Designing Barrier Functions for Graceful Safety Control

1. Problem Statement

The paper addresses a critical limitation in existing Control Barrier Function (CBF) methods: the binary ("black-and-white") definition of safety. Traditional CBFs ensure that a system remains within a single defined safe set ($h(x) \geq 0$). If this set is breached due to large disturbances or component failures, the system is immediately deemed "unsafe," often leading to catastrophic outcomes (e.g., a vehicle collision or battery thermal runaway).

The authors argue that real-world safety requires multi-layered assurances. They define "Grace" as the ability of a control system to provide a secondary "failsafe" layer. If the primary safety boundary is breached, the system should not immediately fail catastrophically but should instead enter a "danger" zone where a secondary barrier prevents total system failure. The goal is to design a controller that guarantees forward invariance of this secondary failsafe layer even when the primary layer is compromised.

2. Methodology

The proposed framework constructs a unified safety constraint that combines the properties of Zeroing CBFs (for the primary boundary) and Reciprocal CBFs (for the secondary boundary) into a single nonlinear inequality.

2.1 Multi-Layered Safety Definition

The authors define three distinct regions based on a transformed barrier function $h_g(x)$:

• Primary Safe Set ($S$): $h_g(x) \geq 0$ (Desirable safety).
• Failsafe/Danger Set ($D$): $-1 < h_g(x) < 0$ (Primary boundary breached, but catastrophe avoided).
• Catastrophic Set ($C$): $h_g(x) \leq -1$ (Total failure).

The transformation is defined as $h_g(x) = \frac{H(x) - b}{b - a}$, where $b$ is the primary boundary and $a$ is the catastrophic boundary.

2.2 The Graceful Safety Constraint

To enforce grace, the authors propose a specific constraint on the time derivative of the barrier function:
$$\dot{h}_g(x, u) \geq -\beta \left( \frac{h_g(x)}{h_g(x) + 1} \right)$$
where $\beta$ is an extended class-$\mathcal{K}$ function (e.g., $\beta(r) = \gamma r$).

• Zeroing Property: As $h_g \to 0$ (approaching the primary boundary), the term behaves like a standard Zeroing CBF, ensuring the system returns to safety.
• Reciprocal/Stiffening Property: As $h_g \to -1$ (approaching catastrophe), the term $\frac{h_g}{h_g+1}$ approaches $-\infty$. This creates an infinitely "stiff" feedback force, analogous to a stiffening spring or a Reciprocal CBF, preventing the system from ever reaching $h_g = -1$.

2.3 Extension to Relative Degree 2

For mechanical systems where control inputs are accelerations (relative degree 2), the authors extend this concept using High-Order CBFs. They derive a second-order constraint analogous to a mass-spring-damper system with a nonlinear stiffening spring:
$$\ddot{h}_g + 2\zeta\omega_n \dot{h}_g + \omega_n^2 \frac{h_g}{h_g + 1} \geq 0$$
This constraint ensures that even if the primary safety condition ($h_g \geq 0$) is violated, the system dynamics are constrained such that $h_g$ never crosses $-1$.

3. Key Contributions

1. Definition of Graceful Safety: Formalized the concept of "grace" in control theory as a multi-layered safety guarantee, distinguishing between "unsafe" (primary breach) and "catastrophic" (secondary breach).
2. Unified Barrier Function Design: Developed a novel constraint that simultaneously enforces a Zeroing CBF around the primary boundary and a Reciprocal CBF around the catastrophic boundary within a single mathematical formulation.
3. Analytical Proofs: Provided rigorous Lyapunov-based proofs for both relative degree 1 and relative degree 2 systems, demonstrating that:
   • The primary safe set is forward invariant.
   • If the system enters the danger zone ($D$), it is guaranteed to remain in $S \cup D$ (avoiding catastrophe) and asymptotically converge back to the primary boundary.
4. Energy-Based Interpretation: Interpreted the nonlinear constraint as a "stiffening spring," allowing for energy-based analytical proofs of stability and safety.

4. Results

The authors validated the framework using a wall collision avoidance simulation with a point mass.

• Baseline Comparison: Traditional exponential CBFs (relative degree 2) failed to prevent collisions when the initial velocity was high, even if the initial position was technically "safe," because they only guaranteed invariance of a velocity-dependent set, not the absolute position.
• Graceful Controller Performance:
  • First-Order: Successfully prevented collisions for all initial conditions, applying aggressive control inputs as the system approached the catastrophic boundary ($x_w$).
  • Second-Order: Successfully prevented collisions even with high initial velocities ($-25$ m/s) and unsafe initial positions ($2$m and $5$m), scenarios where the baseline failed.
  • Damping Effects: The study compared overdamped ($\zeta=2$) and underdamped ($\zeta=0.5$) controllers. The underdamped controller returned to safety faster but with higher peak accelerations and oscillations, while the overdamped controller provided a smoother, monotonic return.
  • Finite vs. Infinite: The controller applied very high but finite accelerations to keep the system away from the catastrophic boundary, confirming that the "stiffening" effect prevents the Lyapunov function from diverging to infinity.

5. Significance

This paper bridges a gap between theoretical safety guarantees and practical engineering needs. In safety-critical domains (automotive, aerospace, battery management), a single safety layer is often insufficient due to unpredictable disturbances.

• Robustness: The proposed method ensures that even if a primary safety system fails (e.g., a car cuts in too close), the system has a built-in "failsafe" mechanism to prevent a crash, rather than simply failing.
• Mechanical Applicability: By addressing relative degree 2 systems, the method is directly applicable to mechanical systems where force/acceleration is the control input, a common scenario often overlooked by simpler first-order CBF designs.
• Design Flexibility: The introduction of tunable parameters (like damping ratio $\zeta$) allows engineers to trade off between response speed and control effort (acceleration limits) while maintaining rigorous safety guarantees.

In conclusion, the paper establishes a new paradigm for safety-critical control where the system is designed not just to avoid failure, but to fail gracefully, ensuring that a primary breach does not inevitably lead to catastrophe.