

Safe Controller Synthesis Using Lyapunov-based Barriers for Linear Hybrid Systems with Simplex Architecture

This paper proposes a novel design method and online activation policy for backup safe controllers in linear hybrid systems that guarantee maximal safety regions, timely recovery, and minimal resource usage by dynamically switching between controllers with different execution rates within a Simplex architecture.

Original authors: Sunandan Adhikary, Soumyajit Dey

Published 2026-02-16

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Sunandan Adhikary, Soumyajit Dey

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are driving a high-tech, self-driving car on a winding mountain road. This car has two "brains" working together to keep you safe and efficient.

The Two Brains: The Race Car Driver and The Safety Pilot

The Primary Controller (The Race Car Driver): This is the main brain. It's often powered by advanced AI or complex math designed to make the car go as fast as possible, use the least amount of fuel, or take the smoothest path. It's great at performance, but it's like a race car driver who might push the car too hard, miss a turn, or get confused by a sudden pothole (a "modeling error"). If it makes a mistake, the car could start drifting toward the edge of the cliff.
The Backup Safe Controller (The Safety Pilot): This is the second brain. Its only job is safety. It doesn't care about speed or fuel; it cares about keeping the car on the road. In the industry, this setup is called a Simplex Architecture.

The Problem:
In the past, when the "Race Car Driver" started to make a mistake, the "Safety Pilot" would jump in. But there were two big issues:

Too Slow: The Safety Pilot might take too long to pull the car back to safety. If the car is already halfway off the cliff, it's too late.
Too Clumsy: The Safety Pilot might be so cautious that it only works in a tiny, safe zone. If the car drifts just a little bit outside that tiny zone, the Safety Pilot panics and fails.
Too Expensive: The Safety Pilot might require a super-powerful computer to run, which drains the car's battery or slows down other systems.

The Paper's Solution: The "Smart Safety Pilot"

This paper proposes a new way to design the Backup Safe Controller (BSC). Think of it as upgrading the Safety Pilot with three superpowers:

1. The "Big Safety Net" (Maximal Region)

Imagine the safe road is a wide valley. Old Safety Pilots only knew how to work in a tiny circle in the middle of the valley. If you drifted even a few feet outside that circle, they couldn't help.
The new method creates a giant safety net. It calculates the largest possible area where the Safety Pilot can still grab the car and pull it back to the center. It ensures that no matter how far you drift (as long as you are still on the mountain road), the pilot can catch you.

2. The "Time Limit" (Timely Recovery)

The paper says, "We don't just want to save the car; we want to save it fast."
They set a strict deadline (like a countdown timer). If the car starts drifting, the Safety Pilot must get it back to the center lane before the timer hits zero. They use a mathematical tool called a Lyapunov Function (think of it as a "sliding slope" or a "gravity well") to guarantee that the car slides back to safety quickly, no matter where it started.

3. The "Smart Switch" (Resource Awareness)

This is the cleverest part. The Safety Pilot doesn't have to run at full speed all the time.

High Gear: If the car is dangerously close to the cliff, the pilot switches to a fast, high-frequency mode. It checks the steering wheel 100 times a second. This uses a lot of computer power but saves the car instantly.
Low Gear: If the car is drifting but still far from the edge, the pilot switches to a slower, low-frequency mode. It only checks the steering wheel 10 times a second. This saves battery and computer power.

The paper introduces a Smart Switching Policy. It's like a traffic cop that decides: "Is the car in danger? Yes? Switch to High Gear! Is the car safe but still drifting? Switch to Low Gear to save energy!" This ensures the system doesn't waste resources when it doesn't need to.

The "Magic Math" (How it Works)

The authors use some fancy math (Linear Matrix Inequalities and Semidefinite Programming) to solve a puzzle. They are trying to find the perfect "Safety Pilot" for different speeds (sampling rates) that satisfies two rules:

Rule 1: You must get back to the center lane within $X$ seconds.
Rule 2: You must never leave the mountain road while doing it.

They prove that by using Barrier Functions (imaginary walls that push the car back if it gets too close to the edge) combined with the "sliding slope" math, they can build a controller that is both safe and fast, without needing a supercomputer.

The Real-World Test

The authors tested this on two things:

An Airplane: Making sure it doesn't pitch up too high or drop too low.
An Inverted Pendulum: A stick balanced on a moving cart (like a Segway).

In both cases, they simulated the airplane or cart going off-course. The new "Smart Safety Pilot" successfully grabbed the system, pulled it back to the safe zone within the time limit, and switched between fast and slow modes to save computer power.

Summary in One Sentence

This paper teaches us how to build a smart, adaptable safety net for self-driving machines that catches them before they fall, pulls them back to safety quickly, and knows exactly when to work hard and when to relax to save energy.

1. Problem Statement

Modern Cyber-Physical Systems (CPS) often utilize a Simplex Architecture, where a high-performance Primary Optimal Controller (POC) (e.g., AI-enabled or cost-optimizing) operates within a preferred region. If the system state deviates into a potentially unsafe region, a Backup Safe Controller (BSC) must activate to restore safety.

Existing BSC design methodologies face three critical limitations:

Lack of Timely Recovery Guarantees: They often fail to guarantee that the system will recover to the safe region within a specific real-time deadline.
Suboptimal Safe Regions: They do not maximize the size of the safe operating region (Forward-Invariant Region) from which recovery is possible.
Resource Ignorance: They typically assume fixed execution rates, ignoring the constraints of limited processing bandwidth in resource-constrained embedded platforms. They often fail to optimize the trade-off between control performance (fast recovery) and resource usage (computation cost).

The paper addresses the challenge of synthesizing a set of BSCs that ensure maximal safety (largest invariant region), timely recovery (within a deadline), and minimal resource usage by adaptively switching between controllers with different sampling rates.

2. Methodology

The proposed framework operates on Linear Time-Invariant (LTI) approximations of hybrid systems linearized around an equilibrium point. The methodology consists of four key steps:

Step 1: Deriving Minimum Exponential Decay Rate

The recovery deadline ( $\delta_t$ ) is translated into a required Quadratic Lyapunov Function (QLF) decay rate ( $\alpha$ ).

The authors derive a minimum decay rate ( $\alpha_{ref}$ ) based on the worst-case scenario: a trajectory starting at the boundary of the Safe Operating Region (SOR) and needing to reach the Preferred Operating Region (POR) within $\delta_t$ sampling steps.
This ensures that if the QLF decays at least at rate $\alpha_{ref}$ , the system will mathematically guarantee recovery within the deadline.

Step 2: Constraint Synthesis for Recovery and Safety

The authors formulate the controller synthesis as a Semidefinite Programming (SDP) problem using Linear Matrix Inequalities (LMIs) to solve for the controller gain ( $K_S$ ) and the Lyapunov matrix ( $P$ ).

Recovery Constraint: An LMI is derived (Lemma 1) to ensure the system states converge to the POR within the required number of steps, satisfying the decay rate derived in Step 1.
Safety Constraint: To ensure the system never leaves the SOR during recovery, the authors utilize Barrier Functions (BF). They define the largest Safe Forward-Invariant Region (SFIR) as the largest ellipsoidal level set of the QLF that fits entirely within the SOR polytope.
Optimization: The synthesis problem (Problem 1) maximizes the size of this ellipsoidal SFIR (by maximizing the matrix $P^{-1}$ ) subject to the recovery and safety LMIs.

Step 3: Multi-Rate BSC Synthesis and Switching Logic

To address resource constraints, the framework synthesizes a set of BSCs ( $\mathcal{K}_S$ ), each designed for a different sampling period ( $h_i$ ).

Multi-Rate Design: Controllers are synthesized for a base period and its multiples (e.g., $h, 2h, 3h$ ). Faster rates offer better performance (higher decay) but consume more bandwidth; slower rates save bandwidth but offer slower recovery.
Switching Logic: A State-Dependent Controller Activation Policy (SCAP) is proposed (Lemma 3). It selects the BSC that:
1. Is valid for the current state (the state must lie within the BSC's SFIR).
2. Maximizes the decay rate ( $\alpha_i V_i(x)$ ) to ensure the fastest possible recovery.
3. Adheres to the switching stability criteria to prevent instability during transitions between different sampling rates.

Step 4: Resource-Aware Runtime Adaptation

The authors introduce a Global Logarithmic Barrier Function (GLBF) to monitor the system's safety margin in real-time.

Adaptive Scheduling: The SCAP (Algorithm 1) dynamically switches between BSCs based on two factors:
1. Safety Margin: If the system is very close to the safety boundary (high risk), it switches to a high-frequency (fast) BSC.
2. Resource Budget: If the system is recovering safely (low risk) and the processor utilization budget is tight, it switches to a lower-frequency (slower) BSC to save bandwidth.
Zeno Prevention: A minimum dwell time ( $d_z$ ) is enforced to prevent infinite switching (Zeno behavior) in finite time.

3. Key Contributions

Maximal Safe Region Synthesis: The first work to synthesize BSCs that guarantee recovery from the largest possible forward-invariant region within the safe domain, rather than a conservative subset.
Timely Recovery Guarantee: Theoretical proof that the synthesized controllers guarantee recovery within a user-defined deadline by enforcing a specific exponential decay rate on the Lyapunov function.
Resource-Sensitive Multi-Rate Switching: A novel framework that synthesizes multiple controllers with different execution rates and switches between them online. This optimizes processing bandwidth usage while maintaining safety guarantees.
SDP-Based Formulation: The use of Semidefinite Programming (SDP) with LMIs to jointly solve for stability, safety (barrier functions), and performance, which is computationally more efficient than Sum-of-Squares (SOS) or Quadratic Programming (QP) approaches for this specific class of problems.

4. Experimental Results

The framework was evaluated on two benchmarks: Aircraft Longitudinal Dynamics (ALD) and Inverted Pendulum Dynamics (IPD).

Synthesis Success: The framework successfully synthesized BSCs for various sampling periods (e.g., 20ms to 300ms) that satisfied both the safety boundaries and the recovery deadlines (1s, 2.5s).
Adaptive Performance:
- In the ALD simulation, when the system state was highly unsafe, the SCAP selected a fast BSC (240ms period). As the state became safer and the bandwidth budget tightened, it successfully switched to a slower BSC (300ms period) without violating safety or missing the recovery deadline.
- In the IPD simulation, the system recovered from states outside the Preferred Operating Region (POR) back to the POR within the 2.5s deadline, utilizing different BSCs based on the current state's location within the respective SFIRs.
Efficiency: The SDP-based synthesis took approximately 0.43 seconds on a standard processor, significantly faster than comparable QP-based methods (~0.85s), demonstrating its suitability for offline design of real-time controllers.

5. Significance

This paper bridges the gap between formal safety verification and resource-constrained real-time control.

Practicality for AI/CPS: It provides a robust safety net for AI-enabled controllers, which are often opaque and prone to modeling errors, by ensuring that even if the AI fails, a mathematically verified backup can recover the system.
Resource Efficiency: By adapting the control execution rate to the system's safety status, it allows for more efficient use of shared computing resources in modern CPS architectures, enabling the deployment of complex controllers on hardware with limited bandwidth.
Theoretical Rigor: It moves beyond heuristic safety checks by providing rigorous mathematical guarantees (via Lyapunov and Barrier functions) for both the size of the safe region and the time required for recovery.