Energy Tank Framework for Robotic Safety

• Energy Tank Framework is an energy-based control method that uses an explicit energy reservoir to store and budget energy, ensuring safe robot interactions.
• It integrates with port-Hamiltonian and operational space models to dynamically scale control forces, maintaining passivity and stable performance.
• Empirical results in industrial and aerial setups demonstrate that real-time convex optimization and gain adaptation allow robots to comply with ISO energy limits.

The energy tank framework is a formal passivity-based control architecture designed to guarantee safe and stable physical interaction of robots with humans and environments by managing the energy flow between the robot and its controller. By introducing an explicit "tank" variable that stores and budgets energy, this framework enforces strict energetic bounds—typically imposed for safety according to standards such as ISO/TS 15066—in a minimally conservative manner, while permitting non-passive control objectives. It is applicable in collaborative manipulation scenarios, including industrial robotic arms and aerial manipulators, where direct energy constraints are necessary to prevent hazardous impacts without imposing excessively restrictive velocity or force limits (Benzi et al., 2023Brunner et al., 2022).

1. Mathematical Foundation of the Energy Tank

At the core of the energy tank framework is a scalar tank state $x_t(t)\in\mathbb{R}$, which defines the stored energy as $T(x_t) = \frac{1}{2} x_t^2$ [Eq. (10), (Benzi et al., 2023)]. The tank possesses input-output (port) variables:

• Input: $u_t(t)$
• Output: $y_t(t) = \frac{\partial T}{\partial x_t} = x_t(t)$

The tank dynamics are: $\dot{x}_t(t) = u_t(t)$

$y_t(t) = x_t(t)$

so that the power exchanged between controller and tank is $u_t \cdot y_t$. To ensure passivity and avoid singularities, the energy is bounded below: $E_t(t) = \frac{1}{2} x_t(t)^2 \ge \epsilon > 0$ Analogously, upper bounds $E_{\max}$ can be imposed to prevent unbounded accumulation (Brunner et al., 2022).

This tank structure is interconnected with the robot dynamics in a modulated fashion, guaranteeing that the overall control system remains passive as long as the tank is non-empty. The framework is natively compatible with port-Hamiltonian robot models but is robust to modeling uncertainty (Benzi et al., 2023).

2. Power-Preserving Interconnection and Passivity

The robot is modeled in operational space as: $\Lambda(x) \ddot{x} + S(x,\dot{x}) \dot{x} = F$ with kinetic energy $$H(\dot{x}) = \frac{1}{2} \dot{x}^{\top} \Lambda(x) \dot{x}$$, and the passive port defined by $F$ (generalized force) and $\dot{x}$ (velocity), such that $F^{\top} \dot{x} = \dot{H}$.

The desired controller force $F_c$ is coupled to the tank via a power modulating interconnection. For example, imposing $F_c(t) = \gamma(t)$ while maintaining passivity necessitates scaling $\gamma(t)$ by the current tank state: $$F_c(t) = a(t) x_t(t) \qquad \text{with}\quad a(t) = \frac{\gamma(t)}{x_t(t)}$$ Thus, the robot "sees" $F_c$, and the tank "sees" the corresponding modulated power port. The passivity of the combined system is formally guaranteed provided the tank is non-empty [Prop. 1, (Benzi et al., 2023)].

A similar structure is used for aerial manipulation, where the tank absorbs energy dissipated by impedance and observer damping and supplies it to passivity-violating control modules (e.g., wrench tracking, impedance springs) (Brunner et al., 2022).

3. Enforcement of Energy Constraints and Adaptation Policies

For safety-critical applications such as human-robot collaboration, standards (e.g., ISO/TS 15066) specify energetic limits: $E_{\text{max}} = \frac{f_{\text{max}}^2}{2k}$ where $f_{\text{max}}$ is the regional pain threshold and $k$ the biomechanical stiffness [Eq. (1), (Benzi et al., 2023)]. The tank framework directly enforces the kinetic energy constraint $H(\dot{x}(t)) \le \bar{H} := E_{\text{max}}$, with the tank storing exactly the available "slack" energy.

Enforcement strategies include:

• Solving at each step a convex program to scale input commands (e.g., minimize $\|\alpha F_{\text{des}} - F_{\text{des}}\|^2$ subject to the tank not emptying; $\alpha \in [0,1]$) [Eq. (19), (Benzi et al., 2023)].
• Channeling interaction energy from external wrenches into the tank, with "emergency dampers" activated when needed (e.g., $b \dot{x}^T \dot{x}$ terms for injecting/extracting energy safely).
• In aerial manipulation, passivity-violating power flows $\{p_i\}$ are scaled by gains $\gamma_i\in[0,1]$, selected using adaptation policies:
  • Individual Gain Scaling (IGS)
  • Weighted Gain Scaling (WGS)
  • Sequential Gain Assignment (SGA)
• Lower-limit scaling gain $\alpha(E_t)$ prevents drain below $E_{\min}$.

These mechanisms ensure all commanded forces or wrenches comply with the energetic budget while maintaining control task performance whenever possible.

4. Control Architecture and Implementation

The energy tank framework is realized as a two-part architecture: initialization and run-time modulation.

Initialization

• Set $\epsilon > 0$
• Measure initial kinetic energy $H(0)$
• Initialize tank energy as $T(0) = \bar{H} - H(0) + \epsilon$ so that the total available energy is at the safety bound

Run-Time Operation

• Monitor the energy balance: $\dot{H}(t) + \dot{T}(t) = 0$ in free motion
• At every control step, solve for scaling parameters (e.g., $\alpha$) so tank never empties
• If interacting externally, energy from $F_e$ is routed to or from the tank, with immediate effect
• If safety bounds change (e.g., closest human body region changes), update allowable tank energy on-the-fly

In discrete time, smooth scaling and low-pass filtering are used to prevent chattering in adaptation gains ($\gamma_i$). Real-time implementation requires control solutions at the hardware rate (1 kHz typical for robot arms, lower rates for some UAVs) (Benzi et al., 2023Brunner et al., 2022).

5. Empirical Evaluation and Performance

The energy tank framework has been validated in simulation and physical tasks:

• Industrial Manipulator Scenario: KUKA LWR 4+ (7-DOF), point-to-point Cartesian motions under PD control. Safety bounds derive from closest body regions (chest or shoulders), resulting in $E_{\text{max},1} = 1.6$ J, $v_{\text{max},1} = 0.29$ m/s; $E_{\text{max},2} = 2.5$ J, $v_{\text{max},2} = 0.37$ m/s. The framework ensures kinetic energy $H(t) \leq E_{\text{max}}$, permitting Cartesian speeds above conservative velocity limits where safe to do so. When $H\rightarrow E_{\text{max}}$, the framework smoothly scales down input commands, guaranteeing safety while maximizing performance (Benzi et al., 2023).
• Aerial Manipulation Scenario: Omnidirectional MAV with a 6-DOF end-effector, manipulating a cart of unknown mass and friction. Real-time wrench estimation and adaptation policies maintain system passivity and stability with only minimal model knowledge. When subjected to unanticipated disturbances, the tank safely throttles command flows, avoiding catastrophic emptying and capping interaction power (Brunner et al., 2022).

A table summarizing implementation and results across these studies:

Platform	Safety Limit Source	Enforcement Mechanism
KUKA LWR 4+ arm	ISO/TS 15066 (body region)	Tank limits $H+\mathcal{T}\le E_{\text{max}}$, $\alpha$-scaling PD force
OMAV + cart	No a priori environment	Tanked adaptation, $\gamma_i$ scaling, momentum observer

6. Advantages, Limitations, and Real-World Considerations

Advantages:

• Direct enforcement of energetic constraints (e.g., ISO/TS 15066) without reliance on conservative velocity caps or inelastic collision assumptions.
• Certified closed-loop passivity and stability, irrespective of uncertainties in robot inertia or damping parameters.
• Model-agnostic with respect to both the controlled plant and the environment; robust to parameter mismatch.
• Supports time-varying safety bounds and safe energy re-routing during external interaction in a unified manner.

Limitations:

• Requires accurate, real-time measurement of robot velocity and, critically, external wrenches.
• Tuning of tank lower bound $\epsilon$ is required; too large reduces task energy, too small risks numerical issues.
• Needs practical upper cap on tank energy to prevent overflow if the system is highly dissipative.
• Sustained near-limit operation will result in throttled control action and degraded performance.

Implementation Considerations:

• Reliable force sensing or estimation is essential for interaction energy management.
• Convex optimization routines must meet real-time constraints.
• Friction, unmodeled system compliance, or discretization introduces extra dissipation—harvested by the tank—generally contributing positively to safety.
• Experimental validation in hardware is needed to address practical tuning and deployment challenges, including selection of tank parameters and thresholds (Benzi et al., 2023Brunner et al., 2022).

7. Comparison to Standard Approaches and Outlook

Traditional safety enforcement utilizes velocity or force limits derived from worst-case modeling assumptions, often resulting in unnecessarily conservative robot behavior. The energy tank framework allows direct enforcement of energy-based safety limits, realizes better utilization of the robot's dynamic capabilities, and maintains guaranteed safety margins under arbitrary (passive) environmental interactions. This removes the need for detailed environment or robot modeling, as passivity alone ensures safe behavior. A plausible implication is that the tank-based approach generalizes readily to any multi-port physical human-robot interaction scenario.

The framework has been instantiated on both fixed-base and aerial platforms. The flexibility to implement various adaptation policies (IGS, WGS, SGA) for different subsystems or priorities illustrates its extensibility (Brunner et al., 2022).

Experimental extension, parameter tuning, and the development of best practices for setting tank bounds under varying task demands remain active research areas. Its integration into future collaborative automation and co-manipulation systems is anticipated, contingent on robust and validated sensor and estimation infrastructure.

---

Key references:

"Energy Tank-based Control Framework for Satisfying the ISO/TS 15066 Constraint" (Benzi et al., 2023) "Energy Tank-Based Policies for Robust Aerial Physical Interaction with Moving Objects" (Brunner et al., 2022)