---
title: 'Safe-Control: Invariance & Barrier Methods'
url: https://www.emergentmind.com/topics/safe-control
type: topic
---

# Safe-Control: Invariance & Barrier Methods

Safe-control denotes a family of methods that enforce safety constraints during decision making by ensuring forward invariance of a prescribed safe set, typically while minimizing deviation from a nominal control objective. In the control-theoretic literature, the safe set is commonly written as $C=\{x\mid h(x)\ge 0\}$ for a barrier or safety function $h$, and safe-control synthesis spans quadratic-program safety filters, model-predictive formulations, Hamilton–Jacobi–Bellman constructions, mixed-integer optimization for neural dynamic models, and backstepping or passivity-based designs [2110.01110]. The exact hyphenated form “Safe-Control” is also used for a plug-and-play safety patch for text-to-image generation models, where safety is enforced by injecting safety control signals into a locked denoiser rather than by modifying robot inputs [2508.21099].

## 1. Core mathematical formulation

A standard formulation defines a safe set through a continuously differentiable or twice-differentiable function $h$, with safety interpreted as forward invariance: once the state enters the set, the closed-loop system must never leave it. In continuous time, this is commonly enforced by a control barrier function condition of the form
$$
L_f h(x)+L_g h(x)\,u+\alpha(h(x))\ge 0,
$$
where $\alpha$ is an extended class-$\mathcal K$ function. In discrete time, related one-step constraints appear as
$$
\bar h(x_{t+1})-(1-\eta)\bar h(x_t)\ge 0
$$
or, for finite-time reentry,
$$
h(x_{k+1})\ge \max\{0,h(x_k)-\gamma\,dt\}.
$$
The latter ensures that if $h(x_k)<0$, the trajectory reenters the safe set in at most $\lceil -h(x_k)/(\gamma\,dt)\rceil$ steps [2110.01110].

This framework generalizes beyond relative-degree-one constraints. For quadrotor dynamics, altitude and lateral position barriers can have relative degrees $2$ and $4$, respectively, and are handled with Exponential Control Barrier Functions (ECBFs) of the form
$$
L_f^\delta h(x)+L_gL_f^{\delta-1}h(x)\,u+K^\top H\ge 0,
$$
with $H=[h,L_fh,\ldots,L_f^{\delta-1}h]^\top$ [1903.09711]. Similar discrete-time barrier logic is used in language generation, where token selection is filtered by enforcing
$$
h(x_{k+1})-h(x_k)\ge -\alpha\,h(x_k),
$$
thereby preserving the nonnegativity of a verifier score over generated text [2408.15625].

A recurrent point in the literature is that safety is not restricted to collision avoidance. Safe sets are used to encode position and velocity bounds, actuator and thrust-direction limits, safe following distances, passivity margins in physical human–robot interaction, and even user-desirable language or image-generation regions [2011.01810]. This suggests that safe-control is best understood as a set-invariance methodology rather than a single task-specific algorithm.

## 2. Synthesis paradigms and computational forms

The most common online mechanism is the safety filter: a controller that minimally modifies a nominal action when a barrier constraint is about to be violated. For multirotor reactive navigation, the filter solves
$$
u^*=\arg\min_{u\in U}\|u-u_{\rm nom}\|^2
\quad\text{s.t.}\quad
\dot h(x,u)+\alpha(h(x))\ge 0,
$$
and is inserted directly after the nominal position/velocity controller [2504.15850]. In environmentally uncertain settings, direct robustification of the barrier inequality leads to a second-order cone program because the worst-case residual contains the term $\|f+g\,u\|$; a two-stage alternative first computes a nominally safe input and then robustifies it through a simpler affine-constraint QP [2304.11600].

Safe-control has also been integrated with optimal control at the value-function level. In “HJB Based Optimal Safe Control Using Control Barrier Functions” [2106.15560], the infinite-horizon problem is written as an HJB minimization subject to a CBF constraint, and Karush–Kuhn–Tucker conditions yield a closed-form safe feedback law. The value function is then approximated by a modified Galerkin successive approximation initialized by a safe stabilizing controller, so that safety and asymptotic stabilization are addressed in a single construction [2106.15560].

Model-predictive variants separate optimistic performance-seeking control from guaranteed safety backup. “Safe Stochastic Model Predictive Control” [2204.06207] combines a stochastic MPC with a robust backup MPC and switches according to whether the one-step predicted state lies in a backup-invariant set. The resulting scheme guarantees recursive feasibility, hard constraint satisfaction, and input-to-state stability of the origin, while retaining much of the efficiency of stochastic MPC [2204.06207].

Data-driven and learned-model settings introduce additional computational structure. “Safe Control with Neural Network Dynamic Models” [2110.01110] proposes MIND-SIS, which synthesizes a safety index offline by CMA-ES and computes online safe optimal control by encoding ReLU neural dynamics exactly as a mixed-integer linear or quadratic program. In experiments with $O(100)$ ReLU nodes, each step took $0.3$–$0.8\,\mathrm{s}$ and the solver certified an optimality gap below $10^{-8}$ [2110.01110]. For discrete-time nonlinear systems with polyhedral safe sets, “Non-Conservative Data-driven Safe Control Design for Nonlinear Systems with Polyhedral Safe Sets” [2505.07733] replaces cancellation-style design by a parameterization
$$
u_k=K_1x_k+K_2Q(x_k),
$$
learns the nonlinear remainder in a control-oriented manner, and enforces $\lambda$-contractivity through a primal-dual convex program with linear constraints and small-dimensional LMI blocks [2505.07733].

## 3. Uncertainty, risk, and conservatism

A central problem in safe-control is conservatism. Classical robust methods often protect against worst-case disturbances by enlarging the safe set or shrinking the admissible input set, but several recent formulations make this trade-off tunable. “Safe Controller Synthesis with Tunable Input-to-State Safe Control Barrier Functions” [2103.08041] introduces TISSf-CBFs, where the disturbance accommodation term depends on the state through a positive function $\epsilon(h(x))$ rather than a constant gain. This yields an enlarged invariant set $C_{\delta,T}$ whose margin depends on both the disturbance bound and the current barrier value, allowing less conservative safety buffers away from the boundary [2103.08041].

Chance-constrained formulations make the risk parameter explicit. “Safe Control Design through Risk-Tunable Control Barrier Functions” [2309.10251] defines uncertain CBF constraints for systems
$$
x_{t+1}=f(x_t)+g(x_t)u_t+d_t
$$
and solves a sampled scenario program with user-chosen risk $\epsilon$ and confidence $\beta$. The sample complexity bound
$$
N \ge \frac{2}{\epsilon}\ln\frac1\beta +2m+\frac{2m}{\epsilon}\ln\frac1\beta
$$
guarantees, with probability at least $1-\beta$, that the scenario solution is an $\epsilon$-level safe control. The reported quadcopter navigation study shows the intended trade-off: smaller $\epsilon$ yields longer, more conservative trajectories but lower collision risk [2309.10251].

Multi-modal uncertainty has motivated a different kind of non-conservative design. “Robust Safe Control with Multi-Modal Uncertainty” [2309.16830] considers additive and multiplicative Gaussian mixtures, allocates failure probability non-uniformly across modes, and derives a least-conservative additive controller by equalizing the mode-wise bottleneck margins subject to a total probability budget. The same work proposes a sampling-based safety-index synthesis method, and reports that a learned safety index produced zero infeasible states out of $2.5\times 10^5$ samples, certifying $P[q\ge 99.99\%]\ge 99.9999\%$ [2309.16830].

The literature also shows that conservatism can be strategically counterproductive in interactive settings. “Rethinking Safe Control in the Presence of Self-Seeking Humans” [2212.00295] models human strategy adaptation through replicator, Brown–von Neumann–Nash, and Smith dynamics, and proves that a deterministic worst-case safe controller with $\pi^a\equiv 1$ drives the human cooperation probability to $0$ in the limit. The paper’s conclusion is not that safety constraints are misplaced, but that human adaptation changes the safe-control design problem itself: a controller that is safe against worst-case human uncertainty may increase long-run risk if humans learn to exploit it [2212.00295].

## 4. Architectures on robotic and mechanical systems

A large body of safe-control work is organized around specific robotic architectures. In SE(3) quadrotor control, barrier functions have been embedded into a two-loop cascaded design, with one QP modifying nominal thrust for altitude safety and a second QP modifying nominal lateral torques for planar safety. The safe region is the intersection of altitude and lateral position–velocity sets, and the paper explicitly shows that the intersection of these forward-invariant subsets remains forward-invariant for the full quadrotor motion [1903.09711].

A different implementation strategy is mapless embedded safety filtering. “Embedded Safe Reactive Navigation for Multirotors Systems using Control Barrier Functions” [2504.15850] constructs a composite obstacle-avoidance CBF directly from onboard range measurements, builds a soft minimum over the individual obstacle barriers, and solves a small QP on acceleration setpoints inside the PX4 stack. The filter runs at the position controller’s $100\,\mathrm{Hz}$ loop, with typical solve time below $2\,\mathrm{ms}$ even with field-of-view constraints and up to $100$ obstacle points [2504.15850]. This suggests that formal safety filters can be deployed inside widely used autopilot stacks without requiring full localization and mapping.

For Euler–Lagrange and general mechanical systems, safe-control often uses decomposition or closed-form shaping rather than only online optimization. “Safe Control of Euler-Lagrange Systems with Limited Model Information” [2309.04839] decomposes the dynamics into a proxy subsystem and a virtual tracking subsystem, uses a barrier Lyapunov function to keep the safe velocity tracking error strictly bounded by a user-chosen radius $L$, and enforces set invariance through a CBF-QP on the proxy dynamics. “Safe, Passive Control for Mechanical Systems with Application to Physical Human-Robot Interactions” [2011.01810] derives a closed-form safety layer
$$
u=(1-\phi_\varepsilon(h))(g+k_h\nabla c)+\phi_\varepsilon(h)\,u_{\rm nom},
$$
where the storage function $S=-h$ satisfies $\dot S\le v^\top\mu$ outside the safe set, establishing passivity with input $\mu$ and output $v$ [2011.01810].

Path-following formulations replace direct control filtering by time reparameterization. “Time Governors for Safe Path-Following Control” [2212.01444] introduces a dynamical law $\dot s=\phi(x,s)\ge 0$ that slows or halts progression along a collision-free reference path whenever a feedback motion predictor approaches the obstacle boundary. Motion prediction can be based on Lyapunov ellipsoids or Vandermonde simplexes, and the framework proves both collision avoidance and convergence to the terminal path parameter $s_{\max}$ [2212.01444].

Safe-control has also been extended to attacked sensing pipelines. “Barrier Certificate based Safe Control for LiDAR-based Systems under Sensor Faults and Attacks” [2208.05944] combines a bank of EKFs, LiDAR scan reconstruction from a known map, sector-wise removal of spoofed LiDAR regions, and a discrete-time control barrier certificate satisfying
$$
\mathbb E[B(x_{k+1})\mid x_k]\le B(x_k)+c.
$$
If $B(x_0)\le \gamma$, the resulting guarantee is
$$
\Pr\{x[k]\in \mathcal C\ \forall\,0\le k\le T\}\ge 1-\gamma-cT,
$$
and the UAV delivery example shows safe navigation under combined INS spoofing and LiDAR ghost-point injection, whereas the baseline crashes [2208.05944].

## 5. Benchmarking, metrics, and empirical characterization

The safe-control literature increasingly emphasizes reproducible evaluation. “safe-control-gym: a Unified Benchmark Suite for Safe Learning-based Control and Reinforcement Learning in Robotics” [2109.06325] provides an open-source benchmark suite based on PyBullet and CasADi, implements cart-pole, 1D quadrotor, and 2D quadrotor environments, and extends the Gym API with symbolic dynamics, symbolic costs, explicit constraints, and repeatable disturbance injection. Safety is quantified by constraint-violation rate and cumulative risk, while performance and learning efficiency are measured by RMSE, cumulative quadratic cost, and simulation time to reach a performance threshold [2109.06325].

The benchmark is explicitly designed to compare traditional control, learning-based control, and reinforcement learning on the same disturbances and tasks. It includes LQR, iLQR, linear and nonlinear MPC, GP-MPC, PPO, SAC, safety-layer PPO, robust adversarial RL, model predictive safety certification, and CBF-QPs [2109.06325]. Reported observations are that GP-MPC reaches near-optimal RMSE with approximately $10^2\,\mathrm{s}$ of simulation, PPO and SAC require approximately $10^3$–$10^4\,\mathrm{s}$, and GP-MPC plus CBF-based filters achieve near-zero violation rates after modest learning [2109.06325].

Individual safe-control papers report complementary empirical patterns. MIND-SIS evaluates three neural network dynamic models on a $4\mathrm D\rightarrow 4\mathrm D$ unicycle, obtains machine-precision tracking error $\|x_{k+1}-x^r\|<10^{-8}$ for the no-safety tracking problem, and reports on $100$ random collision-avoidance and safe-following tasks a $100\%$ success rate, $0\%$ barrier-violation, and $0\%$ infeasible steps, whereas the original index $h_0$ failed on at least $50\%$ of trials [2110.01110]. In comparison studies, purely stochastic MPC is efficient but incurs violations, while robust MPC is safe but conservative; the safe-switching SMPC architecture lies between them, with average cost $1.13\times 10^3$ and zero violations, compared to $0.88\times 10^3$ with violations for pure SMPC and $3.56\times 10^3$ for pure robust MPC [2204.06207].

A plausible implication is that empirical evaluation in safe-control is shifting from isolated trajectory plots toward standardized trade-offs among safety, feasibility, optimality, disturbance tolerance, and computational latency. The presence of symbolic APIs, reproducible disturbance channels, and solver-certified optimality gaps reflects that shift directly [2109.06325].

## 6. Human-centered and generative extensions

Safe-control has expanded beyond classical robot dynamics into systems where the “state” includes human intent or generated content. In human–robot interaction, “Multimodal Safe Control for Human-Robot Interaction” [2311.11898] models an unobserved discrete mode $m$ together with Gaussian uncertainty inside each mode, defines a joint safe set $\mathcal S=\{(x,m):h(x,m)\ge 0\}$, and constructs the Multimodal Safe Set Algorithm. Its optimal variant, O-MMSSA, allocates Gaussian-tail margins across modes through a belief-weighted constraint and, in simulations over $100$ runs, reaches $3.40$ robot goals on average with the lowest safety violations, outperforming both a unimodal baseline and a naive multimodal allocation [2311.11898].

Language-generation work uses the same invariance logic at token level. “CBF-LLM: Safe Control for LLM Alignment” [2408.15625] couples a Llama 3 token predictor with a RoBERTa-based verifier $h(x)$ and zeros out any candidate token that violates the discrete-time CBF condition. The theorem is a direct induction argument: if $h(x(0))\ge 0$ and every appended token satisfies the barrier inequality, then $h(x(k))\ge 0$ for all $k$ [2408.15625]. In the reported sentiment-alignment experiment, the average number of disallowed tokens per generation is $209.79$ for a blacklist, $137.90$ for CBF with $\alpha=0.8$, and $161.59$ for CBF with $\alpha=0.3$, while uncontrolled runs can dip below zero [2408.15625].

The exact title “Safe-Control” appears in text-to-image safety. “Safe-Control: A Safety Patch for Mitigating Unsafe Content in Text-to-Image Generation Models” [2508.21099] introduces an auxiliary patch network that injects a safety control signal $\mathcal M_{\theta_m}(z_t,c_s)$ into a locked diffusion denoiser conditioned on a safety instruction such as “Add clothing to the person in the image.” Individual safety patches can be merged by weighted averaging into a unified patch, and the method is evaluated on six public text-to-image backbones [2508.21099]. Under three malicious prompt sets, the unified patch reduces the unsafe probability of Stable Diffusion v1.4 to $7\%$ on average; across six derivative backbones, nudity rates fall from $20$–$67\%$ to at most $10\%$ post-patch; and FID, LPIPS, and CLIPScore change by at most $1\%$ relative, indicating preservation of benign image quality and text alignment [2508.21099]. The paper also reports $9\%$ unsafe under SneakyPrompt, compared with $55\%$ for the original model, and reductions from $96\%\rightarrow 24\%$ for violence and $81\%\rightarrow 6\%$ for nudity under Ring-A-Bell [2508.21099].

Taken together, these extensions show that safe-control is no longer confined to control-affine physical plants. The same structural ideas—safe sets, barrier-like certificates, minimally invasive intervention, risk allocation, and plug-in safety layers—now appear in human-aware planning, language-model alignment, and diffusion-model safety patches, with the exact implementation determined by whether the controlled object is a dynamical state, a token distribution, or a denoising feature stream [2408.15625].

Source: https://www.emergentmind.com/topics/safe-control