Distributed Safety-Critical MPC

• Distributed Safety-Critical MPC is a framework that enforces safety in multi-agent systems using local MPC with coordinated predictions and robust constraints.
• It integrates methods like prediction synchronization, consistency constraints, and tube-based certification to handle collision avoidance and connectivity requirements.
• DSMPC has been validated in domains such as UAV swarms, autonomous vehicles, and robot teams, ensuring recursive feasibility and formal safety guarantees.

Searching arXiv for recent and representative work on distributed safety-critical MPC and closely related distributed MPC safety formulations. Distributed Safety-Critical Model Predictive Control (DSMPC) is about enforcing safety—such as collision avoidance, respecting physical limits, connectivity preservation, or probabilistic risk bounds—in systems where multiple agents make decisions using distributed MPC rather than a single centralized optimizer. In this setting, each subsystem solves a local optimal control problem using local models, neighbor information, and communication-constrained coordination, while safety is encoded through hard state/input/coupling constraints, invariant sets, tightened chance constraints, or barrier-function conditions. Across recent work, DSMPC appears in synchronization-based cooperative DMPC, consistency-constraint formulations for coupled state constraints, robust and stochastic tube-based schemes, safety certification layers for learning-based control, event-triggered swarm MPC, covariance-steering MPC, adaptive MPC, and CBF-augmented nonlinear MPC for legged multi-robot systems (Beerwerth et al., 2024, Wiltz et al., 2022, Muntwiler et al., 2019).

1. Problem class and formal setting

DSMPC is typically posed over a network of agents indexed by a graph. A representative formulation models the interaction topology by an undirected coupling graph

$$\mathcal{G} = (\mathcal{V}, \mathcal{E}, \mathcal{W}),$$

with vertices as agents, edges as couplings, and weights used in local objectives or synchronization rules. Agent $i$ has local dynamics

$x_i(k+1) = f_i(x_i(k),u_i(k)),$

or, in linear settings,

$x_i(k+1)=A_i x_i(k)+B_i u_i(k),$

while safety enters through local state constraints $x_i(k)\in\mathcal{X}_i$, input constraints $u_i(k)\in\mathcal{U}_i$, and coupling constraints such as collision avoidance, spacing, or shared-resource limits (Beerwerth et al., 2024, Wiltz et al., 2022).

The defining complication is that the optimization is distributed but the safety specification is not fully separable. Coupling state constraints may require

$(x_1(k),\dots,x_M(k)) \in \mathcal{X}_c,$

pairwise collision constraints may require $\|p_i-p_j\| \ge d_{\min}$, connectivity-constrained formulations may require

$\lambda_2(L(x(k))) \ge \underline{\lambda}_2,$

and stochastic variants may impose chance constraints on collision probabilities or input magnitudes (Wiltz et al., 2022, Carron et al., 2023, Saravanos et al., 2022). Inference: this suggests that DSMPC is less a single algorithm than a class of MPC architectures for distributed decision-making under coupled safety requirements.

Representative formulations differ mainly in how they reconcile locality of computation with nonlocal safety coupling.

Representative approach	Safety mechanism	Distributed feature
"Synchronization-Based Cooperative Distributed Model Predictive Control" (Beerwerth et al., 2024)	synchronized predicted trajectories; coupling constraints	local CDMPC plus prediction synchronization
"A Consistency Constraint-Based Approach to Coupled State Constraints in Distributed Model Predictive Control" (Wiltz et al., 2022)	consistency constraints around reference trajectories	neighbor-to-neighbor communication; parallel local solves
"Multi-agent Distributed Model Predictive Control with Connectivity Constraint" (Carron et al., 2023)	state/input constraints, collision avoidance, $\lambda_2(L)\ge \underline{\lambda}_2$	SQP formulation amenable to distributed optimization
"Distributed Model Predictive Safety Certification for Learning-based Control" (Muntwiler et al., 2019)	distributed tube-based safety filter and RPI safe set	local certification around arbitrary learning inputs
"Robust distributed model predictive control of linear systems: analysis and synthesis" (Wang et al., 2020)	constraint tightening, locally robust terminal sets	separable terminal costs and local robust sets
"Distributed and Localized Model Predictive Control. Part I: Synthesis and Implementation" (Alonso et al., 2021)	robust constraint handling under disturbances	localized SLS formulation and ADMM
"Event-triggered and distributed model predictive control for guaranteed collision avoidance in UAV swarms" (Gräfe et al., 2022)	TV-BVC collision constraints, terminal stopping	event-triggered replanning with multiple computation units
"Distributed Model Predictive Covariance Steering" (Saravanos et al., 2022)	probabilistic safety via chance constraints	decentralized consensus-based ADMM
"A distributed framework for linear adaptive MPC" (Parsi et al., 2021)	robust tubes with online uncertainty reduction	distributed set-membership adaptation
"Safety-Critical and Distributed Nonlinear Predictive Controllers for Teams of Quadrupedal Robots" (Imran et al., 18 Mar 2025)	HOCBF constraints over NMPC horizon	distributed nonlinear MPC with one-step-delay communication

2. Why safety is difficult in distributed MPC

A central failure mode is prediction inconsistency. In cooperative DMPC, agent $i$0 predicts neighbor $i$1's trajectory as $i$2 and input as $i$3, while $i$4 simultaneously computes $i$5 and $i$6. An inconsistent solution occurs when

$i$7

If local collision-avoidance or proximity constraints are enforced against inconsistent predicted trajectories, each local MPC may be feasible while the real multi-agent execution violates the intended safety margin (Beerwerth et al., 2024). This directly refutes a common misconception that local feasibility of all subproblems is sufficient for distributed safety.

A second difficulty is that safety coupling is often nonseparable and sometimes nonconvex. In dynamically decoupled systems with coupled state constraints, the admissible joint state set $i$8 generally cannot be factorized as $i$9. Examples include collision avoidance, shared resource limits, and formation or spacing constraints. The consistency-constraint literature addresses exactly this regime: each subsystem remains near a communicated reference trajectory so that neighbors’ assumptions stay valid and the global coupled constraint remains satisfied (Wiltz et al., 2022).

A third difficulty is that “safety” can include communication topology itself. In connectivity-constrained multi-agent MPC, safety-critical constraints include not only state and input bounds but also maintenance of a connected communication graph, expressed by the algebraic connectivity condition $x_i(k+1) = f_i(x_i(k),u_i(k)),$0, typically tightened to $x_i(k+1) = f_i(x_i(k),u_i(k)),$1 for optimization (Carron et al., 2023). Inference: this broadens DSMPC beyond physical collision avoidance to network-operational safety.

A fourth difficulty arises when performance-oriented or learning-based controllers are used. Distributed algorithms reduce local computational load and memory usage, but an initially unsafe control policy can violate state and input constraints unless wrapped by a safety certification layer. The DMPSC formulation addresses this by embedding the learning-based action inside a distributed tube-based MPC backup law that defines a safe set and a safety control law (Muntwiler et al., 2019).

3. Core design mechanisms

One major DSMPC mechanism is synchronization of predicted states. In SCDMPC, each agent first solves a local CDMPC problem and then participates in a synchronization process that replaces inconsistent neighbor predictions by synchronized trajectories obtained from iterative weighted averaging over shared predictions. The synchronized prediction for a given agent is propagated over the coupling subgraph, and convergence holds if and only if each coupling sub-graph contains a spanning tree. In convex problems, the method terminates in one iteration consisting of CDMPC plus one synchronization pass (Beerwerth et al., 2024). Functionally, synchronization acts as a coordination layer restoring a common prediction basis for safety-critical constraints.

A second mechanism is consistency constraints around reference trajectories. Here, each subsystem maintains a reference trajectory $x_i(k+1) = f_i(x_i(k),u_i(k)),$2, communicates it to neighbors, and constrains its own predicted trajectory to remain in a neighborhood of that reference: $x_i(k+1) = f_i(x_i(k),u_i(k)),$3 Because neighbors reason about reference trajectories rather than exact future control inputs, the method can enforce coupled state constraints indirectly while retaining convex local optimization problems, even in the presence of non-convex state constraints. The reference trajectories are improved iteratively rather than being fixed, and neighbor-to-neighbor communication suffices (Wiltz et al., 2022).

A third mechanism is tube-based or invariant-set robustification. DMPSC constructs a distributed safe set $x_i(k+1) = f_i(x_i(k),u_i(k)),$4 as the feasible set of a distributed tube-MPC certification problem, uses a structured ellipsoidal robust positive invariant tube $x_i(k+1) = f_i(x_i(k),u_i(k)),$5, and computes a certified input $x_i(k+1) = f_i(x_i(k),u_i(k)),$6 that stays as close as possible to the learning-based input while guaranteeing state and input constraint satisfaction (Muntwiler et al., 2019). Robust DMPC of linear systems similarly uses an auxiliary feedback $x_i(k+1) = f_i(x_i(k),u_i(k)),$7, disturbance tubes

$x_i(k+1) = f_i(x_i(k),u_i(k)),$8

tightened constraints $x_i(k+1) = f_i(x_i(k),u_i(k)),$9, $x_i(k+1)=A_i x_i(k)+B_i u_i(k),$0, and locally robust adaptive terminal sets $x_i(k+1)=A_i x_i(k)+B_i u_i(k),$1 (Wang et al., 2020). Distributed adaptive MPC extends this template by shrinking the uncertainty set online through decentralized or distributed set-membership identification while preserving robust feasibility and safety (Parsi et al., 2021).

A fourth mechanism is locality-preserving closed-loop synthesis. DLMPC reformulates robust distributed MPC through System Level Synthesis, parameterizing closed-loop disturbance responses $x_i(k+1)=A_i x_i(k)+B_i u_i(k),$2 rather than open-loop control sequences. Localized communication constraints become affine structural constraints on $x_i(k+1)=A_i x_i(k)+B_i u_i(k),$3, and ADMM yields distributed subproblems whose complexity is independent of the global system size (Alonso et al., 2021). This is a different route to DSMPC: instead of coordinating nominal trajectory guesses, it constrains the closed-loop map itself.

A fifth mechanism is explicit barrier-function integration for nonlinear multi-agent systems. A recent explicit DSMPC formulation for nonlinear agents with high relative degree combines discrete-time HOCBFs with DCLF-based terminal constraints, estimated neighbor states, and a bound constraint limiting estimation errors. Safety is enforced by inequalities of the form

$x_i(k+1)=A_i x_i(k)+B_i u_i(k),$4

while convergence is shaped by a terminal inequality built from a DCLF and a contraction factor $x_i(k+1)=A_i x_i(k)+B_i u_i(k),$5 (Wang et al., 27 Aug 2025). Closely related work on quadrupedal teams embeds discrete-time HOCBF constraints directly into distributed nonlinear MPC over the full horizon, rather than using single-step CBF-QPs, thereby enforcing collision safety for underactuated legged robots over longer horizons (Imran et al., 18 Mar 2025).

A sixth mechanism is geometric or stochastic reformulation of safety. Event-triggered UAV swarm DMPC uses time-variant Buffered Voronoi Cell constraints derived from previously planned neighbor trajectories, together with a terminal stopping condition that permits safe trajectory reuse when replanning is skipped (Gräfe et al., 2022). DiMPCS instead steers state distributions using Wasserstein costs and imposes chance constraints for robot-obstacle and robot-robot safety, yielding a decentralized covariance-steering formulation solved by consensus ADMM (Saravanos et al., 2022).

4. Guarantees: feasibility, invariance, convergence, and risk

The strongest deterministic guarantee recurring in DSMPC is recursive feasibility. Consistency-constraint DMPC gives feasibility, recursive feasibility, closed-loop stability, and closed-loop satisfaction of both local and coupling constraints under its assumptions (Wiltz et al., 2022). Robust distributed MPC for disturbed linear systems proves recursive feasibility and input-to-state stability under separable terminal costs, local robust terminal sets, and constraint tightening (Wang et al., 2020). Distributed adaptive MPC preserves these guarantees while reducing uncertainty online, yielding robust constraint satisfaction, recursive feasibility, and finite gain $x_i(k+1)=A_i x_i(k)+B_i u_i(k),$6 stability (Parsi et al., 2021).

Prediction-consistency methods offer narrower but still important guarantees. For SCDMPC, synchronization converges if and only if each coupling sub-graph contains a spanning tree; for convex MPC problems, SCDMPC converges in one iteration; for non-convex problems, convergence to a feasible solution is tied to existence of a feasible centralized solution and suitable topology/weight conditions (Beerwerth et al., 2024). These are feasibility and consistency guarantees rather than full robust invariance results, but they target the specific distributed failure mode that otherwise undermines safety.

Connectivity-constrained distributed MPC extends the guarantee set to graph integrity. Under the standing assumptions and initial feasibility, the FHOCP is recursively feasible; for sufficiently large horizon $x_i(k+1)=A_i x_i(k)+B_i u_i(k),$7, the closed loop converges to the reference while satisfying the state, input, coupling, and generalized connectivity constraints $x_i(k+1)=A_i x_i(k)+B_i u_i(k),$8 for all $x_i(k+1)=A_i x_i(k)+B_i u_i(k),$9 (Carron et al., 2023). This is notable because the spectral connectivity constraint is nonlocal and nonconvex.

Safety filters and stochastic variants shift the guarantee language from deterministic invariance to robust or probabilistic certification. DMPSC proves that the feasible set $x_i(k)\in\mathcal{X}_i$0 is an RPI safe set under the safety control law $x_i(k)\in\mathcal{X}_i$1, so any learning-based controller wrapped by the certification layer satisfies state and input constraints despite bounded disturbances (Muntwiler et al., 2019). Data-driven distributed stochastic MPC guarantees recursive feasibility and closed-loop chance constraint satisfaction with confidence $x_i(k)\in\mathcal{X}_i$2, while avoiding the conservatism of worst-case robust formulations (Muntwiler et al., 2020). DiMPCS similarly encodes probabilistic safety through chance constraints and conservative tractable approximations, then enforces them in receding-horizon form (Saravanos et al., 2022).

For nonlinear safety-critical systems, barrier formulations provide set invariance. In the recent explicit DSMPC for high-relative-degree agents, feasibility and stability are established under a mild assumption together with an estimation-error bound and DCLF terminal constraint (Wang et al., 27 Aug 2025). In quadrupedal DNMPC, discrete-time HOCBF conditions $x_i(k)\in\mathcal{X}_i$3 imply forward invariance of local safe sets $x_i(k)\in\mathcal{X}_i$4, thereby providing formal robot-robot and robot-obstacle collision guarantees at the planning layer (Imran et al., 18 Mar 2025). Event-triggered UAV DMPC complements this with discrete-time recursive feasibility and collision separation, plus a design condition for continuous-time collision avoidance based on bounds on between-sample motion (Gräfe et al., 2022).

5. Communication, decomposition, and scalability

DSMPC architectures differ sharply in communication assumptions, but most are explicitly neighbor-based. In the consistency-constraint framework, neighbor-to-neighbor communication suffices and all subsystems solve their local optimization problem in parallel (Wiltz et al., 2022). In SCDMPC, each agent exchanges current states and predicted states with direct neighbors only, and the local problem size scales with the number of neighbors and the horizon rather than with the total number of agents (Beerwerth et al., 2024). DAMPC uses local or neighbor-shared parameter bounds, ADMM consensus on shared trajectory variables, and structural sparsity in $x_i(k)\in\mathcal{X}_i$5, $x_i(k)\in\mathcal{X}_i$6, and $x_i(k)\in\mathcal{X}_i$7 so that problem size grows linearly rather than combinatorially (Parsi et al., 2021).

For large-scale linear systems, DLMPC makes locality explicit at the controller-synthesis level. Only local state and model information need to be exchanged; ADMM subproblems are localized; and the computational complexity of the subproblems solved by each subsystem is independent of the size of the global system (Alonso et al., 2021). This is one of the clearest computational scalability results in the broader DSMPC landscape.

Event-triggered and stochastic formulations emphasize resource efficiency. In the UAV swarm architecture, path planning is offloaded to multiple ground-based computation units; at each round only a priority-selected subset of UAVs is replanned; non-replanned vehicles reuse safe previously planned trajectories; and simulations report savings of 60% of network traffic and required computational power while maintaining guaranteed feasible and collision-free trajectories for UAVs with linear dynamics (Gräfe et al., 2022). DiMPCS demonstrates multi-robot tasks with up to hundreds of robots via decentralized consensus ADMM and receding-horizon covariance steering (Saravanos et al., 2022).

A plausible implication is that future DSMPC implementations will increasingly combine two forms of parallelism: decomposition across agents and parallel evaluation of multiple safety-constrained candidate plans. A recent single-system MPC result shows that solving several MPC problems in parallel, each instantiating the safe-set constraint at a different time step along the horizon, can improve safety and performance; the paper explicitly discusses relevance to potential distributed, multi-agent extensions (Fontanari et al., 3 Sep 2025).

6. Application domains and empirical evidence

Automotive and CAV settings are prominent. SCDMPC is validated in the Cyber-Physical Mobility Lab on 1:18 scale connected and automated vehicles using a kinematic bicycle model, safety-distance coupling constraints, and formation-building on a $x_i(k)\in\mathcal{X}_i$8 area. It achieves path and speed tracking similar to centralized MPC, safe collision-free motion, and more slowly growing computation time as the number of vehicles increases (Beerwerth et al., 2024). Connectivity-constrained DMPC targets cooperative multi-agent robotics, with examples including 10 agents traversing a workspace with a circular obstacle while maintaining $x_i(k)\in\mathcal{X}_i$9, and a leader-follower scenario with 4 agents (Carron et al., 2023).

UAV and aerial-swarm applications highlight event-triggering and hybrid timing architectures. The event-triggered DMPC for UAV swarms models each vehicle by linear dynamics, uses TV-BVC collision constraints and a terminal stopping condition, and is demonstrated in simulation and hardware-in-the-loop. In the reported experiments, the priority-based trigger rule outperforms round-robin scheduling, about 98.5% of UAVs reach their target under PBT versus about 92.7% under round-robin, and the architecture saves about 60% of bandwidth and computing hardware in one 25-UAV configuration (Gräfe et al., 2022).

Safety certification and robustness have been tested on coupled linear benchmarks and infrastructure-scale problems. DMPSC is evaluated on a chain of 9 masses connected by springs and dampers, where the safety filter modifies unsafe learning-based inputs only when necessary and improves overall control performance compared to robust distributed MPC (Muntwiler et al., 2019). Robust distributed MPC is demonstrated on a mass-spring-damper chain with disturbances, where nominal DMPC violates constraints but the robust formulation maintains constraint satisfaction and converges toward the origin (Wang et al., 2020). Data-driven distributed stochastic MPC is demonstrated on temperature control of a large-scale data center subject to randomly varying computational loads, with exact closed-loop chance constraint satisfaction and complexity similar to nominal distributed MPC (Muntwiler et al., 2020).

Nonlinear robotics now provides explicit DSMPC demonstrations. The quadrupedal-robot framework integrates distributed nonlinear MPC, HOCBF collision safety, and whole-body control, and reports a 27.89% higher success rate than conventional NMPCs without CBF constraints in comparative analysis, together with hardware demonstrations involving two Unitree A1 robots under pushes, rough terrain, and uncertain obstacle information (Imran et al., 18 Mar 2025). Recent explicit nonlinear DSMPC for formation control and obstacle avoidance reports improved performance and reduced computation time compared to existing approaches in simulation, while combining discrete-time HOCBF safety constraints, DCLF terminal constraints, estimated neighbor states, and an estimation-error bound (Wang et al., 27 Aug 2025). DiMPCS adds a stochastic multi-robot perspective, with simulation tasks involving up to hundreds of robots and hardware results on a multi-robot platform (Saravanos et al., 2022).

7. Limitations, misconceptions, and open directions

Several assumptions recur across DSMPC formulations. Synchronization-based methods assume sufficiently connected coupling subgraphs, timely exchange of current and predicted states, and feasible centralized solutions in the non-convex case (Beerwerth et al., 2024). Consistency-constraint approaches assume correct models, local communication, feasible initialization, and properly chosen consistency margins (Wiltz et al., 2022). Tube-based safety certification assumes a distributed stabilizing feedback, full state measurement, bounded disturbances, and a structured RPI tube (Muntwiler et al., 2019). Stochastic methods rely on disturbance samples being representative and on chance-constraint approximations that are conservative by construction (Muntwiler et al., 2020, Saravanos et al., 2022).

One persistent misconception is that “distributed” and “safe” are almost automatic companions because local MPC naturally handles local constraints. The literature instead shows that DSMPC safety depends on specific mechanisms—prediction synchronization, reference consistency, robust tubes, barrier inequalities, spectral constraints, or certified backups—and that removing these mechanisms can produce infeasibility, collisions, or graph disconnection even when nominal local optimizations remain well behaved (Beerwerth et al., 2024, Carron et al., 2023). Another misconception is that a low-level safety filter can always compensate for an unsafe planner. In quadrupedal experiments, placing CBFs only at the whole-body control layer produced a much lower success rate than embedding CBF constraints directly into the distributed NMPC planner (Imran et al., 18 Mar 2025).

Open directions are stated explicitly in several papers. SCDMPC identifies communication delays and learning-based approaches as future topics and notes the absence of explicit robust or stochastic safety analysis in the extended abstract (Beerwerth et al., 2024). Consistency-constraint DMPC motivates robust formulations, formal verification, handling communication delays and failures, and runtime monitoring that checks whether actual trajectories remain inside designed consistency envelopes (Wiltz et al., 2022). Connectivity-constrained DMPC identifies robust and stochastic connectivity maintenance, invariant sets with connectivity, and integration with CBFs as natural extensions (Carron et al., 2023). DLMPC points toward nonlinear systems, richer disturbance models, and unreliable communication as open problems for distributed robust MPC (Alonso et al., 2021).

A plausible synthesis is that DSMPC research is converging toward hybrid architectures in which predictive optimization supplies long-horizon coordination, while explicit safety certificates—tubes, invariant sets, HOCBFs, or stochastic tightenings—supply local correctness conditions under communication and model uncertainty. Across the literature, the central design question is no longer whether safety should be encoded, but which safety mechanism yields the best trade-off among formal guarantees, conservatism, communication load, and real-time tractability for the target distributed system (Muntwiler et al., 2019, Wang et al., 27 Aug 2025).