Output Feedback Backup Control Barrier Functions: Safety Guarantees Under Input Bounds and State Estimation Error

1. Problem Statement

The paper addresses the critical challenge of ensuring safety for nonlinear control systems subject to two major constraints:

1. Input Bounds: The control inputs $u$ are constrained within a bounded set $U$ (e.g., actuator saturation).
2. State Estimation Error: The true state $x$ is unknown and unmeasurable. The controller must rely solely on an estimated state $\hat{x}$ derived from noisy sensor measurements.

The Core Difficulty:
Standard Control Barrier Functions (CBFs) and Backup Control Barrier Functions (bCBFs) typically assume perfect state knowledge. When only an estimate $\hat{x}$ is available:

• The "backup flow" (the trajectory of the system under a safe backup controller) cannot be precisely computed because the initial condition is uncertain.
• There is a coupling between the estimated flow (used for control) and the true flow (which determines actual safety).
• Existing methods often fail to guarantee that a feasible control input exists to keep the true state safe, especially when input constraints are present.

The goal is to synthesize a controller that guarantees the true state $x(t)$ remains within a safe set $C_S$ for all time, using only the estimated state $\hat{x}(t)$ and respecting input bounds.

2. Methodology

The authors propose Output Feedback Backup Control Barrier Functions (O-bCBFs). The methodology extends the standard bCBF framework by introducing an "uncertainty envelope" around the estimated flow to account for state estimation errors.

Key Components:

1. System Model:

   • True dynamics: $\dot{x} = f(x) + g(x)u$
   • Measurement: $y = z(x) + v(t)$ (where $v(t)$ is bounded noise).
   • Estimator: $\dot{\hat{x}} = f(\hat{x}) + g(\hat{x})u + r(t, \hat{x}, y)$, where $r$ is a correction term (e.g., from a Kalman filter or Luenberger observer).
   • Assumption: The estimator is "error-bounded," meaning $\|x(t) - \hat{x}(t)\| \leq \delta_x(t, \bar{e}_0)$.

2. Backup Controller & Set:

   • A backup set $C_B \subseteq C_S$ is defined (e.g., a level set of a Lyapunov function).
   • A backup controller $k_b$ is designed such that if the system enters $C_B$, it remains safe.
   • Robustness: The backup controller is designed to be robust to the "virtual disturbance" caused by the difference between the true state and the estimated state ($k_b(\hat{x}) - k_b(x)$).

3. Two Methods for Flow Propagation:
   The paper presents two distinct techniques to construct a safe set $bC_I(t)$ based entirely on the estimated state $\hat{x}$, such that if $\hat{x} \in bC_I(t)$, the true state $x$ is guaranteed to be safe.

   • Method 1: Open-Loop Safety

     • Propagates the estimated state forward in time using the backup controller without the estimator's correction term (innovation).
     • Constructs a "tube" around this open-loop estimated flow.
     • Tightening: The safe set is tightened by subtracting a margin $\epsilon$ derived from the worst-case deviation between the true open-loop flow and the estimated open-loop flow.
     • Bound: Uses Grönwall-Bellman inequalities to bound the flow deviation based on Lipschitz constants of $f$ and $g$.

   • Method 2: Closed-Loop Safety

     • Considers the evolution of the true closed-loop system vs. the estimated open-loop system.
     • Constructs a tube that accounts for the difference between the true closed-loop flow and the estimated open-loop flow.
     • Bound: Uses one-sided Lipschitz constants (contraction metrics) of the closed-loop backup dynamics to derive tighter bounds, particularly useful for nonlinear systems where standard Lipschitz constants are large.

4. Controller Synthesis (O-bCBF-QP):
   A Quadratic Program (QP) is formulated to find a control input $u$ that:

   • Minimizes deviation from a primary (nominal) controller $k_p$.
   • Satisfies safety constraints derived from the tightened barrier functions.
   • Feasibility Guarantee: The authors prove that if the estimated state is within the constructed set $bC_I(t)$, the backup controller $k_b(\hat{x})$ is always a feasible solution to the QP. Thus, the QP never becomes infeasible, guaranteeing recursive feasibility.

3. Key Contributions

1. Formal Safety Guarantees under Output Feedback: The paper provides the first rigorous framework for bCBFs that guarantees safety of the true state under input constraints and state estimation errors, without assuming perfect state knowledge.
2. Recursive Feasibility Proof: It proves that a feasible control input always exists to maintain safety, even with bounded inputs and state uncertainty. This is achieved by constructing a safe set based on the estimated state that implies safety for the true state.
3. Two Distinct Flow Bounds:
   • Derivation of Open-Loop flow bounds suitable for linear systems or systems with small input map Lipschitz constants.
   • Derivation of Closed-Loop flow bounds suitable for nonlinear systems, leveraging contraction properties to reduce conservatism.
4. Tightening Mechanism: Introduction of a systematic method to "tighten" safety constraints (via $\epsilon_\tau$ and $\epsilon_b$) based on the worst-case estimation error propagation, ensuring that satisfying the constraint on the estimate implies satisfying it on the true state.

4. Results (Numerical Simulations)

The authors validate the approach with two case studies:

• Case Study 1: Double Integrator (Linear System)

  • Setup: A 2D system with noisy position measurements and bounded control input.
  • Outcome: The O-bCBF controller successfully kept the true state within the safe set. As the estimation error decreased over time, the uncertainty envelope (tightening terms) shrank, allowing the system to be less conservative and perform closer to the nominal controller.
  • Comparison: The standard bCBF (which ignores estimation error) failed to guarantee safety, while the proposed method succeeded.

• Case Study 2: Spacecraft Rotation (Nonlinear System)

  • Setup: A rigid-body spacecraft with Euler's rotation equations, noisy gyroscope measurements, and torque constraints. The primary controller was intentionally designed to violate safety.
  • Outcome: The O-bCBF controller prevented the true angular velocity from exceeding the safety limit.
  • Comparison: The "vanilla" backup CBF approach (using $\hat{x}$ as $x$) failed, causing the true state to exit the safe set. The proposed O-bCBF method maintained safety by accounting for the estimation error envelope.

5. Significance

This work bridges a critical gap between theoretical safety guarantees and practical implementation in real-world autonomous systems.

• Realism: Most real-world systems (robots, drones, spacecraft) rely on noisy sensors and state estimators. Previous safety-critical control methods often assumed perfect state knowledge, making them theoretically sound but practically unsafe.
• Input Constraints: By integrating input bounds directly into the safety guarantee, the method is applicable to physical systems with actuator limits.
• Robustness: The approach provides a constructive way to handle uncertainty without resorting to overly conservative worst-case assumptions that would render the system uncontrollable.
• Scalability: The use of QPs and the ability to compute the necessary bounds online makes the approach suitable for real-time implementation in safety-critical applications.

In summary, the paper establishes a rigorous mathematical foundation for Output Feedback Safety, ensuring that autonomous systems can operate safely even when they cannot perfectly "see" their own state and are limited by physical actuators.