We consider safety-critical multi-agent systems with distributed control architectures and potentially varying network topologies. While learning-based distributed control enables scalability and high performance, a lack of formal safety guarantees in the face of unforeseen disturbances and unsafe network topology changes may lead to system failure. To address this challenge, we introduce structured control barrier functions (s-CBFs) as a multi-agent safety framework. The s-CBFs are augmented to a distributed predictive control barrier function (D-PCBF), a predictive, optimization-based safety layer that uses model predictions to guarantee recoverable safety at all times. The proposed approach enables a permissive yet formal plug-and-play protocol, allowing agents to join or leave the network while ensuring safety recovery if a change in network topology requires temporarily unsafe behavior. We validate the formulation through simulations and real-time experiments of a miniature race-car platoon.
Figures & tables
Fig. 1: Network-level recoverable safety using s-CBFs. The formulation defines safe sets Sℓ and regions of attraction Dℓ∖Sℓ , ensuring constraint satisfaction and network-level convergence even when individual trajectories temporarily have to violate safety.
Fig. 2: Possible distributed predictive control barrier function (D-PCBF) control loop. Local control policies propose inputs up,ℓ that a distributed model predictive safety filter (see [ 16 ] , but with the same constraint formulation as the D-PCBF) subsequently filters to generate the control inputs uℓ , using the slack values ξℓi that result from the D-PCBF. The D-PCBF design ensures that the feasible set is forward-invariant and attractive. Instead of using local controllers and a distributed predictive safety filter, distributed MPC can be employed directly by modifying the cost in ( 7 ).
∑ℓ∈Lnew(ξℓN)⋆≤γf.
Algorithm 1 PnP procedure with D-PCBF certificates
Fig. 3: Platoon example system. Assuming perfect lateral tracking and a kinematic model, the distributed dynamics consider the arc length to the preceding vehicle and the velocity magnitude.
Fig. 4: Synthesis results for the vehicle platoon model when maximizing the safe set for L=5 agents. The top plots show the resulting s-CBF safe sets (green) and domains (blue) for the second and third car of the platoon. The bottom plots visualize the alternating optimization results described in Section V-A to approximately solve ( 12 ). The safe set size is plotted as the log-determinants of E , i.e., logdet(E)=∑ℓlogdet(Eℓ)∝∣E∣ , while γf is used to indicate the size of the terminal region of attraction.
Fig. 5: Simulation results for the vehicle platoon model. The top plots show the state space trajectories (start=dot, end=cross) of the distributed simulation for the first four follower agents, where agents ℓ=1,2 are initialized at an unsafe distance. The top-left plot shows results for 5 agents, and the right plot shows results for 40 agents. In both cases, the network-level system converges to safe operation within the state constraints, although all agents try to accelerate with aℓp=10.0m/s2 . The bottom plot shows the solve times of ( 6 ) for the centralized solver and the distributed implementation, where the latter is reported as an idealized parallel runtime.
Fig. 6: State and input signals of the platoon experiment. The experiment starts with the configuration 0←1←2 . It consists of the following events: Car 3 approaches with high speed from behind and plugs in at t≈47s . Then, the leading car 0 plugs out at t≈59s . Finally, at t≈78s , this car approaches with high speed from behind and plugs in again. It can be seen that, in both plug-in scenarios, temporary violations of velocity and distance constraints occur, since the cars have limited acceleration. Although the infeasible commands proposed by the unsafe PID controllers (gray signals) would violate state constraints, the framework prevents unsafe operation whenever possible by applying the filtered commands (red signals). Moreover, it enables safety recovery in cases of constraint violations (gray shaded times). The leader vehicle is constrained to a smaller maximum acceleration to generate visible distance-constraint violations.
Multi-robot systems (MRS) are essential for large-scale applications such as disaster response, material transport, and warehouse logistics, yet ensuring robust, safety-aware formation control in cluttered and dynamic environments remains a major challenge. Existing model predictive control (MPC) approaches suffer from limitations in scalability and provable safety, while control barrier functions (CBFs), though principled for safety enforcement, are difficult to handcraft for large-scale nonlinear systems. This paper presents FORMULA, a safe distributed, learning-enhanced predictive control framework that integrates MPC with Control Lyapunov Functions (CLFs) for stability and neural network-based CBFs for decentralized safety, eliminating manual safety constraint design. This scheme maintains formation integrity during obstacle avoidance, resolves deadlocks in dense configurations, and reduces online computational load. Simulation results demonstrate that FORMULA enables scalable, safety-aware, formation-preserving navigation for multi-robot teams in complex environments.
Qintong Xie, Weishu Zhan, Peter Chin
Thayer School of Engineering, Dartmouth College, NH 03784. · Department of Computer Science, The University of Manchester, Manchester M13 9PL, United Kingdom.
This tutorial provides a critical review of the practical application of Control Barrier Functions (CBFs) in robotic safety. While the theoretical foundations of CBFs are well-established, I identify a recurring gap between the mathematical assumption of a safe controller's existence and its constructive realization in systems with input constraints. I highlight the distinction between candidate and valid CBFs by analyzing the interplay of system dynamics, actuation limits, and class-K functions. I further show that some purported demonstrations of safe robot policies or controllers are limited to passively safe systems, such as single integrators or kinematic manipulators, where safety is already inherited from the underlying physics and even naive geometric hard constraints suffice to prevent collisions. By revisiting simple low-dimensional examples, I show when CBF formulations provide valid safety guarantees and when they fail due to common misuses. I then provide practical guidelines for constructing realizable safety arguments for systems without such passive safety. A crowd-navigation simulation study further illustrates that CBF-derived reward shaping in reinforcement learning can improve empirical behavior without establishing formal safety. The goal of this tutorial is to bridge the gap between theoretical guarantees and actual implementation, supported by an open-source interactive web demonstration that visualizes these concepts intuitively.
Taekyung Kim
Department of Robotics, University of Michigan, Ann Arbor, MI, 48109, USA
Control barrier functions (CBFs) provide real-time safety guarantees through pointwise conditions on the state. However, synthesizing a valid CBF is difficult and the resulting controllers are myopic. To address myopia, this article introduces predicted-flow control barrier functions (P-CBFs), which generalize the CBF from a function of the current state to a functional of a predicted flow under a parametrized control plan over a finite prediction horizon. For safety, a P-CBF can certify that the predicted flow is in a safe set over the entire prediction horizon. However, candidate P-CBFs suffer from the same challenge as candidate CBFs, namely, control constraints make it difficult to guarantee that the P-CBF is valid. This article resolves this challenge by introducing a terminal candidate P-CBF requiring that the predicted flow end in a backup safe set at the terminal time, and a planning-time shift that modulates the prediction horizon, providing an additional degree of freedom to ensure feasibility. The real-time control and the evolution of the control-plan parameter and planning-time shift are determined jointly by a single convex optimization that is guaranteed to be feasible and renders the associated safe set forward invariant. The resulting safe optimal flow control provides a safety certificate over the entire prediction horizon and unifies finite-horizon integral-cost optimization with safety certification. This optimization reduces to a quadratic program (QP) if the control constraints are a convex polytope. The QP implementation, termed FlowBarrier, is validated on a nonholonomic ground robot navigating a dense environment. FlowBarrier is compared to nonlinear model predictive control and two CBF-based safety filter methods across 100 trials, where FlowBarrier achieves the highest goal-reaching rate, zero safety violations, and the lowest computation time.
Amirsaeid Safari, Jesse B. Hoagg
Department of Mechanical and Aerospace Engineering, University of Kentucky, Lexington, KY 40506 USA