Safe Control of Feedback-Interconnected Systems via Singular Perturbations

1. Problem Statement

Modern autonomous systems often consist of feedback-interconnected subsystems evolving at significantly different timescales. Examples include:

• Robotic systems: The interaction between slow mechanical dynamics (position/velocity) and fast electrical dynamics (motor currents).
• Optimization-based control: A physical plant (slow) interacting with an online optimization algorithm (fast) that computes control inputs.

In these scenarios, safety constraints (e.g., avoiding obstacles, respecting joint limits) typically depend only on the slow states. However, designing Control Barrier Functions (CBFs) for the full high-dimensional interconnected system is computationally expensive and often intractable due to unknown or complex coupling dynamics.

The core challenge addressed is: How can we guarantee the safety of a full feedback-interconnected system using a safety certificate (CBF) designed only for a reduced-order (slow) model?

2. Methodology

The authors propose a formal framework based on Singular Perturbation Theory (timescale separation) to "lift" a safety certificate from a reduced-order model to the full system.

A. System Modeling

The system is modeled as a singularly perturbed system with a small parameter $\epsilon > 0$:

• Slow Subsystem: $\dot{x} = f(x, z, u)$
• Fast Subsystem: $\epsilon \dot{z} = g(z, x, u)$
  • $x$: Slow state (e.g., position).
  • $z$: Fast state (e.g., current, optimization variables).
  • $u$: Control input.

B. Key Assumptions

1. Safety Definition: Safety is defined solely on the slow state $x$ via a set $S_x$. The overall safe set is $S = \{(x, z) \mid x \in S_x\}$.
2. Equilibrium Manifold: The fast subsystem admits a continuously differentiable equilibrium function $z_{eq}(x, u)$ such that $0 = g(z_{eq}, x, u)$.
3. Reduced-Order Safety: A robust CBF $h(x)$ and a controller $\pi(x)$ exist for the reduced system $\dot{x} = f(x, z_{eq}(x, \pi(x)), \pi(x))$ that satisfy a safety condition with a strict margin $\eta > 0$.
4. Fast Stability: The "boundary layer system" (fast dynamics with frozen slow states) is globally exponentially stable, characterized by a Lyapunov function $U(\tilde{z})$.

C. The Proposed Solution: Composite CBF

The authors construct a Composite Control Barrier Function $V(x, z)$ that combines the reduced-order safety certificate and the fast subsystem's stability properties:
$$V(x, z) := h(x) - U(z - z_{eq}(x, \pi(x)))$$

• Logic: The term $h(x)$ ensures the slow state stays safe. The term $-U(\cdot)$ acts as a "penalty" or "buffer" that shrinks the admissible region of $x$ based on how far the fast state $z$ is from its equilibrium $z_{eq}$.
• Result: If the timescale separation parameter $\epsilon$ is sufficiently small ($\epsilon < \bar{\epsilon}$), the zero-superlevel set of $V$ (denoted $C_V$) is forward invariant. This guarantees that the full interconnected system remains safe.

3. Key Contributions

1. First Formal Framework for Safety Lifting: This is the first work to establish sufficient conditions for lifting reduced-order safety certificates to general feedback-interconnected systems using singular perturbation theory.
2. Composite CBF Construction: The derivation of a specific composite function $V(x, z)$ that mathematically couples the slow safety constraint with the fast subsystem's convergence properties.
3. Computational Efficiency: The approach allows the online safety filter (typically a Quadratic Program) to be solved only for the low-dimensional reduced-order model. The full system's safety is guaranteed a posteriori, provided $\epsilon$ is small enough.
4. Robustness via Safety Margin: The method explicitly utilizes a safety margin $\eta$ in the reduced-order design to absorb perturbations caused by the transient behavior of the fast subsystem.

4. Results and Validation

The paper validates the theory through two distinct numerical simulations:

A. Robotic Arm with Joint Motor Dynamics

• Setup: A 2-DoF planar robotic arm where mechanical dynamics are slow and motor electrical dynamics are fast.
• Implementation: A safety filter was designed for the reduced mechanical model (ignoring inductance).
• Outcome:
  • For small $\epsilon$ (fast electrical dynamics), the robot successfully avoided obstacles and respected joint limits.
  • As $\epsilon$ increased (slower electrical dynamics), the fast state could not track the equilibrium quickly enough, leading to safety violations.
  • This confirmed the existence of a critical threshold $\bar{\epsilon}$ predicted by the theory.

B. Suboptimal Safe Control (Optimization-Based)

• Setup: A physical plant controlled by an online optimization algorithm (primal-dual gradient flow) solving a constrained problem.
• Implementation: The algorithm acts as the fast subsystem. The safety filter was designed assuming the optimizer converged instantly.
• Outcome:
  • When the optimization algorithm was fast (small $\epsilon$), the system remained safe.
  • When the algorithm was slow, the system violated safety constraints because the control input lagged behind the required safe value.
  • The results demonstrated that the proposed framework correctly predicts the trade-off between algorithm speed and safety guarantees.

5. Significance

• Bridging Theory and Practice: The paper addresses a critical gap in control theory where complex, multi-timescale systems are common, but safety verification tools (like CBFs) are often too computationally heavy for the full system.
• Scalability: By decoupling the safety filter design from the fast dynamics, the method enables the deployment of safety-critical controllers on high-dimensional systems (e.g., complex robots, power grids) without solving high-dimensional optimization problems in real-time.
• Theoretical Rigor: It provides a rigorous mathematical proof (via Lyapunov analysis and singular perturbation bounds) that safety is preserved, moving beyond heuristic approximations often used in engineering practice.

In summary, the paper provides a systematic, mathematically proven method to ensure that if a controller is safe for a simplified model, it remains safe for the full physical system, provided the "fast" parts of the system (actuators, algorithms) operate sufficiently faster than the "slow" parts (plant dynamics).