## Safety verification via barrier certificates

Suppose that we are given a dynamical system of the form $\dot{x} (t) = f ( x (t) )$, where $x : [0, \infty) \to \mathbb{R}^n$ is the state trajectory, and $f : \mathbb{R}^n \to \mathbb{R}^n$ is a known vector field [1]. Suppose further that we are given an initial set $\mathcal{X}_0 \subset \mathbb{R}^n$, and an unsafe set $\mathcal{X}_u \subset \mathbb{R}^n$.

If there exists a state trajectory $x : [0, \infty) \to \mathbb{R}^n$ with initial condition $x(0) \in \mathcal{X}_0$ such that $x(T) \in \mathcal{X}_u$ for some $T \geq 0$, we say that the system is unsafe. An example of an unsafe system is depicted below

If there exists no state trajectory $x : [0, \infty) \to \mathbb{R}^n$ with initial condition $x(0) \in \mathcal{X}_0$ such that $x(T) \in \mathcal{X}_u$ for some $T \geq 0$, we say that the system is safe. Note that if $\mathcal{X}_0 \cap \mathcal{X}_u \neq \emptyset$, we can conclude immediately that the system is unsafe, as there exists an initial condition $x(0) \in \mathcal{X}_u$.

The safety verification problem can then be stated as follows:

Given a vector field $f : \mathbb{R}^n \to \mathbb{R}^n$, an initial set $\mathcal{X}_0 \subset \mathbb{R}^n$ and an unsafe set $\mathcal{X}_u \subset \mathbb{R}^n$, decide whether the dynamical system $\dot{x} = f (x)$ is safe.

To be more precise, safety is not a property of the dynamical system $\dot{x} = f (x)$ per se, but rather of the ordered triple $(f, \mathcal{X}_0, \mathcal{X}_u)$.

How do we go about solving the safety verification problem? The most obvious approach would be to “propagate” the initial set $\mathcal{X}_0$ forwards in time, i.e., to compute (forward) reachable sets. However, computing exact reachable sets is seldom possible, which forces us to compute approximations of reachable sets.

When performing safety verification, we are asking a binary question: is $(f, \mathcal{X}_0, \mathcal{X}_u)$ safe? Hence, computation of the reachable sets seems to provide more information than what we actually do need. This is a personal opinion, not a fact.

__________

Barrier certificates

Probably inspired on Lyapunov stability theory [1], Stephen Prajna introduced a few years ago a new method for safety verification of continuous-time dynamical systems that relies on what he termed barrier certificates [2]. A barrier certificate is a function of state $B : \mathbb{R}^n \to \mathbb{R}$ that satisfies the following inequalities

$\begin{array}{rl} B(x) \leq 0 \qquad{} \forall x \in \mathcal{X}_0 \\ B(x) > 0 \qquad{} \forall x \in \mathcal{X}_u\\ \displaystyle\frac{\partial B}{\partial x} (x) f (x) \leq 0 \qquad{} \forall x \in \mathbb{R}^n\end{array}$

Let us now introduce a function of time $b (t) := B (x (t))$ and fix the initial condition $x(0)$. Taking the derivative of $b$ with respect to time, we obtain

$\dot{b} (t) = \displaystyle\frac{\partial B}{\partial x} (x(t)) \dot{x} (t) = \displaystyle\frac{\partial B}{\partial x} (x(t)) f (x(t)) \leq 0$

which follows from the non-positivity of the Lie derivative of $B$ along the flow of $f$. From $\dot{b}(t) \leq 0$, we conclude that $b(t) \leq b(0)$ for all $t \geq 0$, i.e., we have that $B(x(t)) \leq B(x(0))$ for all $t \geq 0$. Hence, the following sublevel set

$\Omega_0 := \{ x \in \mathbb{R}^n \mid B(x) \leq B(x(0))\}$

is positively invariant [1]. In other words, a solution starting in $\Omega_0$ will remain in $\Omega_0$ for all $t \geq 0$. Since $B(x(0)) \leq 0$ for all $x(0) \in \mathcal{X}_0$, we conclude that $B(x(t)) \leq 0$ for all $t \geq 0$. However, since $B(x) > 0$ for all $x \in \mathcal{X}_u$, we can finally conclude that the safety of $(f, \{x(0)\}, \mathcal{X}_u)$ is guaranteed. Alternatively, one could argue that, since, by construction, $\Omega_0 \cap \mathcal{X}_u = \emptyset$, then safety is certified.

and once we know that $\Omega_0$ is a positively invariant set (from $B(x(t)) \leq B(x(0))$), we conclude that the state trajectory must live in $\Omega_0$, which is painted in dark gray below

Please do recall that $B(x(0)) \leq 0$, and also note that the unsafe set is contained in the superlevel set $\{ x \in \mathbb{R}^n \mid B(x) > 0\}$.

So far we assumed that the initial condition was fixed. Henceforth, we shall make the initial condition free to take any values in the initial set $\mathcal{X}_0$. Let us define

$b_0 := \displaystyle\sup_{x_0 \in \mathcal{X}_0} B(x_0)$

so that we get an upper bound on $B(x(0))$, as follows

$B(x(t)) \leq B(x(0)) \leq b_0 \leq 0$

where we used the inequality $B(x) \leq 0$ for all $x \in \mathcal{X}_0$ to conclude that $b_0 \leq 0$. This allows us to conclude that the sublevel set

$\tilde{\Omega}_0 := \{ x \in \mathbb{R}^n \mid B(x) \leq b_0\}$

is positively invariant. Since $\tilde{\Omega}_0 \cap \mathcal{X}_u = \emptyset$, safety of $(f, \mathcal{X}_0, \mathcal{X}_u)$ is guaranteed. Note that the sublevel set $\tilde{\Omega}_0$ is the union of all possible $\Omega_0$ sublevel sets, i.e.,

$\tilde{\Omega}_0 = \displaystyle\bigcup_{x_0 \in \mathcal{X}_0} \{ x \in \mathbb{R}^n \mid B(x) \leq B(x_0)\}$.

This new sublevel set is depicted below, painted in dark gray

Note that $\mathcal{X}_0 \subset \tilde{\Omega}_0$. Essentially, the zero level set of the barrier certificate $B$ separates an unsafe set, $\mathcal{X}_u$, from all system trajectories starting in the initial set $\mathcal{X}_0$, which are contained in $\tilde{\Omega}_0$, thus providing a proof of safety without requiring the computation of reachable sets. Personally, I like to think of this approach as a sophisticated generalization of the well-known separating hyperplane theorem.

At this point, you may be thinking that this framework is too good to be true. Instead of computing the flow or the reachable sets, all we need to do is find a function $B : \mathbb{R}^n \to \mathbb{R}$ that satisfies three inequalities, and then (voilà!) infinite-time safety of $(f, \mathcal{X}_0, \mathcal{X}_u)$ is certified! As it usually happens, the devil is in the details…

If finding Lyapunov functions [1] for low-dimensional dynamical systems is often “hard”, why should we expect the hunt for barrier certificates to be an “easy” endeavor? Quel panache! Are we merely transferring the complexity of the problem from the computation of reachable sets to the satisfaction of three inequalities? Will we fail to find barrier certificates due to excessive conservativeness? Should we abandon all hope? Please be patient, dear reader, for we will address these issues and alleviate your doubts in future posts ;-)

Next installment will be devoted to an example. до скорой встречи!

_________

References

[1] Hassan K. Khalil, Nonlinear Systems, 3rd edition, Prentice Hall.

[2] Stephen Prajna, Optimization-based methods for nonlinear and hybrid systems verification, Dissertation (Ph.D.), California Institute of Technology, 2005.