Control Sub-Barrier Certificate (CSBC)

• Control Sub-Barrier Certificate (CSBC) is a localized or inner safe-set barrier that certifies subsystem safety by incorporating interconnection gains and uncertainty.
• Various synthesis methods, such as SOS programming and learner-verifier frameworks, are employed to ensure forward invariance under both deterministic and stochastic conditions.
• CSBCs provide both probabilistic and deterministic safety guarantees, enabling scalable composition of local certificates into global control barrier certificates through small-gain conditions.

Searching arXiv for papers on control sub-barrier certificates and closely related barrier-certificate frameworks. Control Sub-Barrier Certificate (CSBC) denotes a subsystem-level or inner-safe-set barrier construct used to certify safety under control, especially in compositional and uncertainty-aware settings. The term is not introduced in "Fossil 2.0: Formal Certificate Synthesis for the Verification and Control of Dynamical Models" (Edwards et al., 2023), but that work provides the closest general mechanism for synthesizing controller-certificate pairs and verifying closed-loop barrier conditions over continuous- and discrete-time models. In the recent literature, CSBC is used explicitly for interconnected stochastic systems, where a local certificate for each subsystem is composed into a global control barrier certificate (CBC) under small-gain conditions (Zaker et al., 2024), for discrete-time stochastic networks against $\omega$-regular specifications (Anand et al., 2021), for large-scale stochastic systems with bounded-time logic specifications (Anand et al., 2021), and for large-scale stochastic switched systems with dwell-time constraints (Nejati et al., 2020). A related but distinct interpretation appears in robust adaptive discrete-time safety filtering, where an inner safe set induced by estimation uncertainty functions as a sub-barrier construction, although the paper does not explicitly define CSBC (Liu et al., 11 Aug 2025). Across these formulations, the common theme is that a CSBC certifies either a local subsystem safety property in the presence of interconnection inputs, or a stricter inner safe set whose forward invariance is enforced by a controller.

1. Terminological scope and conceptual variants

The term “Control Sub-Barrier Certificate” is used explicitly in compositional safety frameworks for interconnected stochastic systems. In that usage, a CSBC is a local barrier for a subsystem in an interconnected network that explicitly retains interconnection or disturbance gains in its inequalities, so that many subsystem certificates can be composed into a network-level CBC under small-gain conditions (Zaker et al., 2024). In discrete-time stochastic networks, the same terminology is used for subsystem certificates with internal inputs and outputs, where the expected one-step barrier change is bounded by a quadratic supply rate in the internal input and output (Anand et al., 2021).

A second usage is interpretive rather than terminological. In Fossil 2.0, the closest construct is a control-enabled barrier certificate whose safe region is specified by a superlevel set $\{x \mid h(x)\ge 0\}$ or a sublevel set $\{x \mid B(x)\le 0\}$ and whose forward invariance is guaranteed under a synthesized feedback controller (Edwards et al., 2023). This suggests that, in deterministic controller synthesis and formal verification, CSBC can be understood as a control-enabled barrier certificate in sublevel-set form.

A third usage arises in robust adaptive discrete-time barrier methods. There, the paper introduces adaptive inner safe sets

$S_t := \{x \in X \mid \mathcal{B}_t(x) \ge 0\},$

with

$$\mathcal{B}_t(x) := B(x) - \frac{1}{2}\tilde{\theta}_t^\top \Gamma^{-1}\tilde{\theta}_t,$$

and notes that $S_t \subset S$ unless the parameter error vanishes (Liu et al., 11 Aug 2025). Since the paper does not define CSBC explicitly, the sub-barrier interpretation is that the certificate guarantees positive invariance of an inner safe set contained in the nominal safe set.

These variants share a structural idea: the certificate is “sub-” either because it is local to a subsystem, because it retains interconnection gain terms rather than certifying the monolithic system directly, or because it certifies a tightened inner region rather than the full nominal safe set.

2. Deterministic barrier and control-barrier formulations

For continuous-time autonomous systems

$\dot{x}=f(x), \qquad x\in X\subset \mathbb{R}^n,$

a barrier certificate $h:X\to \mathbb{R}$ defines a safe set $S$ by $h(x)\ge 0$, with initialization, separation, and invariance conditions

$\{x \mid h(x)\ge 0\}$0

$\{x \mid h(x)\ge 0\}$1

$\{x \mid h(x)\ge 0\}$2

where $\{x \mid h(x)\ge 0\}$3 and $\{x \mid h(x)\ge 0\}$4 is an extended class-$\{x \mid h(x)\ge 0\}$5 function (Edwards et al., 2023). In affine-in-control systems,

$\{x \mid h(x)\ge 0\}$6

the control barrier function condition can be posed in existential form,

$\{x \mid h(x)\ge 0\}$7

or in synthesis form under a feedback law $\{x \mid h(x)\ge 0\}$8,

$\{x \mid h(x)\ge 0\}$9

(Edwards et al., 2023).

The sublevel-set form most closely aligned with the phrase “sub-barrier” replaces $\{x \mid B(x)\le 0\}$0 by a barrier $\{x \mid B(x)\le 0\}$1 and defines the safe set as

$\{x \mid B(x)\le 0\}$2

Then invariance can be enforced by

$\{x \mid B(x)\le 0\}$3

or, in closed loop,

$\{x \mid B(x)\le 0\}$4

(Edwards et al., 2023). This gives a precise deterministic CSBC interpretation: a sublevel-set barrier whose forward invariance is guaranteed under the synthesized controller.

Discrete-time analogues replace Lie derivatives by one-step differences. For autonomous dynamics $\{x \mid B(x)\le 0\}$5 and a superlevel safe set $\{x \mid B(x)\le 0\}$6, invariance is encoded by

$\{x \mid B(x)\le 0\}$7

For controlled dynamics $\{x \mid B(x)\le 0\}$8 under a policy $\{x \mid B(x)\le 0\}$9,

$S_t := \{x \in X \mid \mathcal{B}_t(x) \ge 0\},$0

In sublevel form,

$S_t := \{x \in X \mid \mathcal{B}_t(x) \ge 0\},$1

(Edwards et al., 2023).

A related stochastic finite-horizon formulation replaces pointwise invariance with an expected-evolution inequality. For continuous-time stochastic systems,

$S_t := \{x \in X \mid \mathcal{B}_t(x) \ge 0\},$2

the barrier generator condition

$S_t := \{x \in X \mid \mathcal{B}_t(x) \ge 0\},$3

bounds the expected growth of the barrier process and yields finite-horizon safety probability bounds (Santoyo et al., 2019). This suggests a broader interpretation in which “sub-barrier” refers not only to sublevel sets but also to a sub-solution inequality constraining expected barrier evolution.

3. Compositional CSBCs for interconnected stochastic and hybrid systems

In compositional stochastic safety, a CSBC is local by construction. For an augmented stochastic hybrid subsystem $S_t := \{x \in X \mid \mathcal{B}_t(x) \ge 0\},$4 with augmented state $S_t := \{x \in X \mid \mathcal{B}_t(x) \ge 0\},$5, initial set $S_t := \{x \in X \mid \mathcal{B}_t(x) \ge 0\},$6, and unsafe set $S_t := \{x \in X \mid \mathcal{B}_t(x) \ge 0\},$7, an augmented control sub-barrier certificate $S_t := \{x \in X \mid \mathcal{B}_t(x) \ge 0\},$8 satisfies

$S_t := \{x \in X \mid \mathcal{B}_t(x) \ge 0\},$9

$$\mathcal{B}_t(x) := B(x) - \frac{1}{2}\tilde{\theta}_t^\top \Gamma^{-1}\tilde{\theta}_t,$$0

$$\mathcal{B}_t(x) := B(x) - \frac{1}{2}\tilde{\theta}_t^\top \Gamma^{-1}\tilde{\theta}_t,$$1

and for all $$\mathcal{B}_t(x) := B(x) - \frac{1}{2}\tilde{\theta}_t^\top \Gamma^{-1}\tilde{\theta}_t,$$2, there exists $$\mathcal{B}_t(x) := B(x) - \frac{1}{2}\tilde{\theta}_t^\top \Gamma^{-1}\tilde{\theta}_t,$$3 such that for all $$\mathcal{B}_t(x) := B(x) - \frac{1}{2}\tilde{\theta}_t^\top \Gamma^{-1}\tilde{\theta}_t,$$4,

$$\mathcal{B}_t(x) := B(x) - \frac{1}{2}\tilde{\theta}_t^\top \Gamma^{-1}\tilde{\theta}_t,$$5

(Zaker et al., 2024). The term $$\mathcal{B}_t(x) := B(x) - \frac{1}{2}\tilde{\theta}_t^\top \Gamma^{-1}\tilde{\theta}_t,$$6 is the explicit interconnection gain that distinguishes the local sub-barrier from a monolithic global certificate.

The global A-CBC is then constructed as

$$\mathcal{B}_t(x) := B(x) - \frac{1}{2}\tilde{\theta}_t^\top \Gamma^{-1}\tilde{\theta}_t,$$7

provided the small-gain condition

$$\mathcal{B}_t(x) := B(x) - \frac{1}{2}\tilde{\theta}_t^\top \Gamma^{-1}\tilde{\theta}_t,$$8

and the separation condition

$$\mathcal{B}_t(x) := B(x) - \frac{1}{2}\tilde{\theta}_t^\top \Gamma^{-1}\tilde{\theta}_t,$$9

hold (Zaker et al., 2024). The resulting global certificate satisfies a one-step expected contraction inequality and yields finite-horizon and, when $S_t \subset S$0, infinite-horizon probabilistic safety bounds.

A closely related compositional structure appears for discrete-time stochastic systems with internal inputs and outputs. There, a subsystem CSBC $S_t \subset S$1 satisfies

$S_t \subset S$2

$S_t \subset S$3

and for all $S_t \subset S$4, there exists $S_t \subset S$5 such that for all $S_t \subset S$6,

$S_t \subset S$7

is upper bounded by a quadratic supply rate in $S_t \subset S$8 and $S_t \subset S$9 (Anand et al., 2021). Under the interconnection LMI

$\dot{x}=f(x), \qquad x\in X\subset \mathbb{R}^n,$0

and $\dot{x}=f(x), \qquad x\in X\subset \mathbb{R}^n,$1, the global CBC is the sum

$\dot{x}=f(x), \qquad x\in X\subset \mathbb{R}^n,$2

(Anand et al., 2021).

In large-scale stochastic switched systems, the subsystem object is an augmented pseudo-barrier certificate rather than a plain CSBC, but the paper explicitly maps it to subsystem-level “sub-barrier certificates.” For each augmented subsystem state $\dot{x}=f(x), \qquad x\in X\subset \mathbb{R}^n,$3, the APBC satisfies

$\dot{x}=f(x), \qquad x\in X\subset \mathbb{R}^n,$4

with initial and unsafe level-set conditions, and these local certificates are composed via max-type small-gain conditions into a global augmented barrier certificate (Nejati et al., 2020).

4. Construction and synthesis methodologies

Two synthesis paradigms dominate the literature summarized here: SMT-backed learner-verifier synthesis with neural templates, and SOS-based polynomial synthesis.

In Fossil 2.0, certificate and controller synthesis is performed through a counterexample-guided inductive synthesis loop. The certificate is parameterized as a feed-forward neural network $\dot{x}=f(x), \qquad x\in X\subset \mathbb{R}^n,$5 or $\dot{x}=f(x), \qquad x\in X\subset \mathbb{R}^n,$6, and when control is required, the feedback policy is parameterized as $\dot{x}=f(x), \qquad x\in X\subset \mathbb{R}^n,$7 (Edwards et al., 2023). The learner minimizes losses over sampled states that penalize violations of initialization, separation, or invariance, while the verifier encodes the negation of the barrier conditions over symbolic domains such as spheres, boxes, ellipsoids, or custom sets and checks satisfiability using Z3, dReal, or CVC5 (Edwards et al., 2023). For a closed-loop continuous-time barrier condition, the verifier checks

$\dot{x}=f(x), \qquad x\in X\subset \mathbb{R}^n,$8

If the formula is SAT, counterexamples are returned to the learner; if UNSAT, the certificate is proven over the specified dense domain (Edwards et al., 2023). Fossil synthesizes a feedback law concurrently with the certificate and verifies the closed-loop model; it does not synthesize existential control certificates of the form “$\dot{x}=f(x), \qquad x\in X\subset \mathbb{R}^n,$9 for each state” through online optimization (Edwards et al., 2023).

SOS synthesis is the dominant method in explicit CSBC papers. In the augmented stochastic hybrid setting, the paper computes subsystem CBCs via SOS and then lifts them to A-CSBCs through a scaling

$h:X\to \mathbb{R}$0

where $h:X\to \mathbb{R}$1 is chosen by cases depending on $h:X\to \mathbb{R}$2 and $h:X\to \mathbb{R}$3 (Zaker et al., 2024). The resulting A-CSBC parameters $h:X\to \mathbb{R}$4 are derived from the CBC parameters via inequalities in the proof of Theorem 5.2.

In the data-driven large-scale-network setting, the CSBC is constructed from a single noisy input-state trajectory per subsystem. The subsystem certificate is quadratic,

$h:X\to \mathbb{R}$5

and is obtained through a data-dependent SOS program involving a polynomial matrix $h:X\to \mathbb{R}$6, robustified matrix inequalities, and semialgebraic set constraints (Akbarzadeh et al., 13 Aug 2025). The local controller is also synthesized from the data matrices. This framework requires the rank condition

$h:X\to \mathbb{R}$7

for the trajectory monomial matrix (Akbarzadeh et al., 13 Aug 2025).

For discrete-time stochastic systems against $h:X\to \mathbb{R}$8-regular specifications, the paper combines ADMM with SOS. Local subsystem searches are performed in parallel to compute CSBCs and local controllers subject to consensus on compositionality variables, while a global SDP enforces the interconnection feasibility conditions (Anand et al., 2021). Another bounded-time compositional framework provides both SOS and CEGIS approaches for CSBC synthesis, with the global CBC obtained through a max-type small-gain construction (Anand et al., 2021).

Robust adaptive discrete-time safety filtering uses a different synthesis architecture. The barrier inequality defines a safe input set

$h:X\to \mathbb{R}$9

and the controller is the solution of the projection problem

$S$0

(Liu et al., 11 Aug 2025). This is a safety filter rather than an offline certificate-synthesis loop.

5. Probabilistic guarantees, logic specifications, and adaptive inner safe sets

One major distinction between CSBC formulations is the type of guarantee they provide. Deterministic formulations, including the control-enabled barrier constructions in Fossil 2.0, prove forward invariance and separation of safe and unsafe sets over the chosen domain (Edwards et al., 2023). In contrast, stochastic formulations often provide quantified probabilities of avoiding unsafe states over finite or infinite horizons.

For augmented stochastic hybrid systems, if $S$1 is an A-CBC, the finite-horizon safety bound is

$S$2

bounded by the two-case expression in equation (3.4), and when $S$3 the infinite-horizon bound becomes

$S$4

(Zaker et al., 2024). These are derived via supermartingale arguments on the barrier process.

In finite-time stochastic verification and control, the barrier process need only satisfy an expected-growth envelope. For continuous-time systems, if

$S$5

then the probability of reaching the unsafe region over a finite horizon is upper bounded by one of the expressions in Theorem 1, depending on the relation between $S$6 and $S$7 (Santoyo et al., 2019). The paper emphasizes that this state-dependent envelope generalizes c-martingale bounds and can be less conservative for larger noise levels (Santoyo et al., 2019).

For discrete-time stochastic systems under $S$8-regular specifications, local CSBCs are not only safety certificates but building blocks in an automata-guided synthesis pipeline. The specification is represented by a deterministic Streett automaton, decomposed into safety tasks on triples of automaton states, and a switching policy is synthesized from a switching automaton that routes among local CBCs and controllers (Anand et al., 2021). A related bounded-time framework uses deterministic finite automata over the complement specification, decomposes accepting runs into reachability elements, and derives a lower bound on the satisfaction probability of the original logic formula via a sum-product expression over reachability-task bounds (Anand et al., 2021).

Robust adaptive discrete-time certificates replace global invariance by sequential positive invariance of a time-varying family of inner safe sets. The adaptive barrier

$S$9

induces

$h(x)\ge 0$0

and the robust adaptive CBC condition ensures that if $h(x)\ge 0$1, then the closed-loop system is robustly safe with respect to $h(x)\ge 0$2 and hence with respect to $h(x)\ge 0$3 over the time interval (Liu et al., 11 Aug 2025). This supports an inner-set interpretation of CSBC: robustness is enforced by certifying a stricter sub-safe set that expands as uncertainty shrinks.

6. Case studies, scalability, and limitations

The reported case studies show that CSBC-style constructions are primarily motivated by scalability and by the need to retain explicit interconnection structure.

In the augmented stochastic hybrid framework, the compositional method was verified on an interconnected stochastic hybrid system composed of $h(x)\ge 0$4 nonlinear subsystems (Zaker et al., 2024). Each local CBC was synthesized as a degree-$h(x)\ge 0$5 polynomial in approximately $h(x)\ge 0$6 s with approximately $h(x)\ge 0$7 Mbit memory on a MacBook Pro M2 Max, and the compositional assembly scaled linearly with the number of subsystems (Zaker et al., 2024). Three parameter regimes were reported, with finite-horizon safety at $h(x)\ge 0$8 of at least $h(x)\ge 0$9, at least $\{x \mid h(x)\ge 0\}$00, and at least $\{x \mid h(x)\ge 0\}$01, respectively (Zaker et al., 2024).

In the data-driven compositional framework for unknown large-scale networks, the paper demonstrates tractability for networks with up to $\{x \mid h(x)\ge 0\}$02 subsystems and reports per-subsystem runtime and memory figures such as approximately $\{x \mid h(x)\ge 0\}$03 s and approximately $\{x \mid h(x)\ge 0\}$04 MB for fully connected Lorenz subsystems, approximately $\{x \mid h(x)\ge 0\}$05 s and approximately $\{x \mid h(x)\ge 0\}$06 MB for a spacecraft line network, and approximately $\{x \mid h(x)\ge 0\}$07 s and approximately $\{x \mid h(x)\ge 0\}$08 MB for a Duffing ring (Akbarzadeh et al., 13 Aug 2025). The global CBC is obtained by summing local CSBCs once the small-gain inequalities are satisfied (Akbarzadeh et al., 13 Aug 2025).

In discrete-time stochastic control against $\{x \mid h(x)\ge 0\}$09-regular specifications, a case study on room temperature regulation in a circular building with $\{x \mid h(x)\ge 0\}$10 rooms used fourth-order polynomial CSBCs, and the resulting global CBC yielded a violation bound of $\{x \mid h(x)\ge 0\}$11 for a representative safety task (Anand et al., 2021). In large-scale stochastic switched systems, the framework handled a room temperature network containing $\{x \mid h(x)\ge 0\}$12 rooms and a network of $\{x \mid h(x)\ge 0\}$13 switched subsystems with total dimension $\{x \mid h(x)\ge 0\}$14, providing finite-horizon safety probabilities of at least $\{x \mid h(x)\ge 0\}$15 and at least $\{x \mid h(x)\ge 0\}$16 in the reported settings (Nejati et al., 2020).

Fossil 2.0 reports improved synthesis on barrier benchmarks such as Barr1 and Barr3, with success rates up to $\{x \mid h(x)\ge 0\}$17 and significantly reduced times versus Fossil 1.0 (Edwards et al., 2023). It also reports a Reach-Avoid-Remain example for an inverted pendulum with friction, where a certificate and linear feedback controller were synthesized in approximately $\{x \mid h(x)\ge 0\}$18 s using dReal (Edwards et al., 2023). Although this is not phrased in CSBC terminology, it exemplifies the control-enabled barrier-certificate synthesis that underlies one deterministic interpretation of the concept.

Several limitations recur across the literature. SOS-based methods typically assume polynomial dynamics and semialgebraic sets, and can be conservative (Zaker et al., 2024, Akbarzadeh et al., 13 Aug 2025, Anand et al., 2021). Compositional small-gain conditions are sufficient rather than necessary, and can become restrictive under strong or dense interconnections (Zaker et al., 2024, Akbarzadeh et al., 13 Aug 2025). In the data-driven framework, the single-trajectory rank condition may fail if excitation is inadequate (Akbarzadeh et al., 13 Aug 2025). Robust adaptive discrete-time methods require bounded disturbances in a known polytope, an estimator that returns $\{x \mid h(x)\ge 0\}$19, $\{x \mid h(x)\ge 0\}$20, and error bounds, and can incur conservatism when $\{x \mid h(x)\ge 0\}$21 is used instead of $\{x \mid h(x)\ge 0\}$22 (Liu et al., 11 Aug 2025). Fossil’s learner-verifier loop is sound but not guaranteed to terminate, and dReal’s $\{x \mid h(x)\ge 0\}$23-satisfiability can require special handling near equilibria (Edwards et al., 2023).

A common misconception is that CSBC denotes a single standard mathematical object across all barrier-certificate research. The literature instead supports several technically distinct meanings. In compositional stochastic control, CSBC is explicitly a local subsystem certificate with interconnection gains (Zaker et al., 2024, Anand et al., 2021, Anand et al., 2021). In deterministic formal synthesis, the term is absent but can be mapped to a control-enabled sublevel-set barrier certificate verified on closed-loop dynamics (Edwards et al., 2023). In adaptive discrete-time safety filtering, the term is likewise absent, but the induced inner safe sets provide a natural sub-barrier interpretation (Liu et al., 11 Aug 2025). This suggests that CSBC is best treated as a family resemblance concept rather than a universally standardized definition.