# Input-to-State Safety with Input Delay
in Longitudinal Vehicle Control

Tamas G. Molnar  Anil Alan  Adam K. Kiss  Aaron D. Ames  Gábor Orosz
Department of Mechanical and Civil Engineering, California Institute of
Technology, Pasadena, CA 91125, USA<EMAIL_ADDRESS>ames@caltech.edu).
Department of Mechanical Engineering, University of Michigan, Ann Arbor, MI
48109, USA<EMAIL_ADDRESS>orosz@umich.edu).  Department of Civil and
Environmental Engineering, University of Michigan, Ann Arbor, MI 48109, USA.
MTA-BME Lendület Machine Tool Vibration Research Group, Department of Applied
Mechanics, Budapest University of Technology and Economics, Budapest 1111,
Hungary (kiss_a@mm.bme.hu).

###### Abstract

Safe longitudinal control is discussed for a connected automated truck
traveling behind a preceding connected vehicle. A controller is proposed based
on control barrier function theory and predictor feedback for provably safe,
collision-free behavior by taking into account the significant response time
of the truck as input delay and the uncertainty of its dynamical model as
input disturbance. The benefits of the proposed controller compared to control
designs that neglect the delay or treat the delay as disturbance are shown by
numerical simulations.

###### keywords:

control, safety, time delay, disturbance, connected automated vehicle

††thanks: This research is supported by the National Science Foundation (CPS
Award #1932091), Aerovironment and Dow (#227027AT). The research reported in
this paper and carried out at BME has been supported by the NRDI Fund (TKP2020
NC, Grant No. BME-NCS) based on the charter of bolster issued by the NRDI
Office under the auspices of the Ministry for Innovation and Technology.

, , , , and

##  1 Introduction

Control systems are often subject to strict safety requirements that must be
met before deployment in practice. As such, safety is of primary importance in
vehicle control applications, where collisions must be avoided (Vasudevan et
al., 2012). Control barrier functions (CBFs) (Ames et al., 2017) provide
provable means to achieve safety, similarly to how Lyapunov theory yields
stability. Remarkably, one of the first applications of CBFs was adaptive
cruise control (Ames et al., 2014). Still, challenges continue to arise in
safe vehicle control due to the interplay of significant time delays (the
response time of vehicles, their drivers and controllers), complicated
nonlinear dynamics, disturbances, and dynamically changing environments.

Figure 1:  Safety-critical control of a connected automated truck (CAT) with
input delay behind a connected vehicle (CV) during emergency braking. The
proposed predictor feedback controller maintains safety, while a baseline
controller without predictor fails to do so.

In this work, we address safe vehicle control in the presence of both input
delay and input disturbance. Recently, safety-critical control with input
delay has been addressed in discrete time (Liu et al., 2020; Singletary et
al., 2020) and in continuous time for linear systems (Jankovic, 2018a; Abel et
al., 2019) and nonlinear systems (Molnar et al., 2021), including multiple and
time-varying input delays (Abel et al., 2020, 2021). Furthermore, the safety
of delay-free systems with input disturbance have been investigated by robust
control barrier functions (Jankovic, 2018b) and using the notion of input-to-
state safety (Kolathaya and Ames, 2019; Alan et al., 2022). While real-life
control systems may involve both delays and disturbances, their combined
effect has not yet been addressed in safety-critical control — only Seiler et
al. (2022) approached this problem by treating the delay as part of the
disturbance.

The contribution of our work is twofold. First, we propose a safety-critical
control method using CBFs that handles both input delay and input disturbance.
We achieve this by integrating the approaches of Molnar et al. (2021) and Alan
et al. (2022) that separately address delay and disturbance by relying on the
concepts of predictor feedback (Michiels and Niculescu, 2007; Bekiaris-Liberis
and Krstic, 2013; Karafyllis and Krstic, 2017) and input-to-state safety
(Kolathaya and Ames, 2019), respectively. Second, we apply the proposed method
to safely control a connected automated truck in the presence of a significant
response time (input delay) and uncertainties in its dynamics (input
disturbance). Simulations show that the proposed approach outperforms
controllers designed by neglecting the delay or treating the delay as
disturbance.

##  2 Motivation: Safety-critical Control of a Connected Automated Truck

Consider the scenario in Fig. 1 where a connected automated truck (CAT) is
controlled to follow a connected vehicle (CV) that shares information via
vehicle-to-vehicle (V2V) communication. Our goal is to design a controller
that allows the CAT to match its speed $v$ to the speed $v_{\rm L}$ of the
lead vehicle while maintaining a safe distance $D$.

To design the controller, we consider the dynamical model:

$\displaystyle\begin{split}\dot{D}(t)&=v_{\rm L}(t)-v(t),\\\
\dot{v}(t)&=u(t-\tau)+d(t),\\\ \dot{v}_{\rm L}(t)&=a_{\rm L}(t),\\\
\end{split}$ (1)

where $u(t)$ is the control input (commanded acceleration) of the CAT and
$a_{\rm L}(t)$ is the lead vehicle’s acceleration at time $t$. Since heavy-
duty vehicles have large response time due to their size and inertia, we
include the input delay (powertrain delay) $\tau$ in (1). Furthermore, the
high-fidelity dynamics of the CAT consist of several nontrivial elements
(engine and powertrain behavior, gear schedule, resistance forces, tire
dynamics, etc.) that are missing from the model above. Thus, we capture model
mismatches and real-life uncertainties via the disturbance $d(t)$ in (1).

Our goal is to maintain safety for the CAT despite the presence of the
significant delay $\tau$ and disturbance $d(t)$ in its dynamics. Specifically,
we wish to keep the distance $D$ over a minimal value ${D_{\rm sf}+Tv}$, that
depends on the speed $v$ and is given by a minimum standstill distance $D_{\rm
sf}$ and time headway $T$, i.e., ${h(D(t),v(t)):=D(t)-D_{\rm sf}-Tv(t)\geq
0}$, ${\forall t\geq 0}$. We state this problem more generally below.

###### Problem Statement 1

For control systems of the form:

$\dot{x}(t)=f(t,x(t))+g(t,x(t))(u(t-\tau)+d(t)),$ (2)

design a controller that achieves safety in that ${h(x(t))\geq 0}$, ${\forall
t\geq 0}$ holds along the solutions of the corresponding closed-loop system
for a given safety certificate $h$.

We highlight that for the CAT these quantities read:

$x=\begin{bmatrix}D\\\ v\\\ v_{\rm L}\end{bmatrix},\quad
f(t,x)=\begin{bmatrix}v_{\rm L}-v\\\ 0\\\ a_{\rm L}(t)\end{bmatrix},\quad
g(t,x)=\begin{bmatrix}0\\\ 1\\\ 0\end{bmatrix},$ (3)

and

$h(x)=D-D_{\rm sf}-Tv.$ (4)

##  3 Safety with Input Delay

The problem statement contains two main challenges for safety-critical
control: input delay and input disturbance. This section is dedicated to
addressing the delay without disturbance, and disturbance is added in the next
section.

###  3.1 Delay-free Scenario

First, we revisit safety-critical control for delay-free systems.
Specifically, consider a nonlinear control-affine system with state
${x\in\mathbb{R}^{n}}$, input ${u\in\mathbb{R}^{m}}$ and dynamics:

$\dot{x}=f(t,x)+g(t,x)u,$ (5)

where ${f:\mathbb{R}\times\mathbb{R}^{n}\to\mathbb{R}^{n}}$ and
${g:\mathbb{R}\times\mathbb{R}^{n}\to\mathbb{R}^{m\times n}}$ are locally
Lipschitz continuous. We consider Lipschitz continuous controllers
${k:\mathbb{R}\times\mathbb{R}^{n}\to\mathbb{R}^{m}}$, ${u=k(t,x)}$, and we
assume that given an initial condition ${x(0)\in\mathbb{R}^{n}}$ the solution
$x(t)$ of the closed-loop system exists for all ${t\geq 0}$.

To guarantee safe behavior, we define the safe set $S\subset\mathbb{R}^{n}$
that represents the set of states in which the system is considered safe. We
seek to design controller $k$ such that it enforces safety by rendering $S$
forward invariant, meaning that ${x(0)\in S\implies x(t)\in S}$, ${\forall
t\geq 0}$ holds for the closed-loop system. Specifically, we consider safe
sets of the form:

$S=\\{x\in\mathbb{R}^{n}:h(x)\geq 0\\},$ (6)

where ${h:\mathbb{R}^{n}\to\mathbb{R}}$ denotes a continuously differentiable
function throughout this paper.

We endow the system with safety guarantees using control barrier functions
(CBFs) that provide a practical method to synthesize safety-critical
controllers (Ames et al., 2017). The main idea behind CBFs is lower-bounding
the derivative of $h$ w.r.t. time, which keeps $h(x(t))$ nonnegative (i.e.,
${x(t)\in S}$). This derivative along the system (5) reads:

$\displaystyle\begin{split}\dot{h}(t,x,u)&=L_{f}h(t,x)+L_{g}h(t,x)u,\\\
L_{f}h(t,x)&=\nabla h(x)f(t,x),\\\ L_{g}h(t,x)&=\nabla h(x)g(t,x),\end{split}$
(7)

where $L_{f}h$ and $L_{g}h$ denote the Lie derivatives of $h$ along $f$ and
$g$. With these preliminaries, we formally define CBFs.

######  Definition 1 (Ames et al. (2017))

Function $h:\mathbb{R}^{n}\to\mathbb{R}$ is a control barrier function (CBF)
for (5) if there exists ${\alpha\in\mathcal{K}^{\rm e}_{\infty}}$111Function
$\alpha:\mathbb{R}_{\geq 0}\to\mathbb{R}$ is of class-$\mathcal{K}_{\infty}$
(${\alpha\in\mathcal{K}_{\infty}}$) if it is continuous, strictly
monotonically increasing, ${\alpha(0)=0}$ and
${\lim_{r\to\infty}\alpha(r)=\infty}$. Function
$\alpha:\mathbb{R}\to\mathbb{R}$ is of extended class-$\mathcal{K}_{\infty}$
(${\alpha\in\mathcal{K}^{\rm e}_{\infty}}$) if it is of
class-$\mathcal{K}_{\infty}$ and ${\lim_{r\to-\infty}\alpha(r)=-\infty}$. such
that ${\forall t\geq 0}$ and ${\forall x\in S}$:

$\sup_{u\in\mathbb{R}^{m}}\dot{h}(t,x,u)>-\alpha(h(x)).$ (8)

The main result from Ames et al. (2017) specifies a condition on the control
input $u$ that provides formal safety guarantees, as summarized by the
following theorem.

######  Theorem 2 (Ames et al. (2017))

If $h$ is a CBF for (5), then any locally Lipschitz continuous controller
$k:\mathbb{R}\times\mathbb{R}^{n}\to\mathbb{R}^{m}$ satisfying:

$\dot{h}(t,x,k(t,x))\geq-\alpha(h(x)),$ (9)

${\forall t\geq 0}$, ${\forall x\in S}$ renders $S$ forward invariant (safe)
such that ${x(0)\in S\implies x(t)\in S}$, ${\forall t\geq 0}$.

The proof can be constructed based on Ames et al. (2017) that considers $f$
and $g$ independent of $t$. The same proof applies here, since it is based on
the theorem of Nagumo (1942) that includes time-variant systems. Per Theorem
2, controllers satisfying (9) yield safe behavior, while Definition 1 ensures
that such controllers exist. Thus, (9) can be used as condition to synthesize
safety-critical controllers. This is often achieved by incorporating (9) as
constraint into optimization problems (Ames et al., 2017).

###  3.2 Control with Input Delay

Figure 2:  Illustration of predictor feedback. The state $x(t)$ (purple) and
input history $u_{t}$ (green) are used to calculate the predicted state
$x_{\rm p}(t)$ (blue) that is used as feedback to synthesize the control input
$u(t)$ (red).

Now we revisit the notion of CBFs with input delay, that was introduced by
Molnar et al. (2021) for time-invariant systems via the idea of predictor
feedback (Bekiaris-Liberis and Krstic, 2013; Karafyllis and Krstic, 2017;
Michiels and Niculescu, 2007, ch. 15). We extend these results to the time-
variant system (5) with input delay ${\tau>0}$:

$\dot{x}(t)=f(t,x(t))+g(t,x(t))u(t-\tau).$ (10)

To overcome the delay in ${u(t-\tau)}$ we seek to use a prediction of the
future state ${x(t+\tau)}$ as feedback. To formalize this process, first, we
characterize the solution of (10). We begin by noting that the solution over
$[t,t+\tau]$ evolves according to the history of the control input over
$[t-\tau,t)$; see the illustration in Fig. 2. We formally define the input
history by the function ${u_{t}:[-\tau,0)\to\mathbb{R}^{m}}$:

$u_{t}(\theta)=u(t+\theta),\quad\theta\in[-\tau,0),$ (11)

which is assumed to be bounded and continuous almost everywhere. We shortly
denote the space of such functions with $\mathcal{B}$. As shown below,
predictor feedback leads to controllers that depend on the input history
${u_{t}\in\mathcal{B}}$, in the form
${k:\mathbb{R}\times\mathbb{R}^{n}\times\mathcal{B}\to\mathbb{R}^{m}}$,
${u=k(t,x,u_{t})}$. Throughout the paper, we assume that given an initial
condition ${x(0)\in\mathbb{R}^{n}}$ and initial input history
${u_{0}\in\mathcal{B}}$, the solution $x(t)$ of the closed-loop system exists
for all ${t\geq 0}$.

For given ${u_{t}\in\mathcal{B}}$, system (10) can be considered as a forced
ordinary differential equation (ODE) over $[t,t+\tau]$. The solution of the
ODE over $[t,t+\tau]$ can be written as:

$x(t+\vartheta)=\Psi(\vartheta,t,x(t),u_{t}),\quad\vartheta\in[0,\tau].$ (12)

That is, the solution depends on time $t$, the current state $x(t)$, and the
input history $u_{t}$; see Fig. 2. Formally, it is given by the semi-flow
${\Psi:[0,\tau]\times\mathbb{R}\times\mathbb{R}^{n}\times\mathcal{B}\to\mathbb{R}^{n}}$:

$\Psi(\vartheta,t,x,u_{t})=x+\int_{0}^{\vartheta}\Big{(}f\big{(}t+s,\Psi(s,t,x,u_{t})\big{)}\\\
+g\big{(}t+s,\Psi(s,t,x,u_{t})\big{)}u_{t}(s-\tau)\Big{)}{\rm d}s,$ (13)

which can be calculated by numerical ODE solvers in practice. Specifically,
predictor feedback relies on the predicted state $x_{\rm p}(t)$ at prediction
time $t_{\rm p}$:

$t_{\rm p}\triangleq t+\tau,\quad x_{\rm p}(t)\triangleq
x(t+\tau)=\Psi(\tau,t,x(t),u_{t}).$ (14)

Note that the predicted state depends on ${f(t+s,.)}$ and ${g(t+s,.)}$, i.e.,
on the future expressions of the dynamics in (13). If such information is
unknown, the predicted state needs to be approximated. This leads to
prediction errors, whose effect is treated as disturbance in the next section.
The predicted state is used in the following definition of CBFs for input
delay systems from Molnar et al. (2021).

######  Definition 3 (Molnar et al. (2021))

Function ${h:\mathbb{R}^{n}\to\mathbb{R}}$ is a control barrier function (CBF)
for (10) if there exists ${\alpha\in\mathcal{K}^{\rm e}_{\infty}}$ such that
${\forall t\geq 0}$, ${\forall x\in S}$ and ${\forall u_{t}\in\mathcal{B}}$:

$\sup_{u\in\mathbb{R}^{m}}\dot{h}(t_{\rm p},x_{\rm p},u)>-\alpha(h(x_{\rm
p})),$ (15)

where ${t_{\rm p}=t+\tau}$, ${x_{\rm p}=\Psi(\tau,t,x,u_{t})}$ with $\Psi$
given by (13).

This definition leads to the main result in Molnar et al. (2021) that endows
controllers with safety guarantees, as summarized by the following theorem.

######  Theorem 4 (Molnar et al. (2021))

If $h$ is a CBF for (10), then any locally Lipschitz continuous controller
${k:\mathbb{R}\times\mathbb{R}^{n}\times\mathcal{B}\to\mathbb{R}^{m}}$
satisfying:

$\dot{h}(t_{\rm p},x_{\rm p},k(t,x,u_{t}))\geq-\alpha(h(x_{\rm p})),$ (16)

with ${t_{\rm p}=t+\tau}$, ${x_{\rm p}=\Psi(\tau,t,x,u_{t})}$, ${\forall t\geq
0}$, ${\forall x\in S}$ and ${\forall u_{t}\in\mathcal{B}}$ renders $S$
forward invariant such that ${x(t)\in S}$, ${\forall t\in[0,\tau]}$ ${\implies
x(t)\in S}$, ${\forall t\geq 0}$.

The proof can be constructed based on Molnar et al. (2021). Note that safety
is conditioned on ${x(t)\in S}$, ${\forall t\in[0,\tau]}$ instead of ${x(0)\in
S}$, as the solution over $[0,\tau]$ is determined by the initial input
history $u_{0}$; cf. (12). If ${\tau=0}$, these two conditions coincide and
Theorem 4 reduces to Theorem 2, since ${t_{\rm p}=t}$, ${x_{\rm p}=x}$.

###  3.3 Application to Vehicle Control

Now we apply the above theory to design a safe longitudinal controller for the
connected automated truck (CAT) in Fig. 1. We describe the dynamics of the CAT
by (3, 10), first without considering disturbance (${d(t)\equiv 0}$), and we
rely on CBF (4). This system was studied from safety perspective in He and
Orosz (2018) without time delay, wherein the following nominal controller was
used to execute car following:

$k_{\rm n}(x)=A(V(D)-v)+B(W(v_{\rm L})-v).$ (17)

The term with gain $B$ makes the CAT match its speed $v$ to the speed $v_{\rm
L}$ of the lead vehicle or the speed limit $v_{\max}$, whichever is smaller,
as expressed by the speed policy $W$:

$W(v_{\rm L})=\min\\{v_{\rm L},v_{\max}\\}.$ (18)

The term with gain $A$ allows the CAT to maintain appropriate distance $D$ by
the help of the range policy $V$:

$V(D)=\min\\{\kappa(D-D_{\rm st}),v_{\max}\\},$ (19)

meaning that the CAT shall increase its speed $v$ linearly (with gradient
$\kappa$) for distances above a standstill distance $D_{\rm st}$, until
reaching the speed limit $v_{\max}$.

Here we endow controller (17) with safety guarantees by choosing its
parameters safely. When ${\tau=0}$, we choose ${D_{\rm st}\geq D_{\rm sf}}$
and ${B=\kappa=1/T}$, which makes the controller ${k(t,x)=k_{\rm n}(x)}$
provably safe since it satisfies (9) with ${\alpha(r)=Ar}$. When ${\tau>0}$,
we maintain safety guarantees by using the predictor feedback controller
${k(t,x,u_{t})=k_{\rm n}(x_{\rm p})}$ that satisfies (16). First, we
demonstrate this controller for the case where the predicted state ${x_{\rm
p}=\Psi(\tau,t,x,u_{t})}$ is calculated accurately. This requires information
from the lead vehicle about its future intent (namely, ${a_{\rm L}(t+s)}$,
${s\in[0,\tau]}$ that shows up in ${f(t+s,.)}$ in (13)), which may be provided
by vehicle-to-vehicle (V2V) connectivity. This intent requirement will be
relaxed in the next section.

Table 1: Parameters for longitudinal control of a connected automated truck. Description | Parameter | Value | Unit
---|---|---|---
input delay | $\tau$ | 0.5 | s
distance gain | $A$ | 0.4 | 1/s
velocity gain | $B$ | 0.5 | 1/s
standstill distance | $D_{\rm st}$ | 5 | m
range policy gradient | $\kappa$ | 0.5 | 1/s
speed limit | $v_{\max}$ | 20 | m/s
safe standstill distance | $D_{\rm sf}$ | 3 | m
safe time headway | $T$ | 2 | s
TISSf parameters | $\sigma_{0}$ | 1 | m/s3
$\lambda$ | 0.3 | 1/m
unmodeled first-order lag | $\xi$ | 0.25 | s

Figure 1 shows simulation results in an emergency braking scenario where the
lead vehicle (red) decelerates harshly until a full stop. Two controllers are
compared for the CAT, with parameters in Table 1. When the CAT uses the delay-
free control design ${k(t,x)=k_{\rm n}(x)}$ without predictor feedback in the
presence of input delay, safety is violated (dashed purple). As opposed, the
predictor feedback controller ${k(t,x,u_{t})=k_{\rm n}(x_{\rm p})}$ that
accounts for the delay is able keep a safe distance (solid purple), as
guaranteed by Theorem 4. This shows the relevance of addressing the delay
carefully, as it may otherwise lead to unsafe behavior.

##  4 Robust Safety with Disturbance

In this section, we provide robust safety guarantees against disturbances via
the notion of input-to-state safety. We also address prediction errors as a
part of disturbances.

###  4.1 Delay-free Scenario

Consider control-affine systems with input disturbance:

$\dot{x}=f(t,x)+g(t,x)\big{(}u+d(t)\big{)},$ (20)

where ${d:\mathbb{R}\to\mathbb{R}^{m}}$ is bounded: there exists
${\delta\in\mathbb{R}_{\geq 0}}$ such that ${\|d(t)\|\leq\delta}$, ${\forall
t\geq 0}$. The disturbance affects safety as:

$\dot{h}(t,x,u+d)=\dot{h}(t,x,u)+L_{g}h(t,x)d,$ (21)

cf. (7). Since $L_{g}h(t,x)$ characterizes the impact of the disturbance on
safety, we use $L_{g}h(t,x)$ to provide robustness against the input
disturbance. Instead of accounting for the worst-case disturbance as described
by Jankovic (2018b) we rely on input-to-state safety (Kolathaya and Ames,
2019). When a system is input-to-state safe, trajectories are kept within a
neighborhood ${S_{\delta}\supseteq S}$ of the safe set $S$:

$S_{\delta}=\\{x\in\mathbb{R}^{n}:h_{\delta}(x)\geq 0\\},$ (22)

defined with:

$h_{\delta}(x)=h(x)+\gamma(h(x),\delta).$ (23)

The size of the neighborhood $S_{\delta}$ depends on the bound $\delta$ of the
disturbance, and it is characterized by function
${\gamma:\mathbb{R}\times\mathbb{R}_{\geq 0}\to\mathbb{R}}$ that is
continuously differentiable in its first argument and is of
class-$\mathcal{K}_{\infty}$ in its second argument (see the expression of
$\gamma$ later in (26)). Below we outline a method that enables us to make
this neighborhood as small as desired and keep safety violations arbitrarily
small in the presence of disturbance. We achieve this by using tunable input-
to-state safe control barrier functions (TISSf-CBFs) from Alan et al. (2022).

######  Definition 5 (Alan et al. (2022))

Function ${h:\mathbb{R}^{n}\to\mathbb{R}}$ is a tunable input-to-state safe
control barrier function (TISSf-CBF) for (20) with a continuously
differentiable function ${\sigma:\mathbb{R}\to\mathbb{R}_{>0}}$ if there
exists ${\alpha\in\mathcal{K}^{\rm e}_{\infty}}$ such that ${\forall t\geq 0}$
and ${\forall x\in\mathbb{R}^{n}}$:

$\sup_{u\in\mathbb{R}^{m}}\dot{h}(t,x,u)>-\alpha(h(x))+\sigma(h(x))\|L_{g}h(t,x)\|^{2}.$
(24)

Note the difference from the CBF definition (8): an additional term with the
Euclidean norm of $L_{g}h(t,x)$ appears, which provides robustness against
disturbance. By tuning the coefficient $\sigma(h(x))$, one may choose to
increase this robustness closer to the safe set boundary or outside the safe
set without introducing conservativeness farther inside the safe set. To
achieve this, we choose ${\sigma(h)=\sigma_{0}\exp(-\lambda h)}$ with
parameters ${\sigma_{0},\lambda\in\mathbb{R}_{>0}}$ so that $\sigma(h(x))$
gets larger as $h(x)$ gets smaller. We remark that a reciprocal coefficient
$\epsilon(h)$ is utilized in Alan et al. (2022), which can be translated to
the form given in this study by simply choosing ${\sigma(h)=1/\epsilon(h)}$.
Furthermore, ${\sigma(h)\equiv 0}$ would reduce to the CBF definition (8).

The following theorem from Alan et al. (2022) states the robust safety
guarantees provided by TISSf-CBFs.

######  Theorem 6 (Alan et al. (2022))

If $h$ is a TISSf-CBF for (20) with ${\sigma:\mathbb{R}\to\mathbb{R}_{>0}}$
satisfying ${\sigma^{\prime}(r)\leq 0}$, ${\forall r\in\mathbb{R}}$ such that
${\alpha^{-1}\in\mathcal{K}^{\rm e}_{\infty}}$ is continuously differentiable,
then any locally Lipschitz continuous controller
${k:\mathbb{R}\times\mathbb{R}^{n}\to\mathbb{R}^{m}}$ satisfying:

$\dot{h}(t,x,k(t,x))\geq-\alpha(h(x))+\sigma(h(x))\|L_{g}h(t,x)\|^{2},$ (25)

${\forall t\geq 0}$ and ${\forall x\in\mathbb{R}^{n}}$ renders $S_{\delta}$
with

$\gamma(h,\delta)=-\alpha^{-1}\bigg{(}-\frac{\delta^{2}}{4\sigma(h)}\bigg{)}$
(26)

forward invariant such that
${x(0)\\!\in\\!S_{\delta}\\!\implies\\!x(t)\\!\in\\!S_{\delta}}$, ${\forall
t\geq 0}$.

The proof can be generalized from Alan et al. (2022), and the proof with input
delay is given in the next section. Note that if a controller ${u=k(t,x)}$
satisfies (9), then robustness to disturbance can be achieved by a simple
modification that satisfies (25): ${u=k(t,x)+\sigma(h(x))L_{g}h^{\top}(t,x)}$.

###  4.2 Control with Input Delay

Having the machinery to address input delay and input disturbance separately,
now we combine our two approaches to handle both simultaneously. Consider the
control-affine system with input delay and disturbance:

$\dot{x}(t)=f(t,x(t))+g(t,x(t))\big{(}u(t-\tau)+d(t)\big{)},$ (27)

cf. (10) and (20). We use TISSf-CBFs and predictor feedback to address the
disturbance and delay.

The disturbance affects the solution of (27) and hence the predicted state
${x_{\rm p}(t)=x(t+\tau)}$. The predicted state is now given as ${x_{\rm
p}(t)=\Psi_{d}(\tau,t,x,u_{t})}$ using the semi-flow
${\Psi_{d}:[0,\tau]\times\mathbb{R}\times\mathbb{R}^{n}\times\mathcal{B}\to\mathbb{R}^{n}}$:

$\Psi_{d}(\vartheta,t,x,u_{t})=x+\int_{0}^{\vartheta}\Big{(}f\big{(}t+s,\Psi_{d}(s,t,x,u_{t})\big{)}\\\
+g\big{(}t+s,\Psi_{d}(s,t,x,u_{t})\big{)}\big{(}u_{t}(s-\tau)+d(t+s)\big{)}\Big{)}{\rm
d}s.$ (28)

We remark that when the disturbance ${d(t+s)}$ or the future dynamics
${f(t+s,.)}$ or ${g(t+s,.)}$ are unknown, ${x_{\rm
p}(t)=\Psi_{d}(\tau,t,x,u_{t})}$ is also unknown and needs to be approximated,
which inevitably leads to prediction errors. First, we provide safety
guarantees with the theoretical assumption that $x_{\rm p}(t)$ is accurately
available, and second, we address prediction errors. We use the following
definition.

###### Definition 7

Function $h:\mathbb{R}^{n}\to\mathbb{R}$ is a tunable input-to-state safe
control barrier function (TISSf-CBF) for (27) with a continuously
differentiable function ${\sigma:\mathbb{R}\to\mathbb{R}_{>0}}$ if there
exists ${\alpha\in\mathcal{K}^{\rm e}_{\infty}}$ such that ${\forall t\geq
0}$, ${\forall x\in\mathbb{R}^{n}}$ and ${\forall u_{t}\in\mathcal{B}}$:

$\sup_{u\in\mathbb{R}^{m}}\dot{h}(t_{\rm p},x_{\rm p},u)>-\alpha(h(x_{\rm
p}))+\sigma(h(x_{\rm p}))\|L_{g}h(t_{\rm p},x_{\rm p})\|^{2},$ (29)

where ${t_{\rm p}=t+\tau}$, ${x_{\rm p}=\Psi_{d}(\tau,t,x,u_{t})}$ with
$\Psi_{d}$ given by (28).

This definition leads to our main result that ensures safety in the presence
of both input delay and disturbance.

###### Theorem 8

If $h$ is a TISSf-CBF for (27) with ${\sigma:\mathbb{R}\to\mathbb{R}_{>0}}$
satisfying ${\sigma^{\prime}(r)\leq 0}$, ${\forall r\in\mathbb{R}}$ such that
${\alpha^{-1}\in\mathcal{K}^{\rm e}_{\infty}}$ is continuously differentiable,
then any locally Lipschitz continuous controller
${k:\mathbb{R}\times\mathbb{R}^{n}\times\mathcal{B}\to\mathbb{R}^{m}}$
satisfying:

$\dot{h}(t_{\rm p},x_{\rm p},k(t,x,u_{t}))\geq-\alpha(h(x_{\rm
p}))+\sigma(h(x_{\rm p}))\|L_{g}h(t_{\rm p},x_{\rm p})\|^{2},$ (30)

with ${t_{\rm p}=t+\tau}$, ${x_{\rm p}=\Psi_{d}(\tau,t,x,u_{t})}$, ${\forall
t\geq 0}$, ${\forall x\in\mathbb{R}^{n}}$ and ${\forall u_{t}\in\mathcal{B}}$
renders $S_{\delta}$ with (26) forward invariant such that ${x(t)\in
S_{\delta}}$, ${\forall t\in[0,\tau]}$ ${\implies x(t)\in S_{\delta}}$,
${\forall t\geq 0}$.

The proof is given in Appendix A. Inequality (30) can be used to verify input-
to-state safety with given controllers or to synthesize robustly safe control
laws.

###### Remark 9

Since the semi-flow $\Psi_{d}$ in (28) depends on the disturbance and future
dynamics, the future state ${x_{\rm p}(t)=\Psi_{d}(\tau,t,x(t),u_{t})}$ may be
unknown. One may approximate $x_{\rm p}(t)$ by some $\hat{x}_{\rm p}(t)$, for
example, as $\hat{x}_{\rm p}(t)=\Psi(\tau,t,x(t),u_{t})$ via the semi-flow
(13) without disturbance. Similarly, one may also approximate $t_{\rm p}$ by
$\hat{t}_{\rm p}$ (e.g. ${\hat{t}_{\rm p}=t}$) if quantities in (30) are
unavailable at the future time $t_{\rm p}$. These yield prediction errors, and
the corresponding controller ${\hat{u}=\hat{k}(t,x,u_{t})}$ synthesized via
$\hat{x}_{\rm p}$, $\hat{t}_{\rm p}$ will differ from ${u=k(t,x,u_{t})}$
synthesized via $x_{\rm p}$, $t_{\rm p}$. The discrepancy contributes to the
disturbance and yields the effective disturbance
${\hat{d}(t)=d(t)+\hat{u}(t-\tau)-u(t-\tau)}$. However, controllers
synthesized via (30) are robust to disturbances by design. If $\hat{d}(t)$ is
bounded and ${\exists\hat{\delta}\in\mathbb{R}_{\geq 0}}$ such that
${\|\hat{d}(t)\|\leq\hat{\delta}}$, ${\forall t\geq 0}$ (e.g. in case of
bounded prediction error and Lipschitz continuous controller), then the robust
safety guarantees of Theorem 8 hold with $\hat{\delta}$ instead of $\delta$.

###### Remark 10

Input-to-state safety allows for safety violations, but they can be made
arbitrarily small with large enough $\sigma(h)$ and control effort. This holds
for both Theorems 6 and 8 without and with delay. As such, one may be tempted
to use the delay-free control design (25) and treat the entire effect of delay
as disturbance, which corresponds to using ${\hat{x}_{\rm p}(t)=x(t)}$ and
${\hat{t}_{\rm p}=t}$. While this solution exhibits a level of robustness and
was successfully implemented in Alan et al. (2022), the size $\hat{\delta}$ of
the disturbance may be large and it may take a large control effort to keep
safety violations minimal. Control effort and safety violations can be
significantly decreased by predictors that estimate $x_{\rm p}(t)$ better than
${x(t)}$; see the example below.

###  4.3 Application to Vehicle Control

Figure 3:  Safety-critical control of a CAT with input delay and disturbance.
Two input-to-state safe controllers yield different safety degradation. While
the baseline controller without predictor has larger degradation (dashed), the
proposed predictor feedback controller limits it with smaller effective
disturbance (solid).

Finally, we use the proposed method for controlling the connected automated
truck (CAT) described by (3, 27). We consider a disturbance arising from an
additional, unmodeled first-order lag ${\xi\in\mathbb{R}_{>0}}$:

$\displaystyle\begin{split}\dot{a}(t)&=\frac{1}{\xi}(-a(t)+u(t-\tau)),\\\
d(t)&=a(t)-u(t-\tau),\end{split}$ (31)

where ${a(t)=\dot{v}(t)}$ is the acceleration of the CAT. Although the first-
order lag increases the system dimension, control design still relies on the
low-dimensional model (27) with a disturbance that will be shown to be bounded
in Fig. 3.

We consider the disturbance and the lead vehicle’s future motion to be unknown
(i.e., ${a_{\rm L}(t+s)}$ appearing in ${f(t+s,.)}$ is unavailable for any
${s>0}$). Thus, we approximate $t_{\rm p}$ by ${\hat{t}_{\rm p}=t}$ and
$x_{\rm p}(t)$ by ${\hat{x}_{\rm p}(t)=\hat{\Psi}(\tau,t,x(t),u_{t})}$, with a
predictor $\hat{\Psi}$ that assumes zero disturbance and constant lead vehicle
acceleration (${f(t+s,.)\approx f(t,.)}$):

$\hat{\Psi}(\vartheta,t,x,u_{t})=x+\int_{0}^{\vartheta}\Big{(}f\big{(}t,\hat{\Psi}(s,t,x,u_{t})\big{)}\\\
+g\big{(}t,\hat{\Psi}(s,t,x,u_{t})\big{)}u_{t}(s-\tau)\Big{)}{\rm d}s,$ (32)

cf. (13). We compare two controllers: the robust delay-free design
${k(t,x)=k_{\rm n}(x)+\sigma(h(x))L_{g}h^{\top}(t,x)}$ satisfying (24) and the
predictor feedback controller $k(t,x,u_{t})=k_{\rm n}(\hat{x}_{\rm
p})+\sigma(h(\hat{x}_{\rm p}))L_{g}h^{\top}(\hat{t}_{\rm p},\hat{x}_{\rm p})$
satisfying (29); both with the nominal control law $k_{\rm n}$ given in (17).

The resulting closed-loop system is simulated222See Matlab code at:
https://github.com/molnartamasg/safety-critical-control-with-input-delay-and-
disturbance. in Fig. 3 for the scenario of Fig. 1 with parameters in Table 1.
The delay-free control design (dashed purple), that treats the effect of the
delay as part of the disturbance, yields small safety violations with large
control effort. As opposed, the proposed predictor feedback controller (solid
purple) uses significantly smaller control input while keeping the system
safe, despite the unmodeled first-order lag and prediction errors. This is
achieved by reducing the effective disturbance $\hat{d}$ relative to the ideal
input calculated with ground truth future state $x_{\rm p}$ (thin green
lines). This justifies that even an approximate prediction $\hat{x}_{\rm p}$
may yield better performance than using the current state $x$, and addressing
the delay with predictor feedback is beneficial.

##  5 Conclusion

This work addressed the robust safety-critical control of systems with input
delay and input disturbance. Predictor feedback and tunable input-to-state
safe control barrier functions were integrated to achieve provable safety
guarantees. The proposed control method was applied to the longitudinal
control of a connected automated truck, and showed better performance than
delay-free control designs or controllers treating the delay as disturbance.
Future work may involve safety for systems with state delays and robust safety
with disturbance observers.

## References

  * Abel et al. (2019) Abel, I., Jankovic, M., and Krstić, M. (2019).  Constrained stabilization of multi-input linear systems with distinct input delays.  _IFAC-PapersOnLine_ , 52(2), 82–87.
  * Abel et al. (2020) Abel, I., Janković, M., and Krstić, M. (2020).  Constrained control of input delayed systems with partially compensated input delays.  In _Dynamic Systems and Control Conference_ , volume 84270, V001T04A006. American Society of Mechanical Engineers.
  * Abel et al. (2021) Abel, I., Krstić, M., and Janković, M. (2021).  Safety-critical control of systems with time-varying input delay.  _IFAC-PapersOnLine_ , 54(18), 169–174.
  * Alan et al. (2022) Alan, A., Taylor, A.J., He, C.R., Orosz, G., and Ames, A.D. (2022).  Safe controller synthesis with tunable input-to-state safe control barrier functions.  _IEEE Control Systems Letters_ , 6, 908–913.
  * Ames et al. (2014) Ames, A.D., Grizzle, J.W., and Tabuada, P. (2014).  Control barrier function based quadratic programs with application to adaptive cruise control.  In _53rd IEEE Conference on Decision and Control_ , 6271–6278.
  * Ames et al. (2017) Ames, A.D., Xu, X., Grizzle, J.W., and Tabuada, P. (2017).  Control barrier function based quadratic programs for safety critical systems.  _IEEE Transactions on Automatic Control_ , 62(8), 3861–3876.
  * Bekiaris-Liberis and Krstic (2013) Bekiaris-Liberis, N. and Krstic, M. (2013).  _Nonlinear Control Under Nonconstant Delays_.  SIAM.
  * He and Orosz (2018) He, C.R. and Orosz, G. (2018).  Safety guaranteed connected cruise control.  In _21st IEEE International Conference on Intelligent Transportation Systems_ , 549–554.
  * Jankovic (2018a) Jankovic, M. (2018a).  Control barrier functions for constrained control of linear systems with input delay.  In _American Control Conference_ , 3316–3321.
  * Jankovic (2018b) Jankovic, M. (2018b).  Robust control barrier functions for constrained stabilization of nonlinear systems.  _Automatica_ , 96, 359–367.
  * Karafyllis and Krstic (2017) Karafyllis, I. and Krstic, M. (2017).  _Predictor feedback for delay systems: Implementations and approximations_.  Birkhäuser, Basel.
  * Kolathaya and Ames (2019) Kolathaya, S. and Ames, A.D. (2019).  Input-to-state safety with control barrier functions.  _IEEE Control Systems Letters_ , 3(1), 108–113.
  * Liu et al. (2020) Liu, Z., Yang, L., and Ozay, N. (2020).  Scalable computation of controlled invariant sets for discrete-time linear systems with input delays.  In _American Control Conference_ , 4722–4728.
  * Michiels and Niculescu (2007) Michiels, W. and Niculescu, S.I. (2007).  _Stability and stabilization of time-delay systems: An eigenvalue-based approach_.  SIAM.
  * Molnar et al. (2021) Molnar, T.G., Kiss, A.K., Ames, A.D., and Orosz, G. (2021).  Safety-critical control with input delay in dynamic environment.  _arXiv preprint_ , (arXiv:2112.08445).
  * Nagumo (1942) Nagumo, M. (1942).  Über die lage der integralkurven gewöhnlicher differentialgleichungen.  _Proceedings of the Physico-Mathematical Society of Japan_ , 24, 551–559.
  * Seiler et al. (2022) Seiler, P., Jankovic, M., and Hellstrom, E. (2022).  Control barrier functions with unmodeled dynamics using integral quadratic constraints.  _IEEE Control Systems Letters_ , 6, 1664–1669.
  * Singletary et al. (2020) Singletary, A., Chen, Y., and Ames, A.D. (2020).  Control barrier functions for sampled-data systems with input delays.  In _59th IEEE Conference on Decision and Control_ , 804–809.
  * Vasudevan et al. (2012) Vasudevan, R., Shia, V., Gao, Y., Cervera-Navarro, R., Bajcsy, R., and Borrelli, F. (2012).  Safe semi-autonomous control with enhanced driver modeling.  In _American Control Conference_ , 2896–2903.

##  Appendix A Proof of Theorem 8

The theorem is conditioned on ${x(t)\in S_{\delta}}$, ${\forall
t\in[0,\tau]}$. This yields ${x(\tau)\in S_{\delta}}$ and we prove
${x(\tau)\in S_{\delta}\implies x(t)\in S_{\delta}}$, ${\forall t\geq\tau}$.
This is equivalent to ${x_{\rm p}(0)\in S_{\delta}\implies x_{\rm p}(t)\in
S_{\delta}}$, ${\forall t\geq 0}$. We begin by shifting argument $t$ in (27)
to ${t+\tau}$ that yields the evolution of $x_{\rm p}(t)$ in (14) as:

$\dot{x}_{\rm p}(t)=f(t_{\rm p},x_{\rm p}(t))+g(t_{\rm p},x_{\rm
p}(t))(u(t)+d_{\rm p}(t)),$ (33)

with ${d_{\rm p}(t)=d(t+\tau)}$ that satisfies ${\|d_{\rm p}(t)\|\leq\delta}$,
${\forall t\geq 0}$.

Since (33) is a delay-free system, the necessary and sufficient condition for
${x_{\rm p}(0)\in S_{\delta}\implies x_{\rm p}(t)\in S_{\delta}}$, ${\forall
t\geq 0}$ can be given by the theorem of Nagumo (1942) as:

$h_{\delta}(x_{\rm p})=0\implies\dot{h}_{\delta}(t_{\rm p},x_{\rm p},u+d_{\rm
p})\geq 0.$ (34)

Using (23), we can express $\dot{h}_{\delta}$ as:

$\displaystyle\dot{h}_{\delta}(t_{\rm p},x_{\rm p},u+d_{\rm p})$
$\displaystyle=\left(1+\frac{\partial\gamma}{\partial h}(h(x_{\rm
p}),\delta)\right)\dot{h}(t_{\rm p},x_{\rm p},u+d_{\rm p}),$ (35)

where, according to (26), the following holds:

$\frac{\partial\gamma}{\partial h}(h(x_{\rm p}),\delta)=-\frac{{\rm
d}\alpha^{-1}}{{\rm d}r}\left(-\frac{\delta^{2}}{4\sigma(h(x_{\rm
p}))}\right)\frac{\delta^{2}\sigma^{\prime}(h(x_{\rm p}))}{4\sigma(h(x_{\rm
p}))^{2}}>0,$ (36)

since the derivative of ${\alpha^{-1}\in\mathcal{K}^{\rm e}_{\infty}}$ above
is positive while ${\sigma^{\prime}(h(x_{\rm p}))\leq 0}$. Hence, (34) is
equivalent to:

$h_{\delta}(x_{\rm p})=0\implies\dot{h}(t_{\rm p},x_{\rm p},u+d_{\rm p})\geq
0.$ (37)

To prove this, we express $\dot{h}$ as:

$\displaystyle\dot{h}(t_{\rm p},x_{\rm p}$ $\displaystyle,u+d_{\rm
p})=\dot{h}(t_{\rm p},x_{\rm p},u)+L_{g}h(t_{\rm p},x_{\rm p})d_{\rm p},$ (38)
$\displaystyle\geq-\alpha(h(x_{\rm p}))+\sigma(h(x_{\rm p}))\|L_{g}h(t_{\rm
p},x_{\rm p})\|^{2}$ (39) $\displaystyle\quad-\|L_{g}h(t_{\rm p},x_{\rm
p})\|\delta$ $\displaystyle\geq-\alpha(h(x_{\rm
p}))-\frac{\delta^{2}}{4\sigma(h(x_{\rm p}))}$ (40)
$\displaystyle\quad+\left(\sqrt{\sigma(h(x_{\rm p}))}\|L_{g}h(t_{\rm p},x_{\rm
p})\|-\frac{\delta}{2\sqrt{\sigma(h(x_{\rm p}))}}\right)^{2}$
$\displaystyle\geq-\alpha(h(x_{\rm p}))+\alpha(h(x_{\rm p})-h_{\delta}(x_{\rm
p})),$ (41)

where we substituted (21) in (38); we used (30), the Cauchy-Schwartz
inequality and ${\|d_{\rm p}\|\leq\delta}$ in (39); we completed the square in
(40); and we applied the definition (23, 26) of $h_{\delta}$ in (41). From
(41), the implication (37) follows, and the proof is complete. $\blacksquare$