Safe-Control: Invariance & Barrier Methods

• Safe-Control is a framework that defines safe sets through barrier functions to maintain system invariance under safety constraints.
• It employs methodologies like QP safety filters, MPC formulations, and robust optimization to minimally adjust nominal actions.
• Applications span robotics, human-robot interaction, and generative models, where safety is critical for performance and risk minimization.

Safe-control denotes a family of methods that enforce safety constraints during decision making by ensuring forward invariance of a prescribed safe set, typically while minimizing deviation from a nominal control objective. In the control-theoretic literature, the safe set is commonly written as $C=\{x\mid h(x)\ge 0\}$ for a barrier or safety function $h$, and safe-control synthesis spans quadratic-program safety filters, model-predictive formulations, Hamilton–Jacobi–Bellman constructions, mixed-integer optimization for neural dynamic models, and backstepping or passivity-based designs (Wei et al., 2021). The exact hyphenated form “Safe-Control” is also used for a plug-and-play safety patch for text-to-image generation models, where safety is enforced by injecting safety control signals into a locked denoiser rather than by modifying robot inputs (Meng et al., 28 Aug 2025).

1. Core mathematical formulation

A standard formulation defines a safe set through a continuously differentiable or twice-differentiable function $h$, with safety interpreted as forward invariance: once the state enters the set, the closed-loop system must never leave it. In continuous time, this is commonly enforced by a control barrier function condition of the form

$L_f h(x)+L_g h(x)\,u+\alpha(h(x))\ge 0,$

where $\alpha$ is an extended class-$\mathcal K$ function. In discrete time, related one-step constraints appear as

$\bar h(x_{t+1})-(1-\eta)\bar h(x_t)\ge 0$

or, for finite-time reentry,

$h(x_{k+1})\ge \max\{0,h(x_k)-\gamma\,dt\}.$

The latter ensures that if $h(x_k)<0$, the trajectory reenters the safe set in at most $\lceil -h(x_k)/(\gamma\,dt)\rceil$ steps (Wei et al., 2021).

This framework generalizes beyond relative-degree-one constraints. For quadrotor dynamics, altitude and lateral position barriers can have relative degrees $h$0 and $h$1, respectively, and are handled with Exponential Control Barrier Functions (ECBFs) of the form

$h$2

with $h$3 (Khan et al., 2019). Similar discrete-time barrier logic is used in language generation, where token selection is filtered by enforcing

$h$4

thereby preserving the nonnegativity of a verifier score over generated text (Miyaoka et al., 2024).

A recurrent point in the literature is that safety is not restricted to collision avoidance. Safe sets are used to encode position and velocity bounds, actuator and thrust-direction limits, safe following distances, passivity margins in physical human–robot interaction, and even user-desirable language or image-generation regions (Cortez et al., 2020). This suggests that safe-control is best understood as a set-invariance methodology rather than a single task-specific algorithm.

2. Synthesis paradigms and computational forms

The most common online mechanism is the safety filter: a controller that minimally modifies a nominal action when a barrier constraint is about to be violated. For multirotor reactive navigation, the filter solves

$h$5

and is inserted directly after the nominal position/velocity controller (Misyats et al., 22 Apr 2025). In environmentally uncertain settings, direct robustification of the barrier inequality leads to a second-order cone program because the worst-case residual contains the term $h$6; a two-stage alternative first computes a nominally safe input and then robustifies it through a simpler affine-constraint QP (Hamdipoor et al., 2023).

Safe-control has also been integrated with optimal control at the value-function level. In “HJB Based Optimal Safe Control Using Control Barrier Functions” (Almubarak et al., 2021), the infinite-horizon problem is written as an HJB minimization subject to a CBF constraint, and Karush–Kuhn–Tucker conditions yield a closed-form safe feedback law. The value function is then approximated by a modified Galerkin successive approximation initialized by a safe stabilizing controller, so that safety and asymptotic stabilization are addressed in a single construction (Almubarak et al., 2021).

Model-predictive variants separate optimistic performance-seeking control from guaranteed safety backup. “Safe Stochastic Model Predictive Control” (Brüdigam et al., 2022) combines a stochastic MPC with a robust backup MPC and switches according to whether the one-step predicted state lies in a backup-invariant set. The resulting scheme guarantees recursive feasibility, hard constraint satisfaction, and input-to-state stability of the origin, while retaining much of the efficiency of stochastic MPC (Brüdigam et al., 2022).

Data-driven and learned-model settings introduce additional computational structure. “Safe Control with Neural Network Dynamic Models” (Wei et al., 2021) proposes MIND-SIS, which synthesizes a safety index offline by CMA-ES and computes online safe optimal control by encoding ReLU neural dynamics exactly as a mixed-integer linear or quadratic program. In experiments with $h$7 ReLU nodes, each step took $h$8–$h$9 and the solver certified an optimality gap below $h$0 (Wei et al., 2021). For discrete-time nonlinear systems with polyhedral safe sets, “Non-Conservative Data-driven Safe Control Design for Nonlinear Systems with Polyhedral Safe Sets” (Modares et al., 12 May 2025) replaces cancellation-style design by a parameterization

$h$1

learns the nonlinear remainder in a control-oriented manner, and enforces $h$2-contractivity through a primal-dual convex program with linear constraints and small-dimensional LMI blocks (Modares et al., 12 May 2025).

3. Uncertainty, risk, and conservatism

A central problem in safe-control is conservatism. Classical robust methods often protect against worst-case disturbances by enlarging the safe set or shrinking the admissible input set, but several recent formulations make this trade-off tunable. “Safe Controller Synthesis with Tunable Input-to-State Safe Control Barrier Functions” (Alan et al., 2021) introduces TISSf-CBFs, where the disturbance accommodation term depends on the state through a positive function $h$3 rather than a constant gain. This yields an enlarged invariant set $h$4 whose margin depends on both the disturbance bound and the current barrier value, allowing less conservative safety buffers away from the boundary (Alan et al., 2021).

Chance-constrained formulations make the risk parameter explicit. “Safe Control Design through Risk-Tunable Control Barrier Functions” (Sharma et al., 2023) defines uncertain CBF constraints for systems

$h$5

and solves a sampled scenario program with user-chosen risk $h$6 and confidence $h$7. The sample complexity bound

$h$8

guarantees, with probability at least $h$9, that the scenario solution is an $L_f h(x)+L_g h(x)\,u+\alpha(h(x))\ge 0,$0-level safe control. The reported quadcopter navigation study shows the intended trade-off: smaller $L_f h(x)+L_g h(x)\,u+\alpha(h(x))\ge 0,$1 yields longer, more conservative trajectories but lower collision risk (Sharma et al., 2023).

Multi-modal uncertainty has motivated a different kind of non-conservative design. “Robust Safe Control with Multi-Modal Uncertainty” (Wei et al., 2023) considers additive and multiplicative Gaussian mixtures, allocates failure probability non-uniformly across modes, and derives a least-conservative additive controller by equalizing the mode-wise bottleneck margins subject to a total probability budget. The same work proposes a sampling-based safety-index synthesis method, and reports that a learned safety index produced zero infeasible states out of $L_f h(x)+L_g h(x)\,u+\alpha(h(x))\ge 0,$2 samples, certifying $L_f h(x)+L_g h(x)\,u+\alpha(h(x))\ge 0,$3 (Wei et al., 2023).

The literature also shows that conservatism can be strategically counterproductive in interactive settings. “Rethinking Safe Control in the Presence of Self-Seeking Humans” (Zhang et al., 2022) models human strategy adaptation through replicator, Brown–von Neumann–Nash, and Smith dynamics, and proves that a deterministic worst-case safe controller with $L_f h(x)+L_g h(x)\,u+\alpha(h(x))\ge 0,$4 drives the human cooperation probability to $L_f h(x)+L_g h(x)\,u+\alpha(h(x))\ge 0,$5 in the limit. The paper’s conclusion is not that safety constraints are misplaced, but that human adaptation changes the safe-control design problem itself: a controller that is safe against worst-case human uncertainty may increase long-run risk if humans learn to exploit it (Zhang et al., 2022).

4. Architectures on robotic and mechanical systems

A large body of safe-control work is organized around specific robotic architectures. In SE(3) quadrotor control, barrier functions have been embedded into a two-loop cascaded design, with one QP modifying nominal thrust for altitude safety and a second QP modifying nominal lateral torques for planar safety. The safe region is the intersection of altitude and lateral position–velocity sets, and the paper explicitly shows that the intersection of these forward-invariant subsets remains forward-invariant for the full quadrotor motion (Khan et al., 2019).

A different implementation strategy is mapless embedded safety filtering. “Embedded Safe Reactive Navigation for Multirotors Systems using Control Barrier Functions” (Misyats et al., 22 Apr 2025) constructs a composite obstacle-avoidance CBF directly from onboard range measurements, builds a soft minimum over the individual obstacle barriers, and solves a small QP on acceleration setpoints inside the PX4 stack. The filter runs at the position controller’s $L_f h(x)+L_g h(x)\,u+\alpha(h(x))\ge 0,$6 loop, with typical solve time below $L_f h(x)+L_g h(x)\,u+\alpha(h(x))\ge 0,$7 even with field-of-view constraints and up to $L_f h(x)+L_g h(x)\,u+\alpha(h(x))\ge 0,$8 obstacle points (Misyats et al., 22 Apr 2025). This suggests that formal safety filters can be deployed inside widely used autopilot stacks without requiring full localization and mapping.

For Euler–Lagrange and general mechanical systems, safe-control often uses decomposition or closed-form shaping rather than only online optimization. “Safe Control of Euler-Lagrange Systems with Limited Model Information” (Wang et al., 2023) decomposes the dynamics into a proxy subsystem and a virtual tracking subsystem, uses a barrier Lyapunov function to keep the safe velocity tracking error strictly bounded by a user-chosen radius $L_f h(x)+L_g h(x)\,u+\alpha(h(x))\ge 0,$9, and enforces set invariance through a CBF-QP on the proxy dynamics. “Safe, Passive Control for Mechanical Systems with Application to Physical Human-Robot Interactions” (Cortez et al., 2020) derives a closed-form safety layer

$\alpha$0

where the storage function $\alpha$1 satisfies $\alpha$2 outside the safe set, establishing passivity with input $\alpha$3 and output $\alpha$4 (Cortez et al., 2020).

Path-following formulations replace direct control filtering by time reparameterization. “Time Governors for Safe Path-Following Control” (Arslan, 2022) introduces a dynamical law $\alpha$5 that slows or halts progression along a collision-free reference path whenever a feedback motion predictor approaches the obstacle boundary. Motion prediction can be based on Lyapunov ellipsoids or Vandermonde simplexes, and the framework proves both collision avoidance and convergence to the terminal path parameter $\alpha$6 (Arslan, 2022).

Safe-control has also been extended to attacked sensing pipelines. “Barrier Certificate based Safe Control for LiDAR-based Systems under Sensor Faults and Attacks” (Zhang et al., 2022) combines a bank of EKFs, LiDAR scan reconstruction from a known map, sector-wise removal of spoofed LiDAR regions, and a discrete-time control barrier certificate satisfying

$\alpha$7

If $\alpha$8, the resulting guarantee is

$\alpha$9

and the UAV delivery example shows safe navigation under combined INS spoofing and LiDAR ghost-point injection, whereas the baseline crashes (Zhang et al., 2022).

5. Benchmarking, metrics, and empirical characterization

The safe-control literature increasingly emphasizes reproducible evaluation. “safe-control-gym: a Unified Benchmark Suite for Safe Learning-based Control and Reinforcement Learning in Robotics” (Yuan et al., 2021) provides an open-source benchmark suite based on PyBullet and CasADi, implements cart-pole, 1D quadrotor, and 2D quadrotor environments, and extends the Gym API with symbolic dynamics, symbolic costs, explicit constraints, and repeatable disturbance injection. Safety is quantified by constraint-violation rate and cumulative risk, while performance and learning efficiency are measured by RMSE, cumulative quadratic cost, and simulation time to reach a performance threshold (Yuan et al., 2021).

The benchmark is explicitly designed to compare traditional control, learning-based control, and reinforcement learning on the same disturbances and tasks. It includes LQR, iLQR, linear and nonlinear MPC, GP-MPC, PPO, SAC, safety-layer PPO, robust adversarial RL, model predictive safety certification, and CBF-QPs (Yuan et al., 2021). Reported observations are that GP-MPC reaches near-optimal RMSE with approximately $\mathcal K$0 of simulation, PPO and SAC require approximately $\mathcal K$1–$\mathcal K$2, and GP-MPC plus CBF-based filters achieve near-zero violation rates after modest learning (Yuan et al., 2021).

Individual safe-control papers report complementary empirical patterns. MIND-SIS evaluates three neural network dynamic models on a $\mathcal K$3 unicycle, obtains machine-precision tracking error $\mathcal K$4 for the no-safety tracking problem, and reports on $\mathcal K$5 random collision-avoidance and safe-following tasks a $\mathcal K$6 success rate, $\mathcal K$7 barrier-violation, and $\mathcal K$8 infeasible steps, whereas the original index $\mathcal K$9 failed on at least $\bar h(x_{t+1})-(1-\eta)\bar h(x_t)\ge 0$0 of trials (Wei et al., 2021). In comparison studies, purely stochastic MPC is efficient but incurs violations, while robust MPC is safe but conservative; the safe-switching SMPC architecture lies between them, with average cost $\bar h(x_{t+1})-(1-\eta)\bar h(x_t)\ge 0$1 and zero violations, compared to $\bar h(x_{t+1})-(1-\eta)\bar h(x_t)\ge 0$2 with violations for pure SMPC and $\bar h(x_{t+1})-(1-\eta)\bar h(x_t)\ge 0$3 for pure robust MPC (Brüdigam et al., 2022).

A plausible implication is that empirical evaluation in safe-control is shifting from isolated trajectory plots toward standardized trade-offs among safety, feasibility, optimality, disturbance tolerance, and computational latency. The presence of symbolic APIs, reproducible disturbance channels, and solver-certified optimality gaps reflects that shift directly (Yuan et al., 2021).

6. Human-centered and generative extensions

Safe-control has expanded beyond classical robot dynamics into systems where the “state” includes human intent or generated content. In human–robot interaction, “Multimodal Safe Control for Human-Robot Interaction” (Pandya et al., 2023) models an unobserved discrete mode $\bar h(x_{t+1})-(1-\eta)\bar h(x_t)\ge 0$4 together with Gaussian uncertainty inside each mode, defines a joint safe set $\bar h(x_{t+1})-(1-\eta)\bar h(x_t)\ge 0$5, and constructs the Multimodal Safe Set Algorithm. Its optimal variant, O-MMSSA, allocates Gaussian-tail margins across modes through a belief-weighted constraint and, in simulations over $\bar h(x_{t+1})-(1-\eta)\bar h(x_t)\ge 0$6 runs, reaches $\bar h(x_{t+1})-(1-\eta)\bar h(x_t)\ge 0$7 robot goals on average with the lowest safety violations, outperforming both a unimodal baseline and a naive multimodal allocation (Pandya et al., 2023).

Language-generation work uses the same invariance logic at token level. “CBF-LLM: Safe Control for LLM Alignment” (Miyaoka et al., 2024) couples a Llama 3 token predictor with a RoBERTa-based verifier $\bar h(x_{t+1})-(1-\eta)\bar h(x_t)\ge 0$8 and zeros out any candidate token that violates the discrete-time CBF condition. The theorem is a direct induction argument: if $\bar h(x_{t+1})-(1-\eta)\bar h(x_t)\ge 0$9 and every appended token satisfies the barrier inequality, then $h(x_{k+1})\ge \max\{0,h(x_k)-\gamma\,dt\}.$0 for all $h(x_{k+1})\ge \max\{0,h(x_k)-\gamma\,dt\}.$1 (Miyaoka et al., 2024). In the reported sentiment-alignment experiment, the average number of disallowed tokens per generation is $h(x_{k+1})\ge \max\{0,h(x_k)-\gamma\,dt\}.$2 for a blacklist, $h(x_{k+1})\ge \max\{0,h(x_k)-\gamma\,dt\}.$3 for CBF with $h(x_{k+1})\ge \max\{0,h(x_k)-\gamma\,dt\}.$4, and $h(x_{k+1})\ge \max\{0,h(x_k)-\gamma\,dt\}.$5 for CBF with $h(x_{k+1})\ge \max\{0,h(x_k)-\gamma\,dt\}.$6, while uncontrolled runs can dip below zero (Miyaoka et al., 2024).

The exact title “Safe-Control” appears in text-to-image safety. “Safe-Control: A Safety Patch for Mitigating Unsafe Content in Text-to-Image Generation Models” (Meng et al., 28 Aug 2025) introduces an auxiliary patch network that injects a safety control signal $h(x_{k+1})\ge \max\{0,h(x_k)-\gamma\,dt\}.$7 into a locked diffusion denoiser conditioned on a safety instruction such as “Add clothing to the person in the image.” Individual safety patches can be merged by weighted averaging into a unified patch, and the method is evaluated on six public text-to-image backbones (Meng et al., 28 Aug 2025). Under three malicious prompt sets, the unified patch reduces the unsafe probability of Stable Diffusion v1.4 to $h(x_{k+1})\ge \max\{0,h(x_k)-\gamma\,dt\}.$8 on average; across six derivative backbones, nudity rates fall from $h(x_{k+1})\ge \max\{0,h(x_k)-\gamma\,dt\}.$9–$h(x_k)<0$0 to at most $h(x_k)<0$1 post-patch; and FID, LPIPS, and CLIPScore change by at most $h(x_k)<0$2 relative, indicating preservation of benign image quality and text alignment (Meng et al., 28 Aug 2025). The paper also reports $h(x_k)<0$3 unsafe under SneakyPrompt, compared with $h(x_k)<0$4 for the original model, and reductions from $h(x_k)<0$5 for violence and $h(x_k)<0$6 for nudity under Ring-A-Bell (Meng et al., 28 Aug 2025).

Taken together, these extensions show that safe-control is no longer confined to control-affine physical plants. The same structural ideas—safe sets, barrier-like certificates, minimally invasive intervention, risk allocation, and plug-in safety layers—now appear in human-aware planning, language-model alignment, and diffusion-model safety patches, with the exact implementation determined by whether the controlled object is a dynamical state, a token distribution, or a denoising feature stream (Miyaoka et al., 2024).