Robust Safety Controllers (R-SCs)

• Robust Safety Controllers (R-SCs) are feedback mechanisms that guarantee safety under modeled uncertainties by enforcing forward invariance or avoiding unsafe sets through methods like control barrier functions and invariant-set techniques.
• They are synthesized via optimization frameworks such as quadratic programs, tube MPC, and data-driven SOS methods, balancing nominal performance with stringent safety guarantees.
• R-SCs robustly counteract uncertainties from disturbances, sensor/actuator delays, estimation errors, and perception gaps, ensuring safety certification even under worst-case conditions.

Searching arXiv for recent and foundational papers on robust safety controllers, control barrier functions, invariant-set methods, and related architectures. Robust Safety Controllers (R-SCs) are feedback laws, safety filters, or supervisory architectures whose defining objective is to preserve safety under explicitly modeled uncertainty. In the cited literature, safety is expressed either as forward invariance of a safe set, avoidance of an unsafe set from a designated initial set, or winning conditions in an adversarial game; robustness is expressed against bounded disturbances, model mismatch, state-estimation error, sensor and actuator delays, unknown parameters, or uncertainty in learned or black-box perception pipelines (Nanayakkara et al., 24 Aug 2025, Zhong et al., 2022, Nezami et al., 2022, Akbarzadeh et al., 2024, Lin et al., 18 Nov 2025). This suggests that “R-SC” is best treated as an umbrella category: different works instantiate it through control barrier functions, robust controlled invariant sets, discriminating kernels, predictive backup planners, or data-driven certificates, but they share the same core requirement that safety guarantees survive uncertainty.

1. Scope and problem formulations

A recurrent formulation represents safety through a continuously differentiable function $h$ and the superlevel set $S=\{x:h(x)\ge 0\}$. In this setting, the controller must ensure that trajectories remain in $S$, often while staying as close as possible to a nominal command (Nanayakkara et al., 24 Aug 2025). A second formulation separates an initial set $X_{\mathbf i}$ from one or more unsafe sets $X_{\mathbf u}$ by means of a robust control barrier certificate (R-CBC), so that all trajectories starting in $X_{\mathbf i}$ avoid $X_{\mathbf u}$ over a finite or infinite horizon (Ashoori et al., 2 Aug 2025). A third formulation expresses safety as robust controlled invariance or discriminating-kernel membership, requiring that every admissible disturbance can be countered by a control action that keeps the next state inside a certified invariant set (Liu et al., 2021, Kaynama et al., 2013). In adversarial settings, the same idea appears as a winning set in a safety game, with existential closure for system moves and universal closure against environment moves (Neider et al., 2019).

Formulation family	Certified safety object	Representative papers
Barrier-based	Safe-set superlevel set or unsafe-set separating certificate	(Nanayakkara et al., 24 Aug 2025, Wijk et al., 19 Mar 2025, Agrawal et al., 2022, Akbarzadeh et al., 2024, Ashoori et al., 2 Aug 2025)
Invariant-set / reachability-based	RCI set, discriminating kernel, or reachable tube	(Liu et al., 2021, Zhong et al., 2022, Kaynama et al., 2013)
Predictive / supervisory	Backup-safe region or robust MPC safety certificate	(Nezami et al., 2022, Brüdigam et al., 2022)
Game-theoretic / symbolic	Winning region and winning strategy	(Neider et al., 2019)

The uncertainty models vary substantially. Some papers assume unknown-but-bounded additive disturbances (Zhong et al., 2022), others bounded state-dependent uncertainty in both drift and input channels (Wei et al., 2022), multi-modal Gaussian dynamics uncertainty (Wei et al., 2023), constant but unknown parameters (Liu et al., 2023), partial-state measurements with observer error (Agrawal et al., 2022), or perception-induced state uncertainty modeled as an adversarial input in a Hamilton–Jacobi (HJ) reachability analysis (Lin et al., 18 Nov 2025). The common structural feature is that the controller is not merely nominally safe; it is required to remain safe for every uncertainty realization admitted by the model.

2. Core mathematical objects

In barrier-based R-SCs, robustness is typically obtained by strengthening the usual barrier inequality. For control-affine dynamics $\dot{x}=f(x)+g(x)u$, the Robust Control Barrier Function (R-CBF) condition of “Safety Under State Uncertainty: Robustifying Control Barrier Functions” requires

$$\sup_{u\in U} L_fh(x)+L_gh(x)u+\alpha(h(x)) \ge \rho(\|L_gh(x)\|),\quad \forall x,$$

where $\rho$ is a robustness function satisfying additional regularity properties (Nanayakkara et al., 24 Aug 2025). The added term $S=\{x:h(x)\ge 0\}$0 acts as a buffer against estimation-induced actuation error, and the paper proves two regimes: if the induced error is small enough, the original safe set $S=\{x:h(x)\ge 0\}$1 is forward invariant and asymptotically stable; if it is larger, an inflated set $S=\{x:h(x)\ge 0\}$2 becomes forward invariant and asymptotically stable instead (Nanayakkara et al., 24 Aug 2025). This distinction between preservation of the original set and preservation of an inflated set recurs across the literature.

Backup-control formulations replace a single local inequality by a certificate along a backup trajectory. In the disturbance-observer backup control barrier function (DO-bCBF) method, the online safe set is defined by requiring the estimated backup flow to remain safe over a horizon $S=\{x:h(x)\ge 0\}$3, with tightening terms $S=\{x:h(x)\ge 0\}$4 and $S=\{x:h(x)\ge 0\}$5 chosen from Lipschitz constants and a disturbance-estimation error bound (Wijk et al., 19 Mar 2025). The robustified set $S=\{x:h(x)\ge 0\}$6 is proved to be an inner approximation of the true disturbed safe set, $S=\{x:h(x)\ge 0\}$7, which is the key step that makes online flow simulation compatible with safety under unknown disturbances (Wijk et al., 19 Mar 2025).

Invariant-set methods use different objects but a comparable logic. For uncertain discrete-time linear systems, a $S=\{x:h(x)\ge 0\}$8-robust safety invariant ($S=\{x:h(x)\ge 0\}$9-RSI) set is an ellipsoid $S$0 such that $S$1 implies $S$2 for every disturbance $S$3 (Zhong et al., 2022). In compositional synthesis for interconnected linear systems, each subsystem computes a local robust controlled invariant set, and the Cartesian product of the corresponding local safety controllers yields a safety controller for the full network (Liu et al., 2021). In continuous-time linear systems with adversarial disturbance, the discriminating kernel plays the analogous role; the controller keeps the trajectory inside a conservative under-approximation of that kernel computed offline by piecewise-ellipsoidal reachability (Kaynama et al., 2013).

A distinct but closely related certificate is the robust control barrier certificate used for polynomial systems. In the physics-informed direct data-driven framework, an R-CBC $S$4 separates $S$5 from $S$6 and satisfies either a discrete-time contractive inequality

$S$7

under all admissible disturbances, or the continuous-time differential inequality $S$8 on the sublevel region below the unsafe threshold (Ashoori et al., 2 Aug 2025). Here safety is not full-set invariance; trajectories from $S$9 must simply avoid $X_{\mathbf i}$0. This is explicitly presented as less conservative than methods based on robust invariant sets (Ashoori et al., 2 Aug 2025).

3. Synthesis architectures and online control laws

A standard synthesis pattern is the minimally invasive quadratic program. In the R-CBF framework, one solves

$X_{\mathbf i}$1

subject to the robust barrier inequality, so the resulting controller acts as a safety filter around a nominal controller $X_{\mathbf i}$2 (Nanayakkara et al., 24 Aug 2025). The same structure appears in robust observer-controller interconnections, where the desired control $X_{\mathbf i}$3 is projected onto the set of controls that satisfy a barrier inequality tightened by observer error bounds (Agrawal et al., 2022). Robust CLF-CBF-QPs for dynamic robotics extend this idea to stability and safety simultaneously, adding robust CLF, robust CBF, and robustified state/input constraints under bounded model uncertainty (Nguyen et al., 2020).

Backup architectures constitute a second major pattern. DO-bCBF combines a primary controller $X_{\mathbf i}$4, a backup controller $X_{\mathbf i}$5, a disturbance observer, and a QP that enforces robustified backup-barrier constraints at discrete samples of a future horizon (Wijk et al., 19 Mar 2025). The Robust Safe Control Architecture (RSCA) for autonomous driving uses two tube MPCs: a Supervisor MPC that certifies the operating controller and produces a backup input, and a Controller MPC that takes over after a detection event (Nezami et al., 2022). The safe stochastic MPC wrapper follows a closely related logic: an optimistic stochastic MPC input is allowed only if the nominal successor lies in the shrunken robust safe region,

$X_{\mathbf i}$6

otherwise a robust backup MPC input is applied (Brüdigam et al., 2022).

A third architecture is explicit hybrid switching. The scalable continuous-time LTI method of (Kaynama et al., 2013) precomputes a safe reachable tube and switches between a performance mode and a safety mode. In safety mode, the control is chosen from the support function of the control ellipsoid in the direction that prevents growth of distance to the tube; a smoothed interpolation law is also given to obtain continuity across mode transitions (Kaynama et al., 2013). Symbolic safety-game synthesis has a comparable supervisory interpretation: once a winning set is learned, a memoryless winning strategy is extracted by choosing a successor that remains in the winning region at every system state (Neider et al., 2019).

4. Robustness channels: what the controllers are robust against

State uncertainty is a central channel. Standard CBFs assume exact state knowledge, but the R-CBF paper shows that using $X_{\mathbf i}$7 rather than $X_{\mathbf i}$8 induces an actuation perturbation $X_{\mathbf i}$9, which can destroy the nominal invariance condition unless an explicit robustness margin is built into the barrier inequality (Nanayakkara et al., 24 Aug 2025). “Safe and Robust Observer-Controller Synthesis using Control Barrier Functions” generalizes this to partial-state output feedback by co-designing the observer and controller; for ISS observers, the estimate must remain inside a tightened safe set $X_{\mathbf u}$0, and for bounded-error observers the controller must lie in the intersection $X_{\mathbf u}$1 of feasible control sets for all states consistent with the observer (Agrawal et al., 2022).

Unknown disturbances motivate a different mechanism. DO-bCBF uses a disturbance observer

$X_{\mathbf u}$2

and propagates the resulting estimation bound through the backup flow, producing tightening margins that decrease as the observer converges (Wijk et al., 19 Mar 2025). Robust CLF-CBF-QPs for robotics instead bound additive and multiplicative uncertainty terms $X_{\mathbf u}$3 in the derivatives of Lyapunov and barrier functions, then convert the worst-case conditions into linear inequalities usable in real-time optimization (Nguyen et al., 2020). For mixed-autonomy traffic, predictor-based robust safety-critical traffic control (RSTC) compensates actuator delay with a future-state predictor and adds robust CBF terms that account for bounded head-vehicle acceleration; with sensor delay, the predictor is combined with an observer whose estimation error decays exponentially (Zhao et al., 2023).

Several works target uncertainty that is not well described by a single bounded additive term. “Robust Safe Control with Multi-Modal Uncertainty” derives least-conservative robust safe control for additive multi-modal Gaussian uncertainty and locally least-conservative robust safe control for multiplicative uncertainty, with per-mode confidence allocation embedded in a chance-constrained QP or SOCP (Wei et al., 2023). “Synthesis and verification of robust-adaptive safe controllers” addresses constant but unknown parameters by coupling a parameter estimator with a robust-adaptive control barrier function (raCBF), producing a safety filter whose invariant set explicitly shrinks by $X_{\mathbf u}$4 according to estimation error (Liu et al., 2023). “Persistently Feasible Robust Safe Control by Safety Index Synthesis and Convex Semi-Infinite Programming” emphasizes a different issue: even if a robust barrier exists in principle, the safe input may be unrealizable under actuator limits, so the safety index itself must be synthesized to guarantee persistent feasibility under bounded state-dependent uncertainty (Wei et al., 2022).

Perception uncertainty introduces still another viewpoint. RoVer-CoRe is described primarily as a robust verification framework rather than a standalone online safety filter: it composes the plant, observation function, estimator, and controller into a closed-loop system compatible with HJ reachability, then treats perceptual error as an adversarial input (Lin et al., 18 Nov 2025). A plausible implication is that robust verification and robust controller synthesis are beginning to converge: the same reachable sets that certify failure avoidance can be used to tune controller parameters or light-activation policies under perceptual uncertainty (Lin et al., 18 Nov 2025).

5. Data-driven, learning-based, and compositional synthesis

Direct data-driven synthesis avoids explicit model identification. For unknown linear systems with unknown-but-bounded disturbance, the $X_{\mathbf u}$5-RSI framework computes an invariant ellipsoid and linear feedback law $X_{\mathbf u}$6 directly from a single input-state trajectory via LMIs (Zhong et al., 2022). For unknown discrete-time input-affine polynomial systems, robust control barrier certificates and polynomial robust safety controllers are learned from one persistently exciting trajectory through SOS constraints; the resulting controller is extracted directly from the same optimization that certifies the barrier decrease condition (Akbarzadeh et al., 2024). The physics-informed extension for nonlinear polynomial systems adds approximate first-principles dynamics as extra constraints on the admissible system matrices, which is reported to reduce data requirements substantially relative to purely data-driven synthesis (Ashoori et al., 2 Aug 2025).

Learning also appears at the symbolic and behavioral levels. In safety games over finite or infinite graphs, a reactive safety controller is synthesized by learning a decision-tree representation of the winning region from positive, negative, existential, and universal counterexamples supplied by a symbolic teacher (Neider et al., 2019). In safety-aware preference-based learning, the online safety layer is a tunable robustified SOCP based on CBFs, while Gaussian-process preference learning selects parameters $X_{\mathbf u}$7 that trade performance against robust safety (Cosner et al., 2021). This does not remove the safety filter; it tunes its conservatism. The paper explicitly reports that a conservative baseline action remains safe but fails to progress to the goal, whereas the learned parameters produce better performance with only minor safety violations during exploratory tuning (Cosner et al., 2021).

Compositionality addresses scalability rather than data scarcity. For interconnected discrete-time linear systems, local robust safety controllers are synthesized for subsystems under assume-guarantee bounds on interconnection variables, then composed into a global controller via Cartesian product (Liu et al., 2021). The paper proves that if every local controller is a safety controller for its subsystem, then the composed controller is a safety controller for the full interconnected system (Liu et al., 2021). This is a precise form of decentralization: safety is certified locally but inherited globally.

6. Applications, empirical evidence, and recurring limitations

The application range is broad. Robust CLF-CBF-QPs were evaluated on dynamic walking of the RABBIT planar five-link biped, where the robust controller maintained tracking and contact constraints under load uncertainty up to about $X_{\mathbf u}$8 kg, roughly $X_{\mathbf u}$9 of robot weight, and achieved about $X_{\mathbf i}$0 success versus about $X_{\mathbf i}$1 for the nominal CBF-CLF-QP in randomized footstep experiments (Nguyen et al., 2020). The same paper reports spring-cart experiments implemented in LabVIEW with a CVXGEN-generated QP solver at $X_{\mathbf i}$2 Hz, where the robust CBF-CLF-QP maintained the safety constraint $X_{\mathbf i}$3 cm across six uncertainty and perturbation cases (Nguyen et al., 2020).

Autonomous-driving and traffic-control results illustrate the supervisory and delay-robust strands. RSCA was validated in $X_{\mathbf i}$4 obstacle-avoidance scenarios with sampling time $X_{\mathbf i}$5 s and prediction horizon $X_{\mathbf i}$6; in a representative case, the Supervisor MPC detected an unsafe Pure Pursuit maneuver $X_{\mathbf i}$7 m before an obstacle at $X_{\mathbf i}$8 m/s, after which the Controller MPC safely overtook the obstacle and reached a safe reference (Nezami et al., 2022). The safe SMPC wrapper achieved zero constraint violations with average cost $X_{\mathbf i}$9, compared with $X_{\mathbf u}$0 and $X_{\mathbf u}$1 violations/run for pure SMPC and $X_{\mathbf u}$2 with zero violations for pure RMPC (Brüdigam et al., 2022). In mixed-autonomy traffic, RSTC avoided rear-end collisions in unsafe scenarios with actuator delay $X_{\mathbf u}$3 s, sensor delay $X_{\mathbf u}$4 s, and bounded disturbances in a six-vehicle chain (Zhao et al., 2023).

Segway-based studies illustrate several robustness notions at once. Multi-Modal RSSA on a Segway reported a significantly reduced confidence bound in the gradient direction and a larger robust safe control set than a uni-modal baseline under additive uncertainty; in safety-index synthesis over $X_{\mathbf u}$5 sampled states, the learned probabilistically robust safety index achieved $X_{\mathbf u}$6 infeasible rate, leading to the conclusion

$X_{\mathbf u}$7

for the sampled setup (Wei et al., 2023). The state-uncertainty R-CBF paper also used a Segway model, comparing unsupervised LQR, standard CBF with true state, standard CBF with estimated state, R-CBF, and an ISSf-CBF baseline; the reported outcome is that regular CBF can violate safety under corrupted estimates, whereas R-CBF preserves the original safe set within its tolerated uncertainty regime (Nanayakkara et al., 24 Aug 2025).

A recurring empirical theme is that robustness does not eliminate conservatism; it redistributes it. Several papers explicitly argue that over-approximated uncertainty can make safe control unrealizable under control limits or unnecessarily shrink feasible input sets (Wei et al., 2022, Wei et al., 2023). Others show that adaptive or observer-based mechanisms reduce conservatism over time as estimates improve (Wijk et al., 19 Mar 2025, Liu et al., 2023). Yet the guarantees remain assumption-dependent: bounded disturbances, valid Lipschitz constants, full-row-rank or persistent-excitation conditions for direct data-driven schemes, accurate uncertainty sets, or finite-horizon reachability computations (Zhong et al., 2022, Akbarzadeh et al., 2024, Lin et al., 18 Nov 2025). This suggests that the main controversy is not whether safety can be certified, but how much model structure, uncertainty information, and computational overhead are required to certify it without sacrificing too much permissiveness.

A final misconception is that R-SCs are synonymous with a single CBF-QP. The surveyed work does not support that view. Robust safety controllers include CLF-CBF-QPs (Nguyen et al., 2020), disturbance-observer backup CBFs (Wijk et al., 19 Mar 2025), supervisory and backup tube MPCs (Nezami et al., 2022), safe wrappers for stochastic MPC (Brüdigam et al., 2022), invariant-set and discriminating-kernel controllers (Zhong et al., 2022, Kaynama et al., 2013), game-based winning strategies (Neider et al., 2019), direct data-driven SOS controllers (Akbarzadeh et al., 2024), and risk-informed supervisory policies for collaborative robotics (Gleirscher et al., 2021). What unifies them is not syntax but certification: each architecture is constructed so that safety survives a specified uncertainty model.