# Distributed Collaborative Safety-Critical Control for Networked Dynamic
Systems

Brooks A. Butler
Elmore Family School of Electrical and Computer Engineering
Purdue University
<EMAIL_ADDRESS>
& Philip E. Paré
Elmore Family School of Electrical and Computer Engineering
Purdue University
<EMAIL_ADDRESS>
This work was partially funded by Purdue’s Elmore Center for Uncrewed Aircraft
Systems and the National Science Foundation, grant NSF-ECCS #2238388.

###### Abstract

As modern systems become ever more connected with complex dynamic coupling
relationships, the development of safe control methods for such networked
systems becomes paramount. In this paper, we define a general networked model
with coupled dynamics and local control and discuss the relationship of node-
level safety definitions for individual agents with local neighborhood
dynamics. We define a node-level barrier function (NBF), node-level control
barrier function (NCBF), and collaborative node-level barrier function (cNCBF)
and provide conditions under which sets defined by these functions will be
forward invariant. We use collaborative node-level barrier functions to
construct a novel distributed algorithm for the safe control of collaborating
network agents and provide conditions under which the algorithm is guaranteed
to converge to a viable set of safe control actions for all agents or a
terminally infeasible state for at least one agent. We introduce the notion of
non-compliance of network neighbors as a metric of robustness for
collaborative safety for a given network state and chosen barrier function
hyper-parameters. We illustrate these results on a networked susceptible-
infected-susceptible (SIS) model.

_Keywords_ Network analysis and control $\cdot$ Safety-critical control
$\cdot$ Cooperative control $\cdot$ Constrained control

##  1 Introduction

Networked dynamic systems have become ubiquitous in modern society,
underpinning critical infrastructure, transportation, communication, and
coupled processes. In many applications, effective and safe operation in
networked systems is crucial, as disruptions in these interconnected systems
can potentially have far-reaching societal and economic consequences. Some
examples of critical network model applications include the mitigation of
epidemic spreading processes Paré et al. (2020), smart grid management Tuballa
and Abundo (2016), uncrewed aerial drone swarms Tahir et al. (2019); Chung et
al. (2018), autonomous vehicle networks Plathottam and Ranganathan (2018), and
multi-agent robot systems Wang et al. (2017a). One of the greatest challenges
in the effective control of such networked systems is the rate at which
complexity scales with each additional node, where the computational
complexity for even relatively simple networked models can become
exponentially intractable as these networks grow (i.e., as the number of nodes
increases). In order to overcome this scaling challenge, distributed and
decentralized controllers are developed to scale with network growth.
Distributed control laws become especially important when nodes represent
independent agents with individual goals. Additionally, when network agents
are considered to be independent actors with individual objectives,
cooperative control schemes allow for coordination between networked agents
via active communication Lewis et al. (2013); Li and Duan (2017); Wang et al.
(2017b); Yu et al. (2017), further emphasizing the importance of a distributed
control law in such systems. In this work, we develop methods for the
collaborative distributed safety-critical control of networked dynamic systems
and discuss principles of safe control for networked systems with node-level
definitions of safety.

###  1.1 Background

While much of the foundational work on safety for dynamical systems via set
invariance was performed by Nagumo during the 1940s Nagumo (1942); Blanchini
(1999), the study of safety-critical control has seen a significant resurgence
in recent years, due largely to the introduction and refinement of control
barrier functions (CBFs) Ames et al. (2016, 2019). Since their introduction,
control barrier functions have been used in numerous applications to provide
safety guarantees in many dynamic system models including robotics Wang et al.
(2017a); Glotfelter et al. (2017); Chung et al. (2018); Chen et al. (2020a)
and autonomous vehicles Notomista et al. (2020); Ma et al. (2021); Alan et al.
(2022); Lyu et al. (2022). We do not attempt an exhaustive literature review
on the general application of CBFs to cyber-physical systems in this paper;
additional references may be found here Hobbs et al. (2023); Xiao et al.
(2023).

We now provide some background on work relating to the safety-critical control
of networked systems with coupled dynamics. While many of the initial
applications of safety-critical control have been focused on multi-robot
systems Wang et al. (2016, 2017a); Glotfelter et al. (2017, 2018); Chen et al.
(2020a); Panagou et al. (2015); Hu et al. (2022) with an emphasis on collision
avoidance, there is a key distinction to be made between systems with
networked communication and mutually independent agent dynamics (e.g. a group
of robots with a common goal and shared communication but mutually independent
kinematics) and a networked system with coupled dynamics (e.g. a networked
power grid, physically coupled robots, or epidemic processes) where
neighboring states can be found directly in the first order dynamics of each
node. Thus, this work focuses on the second case of coupled networked
dynamics.

One common strategy used to tackle the high dimensionality and complexity of
networked systems is to break down these potentially large systems into
smaller, and therefore more readily solvable, components and provide methods
for composing a solution for the entire system. This strategy has been applied
in the compositional construction of barrier functions for networked systems
Nejati et al. (2020a, b, 2022); Jahanshahi et al. (2022); Jagtap et al. (2020)
where systems are interconnected via input-output connections. Oftentimes, the
input of other systems to an interconnected component is treated as a bounded
disturbance, and one may take advantage of the small-gain theory when
composing multiple barrier certificates Anand et al. (2022). Other work on
composing barrier functions, although not explicitly for networked systems,
uses geometric methods to compose multiple safety constraints on second-order
systems Breeden and Panagou (2023), which utilizes principles of higher-order
barrier functions Xiao and Belta (2019, 2021). Work has also been presented on
the composition of neural certificates for networked systems Zhang et al.
(2023a), which uses deep learning to train scalable models with networked
connections based on principles of control Lyapunov functions combined with a
small-gain assumption.

Another method for computing safety certificates for systems involves the use
of signal temporal logic (STL) Donzé (2013); Raman et al. (2014); Deshmukh et
al. (2017); Raman et al. (2015); Sadigh and Kapoor (2016) which provides a
natural syntax for ensuring that a dynamic system meets certain safety
requirements for all time. These methods have been applied to networked
systems with coupled dynamics to formulate both centralized and decentralized
controllers under STL tasks Lindemann and Dimarogonas (2020, 2019a, 2019b)
which can be applied to time-varying barrier functions. Additionally, work has
been done using assume-guarantee contracts and parameterized signal temporal
logic (pSTL) as an analogy for barrier certificates in networked systems with
applications to power systems Chen et al. (2020b, 2019). In these works, input
from neighboring nodes in the network is treated as a bounded disturbance,
which in the case of Chen et al. (2020b), these disturbances are considered to
be scalar and summable. Many of these works often focus on the definition of
safety for the network as a whole and use compositional methods to efficiently
compute centralized safety certificates Song et al. (2022). There is also
recent work that uses machine learning to train distributed controllers for
scalable networked systems via graph neural networks Zhou et al. (2020); Wu et
al. (2020); Scarselli et al. (2008) to implement safe multi-agent control Fan
et al. (2023) that can be tested by neighbors without knowledge of the control
inputs.

The field of cooperative control for multi-agent systems provides a rich body
of literature that examines scenarios where agents may share information over
a communication network Lewis et al. (2013); Li and Duan (2017); Wang et al.
(2017b); Yu et al. (2017). In such formulations, agents typically share and
receive information via either direct communication or broadcast that enables
cooperative control adjustments to be made Huang et al. (2010); Li et al.
(2021); Qu (2010); Qu and Simaan (2012). However, in many formulations of
cooperative control, a common assumption is that agent first-order dynamics
are independent of each other, thus the networked element is mainly
facilitated via virtual communication. Contrasting in this work, we wish to
include the class of explicitly coupled systems and leverage any knowledge of
the networked dynamic structure in the formulation of safety requests.

While the current literature has explored some approaches for distributed
safety-critical control of networked dynamic systems, the use of explicit
coupled network dynamics for safety-critical control of individual network
agents and the implementation of active collaboration between coupled agents
to achieve independent safety goals is, to the best of our knowledge, an open
problem. Therefore, this work aims to contribute to the development of control
theory for safety-critical systems with coupled dynamics by exploiting
directly the dynamic structure of coupled systems.

###  1.2 Contributions

In this paper, we make the following contributions:

  1. 1.

We define a general class of networked dynamic systems with coupled dynamics
and local control.

  2. 2.

Using this class of networked systems, we provide conditions under which both
individual nodes and the entire network are guaranteed to satisfy safety
constraints.

  3. 3.

We define a collaborative node-level control barrier function (cNCBF) that can
be used to guarantee the safety of a given node with respect to the dynamics
of its 1-hop neighbors.

  4. 4.

We construct a novel distributed algorithm for collaborative safety between
neighboring agents and provide conditions under which this algorithm is
guaranteed to converge.

  5. 5.

We introduce the notion of non-compliance of network neighbors as a metric of
robustness for collaborative safety with respect to a given network state and
barrier function hyper-parameters.

We introduce notation, networked model definitions, and background for safety
definitions in networked dynamic systems in Section 2 and provide theoretical
results on safety guarantees for coupled systems with local control in Section
3. We then use the developed theory for collaborative safety-critical control
to construct and analyze an algorithm for collaborative safety in Section 4.
Finally, we illustrate our results using a networked SIS epidemic model in
Section 5 and provide some conclusions in Section 6.

##  2 Preliminaries

In this section, we define the notation to be used in this paper, provide a
general definition for the class of networked dynamic systems discussed in
this work, and discuss safety definitions for networked systems including
node-level definitions of safety and their relationship to network dynamics.

###  2.1 Notation

Let $\text{Int}\mathcal{C}$, $\partial\mathcal{C}$, $|\mathcal{C}|$ denote the
interior, boundary, and cardinality of the set $\mathcal{C}$, respectively.
$\mathbb{R}$ and $\mathbb{N}$ are the set of real numbers and positive
integers, respectively. Let $C^{r}$ denote the set of functions $r$-times
continuously differentiable in all arguments, and $\mathcal{K}$ the set of
class-$\mathcal{K}$ functions. We define $[n]\subset\mathbb{N}$ to be a set of
indices $\\{1,2,\dots,n\\}$. We define the Lie derivative of the function
$h:\mathbb{R}^{N}\rightarrow\mathbb{R}$ with respect to the vector field
generated by $f:\mathbb{R}^{N}\rightarrow\mathbb{R}^{N}$ as

$\mathcal{L}_{f}h(x)=\frac{\partial h(x)}{\partial x}f(x).$ (1)

We define higher-order Lie derivatives with respect to the same vector field
$f$ with a recursive formula Röbenack (2008), where $k>1$, as

$\mathcal{L}^{k}_{f}h(x)=\frac{\partial\mathcal{L}^{k-1}_{f}h(x)}{\partial
x}f(x).$ (2)

###  2.2 Networked Dynamic System Model

We define a networked system using a graph
$\mathcal{G}=(\mathcal{V},\mathcal{E})$, where $\mathcal{V}$ is the set of
$n=|\mathcal{V}|$ nodes, $\mathcal{E}\subseteq\mathcal{V}\times\mathcal{V}$ is
the set of edges. Let $\mathcal{N}_{i}^{+}$ be the set of all neighbors with
an incoming connection to node $i$, where

$\mathcal{N}_{i}^{+}=\\{j\in[n]\setminus\\{i\\}:(i,j)\in\mathcal{E}\\}.$ (3)

Similarly, all nodes with an outgoing connection from $i$ to $j$ are given by

$\mathcal{N}_{i}^{-}=\\{j\in[n]\setminus\\{i\\}:(j,i)\in\mathcal{E}\\},$ (4)

with the complete set of neighboring nodes given by

$\mathcal{N}_{i}=\mathcal{N}_{i}^{+}\cup\mathcal{N}_{i}^{-}.$ (5)

Further, we define the state vector for each node as
$x_{i}\in\mathbb{R}^{N_{i}}$, with $N=\sum_{i\in[n]}N_{i}$ being the state
dimension of the entire system,
$N_{i}^{+}=\sum_{j\in\mathcal{N}_{i}^{+}}N_{j}$ the combined dimension of
incoming neighbor states, and
$x_{\mathcal{N}_{i}^{+}}\in\mathbb{R}^{N_{i}^{+}}$ denoting the combined state
vector of all incoming neighbors. Then, for each node $i\in[n]$, we can
describe its state dynamics, which may be nonlinear and are time-invariant, as

$\dot{x}_{i}=f_{i}(x_{i},x_{\mathcal{N}_{i}^{+}})+g_{i}(x_{i},x_{\mathcal{N}_{i}^{+}},u_{i},u_{\mathcal{N}_{i}^{+}})$
(6)

where $f_{i}:\mathbb{R}^{N_{i}+N_{i}^{+}}\rightarrow\mathbb{R}^{N_{i}}$ and
$g_{i}:\mathbb{R}^{N_{i}+N_{i}^{+}}\times\mathbb{R}^{M_{i}+M_{i}^{+}}\rightarrow\mathbb{R}^{N_{i}}$
locally Lipschitz for all $i\in[n]$, and
$u_{i}\in\mathcal{U}_{i}\subset\mathbb{R}^{M_{i}}$,
$M_{i}^{+}=\sum_{j\in\mathcal{N}_{i}^{+}}M_{j}$, and
$u_{\mathcal{N}_{i}^{+}}\in\mathbb{R}^{M_{i}^{+}}$ is the combined control
input for all other incoming neighbors. Note that in our formulation of a
networked dynamic system, we include coupling effects and networked structure
as an integral part of our control-free model dynamics $f_{i}$, rather than
treating coupling connections as disturbances or noise. In this sense, we aim
to exploit any information provided by the network structure in our control
design.

###  2.3 Safety Definitions

While the language and syntax of set invariance and barrier functions provide
a mathematically succinct grammar for describing theoretical safety, defining
safety in practice requires careful delineation between desired safety goals
and actual viable safety in the defined state space with respect to the system
dynamics. Additionally, when discussing definitions of safety for networked
dynamic systems, one must consider the possibly differing definitions of
safety for each node in the network. These node-level safety definitions
become even more relevant when considering networked models where nodes may be
viewed as independent agents working to achieve individual or node-level
goals. Thus, in the context of a networked model defined in Section 2.2, we
define a node-level safety constraint for node $i\in[n]$ with the set

$\displaystyle\mathcal{C}_{i}$
$\displaystyle=\left\\{x\in\mathbb{R}^{N}:h_{i}(x_{i})\geq 0\right\\},$ (7)

where $h_{i}\in C^{r},r\geq 1$ and
$h_{i}:\mathbb{R}^{N_{i}}\rightarrow\mathbb{R}$ is a function whose zero-
super-level set defines the region which node $i\in[n]$ considers to be safe
(i.e., if $h_{i}(x_{i})<0$, then node $i$ is no longer safe). Note that
$\mathcal{C}_{i}$ also collects all other states in the network, which enables
us to define the safety constraints of the entire networked system as

$\displaystyle\mathcal{C}$ $\displaystyle=\bigcap_{i\in[n]}\mathcal{C}_{i}.\;$
(8)

This notation also allows us to define the constraints of a particular 1-hop
neighborhood centered on node $i$ as

$\displaystyle\mathcal{C}_{\mathcal{N}_{i}}=\bigcap_{j\in\mathcal{N}_{i}\cup\\{i\\}}\mathcal{C}_{j}.$
(9)

Given the definitions of these safety constraints, we define the viable safe
regions Breeden and Panagou (2023) for each node as follows.

######  Definition 1.

A set $\mathcal{S}_{i}\subseteq\mathcal{C}_{i}$ is called a node-level
viability domain for node $i$ if for every point
$x_{i}(t_{0})\in\mathcal{S}_{i}$ there exist control signals
$u_{i}(t)\in\mathcal{U}_{i}$ and
$u_{\mathcal{N}_{i}^{+}}(t)\in\mathcal{U}_{\mathcal{N}_{i}^{+}}$ with
$t\in\mathcal{T}$ such that the trajectory $x_{i}(\cdot)$ of (6) satisfies
$x_{i}(t)\in\mathcal{S}_{i}$ for all $t\in\mathcal{T}$.

We define a similar notion for the entire networked system, where we compose
the dynamics for the entire system as

$\dot{x}=f(x)+g(x,u)$ (10)

where $x\in\mathbb{R}^{N}$, $f:\mathbb{R}^{N}\rightarrow\mathbb{R}^{N}$,
$g:\mathbb{R}^{N}\times\mathbb{R}^{M}\rightarrow\mathbb{R}^{N}$,
$M=\sum_{i\in[n]}M_{i}$, and $u\in\mathcal{U}\subset\mathbb{R}^{M}$ with

$\mathcal{U}=\mathcal{U}_{1}\times\cdots\times\mathcal{U}_{n},$

which contains all the control actions taken across the network.

######  Definition 2.

A set $\mathcal{S}\subseteq\mathcal{C}$ is called a network viability domain
if for every point $x(t_{0})\in\mathcal{S}$ there exist control signals
$u(t)\in\mathcal{U}$ with $t\in\mathcal{T}$ such that the trajectory
$x(\cdot)$ of (10) satisfies $x(t)\in\mathcal{S}$ for all $t\in\mathcal{T}$.

Note that viability domains may be defined by an implicit barrier function
Gurriet et al. (2020) with respect to a defined backup set
$\mathcal{S}^{b}\subseteq\mathcal{S}$ which the system can safely return to
within a given time horizon. We now discuss barrier functions in the context
of networked dynamic systems with node-level safety constraints in the
following subsection.

###  2.4 Safety in Networked Dynamic Systems

One unique challenge that comes from the definition of node-level safety
constraints as defined in Section 2.3, which depend only on the state of the
given node, is that when evaluating the derivative of $h_{i}(x_{i})$ we must
incorporate the network influence of its neighbors $j\in\mathcal{N}_{i}^{+}$,
where, with a slight abuse of notation, we define the derivative of $h_{i}$ as

$\dot{h}_{i}(x,u)=\mathcal{L}_{f_{i}}h_{i}(x)+\mathcal{L}_{g_{i}}h_{i}(x,u)=\frac{\partial
h_{i}(x)}{\partial x}\big{(}f_{i}(x)+g_{i}(x,u)\big{)}.$

Notice that in this case, we can define the node-level constraint function as
the mapping $h_{i}:\mathbb{R}^{N_{i}}\rightarrow\mathbb{R}$; however, the
dynamics of node $i$, whose dynamics are a function of all neighboring nodes
in $\mathcal{N}_{i}^{+}$, require that
$\dot{h}_{i}:\mathbb{R}^{N_{i}+N_{i}^{+}}\rightarrow\mathbb{R}$.

Therefore, even though we define $h_{i}$ with respect to only
$x_{i}\in\mathbb{R}^{N_{i}}$, when computing the Lie derivative we must
compute the Jacobian with respect to all network states $\frac{\partial
h_{i}(x)}{\partial x}$, which naturally zeros out all states of nodes
$j\notin\mathcal{N}_{i}^{+}\cup\\{i\\}$ when taking only the first derivative,
but is relevant when we must consider higher-order derivatives of the
constraint function $h_{i}$. In fact, although the initial definition of a
node-level constraint function $h_{i}(x_{i})$ may appear to be agnostic to
other nodes’ dynamics and their respective constraint functions
$h_{j}(x_{j}),j\in\mathcal{N}_{i}^{+}$, we see the $(k-1)$-hop neighborhood
dynamics appear in $k$th derivative of $h_{i}$ as follows.

Taking the first-order Lie derivative of the node-level constraint function
$h_{i}(x_{i})$ with respect to a general networked system

$\dot{x}=f(x),$ (11)

without control inputs for the sake of notational simplicity in this initial
discussion, yields

$\displaystyle\mathcal{L}_{f}h_{i}(x)$ $\displaystyle=\frac{\partial
h_{i}(x_{i})}{\partial x}f(x)=\sum_{j\in[n]}\frac{\partial h_{i}(x)}{\partial
x_{j}}f_{j}(x).$ (12)

Note that since $h_{i}$ is defined with respect to only the states at node
$i$, we have $\frac{\partial h_{i}(x_{i})}{\partial x_{j}}=0$ for all
$j\in[n]\setminus\\{i\\}$ where $j\neq i$. Therefore, we may express the
first-order Lie derivative of such a constraint function as

$\mathcal{L}_{f}h_{i}(x)=\frac{\partial h_{i}(x_{i})}{\partial
x_{i}}f_{i}(x)=\mathcal{L}_{f_{i}}h_{i}(x).$ (13)

Extending this computation to the second-order Lie derivative yields

$\displaystyle\mathcal{L}_{f}^{2}h_{i}(x)$
$\displaystyle=\frac{\partial\mathcal{L}_{f}h_{i}(x)}{\partial
x}f(x)=\sum_{j\in[n]}\mathcal{L}_{f_{j}}\mathcal{L}_{f_{i}}h_{i}(x)$ (14)

where we now begin to see the dynamics of the 1-hop neighbors of node $i$
emerge, since

$\frac{\partial}{\partial x_{j}}\left(\frac{\partial h_{i}(x_{i})}{\partial
x_{i}}f_{i}(x)\right)=0,\forall
j\in[n]\setminus(\mathcal{N}_{i}^{+}\cup\\{i\\})$ (15)

making

$\mathcal{L}_{f}^{2}h_{i}(x)=\sum_{j\in\mathcal{N}_{i}^{+}}\mathcal{L}_{f_{j}}\mathcal{L}_{f_{i}}h_{i}(x)+\mathcal{L}^{2}_{f_{i}}h_{i}(x).$
(16)

Therefore, the second derivative of $h_{i}$ includes the Lie derivatives along
the vector fields generated by both $f_{i}$ and its neighbors $f_{j}$ for
$j\in\mathcal{N}_{i}^{+}$. Following this same pattern, the $k$th-order Lie
derivative of $h_{i}$ can be written as

$\mathcal{L}_{f}^{k}h_{i}(x)=\sum_{\alpha_{1},\dots,\alpha_{k-1}\in[n]}\mathcal{L}_{f_{\alpha_{k-1}}}\cdots\mathcal{L}_{f_{\alpha_{1}}}\mathcal{L}_{f_{i}}h_{i}(x),$

where we can see that these $k$th-order Lie derivatives of $h_{i}$ encode the
dynamic relationships of the $(k-1)$-hop neighborhood of node $i\in[n]$.
Recall the definition of high-order barrier functions (HOBF) Xiao and Belta
(2019, 2021), where we define a series of functions in the following form

$\displaystyle\psi_{i}^{0}(x)$ $\displaystyle:=h_{i}(x)$ (17)
$\displaystyle\psi_{i}^{1}(x)$
$\displaystyle:=\dot{\psi}_{i}^{0}(x)+\alpha_{i}^{1}(\psi_{i}^{0}(x))$
$\displaystyle\vdots$ $\displaystyle\psi_{i}^{k}(x)$
$\displaystyle:=\dot{\psi}_{i}^{k-1}(x)+\alpha_{i}^{r}(\psi_{i}^{k-1}(x))$

where
$\alpha_{i}^{1}(\cdot),\alpha_{i}^{1}(\cdot),\dots,\alpha_{i}^{k}(\cdot)$
denote class-$\mathcal{K}$ functions of their argument. These functions
provide definitions for the corresponding series of sets

$\displaystyle\mathcal{C}_{i}^{1}$
$\displaystyle:=\\{x\in\mathbb{R}^{N}:\psi_{i}^{0}(x)\geq 0\\}$ (18)
$\displaystyle\mathcal{C}_{i}^{2}$
$\displaystyle:=\\{x\in\mathbb{R}^{N}:\psi_{i}^{1}(x)\geq 0\\}$
$\displaystyle\vdots$ $\displaystyle\mathcal{C}_{i}^{k}$
$\displaystyle:=\\{x\in\mathbb{R}^{N}:\psi_{i}^{k-1}(x)\geq 0\\}$

which yield the following definition.

######  Definition 3.

Let $\mathcal{C}_{i}^{1},\mathcal{C}_{i}^{2},\dots,\mathcal{C}_{i}^{k}$ be
defined by (17) and (18). We have that $h_{i}$ is a node-level barrier
function (NBF) for node $i\in[n]$ if $h_{i}\in C^{k}$ and there exist
differentiable class-$\mathcal{K}$ functions
$\alpha_{i}^{1},\alpha_{i}^{2},\dots,\alpha_{i}^{k}$ such that
$\psi_{i}^{k}(x)\geq 0$ for all $x\in\bigcap_{r=1}^{k}\mathcal{C}_{i}^{r}$.

This definition leads naturally to the following lemma (which is a direct
result of Theorem 4 in Xiao and Belta (2019)).

######  Lemma 1.

The set $\bigcap_{r=1}^{k}\mathcal{C}_{i}^{r}$ is forward invariant for the
system in (11) if $h_{i}$ is an NBF.

In this sense, under Lemma 1 we may consider

$\mathcal{S}_{i}=\bigcap_{r=1}^{k}\mathcal{C}_{i}^{r}\subseteq\mathcal{C}_{i}$
(19)

to be a node-level viability domain of $\mathcal{C}_{i}$ with respect to the
$(k-1)$-hop neighborhood dynamics of node $i\in[n]$. For the rest of the
discussion in this paper, we only consider the 1-hop neighborhoods for nodes
in a networked system. However, extending this discussion to 2-hop
neighborhoods and beyond may be a valuable direction for future work.

##  3 Safety Guarantees with Local Control

We now consider the safety of a controlled networked dynamic system with
respect to node-level defined safety conditions and distributed control. We
first present a result that allows for a worse-case analysis of the
vulnerability of a given node depending on the definition of safety
constraints by its neighbors. We then define a collaborative node-level
barrier function that incorporates the 1-hop neighborhood dynamics into the
evaluation of node-level safety.

For this analysis, we limit our control actions to the case when the dynamics
of each node $i\in[n]$ are defined by

$\dot{x}_{i}=f_{i}(x_{i},x_{\mathcal{N}_{i}^{+}})+g_{i}(x_{i},u_{i}).$ (20)

In other words, assume that the controller $u_{i}\in\mathcal{U}_{i}$ for each
node $i\in[n]$ is incapable of changing the strength of the network influences
from its neighbors $\mathcal{N}_{i}^{+}$, which are encoded in the networked
dynamics of $f_{i}(x_{i},x_{\mathcal{N}_{i}^{+}})$.

###  3.1 Node Vulnerability

We define a conservative condition for safety with respect to a worst-case
scenario for neighbors as follows. Given the system dynamics defined in (20),
we make a best-case assumption on the capability of the controllers for nodes
$j\in\mathcal{N}_{i}^{+}$.

######  Assumption 1.

Let there exist an NBF $h_{j}:\mathbb{R}^{N_{j}}\rightarrow\mathbb{R}$ for
each $j\in\mathcal{N}_{i}^{+}$ with a corresponding node-level viability
domain $\mathcal{S}_{j}$ as defined by (19).

Thus, we assume that all neighbors $j\in\mathcal{N}_{i}^{+}$ are capable of
satisfying their individual safety constraints within their node-level
viability domain. Further, we assume that the relative safety of each neighbor
$j\in\mathcal{N}_{i}^{+}$ has an influence on the capability of node $i$ to
remain safe, which is defined in the following assumption.

######  Assumption 2.

For a given node $i\in[n]$ with neighbors $j\in\mathcal{N}_{i}^{+}$ and
$x,y\in\mathcal{S}_{i}\cap\mathcal{S}_{j}$, if
$x_{\mathcal{N}_{i}^{+}}=y_{\mathcal{N}_{i}^{+}}$ and

$h_{j}(x)<h_{j}(y)$ (21)

then

$\mathcal{L}_{f_{i}}h_{i}(x)\leq\mathcal{L}_{f_{i}}h_{i}(y).$ (22)

Conversely, one may interpret Assumption 2 as increasing the safety of the
neighbors of node $i$ also increases its ability to remain safe. This
assumption restricts the use of the following results to specific applications
such as networked epidemic spreading models, where typically the shared goal
of all nodes is to keep the level of infection below some threshold, and an
increase in infection levels for connected neighbors of a given node results
in a higher total infection rate. Another example is power system control,
where a typical goal for each node is to keep voltage frequency within a
specified range, and deviation by neighbors for a given node increases the
strain on its own controller.

Under Assumptions 1 and 2, we consider a worst-case scenario that can identify
if node $i\in[n]$ is vulnerable to violating its safety conditions based on
the safety constraints of its neighbors.

######  Definition 4.

Let $\mathcal{C}_{i}$ be defined by (7). We have that
$h_{i}:\mathbb{R}^{N_{i}}\rightarrow\mathbb{R}$ is a node-level control
barrier function (NCBF) if $\forall
x\in\partial\mathcal{S}_{\mathcal{N}_{i}^{+}},\exists u_{i}\in\mathcal{U}_{i}$
such that

$\dot{h}_{i}(x,u_{i})\geq-\alpha_{i}(h_{i}(x)),$ (23)

where $\alpha_{i}$ is an extended class-$\mathcal{K}$ function.

Note that the NCBF is defined using the boundary states of neighbors viability
domains $\mathcal{S}_{\mathcal{N}_{i}^{+}}$, which yields the following
results on the forward invariance of
$\mathcal{S}_{i}\subseteq\mathcal{C}_{i}$.

######  Theorem 1.

Given a networked dynamic system defined by (20) and that Assumptions 1 and 2
hold, $\mathcal{S}_{i}\subseteq\mathcal{C}_{i}$ is forward invariant if and
only if $h_{i}$ is an NCBF.

###### Proof.

By Assumption 1 and Lemma 1, we know that if
$x\in\partial\mathcal{S}_{\mathcal{N}_{i}^{+}}$ then $h_{j}(x)=0$ and

$\dot{h}_{j}(x)\geq 0,\forall j\in\mathcal{N}_{i}^{+}.$ (24)

Consider the set
$\mathcal{M}_{ij}=\text{Int}\mathcal{S}_{j}\cap\left(\partial\mathcal{S}_{\mathcal{N}_{i}^{+}}\setminus\partial\mathcal{S}_{j}\right)$,
i.e., the set of all states that include the interior of $\mathcal{S}_{j}$ and
where $h_{i}(x_{i})=0$ for some $i\in[n]\setminus\\{j\\}$. By Assumption 2, we
know that if $\exists u_{i}\in\mathcal{U}_{i}$ such that (23) holds, then

$\displaystyle\dot{h}_{i}(y,u_{i})$
$\displaystyle=\mathcal{L}_{f_{i}}h_{i}(y)+\mathcal{L}_{g_{i}}h_{i}(y,u_{i})$
(25)
$\displaystyle\geq\mathcal{L}_{f_{i}}h_{i}(x)+\mathcal{L}_{g_{i}}h_{i}(x,u_{i})$
$\displaystyle=\dot{h}_{i}(x,u_{i}),\forall y\in\mathcal{M}_{ij},\forall
j\in\mathcal{N}_{i}^{+}$

since $\mathcal{L}_{g_{i}}h_{i}(y,u_{i})=\mathcal{L}_{g_{i}}h_{i}(x,u_{i})$
and $h_{j}(y)>h_{j}(x),\forall y\in\mathcal{M}_{ij},\forall
j\in\mathcal{N}_{i}^{+}$. Thus, if $x_{0}\in\mathcal{S}_{i}$ then $\exists
u_{i}\in\mathcal{U}_{i}$ such that (23) holds. Therefore, $\mathcal{S}_{i}$ is
forward invariant.

For proof of sufficiency, assume $\exists
x\in\partial\mathcal{S}_{\mathcal{N}_{i}^{+}}$ such that $\forall
u_{i}\in\mathcal{U}_{i}$

$\dot{h}_{i}(x,u_{i})+\alpha_{i}(h_{i}(x))<0.$ (26)

Since $x\in\partial\mathcal{S}_{\mathcal{N}_{i}}$ we have $h_{i}(x)=0$, making

$\dot{h}_{i}(x,u_{i})<0,\forall u_{i}\in\mathcal{U}_{i}.$ (27)

Thus, $\mathcal{S}_{i}$ is not forward invariant since $\exists
x\in\mathcal{S}_{i}$ that is guaranteed to leave the safe set by entering its
complement $\mathcal{S}_{i}^{\mathsf{c}}=\\{x\in\mathbb{R}^{N}:h_{i}(x)<0\\}$.
∎

We, therefore, have a result that can describe the safety of a single node in
a networked system where distributed controllers are unable to change network
connections and where the safety of a node is mutually dependent on the safety
of its neighbors. Given that the assumptions for this result limits its
application to specific networked models, we aim next to generalize these
results to a more diverse set of network applications that allow collaboration
between node $i$ and its neighbors.

###  3.2 Collaborative Network Safety-Critical Control

In the case where we have knowledge of network dynamic influences and all
nodes are able to cooperate and communicate freely, we work to leverage this
collective power to achieve network safety in a distributed manner. For this
result, we assume that the system in (20) is control affine, i.e.,

$\dot{x}_{i}=f_{i}(x_{i},x_{\mathcal{N}_{i}^{+}})+g_{i}(x_{i})u_{i}.$ (28)

For the sake of notational simplicity in the remaining derivations of this
paper, we use the full state of the network $(x)$ and the state for the 1-hop
neighborhood $(x_{i},x_{\mathcal{N}_{i}^{+}})$ and 1-hop neighborhood dynamics
$(x_{i},x_{\mathcal{N}_{i}^{+}},x_{\mathcal{N}_{j}^{+}}:\forall j\in
x_{\mathcal{N}_{i}^{+}})$ interchangeably. Given the node-level safety
constraints sets $\mathcal{C}_{i}$ defined by (7) for the system in (28), we
compute the first-order derivative of the safety constraint with respect to
the network dynamics as

$\dot{h}_{i}(x,u_{i})=\mathcal{L}_{f_{i}}h_{i}(x)+\mathcal{L}_{g_{i}}h_{i}(x_{i})u_{i}.$
(29)

Similar to our discussion in Section 2.4, we can compute the second-order
derivative of $h_{i}$ with respect to the network dynamics defined by (28) as

$\displaystyle\ddot{h}_{i}(x,u)$
$\displaystyle=\sum_{j\in\mathcal{N}_{i}^{+}}\big{[}\mathcal{L}_{f_{j}}\mathcal{L}_{f_{i}}h_{i}(x)+\mathcal{L}_{g_{j}}\mathcal{L}_{f_{i}}h_{i}(x)u_{j}\big{]}+\mathcal{L}^{2}_{f_{i}}h_{i}(x)+u_{i}^{\top}\mathcal{L}^{2}_{g_{i}}h_{i}(x_{i})u_{i}$
(30)
$\displaystyle\quad+\big{(}\mathcal{L}_{f_{i}}\mathcal{L}_{g_{i}}h_{i}(x)^{\top}+\mathcal{L}_{g_{i}}\mathcal{L}_{f_{i}}h_{i}(x)\big{)}u_{i}.$

Notice, as before, that the dynamics of each neighbor
$j\in\mathcal{N}_{i}^{+}$ appear in the differential expressions of $h_{i}$.
For the purposes of implementing a distributed control law, we need only
consider the 1-hop neighborhood dynamics of any given node, which may then be
applied recursively across the entire network. Additionally, since control is
applied locally at each node, we have that the combined control for $h_{i}$ is
of mixed relative degree due to the control input of neighbors appearing in
the second-order derivative of $h_{i}$. Given this structure in the 1-hop
neighborhood controlled dynamics, we construct a similar series of functions
to (17) for the second-order system for the 1-hop neighborhood of node
$i\in[n]$

$\displaystyle\psi_{i}^{0}(x_{i})$ $\displaystyle:=h_{i}(x_{i})$ (31)
$\displaystyle\psi_{i}^{1}(x,u_{i})$
$\displaystyle:=\dot{\psi}_{i}^{0}(x,u_{i})+\eta_{i}(\psi_{i}^{0}(x_{i}))$
$\displaystyle\psi_{i}^{2}(x,u_{i},u_{\mathcal{N}_{i}^{+}})$
$\displaystyle:=\dot{\psi}_{i}^{1}(x,u_{i},u_{\mathcal{N}_{i}^{+}})+\kappa_{i}(\psi_{i}^{1}(x,u_{i}))$

where $\eta_{i},\kappa_{i}$ are class-$\mathcal{K}$ functions. Note that
$\psi_{i}^{1}(x,u_{i})$ is equivalent to (29). We can also express
$\psi_{i}^{2}(x,u_{i},u_{\mathcal{N}_{i}^{+}})$ in terms of $h_{i}$ as

$\displaystyle\psi_{i}^{2}(x,u_{i},u_{\mathcal{N}_{i}^{+}})$
$\displaystyle=\ddot{h}_{i}(x,u_{i},u_{\mathcal{N}_{i}^{+}})+\dot{\eta}_{i}(h_{i}(x_{i}),x,u_{i})+\kappa_{i}\big{(}\dot{h}_{i}(x,u_{i})+\eta_{i}(h_{i}(x_{i}))\big{)}.$
(32)

Further, we may rewrite (32) by collecting the terms independent of $u_{j}$ as

$\psi_{i}^{2}(x,u_{i},u_{\mathcal{N}_{i}^{+}})=\sum_{j\in\mathcal{N}_{i}^{+}}a_{ij}(x)u_{j}+c_{i}(x,u_{i})$
(33)

where

$a_{ij}(x)=\mathcal{L}_{g_{j}}\mathcal{L}_{f_{i}}h_{i}(x)$ (34)

and

$\displaystyle c_{i}(x,u_{i})$
$\displaystyle=\sum_{j\in\mathcal{N}_{i}^{+}}\mathcal{L}_{f_{j}}\mathcal{L}_{f_{i}}h_{i}(x)+\mathcal{L}^{2}_{f_{i}}h_{i}(x)+u_{i}^{\top}\mathcal{L}^{2}_{g_{i}}h_{i}(x_{i})u_{i}+\big{(}\mathcal{L}_{f_{i}}\mathcal{L}_{g_{i}}h_{i}(x)^{\top}+\mathcal{L}_{g_{i}}\mathcal{L}_{f_{i}}h_{i}(x)\big{)}u_{i}$
(35)
$\displaystyle\quad+\dot{\eta}_{i}\big{(}h_{i}(x_{i}),x,u_{i}\big{)}+\kappa_{i}\big{(}\dot{h}_{i}(x,u_{i})+\eta_{i}(h_{i}(x_{i}))\big{)}.$

In this form, we may consider $a_{ij}(x)\in\mathbb{R}^{M_{j}}$ to be the
effect that node $j\in\mathcal{N}_{i}^{+}$ has on the safety of node $i\in[n]$
via its own control inputs $u_{j}$, and $c_{i}(x,u_{i})$ is the effect that
node $i\in[n]$ has on its own safety combined with the uncontrolled system
dynamics. The functions in (31) in turn define the constraint sets

$\displaystyle\mathcal{C}_{i}^{1}$
$\displaystyle=\\{x\in\mathbb{R}^{N}:\psi_{i}^{0}(x_{i})\geq 0\\}$ (36)
$\displaystyle\mathcal{C}_{i}^{2}$
$\displaystyle=\\{x\in\mathbb{R}^{N}:\exists u_{i}\in\mathcal{U}_{i}\text{
s.t. }\psi_{i}^{1}(x,u_{i})\geq 0\\}.$

We may now formally define a collaborative node-level control barrier function
for node $i$ that takes into account the control actions of its incoming
neighbors $j\in\mathcal{N}_{i}^{+}$.

######  Definition 5.

Let $\mathcal{C}_{i}^{1}$ and $\mathcal{C}_{i}^{2}$ be defined by (31) and
(36). We have that $h_{i}$ is a collaborative node-level control barrier
function (cNCBF) for node $i\in[n]$ if $h_{i}\in C^{2}$ and $\forall
x\in\mathcal{C}_{i}^{1}\cap\mathcal{C}_{i}^{2}$ there exists
$(u_{i},u_{\mathcal{N}_{i}^{+}})\in\mathcal{U}_{i}\times\mathcal{U}_{\mathcal{N}_{i}^{+}}$
such that

$\psi_{i}^{2}(x,u_{i},u_{\mathcal{N}_{i}^{+}})\geq 0,$ (37)

where $\eta_{i},\kappa_{i}$ are class-$\mathcal{K}$ functions and $\eta_{i}\in
C^{r}$, with $r\geq 1$.

This definition yields the corresponding result for the forward invariance of
the constraint sets in (36).

######  Theorem 2.

Given a networked dynamic system defined by (28) and constraint sets defined
by (31) and (36), $\mathcal{C}_{i}^{1}\cap\mathcal{C}_{i}^{2}$ is forward
invariant if $h_{i}$ is a cNCBF.

###### Proof.

If $h_{i}$ is a cNCBF, then
$\exists(u_{i},u_{\mathcal{N}_{i}^{+}})\in\mathcal{U}_{i}\times\mathcal{U}_{\mathcal{N}_{i}^{+}}$
such that (37) holds, i.e., we have that there exists a class-$\mathcal{K}$
function $\kappa_{i}$ such that

$\dot{\psi}_{i}^{1}(x,u_{i},u_{\mathcal{N}_{i}^{+}})+\kappa_{i}(\psi_{i}^{1}(x,u_{i}))\geq
0,\forall x\in\mathcal{C}_{i}^{1}\cap\mathcal{C}_{i}^{2}.$

Since $u_{i}$ appears in both $\psi_{i}^{2}(x,u_{i},u_{\mathcal{N}_{i}^{+}})$
and $\psi_{i}^{1}(x,u_{i})$, we must show that if
$x\in\mathcal{C}_{i}^{1}\cap\mathcal{C}_{i}^{2}$ and
$\psi_{i}^{2}(x,u_{i},u_{\mathcal{N}_{i}^{+}})\geq 0$ for some
$u_{i}\in\mathcal{U}_{i}$, then $\psi_{i}^{1}(x,u_{i})\geq 0$ also. If (37)
holds for all $x\in\mathcal{C}_{i}^{1}\cap\mathcal{C}_{i}^{2}$, then $\forall
x_{i},x_{\mathcal{N}_{i}^{+}},u_{i}\in\mathbb{R}^{N_{i}}\times\mathbb{R}^{N_{i}^{+}}\times\mathbb{R}^{M_{i}}$
where $\psi_{i}^{1}(x,u_{i})=0$, there exists
$u_{\mathcal{N}_{i}^{+}}\in\mathbb{R}^{N_{i}^{+}}$ such that
$\dot{\psi}_{i}^{1}(x,u_{i},u_{\mathcal{N}_{i}^{+}})\geq 0$. Thus, we have
that $\psi_{i}^{1}(x,u_{i})\geq 0,\forall
x\in\mathcal{C}_{i}^{1}\cap\mathcal{C}_{i}^{2}$, which directly implies
$\psi_{i}^{0}(x_{i})\geq 0,\forall
x\in\mathcal{C}_{i}^{1}\cap\mathcal{C}_{i}^{2}$. Therefore, we have that
$\mathcal{C}_{i}^{1}\cap\mathcal{C}_{i}^{2}$ is forward invariant. ∎

Notice, however, that the definition of the cNCBF is still centered around
node $i$ and its incoming 1-hop neighbors. In order to design a distributed
control scheme for each node, we need to account for both the needs of node
$i$ with respect to its incoming neighbors $j\in\mathcal{N}_{i}^{+}$ and the
needs of the outgoing neighbors $k\in\mathcal{N}_{i}^{-}$ with respect to
control actions made by node $i$. Thus, we propose in the following section a
distributed collaborative control algorithm that ensures safety throughout a
given networked dynamic system of the form in (28) via rounds of communication
between neighboring nodes.

##  4 Collaborative Safety

In this section, we construct an algorithm that exploits the properties of the
cNCBF to communicate and process safety requests to and from neighbors,
respectively. Typically, the goal of safety-critical control is to minimally
alter nominal control commands such that the controlled system is always safe.
For example, given some nominal command control policies
$u_{i}^{n}:\mathbb{R}^{N}\rightarrow\mathcal{U}_{i}$ and
$u_{\mathcal{N}_{i}^{+}}^{n}:\mathbb{R}^{N}\rightarrow\mathcal{U}_{\mathcal{N}_{i}^{+}}$
for node $i\in[n]$ and its neighbors $j\in\mathcal{N}_{i}^{+}$, respectively,
as well as a valid cNCBF $h_{i}$, our safe control
$u_{i}^{s},u_{\mathcal{N}_{i}^{+}}^{s}$ given a network state
$x\in\mathbb{R}^{N}$ may be computed as

$\displaystyle\operatorname*{arg\,min}_{u_{i},u_{\mathcal{N}_{i}^{+}}\in\mathcal{U}_{i}\times\mathcal{U}_{\mathcal{N}_{i}^{+}}}$
$\displaystyle{||u_{i}-u_{i}^{n}(x)||}^{2}+{||u_{\mathcal{N}_{i}^{+}}-u_{\mathcal{N}_{i}^{+}}^{n}(x)||}^{2}$
(38) s.t. $\displaystyle\psi_{i}^{2}(x,u_{i},u_{\mathcal{N}_{i}^{+}})\geq 0.$

However, ensuring that $h_{i}$ is a valid cNCBF in practice may be infeasible
since (38) does not account for the effects of the incoming neighbors
$\mathcal{N}_{j}^{+},\forall j\in\mathcal{N}_{i}^{+}$. Therefore, in order to
consider the needs of nodes in $\mathcal{N}_{i}^{-}$, we propose the use of
Algorithm 1, which uses rounds of communication to request shared
responsibility for safety among incoming neighbors $\mathcal{N}_{i}^{+}$ while
receiving requests from outgoing neighbors to determine feasible control
constraints for node $i\in[n]$.

###  4.1 Algorithm Construction and Convergence

We now discuss the construction of Algorithm 1 and the properties of its
convergence to viable sets of constrained control actions that assist in
guaranteeing neighbor safety. The central idea of Algorithm 1 involves rounds
of communication between nodes (lines 14-18), where each round of
communication between nodes, centered on a node $i\in[n]$, involves the
following steps:

  1. 1.

Receive (Send) requests from (to) neighboring nodes in $\mathcal{N}_{i}^{-}$
$\left(\mathcal{N}_{i}^{+}\right)$

  2. 2.

Process requests and determine needed compromises for nodes in
$\mathcal{N}_{i}^{-}$

  3. 3.

Send (Receive) adjustments to (from) neighboring nodes in
$\mathcal{N}_{i}^{-}$ $\left(\mathcal{N}_{i}^{+}\right)$

By (33) and (37), the condition node $i\in[n]$ must satisfy to guarantee
safety for a given state
$x_{i},x_{\mathcal{N}_{i}^{+}}\in\mathbb{R}^{N_{i}}\times\mathbb{R}^{N_{i}^{+}}$
is

$\sum_{j\in\mathcal{N}_{i}^{+}}a_{ij}(x)u_{j}+c_{i}(x,u_{i})\geq 0.$ (39)

Thus, we compute the maximum capability of node $i\in[n]$ to achieve its
safety constraints

$\bar{c}_{i}=\max_{u_{i}\in\mathcal{U}_{i}}c_{i}(x,u_{i})$ (40)

where we may interpret $\bar{c}_{i}$ as the total responsibility of node
$i\in[n]$, with $\bar{c}_{i}>0$ indicating a surplus and $\bar{c}_{i}<0$ a
deficit of control capability at node $i\in[n]$, respectively. We then
partition control responsibility among incoming neighbors
$\bar{c}_{ij},\forall j\in\mathcal{N}_{i}^{+}$ such that
$\bar{c}_{i}=\sum_{j\in\mathcal{N}_{i}^{+}}\bar{c}_{ij}$, where each incoming
neighbor is responsible for satisfying

$a_{ij}u_{j}+\bar{c}_{ij}\geq 0.$ (41)

Since there are infinite solutions to the partitioning of $\bar{c}_{i}$, we
must choose a method for dividing responsibility among each neighbor
$j\in\mathcal{N}_{i}^{+}$ for $i\in[n]$

$\bar{c}_{ij}=\frac{\bar{c}_{i}w_{ij}}{\sum_{j\in\mathcal{N}_{i}^{+}}w_{ij}},$
(42)

where $w_{ij}$ is given by a weighting function
$W_{i}:\mathcal{N}_{i}^{+}\rightarrow\mathbb{R}_{\geq 0}$ that determines how
much responsibility node $i$ requests from its available neighbors. An example
of a weighting function candidate would be

$W_{i}(j)=|a_{ij}|;\forall i\in[n],\forall j\in\mathcal{N}_{i}^{+},$ (43)

which allocates responsibility to neighbors $\mathcal{N}_{i}^{+}$ based on the
magnitude effect (i.e. the 1-norm of $a_{ij}$) of their actions on node $i$.
Therefore, if $\exists u_{j}\in\mathcal{U}_{j}$ such that (41) is satisfied
for all $j\in\mathcal{N}_{i}^{+}$ for all
$x\in\mathcal{C}_{i}^{1}\cap\mathcal{C}_{i}^{2}$, then $h_{i}$ is an cNCBF and
$\overline{\underline{\mathcal{U}}}_{j}=\\{u_{j}\in\mathcal{U}_{j}:\eqref{eq:neighbor_responsibility}\\}$
is a viable set of control inputs for node $j\in\mathcal{N}_{i}^{+}$ that will
keep node $i\in[n]$ safe.

However, (41) may not always be feasible for all $j\in\mathcal{N}_{i}^{+}$,
which would require an adjustment of the responsibility allocated to node $j$.
To illustrate the process for updating the responsibility, we shift our
perspective back to node $i\in[n]$ and consider requests $\bar{c}_{ki}$
received from $k\in\mathcal{N}_{i}^{-}$. In order to satisfy the requests of
outgoing neighbors, node $i$ must ensure that

$\bigwedge_{k\in\mathcal{N}_{i}^{-}}\big{(}a_{ki}u_{i}+\bar{c}_{ki}\geq
0\big{)}$ (44)

holds, given $u_{i}\in\mathcal{U}_{i}$. Thus, we may compute constraints on
$u_{i}$ according to a series of linear equations which define the super-level
sets

$\overline{\underline{\mathcal{U}}}_{ki}=\\{u_{i}\in\mathbb{R}^{M_{i}}:a_{ki}u_{i}+\bar{c}_{ki}\geq
0\\}.$ (45)

Note that (45) does not yet constrain $u_{i}$ by $\mathcal{U}_{i}$, rather it
is the set of all possible control actions that satisfy the request of node
$k\in\mathcal{N}_{i}^{-}$. We then take the intersection of all requested
constraints

$\overline{\underline{\mathcal{U}}}_{\mathcal{N}_{i}^{-}}=\bigcap_{k\in\mathcal{N}_{i}^{-}}\overline{\underline{\mathcal{U}}}_{ki}.$
(46)

If
$\mathcal{U}_{i}\cap\overline{\underline{\mathcal{U}}}_{\mathcal{N}_{i}^{-}}$
is nonempty, then
$\overline{\underline{\mathcal{U}}}_{i}=\mathcal{U}_{i}\cap\overline{\underline{\mathcal{U}}}_{\mathcal{N}_{i}^{-}}$
is a valid constrained control set and no adjustments need to be sent.
Otherwise, if
$\mathcal{U}_{i}\cap\overline{\underline{\mathcal{U}}}_{\mathcal{N}_{i}^{-}}=\emptyset$
and $\overline{\underline{\mathcal{U}}}_{\mathcal{N}_{i}^{-}}\neq\emptyset$,
then we may compute the point
$\overline{\underline{u}}_{i}\in\partial\mathcal{U}_{i}$ that yields the
minimum distance between the two hulls $\mathcal{U}_{i}$ and
$\overline{\underline{\mathcal{U}}}_{\mathcal{N}_{i}^{-}}$ Kaown and Liu
(2009), respectively, and use this point to compute needed adjustments for
neighbors in $\mathcal{N}_{i}^{-}$ where if

$a_{ki}\overline{\underline{u}}_{i}+\bar{c}_{ki}<0,$ (47)

then we must request an adjustment $\varepsilon_{ki}>0$ such that

$a_{ki}\overline{\underline{u}}_{i}+\bar{c}_{ki}+\varepsilon_{ki}=0,$ (48)

and send this adjustment back to each node $k\in\mathcal{N}_{i}^{-}$ where
(47) is true.

Shifting our perspective again to consider adjustments $\varepsilon_{ij}$
requested from incoming neighbors $\mathcal{N}_{i}^{+}$, we must update the
original request $\bar{c}_{ij}\leftarrow\bar{c}_{ij}+\varepsilon_{ij}$ for all
neighbors and compute the deficit in control responsibility

$\delta_{i}=\bar{c}_{i}-\sum_{j\in\mathcal{N}_{i}^{+}}\bar{c}_{ij}$ (49)

which we can use to make another round of requests to all neighbors that are
not yet constrained. We repeat this process until either no adjustments are
needed, or until all neighbors, $j\in\mathcal{N}_{i}^{+}$ are constrained.

Finally, we check our current capability
$\bar{c}_{i}=\max_{u_{i}\in\overline{\underline{\mathcal{U}}}_{i}}c_{i}(u_{i})$
with our now potentially constrained control set
$\overline{\underline{\mathcal{U}}}_{i}\subseteq\mathcal{U}_{i}$ and compute
the deficit in control responsibility again through (49). If $\delta_{i}<0$,
then we must repeat the process again to try and distribute responsibility
amongst neighbors, otherwise, Algorithm 1 will halt with a feasibly
constrained control set $\overline{\underline{\mathcal{U}}}_{i}$.

Algorithm 1 Collaborative Safety

1: $\bar{c}_{ij}\leftarrow 0,\forall j\in\mathcal{N}_{i}^{+}$

2: $\bar{c}_{ki}\leftarrow 0,\forall k\in\mathcal{N}_{i}^{-}$

3: $\overline{\underline{\mathcal{U}}}_{i}\leftarrow\mathcal{U}_{i}$

4: viable $\leftarrow$ False

5: FirstRound $\leftarrow$ True

6: while not viable do

7:
$\bar{c}_{i}\leftarrow\max_{u_{i}\in\overline{\underline{\mathcal{U}}}_{i}}c_{i}(x,u_{i})$

8:
$\delta_{i}\leftarrow\bar{c}_{i}-\sum_{j\in\mathcal{N}_{i}^{+}}\bar{c}_{ij}$

9: if $\delta_{i}<0\;\lor$ FirstRound then

10: tick $\leftarrow$ True

11: $\underline{\overline{\mathcal{N}}}_{i}^{+}\leftarrow\emptyset$

12: FirstRound $\leftarrow$ False

13: while tick do

14: SEND $\rightarrow
j\in\mathcal{N}_{i}^{+}\setminus\underline{\overline{\mathcal{N}}}_{i}^{+}:\delta_{ij}\leftarrow\frac{\delta_{i}w_{ij}}{\sum_{l\in\mathcal{N}_{i}^{+}\setminus\underline{\overline{\mathcal{N}}}_{i}^{+}}w_{il}}$

15: RECEIVE $\leftarrow k\in\mathcal{N}_{i}^{-}:\delta_{ki}$

16:
$\bar{c}_{ki},\varepsilon_{ki},\overline{\underline{\mathcal{U}}}_{i}\leftarrow$
processRequests$(\bar{c}_{ki},\delta_{ki};\forall k\in\mathcal{N}_{i}^{-})$

17: SEND $\rightarrow k\in\mathcal{N}_{i}^{-}:\varepsilon_{ki}$

18: RECEIVE $\leftarrow j\in\mathcal{N}_{i}^{+}:\varepsilon_{ij}$

19: for $j\in\mathcal{N}_{i}^{+}$ do

20: $\bar{c}_{ij}\leftarrow\bar{c}_{ij}+\varepsilon_{ij}$

21: if $\varepsilon_{ij}>0$ then

22:
$\underline{\overline{\mathcal{N}}}_{i}^{+}\leftarrow\underline{\overline{\mathcal{N}}}_{i}^{+}\cup\\{j\\}$

23: end if

24: end for

25: if
$(\underline{\overline{\mathcal{N}}}_{i}^{+}=\mathcal{N}_{i}^{+})\lor(\varepsilon_{ij}=0,\forall
j\in\mathcal{N}_{i}^{+}\land\varepsilon_{ki}=0,\forall
k\in\mathcal{N}_{i}^{-})$ then

26: tick $\leftarrow$ False

27: else

28:
$\delta_{i}\leftarrow\bar{c}_{i}-\sum_{j\in\mathcal{N}_{i}^{+}}\bar{c}_{ij}$

29: end if

30: end while

31: else if $\delta_{i}\geq 0$ then

32: viable $\leftarrow$ True

33: end if

34: end while

Algorithm 2 processRequests$(\bar{c}_{ki},\delta_{ki};\forall
k\in\mathcal{N}_{i}^{-})$

1: $\varepsilon_{ki}\leftarrow 0,\forall k\in\mathcal{N}_{i}^{-}$

2: for $k\in\mathcal{N}_{i}^{-}$ do

3:
$\overline{\underline{\mathcal{U}}}_{ki}\leftarrow\\{u_{i}\in\mathbb{R}^{M_{i}}:a_{ki}u_{i}+\bar{c}_{ki}+\delta_{ki}\geq
0\\}$

4: end for

5:
$\overline{\underline{\mathcal{U}}}_{\mathcal{N}_{i}^{-}}\leftarrow\bigcap_{k\in\mathcal{N}_{i}^{-}}\overline{\underline{\mathcal{U}}}_{ki}$

6: if
$\mathcal{U}_{i}\cap\overline{\underline{\mathcal{U}}}_{\mathcal{N}_{i}^{-}}\neq\emptyset$
then

7:
$\overline{\underline{\mathcal{U}}}_{i}\leftarrow\mathcal{U}_{i}\cap\overline{\underline{\mathcal{U}}}_{\mathcal{N}_{i}^{-}}$

8: else

9: $\overline{\underline{u}}_{i}\leftarrow$
getClosestPoint$(\mathcal{U}_{i},\overline{\underline{\mathcal{U}}}_{\mathcal{N}_{i}^{-}})$
Kaown and Liu (2009)

10:
$\overline{\underline{\mathcal{U}}}_{i}\leftarrow\\{\overline{\underline{u}}_{i}\\}$

11: for $k\in\mathcal{N}_{i}^{-}$ do

12: if $a_{ki}\overline{\underline{u}}_{i}+\bar{c}_{ki}+\delta_{ki}<0$ then

13:
$\varepsilon_{ki}\leftarrow-(a_{ki}\overline{\underline{u}}_{i}+\bar{c}_{ki}+\delta_{ki})$

14: end if

15: end for

16: end if

17: $\bar{c}_{ki}\leftarrow\bar{c}_{ki}+\delta_{ki}+\varepsilon_{ki},\forall
k\in\mathcal{N}_{i}^{-}$

Thus, by Algorithm 1 we yield the following results for the entire network
under the following assumption.

######  Assumption 3.

Let $a_{ki}(x)$ and $a_{li}(x)$ lay in the same closed orthant for all
$k,l\in\mathcal{N}_{i}^{-}$ and $i\in[n]$, respectively.

In other words, assume that there are no conflicting constraints between
requesting neighbors for each node $i\in[n]$. We, therefore, have the
following result for the special case defined by Assumption 3.

######  Theorem 3.

Under Assumption 3, if all nodes $i\in[n]$ follow Algorithm 1 for some
$x\in\bigcap_{i\in[n]}\big{(}\mathcal{C}_{i}^{1}\cap\mathcal{C}_{i}^{2}\big{)}$,
they will converge to either a feasible set of control constraints
$\overline{\underline{\mathcal{U}}}_{i}\subset\mathcal{U}_{i},\forall i\in[n]$
or a terminally infeasible state for at least one node $i\in[n]$ where

$\bar{c}_{ij}=-a_{ij}\overline{\underline{u}}_{j},\forall
j\in\mathcal{N}_{i}^{+}$ (50)

with $\overline{\underline{u}}_{j}\in\partial\mathcal{U}_{j}$.

###### Proof.

First, let us define an algorithm time $\tau_{i}\in\mathbb{N}$ for node
$i\in[n]$, which tracks the number of total iterations carried out by the
while loop in lines 13-30, i.e., $\tau_{i}\leftarrow\tau_{i}+1$ for each
send/receive interaction performed by node $i$. We step Algorithm 1 through
$\tau_{i}=1$, then show for $\tau_{i}>\leavevmode\nobreak\ 1$ that
$\bar{c}_{ij},\forall j\in\mathcal{N}_{i}^{+}$ and $\bar{c}_{ki},\forall
k\in\mathcal{N}_{i}^{-}$ are monotonically decreasing and lower bounded.

At $\tau_{i}=1$, Algorithm 1 will enter line 9 regardless of the sign of
$\delta_{i}$. Therefore, if $\bar{c}_{i}>0$, then node $i$ communicates a
control surplus $\delta_{ij}\geq 0,\forall j\in\mathcal{N}_{i}^{+}$ ,
otherwise it will communicate a control deficit of $\delta_{ij}<0,\forall
j\in\mathcal{N}_{i}^{+}$. Once requests have been sent and received, each node
processes them using Algorithm 2, which initializes responsibility surpluses
and deficits across the network. Note that if $\varepsilon_{ki}>0$, then

$\overline{\underline{u}}_{ki}=\operatorname*{arg\,max}_{u_{i}\in\mathcal{U}_{i}}a_{ki}u_{i},$

where by Assumption 3 we have that
$\overline{\underline{u}}_{ki}=\overline{\underline{u}}_{li}=\overline{\underline{u}}_{i}$
for all $k,l\in\mathcal{N}_{i}^{-}$. Thus, with responsibility $\bar{c}_{ki}$
initialized and adjustments $\varepsilon_{ki}$ computed $\forall
k\in\mathcal{N}_{i}^{-}$, Algorithm 2 returns to Algorithm 1 to send and
receive the computed adjustments to and from neighbors, respectively. If no
adjustments are sent or received, then the loop will exit and recompute
$\bar{c}_{i}$ and $\delta_{i}$. If $\delta_{i}\geq 0$, then all neighbors have
been viably constrained and Algorithm 1 exits with node $i\in[n]$ and its
neighbors $\mathcal{N}_{i}$ having at least one action that satisfies safety
constraints for the neighborhood centered on node $i$. Otherwise, if
$\delta_{i}<0$, then the algorithm time advances to $\tau_{i}>1$.

For $\tau_{i}>1$, all computations and actions from $\tau_{i}=1$ are repeated,
with the only change being $\bar{c}_{ki}\neq 0,\forall
k\in\mathcal{N}_{i}^{-}$ and $\bar{c}_{ij}\neq 0,\forall
j\in\mathcal{N}_{i}^{+}$. Since for all $\tau_{i}>1$ we have $\delta_{i}<0$,
with $\varepsilon_{ki}>0$ only if
$\overline{\underline{\mathcal{U}}}_{i}=\\{\overline{\underline{u}}_{i}\\}$
where $\overline{\underline{u}}_{i}\in\partial\mathcal{U}_{i}$. We compute
$\bar{c}_{ki}^{\tau_{i}+1}$ as

$\bar{c}_{ki}^{\tau_{i}+1}=\bar{c}_{ki}^{\tau_{i}}+\delta_{ki}^{\tau_{i}}+\varepsilon_{ki}^{\tau_{i}}=-a_{ki}\overline{\underline{u}}_{i}^{\tau_{i}},$

which yields

$\bar{c}_{ki}^{\tau_{i}}-\bar{c}_{ki}^{\tau_{i}+1}=a_{ki}(\overline{\underline{u}}_{i}^{\tau_{i}}-\overline{\underline{u}}_{i}^{\tau_{i}-1}).$
(51)

Thus, there are only two cases: $\varepsilon_{ki}^{\tau_{i}}=0$ and
$\varepsilon_{ki}^{\tau_{i}}>0$. When $\varepsilon_{ki}^{\tau_{i}}=0$, then
$\bar{c}_{ki}^{\tau_{i}+1}=\bar{c}_{ki}^{\tau_{i}}+\delta_{ki}\implies\bar{c}_{ki}^{\tau_{i}+1}-\bar{c}_{ki}^{\tau_{i}}=\delta_{i}<0$.
Further, when $\varepsilon_{ki}>0$, then
$\overline{\underline{u}}_{i}^{\tau_{i}}=\overline{\underline{u}}_{ki}$, which
by (51) yields $\bar{c}_{ki}^{\tau_{i}}-\bar{c}_{ki}^{\tau_{i}+1}>0$ if
$\varepsilon_{ki}^{\tau_{i}-1}=0$ or
$\bar{c}_{ki}^{\tau_{i}}-\bar{c}_{ki}^{\tau_{i}+1}=0$ otherwise. Thus, we have
$\bar{c}_{ki}^{\tau_{i}}$ is monotonically decreasing $\forall\tau_{i}>0$ and
is lower bounded, implying that as $\tau_{i}\rightarrow\infty$, it must be
that Algorithm 1 exits with viable constraint set for all nodes, or at least
one node $i\in[n]$ will reach a terminally infeasible state where
$\bar{c}_{ij}=-a_{ij}\overline{\underline{u}}_{j},\forall
j\in\mathcal{N}_{i}^{+}$. ∎

Since we are designing a distributed controller for each node, once safety
needs have been communicated via Algorithm 1 for each node $i\in[n]$, control
actions must then be selected independently of each other, yielding the
safety-filtered control action for node $i$ computed as

$\displaystyle
u_{i}^{s}(x)=\operatorname*{arg\,min}_{u_{i}\in\overline{\underline{\mathcal{U}}}_{i}}$
$\displaystyle{||u_{i}-u_{i}^{n}(x)||}^{2}$ (52) s.t.
$\displaystyle\psi_{i}^{1}(x,u_{i})\geq 0$

where $\overline{\underline{\mathcal{U}}}_{i}$ is the constrained control set
for node $i$ given by Algorithm 1. Thus, we yield the following distributed
result for each node $i\in[n]$.

######  Corollary 1.

If $\overline{\underline{\mathcal{U}}}_{i}$ and
$\overline{\underline{\mathcal{U}}}_{j}$ computed by Algorithm 1 are viable
for $i\in[n]$ and $j\in\mathcal{N}_{i}^{+}$, respectively, for all
$t\in\mathcal{T}$, then $\mathcal{C}_{i}^{1}\cap\mathcal{C}_{i}^{2}$ is
forward invariant under (52).

###### Proof.

For a given $x\in\mathcal{C}_{i}^{1}\cap\mathcal{C}_{i}^{2}$, if Algorithm 1
returns with a viable $\overline{\underline{\mathcal{U}}}_{i}$ then there
exists
$u_{i},u_{\mathcal{N}_{i}^{+}}\in\mathcal{U}_{i}\times\mathcal{U}_{\mathcal{N}_{i}^{+}}$
such that

$\psi_{i}^{2}(x,u_{i},u_{\mathcal{N}_{i}^{+}})\geq 0.$ (53)

Thus, by Theorem 2, if (53) holds $\forall t\in\mathcal{T}$ then $\exists
u_{i}\in\mathcal{U}_{i}$ such that $\psi_{i}^{1}(x,u_{i})\geq 0$. Therefore,
$\mathcal{C}_{i}^{1}\cap\mathcal{C}_{i}^{2}$ will be forward invariant
$\forall t\in\mathcal{T}$ under (52). ∎

It should be noted that Algorithm 1 is not guaranteed to converge when
Assumption 3 does not hold, i.e., when neighbors $k\in\mathcal{N}_{i}^{-}$
make conflicting requests of node $i$. In particular, our algorithm does not
handle the case when
$\overline{\underline{\mathcal{U}}}_{\mathcal{N}_{i}^{-}}=\emptyset$, which
may occur when conflicting requests cause no possible action
$u_{i}\in\mathbb{R}^{M_{i}}$ to satisfy all neighbor constraints. In this
case, we must choose a point of compromise for all conflicting neighbors and
send adjustments accordingly so that neighbors may reallocate responsibility
as needed.

###  4.2 Robustness of Collaborative Control Algorithm

In this section, we explore properties of robustness in the context of
collaborative safety via Algorithm 1. For our discussion, we consider the
choice of class-$\mathcal{K}$ functions $\eta_{i}(\cdot)$ and
$\kappa_{i}(\cdot)$ as a part of $\psi_{i}^{1}(x,u_{i})$ and
$\psi_{i}^{2}(x,u_{i},u_{\mathcal{N}_{i}^{+}})$ and their effect on the
behavior of neighbors with respect to communicating safety needs to neighbors
and choosing actions that guarantee individual node safety. To simplify our
discussion, we consider the set of linear class-$\mathcal{K}$ functions.

######  Assumption 4.

Let $\eta_{i}(z):=\eta_{i}z$ and $\kappa_{i}(z):=\kappa_{i}z$ where
$z\in\mathbb{R}^{N_{i}}$ and $\eta_{i},\kappa_{i}\in\mathbb{R}_{\geq 0}$.

The selection of $\eta_{i}$ and $\kappa_{i}$ may be used to determine the
qualitative behavior of a given node, where large $\eta_{i}$
$\left(\kappa_{i}\right)$ will prevent the first (second) derivative safety
condition in (31) from activating until $x_{i}$ approaches much closer to the
boundary of $\mathcal{C}_{i}^{1}$ ($\mathcal{C}_{i}^{2}$). In other words, we
can use $\eta_{i}$ and $\kappa_{i}$ to tune how conservative node $i$ is in
avoiding the boundary of its safety constraints. Additionally, we make the
following assumption on the control constraints for node $i\in[n]$

######  Assumption 5.

Let $\mathcal{U}_{i}\subset\mathbb{R}^{M_{i}}$ be a closed set.

Note that a key step in collaborative safety via Algorithm 1 is the evaluation
of the max capability of node $i\in[n]$ through (35) and (40). Under
Assumption 4 we may express (35) as

$\displaystyle c_{i}(x,u_{i},\nu_{i})$
$\displaystyle=\sum_{j\in\mathcal{N}_{i}^{+}}\mathcal{L}_{f_{j}}\mathcal{L}_{f_{i}}h_{i}(x)+\mathcal{L}^{2}_{f_{i}}h_{i}(x)+\kappa_{i}\eta_{i}h_{i}(x_{i})+\nu_{i}\mathcal{L}_{f_{i}}h_{i}(x)+u_{i}^{\top}\mathcal{L}^{2}_{g_{i}}h_{i}(x_{i})u_{i}$
(54)
$\displaystyle\quad+\big{(}\mathcal{L}_{f_{i}}\mathcal{L}_{g_{i}}h_{i}(x)^{\top}+\mathcal{L}_{g_{i}}\mathcal{L}_{f_{i}}h_{i}(x)+\nu_{i}\mathcal{L}_{g_{i}}h_{i}(x)\big{)}u_{i}$

where $\nu_{i}=\eta_{i}+\kappa_{i}$. Thus, solving (40) is equivalent to
solving the constrained quadratic program

$\displaystyle\max_{u_{i}\in\overline{\underline{\mathcal{U}}}_{i}}$
$\displaystyle
u_{i}^{\top}Q_{i}(x_{i})u_{i}+[q_{i}(x)+\nu_{i}\mathcal{L}_{g_{i}}h_{i}(x_{i})]u_{i}$
(55)

with

$Q_{i}(x_{i})=\mathcal{L}^{2}_{g_{i}}h_{i}(x_{i})$

and

$q_{i}(x)=\mathcal{L}_{f_{i}}\mathcal{L}_{g_{i}}h_{i}(x)^{\top}+\mathcal{L}_{g_{i}}\mathcal{L}_{f_{i}}h_{i}(x).$

Notice, however, that this maximization problem may not necessarily represent
the true maximum capability of node $i$ in satisfying its own safety
conditions depending on the properties of
$Q_{i}(x_{i})\in\mathbb{R}^{M_{i}\times M_{i}}$, i.e. when $Q_{i}(x_{i})$ is
negative definite, positive definite, or indefinite, respectively. In other
words, we must also consider the maximization of $\psi_{i}^{1}(x,u_{i})$ with
respect to its local control

$\displaystyle\max_{u_{i}\in\overline{\underline{\mathcal{U}}}_{i}}$
$\displaystyle\mathcal{L}_{g_{i}}h_{i}(x_{i})u_{i}.$ (56)

We also consider the following assumption on
$\mathcal{L}_{g_{i}}h_{i}(x_{i})$.

######  Assumption 6.

For a given $x_{i}\in\mathbb{R}^{N_{i}}$, let all entries of
$\mathcal{L}_{g_{i}}h_{i}(x_{i})\in\mathbb{R}^{M_{i}}$ be non-zero.

In other words, assume that each control input for node $i$ has some effect on
the safety dynamics of $h_{i}$. Using the above assumptions, we yield the
following results.

######  Lemma 2.

Given Assumption 5, $\overline{\underline{\mathcal{U}}}_{i}\neq\emptyset$, and
$|\mathcal{L}_{g_{i}}h_{i}(x_{i})|>0$ for some $x_{i}\in\mathbb{R}^{N_{i}}$,
(56) must have a maximal solution
$u_{i}^{*}\in\partial\overline{\underline{\mathcal{U}}}_{i}$, with
$u_{i}^{*}=\operatorname*{arg\,max}_{u_{i}\in\overline{\underline{\mathcal{U}}}_{i}}\mathcal{L}_{g_{i}}h_{i}(x_{i})u_{i}$.
Further, if Assumption 6 holds, then $u_{i}^{*}$ is unique.

###### Proof.

By Algorithm 2 we have that
$\overline{\underline{\mathcal{U}}}_{\mathcal{N}_{i}^{-}}$ is the intersection
of closed half-spaces
$\bigcap_{k\in\mathcal{N}_{i}^{-}}\overline{\underline{\mathcal{U}}}_{ki}$.
Since $\mathcal{U}_{i}$ is closed by Assumption 5, we have that
$\overline{\underline{\mathcal{U}}}_{i}=\mathcal{U}_{i}\cap\overline{\underline{\mathcal{U}}}_{\mathcal{N}_{i}^{-}}$
must also be closed. Thus, the expression
$\mathcal{L}_{g_{i}}h_{i}(x_{i})u_{i}$ evaluated at some
$x_{i}\in\mathbb{R}^{N_{i}}$ describes a closed hyperplane in
$\mathbb{R}^{M_{i}}$ with at least one non-zero gradient. Therefore, if we
define $u_{i}^{*}=[u_{i}^{1*},\dots u_{i}^{M_{i}*}]^{\top}$,
$\mathcal{L}_{g_{i}}h_{i}(x_{i})=[\mathcal{L}_{g_{i}}h_{i}(x_{i})^{1},\dots,\mathcal{L}_{g_{i}}h_{i}(x_{i})^{M_{i}}]$,
and
$\overline{\underline{\mathcal{U}}}_{i}=\overline{\underline{\mathcal{U}}}_{i}^{1}\times\dots\times\overline{\underline{\mathcal{U}}}_{i}^{M_{i}}\neq\emptyset$
then

$u_{i}^{m*}=\operatorname*{arg\,max}_{u_{i}^{m}\in\partial\overline{\underline{\mathcal{U}}}_{i}^{m}}\mathcal{L}_{g_{i}}h_{i}(x_{i})^{m}u_{i}^{m}.$

Further, if $|\mathcal{L}_{g_{i}}h_{i}(x_{i})^{m}|>0$ for all $m\in[M_{i}]$,
i.e., if Assumption 6 holds, then $u_{i}^{m*}$ is unique for $m\in[M_{i}]$. ∎

Since $\mathcal{L}_{g_{i}}h_{i}(x_{i})u_{i}$ is a subterm of (55) we gain the
following insight on the relationship of (55) and (56).

######  Lemma 3.

Given Assumptions 4-6 hold for some $x_{i}\in\mathbb{R}^{N_{i}}$ and
$x_{\mathcal{N}_{i}^{+}}\in\mathbb{R}^{N_{i}^{+}}$, if

$u_{i}^{*}=\operatorname*{arg\,max}_{u_{i}\in\overline{\underline{\mathcal{U}}}_{i}}\mathcal{L}_{g_{i}}h_{i}(x_{i})u_{i}$
(57)

and

$u_{i}^{c}=\operatorname*{arg\,max}_{u_{i}\in\overline{\underline{\mathcal{U}}}_{i}}u_{i}^{\top}Q_{i}(x_{i})u_{i}+[q_{i}(x)+\nu_{i}\mathcal{L}_{g_{i}}h_{i}(x_{i})]u_{i}$
(58)

as $\nu_{i}\rightarrow\infty$ we have that $u_{i}^{*}=u_{i}^{c}$.

###### Proof.

Note that in (58) as we increase $\nu_{i}$ the linear term
$\mathcal{L}_{g_{i}}h_{i}(x_{i})$ will begin to dominate the expression for
the capability of node $i\in[n]$. Therefore, by Assumptions 4 and 5 we have

$\lim_{\nu_{i}\rightarrow\infty}\frac{1}{\nu_{i}}\left(u_{i}^{\top}Q_{i}(x_{i})u_{i}+q_{i}(x)u_{i}\right)+\mathcal{L}_{g_{i}}h_{i}(x_{i})u_{i}=\mathcal{L}_{g_{i}}h_{i}(x_{i})u_{i}.$

Thus, as $\nu_{i}\rightarrow\infty$ we have $u_{i}^{*}=u_{i}^{c}$, where
$u_{i}^{*}$ is unique by Lemma 2. Furthermore, we compute $\nu_{i}^{*}$ by
finding the minimum $\nu_{i}$ such that $u_{i}^{c}=u_{i}^{*}$. ∎

Given these results, we may quantify the discrepancy between the communicated
capability and the actual capability of node $i$ with respect to a chosen
$\nu_{i}$. We define the quantity of neighbor compliance as follows. First,
define the minimum assistance requested from neighbor
$j\in\mathcal{N}_{i}^{+}$ by node $i$ as the set of control actions

$U_{j}^{m}(x)=\\{u_{j}\in\overline{\underline{\mathcal{U}}}_{j}:a_{ij}(x)u_{j}+\bar{c}_{ij}=0\\}$
(59)

where $\bar{c}_{ij}$ is the partition of responsibility allocated to node $j$
by node $i$ according to Algorithm 1. We compute the amount of compliance by
neighbor $j$ to requests by node $i$ given any action
$u_{j}\in\mathcal{U}_{j}$ as

$e_{ij}(x)=a_{ij}(x)(u_{j}^{m}-u_{j}),$ (60)

where we may choose any $u_{j}^{m}\in U_{j}^{m}(x)$ without loss of
generality.

######  Definition 6.

If $e_{ij}(x)<0$, then neighbor $j$ is non-compliant. The neighborhood
compliance of incoming neighbors to node $i$ is given by
$e_{i}(x)=\sum_{j\in\mathcal{N}_{i}^{+}}e_{ij}(x)$, where if $e_{i}(x)<0$ then
the incoming neighborhood of node $i$ is non-compliant.

######  Theorem 4.

For a given $x\in\mathbb{R}^{N}$ let $\nu_{i}\leq\nu_{i}^{*}$, $u_{i}^{*}$,
and $u_{i}^{c}$ be computed via (57) and (58), respectively. If Assumptions
4-6 hold and $e_{i}(x)<0$, then node $i$ will be capable of satisfying its
safety constraints in the presence of non-compliance from its incoming
neighborhood up to

$\displaystyle|e_{i}(x)|$
$\displaystyle\leq(u_{i}^{*}-u_{i}^{c})^{\top}Q_{i}(x_{i})(u_{i}^{*}-u_{i}^{c})+q_{i}(x)(u_{i}^{*}-u_{i}^{c})+\nu_{i}^{*}\mathcal{L}_{g_{i}}h_{i}(x_{i})u_{i}^{*}-\nu_{i}\mathcal{L}_{g_{i}}h_{i}(x_{i})u_{i}^{c}.$
(61)

###### Proof.

By Assumption 6 and Lemma 2 we that
$u_{i}^{*}\in\partial\overline{\underline{\mathcal{U}}}_{i}$ is unique and
therefore
$\mathcal{L}_{g_{i}}h_{i}(x_{i})u_{i}^{*}>\mathcal{L}_{g_{i}}h_{i}(x_{i})u_{i},\forall
u_{i}\in\overline{\underline{\mathcal{U}}}_{i}\setminus\\{u_{i}^{*}\\}$. Thus,
for all $\nu_{i}\leq\nu_{i}^{*}$ we have

$c_{i}(x,u_{i}^{*},\nu_{i}^{*})\geq c_{i}(x,u_{i}^{c},\nu_{i})$ (62)

for a given $x\in\mathbb{R}^{N}$. Consider when

$c_{i}(x,u_{i}^{*},\nu_{i}^{*})\leq 0$

and there exists $\nu_{i}>0$ such that

$\psi_{i}^{2}(x,u_{i}^{c},u^{c}_{\mathcal{N}_{i}^{+}},\nu_{i})=\psi_{i}^{2}(x,u_{i}^{*},u^{*}_{\mathcal{N}_{i}^{+}},\nu_{i}^{*}).$
(63)

Thus, by (63) we have

$\displaystyle\sum_{j\in\mathcal{N}_{i}^{+}}a_{ij}(u_{j}^{*}-u_{j}^{c})+c_{i}(x,u_{i}^{*},\nu_{i}^{*})-c_{i}(x,u_{i}^{c},\nu_{i})=0$
(64)

and by (62) we have

$\sum_{j\in\mathcal{N}_{i}^{+}}a_{ij}(u_{j}^{*}-u_{j}^{c})\leq 0.$

In this way, we characterize the difference in the true maximum capability of
node $i$ and its communicated maximum capability as

$\displaystyle\epsilon_{i}(x,\nu_{i})$
$\displaystyle=(u_{i}^{*}-u_{i}^{c})^{\top}Q_{i}(x_{i})(u_{i}^{*}-u_{i}^{c})+q_{i}(x)(u_{i}^{*}-u_{i}^{c})+\nu_{i}^{*}\mathcal{L}_{g_{i}}h_{i}(x_{i})u_{i}^{*}-\nu_{i}\mathcal{L}_{g_{i}}h_{i}(x_{i})u_{i}^{c}\geq
0$ (65)

where, by Assumptions 4-6 and Lemma 3, we have if $\nu_{i}\geq\nu_{i}^{*}$
then $\epsilon_{i}(x,\nu_{i})=0$. Therefore, if we consider any deficiency
between the minimum requested assistance via Algorithm 1 and the actual
actions of neighbors $e_{ij}=a_{ij}(u_{j}^{m}-u_{j})$ for
$j\in\mathcal{N}_{i}^{+}$, if
$\left|\sum_{j\in\mathcal{N}_{i}^{+}}e_{ij}\right|\leq\epsilon_{i}(x,\nu_{i})$
then there exists a $u_{i}^{*}\in\overline{\underline{\mathcal{U}}}_{i}$ and
$\nu_{i}^{*}$ such that
$\sum_{j\in\mathcal{N}_{i}^{+}}a_{ij}u_{j}+c_{i}(x,u_{i}^{*},\nu_{i}^{*})\geq
0$. ∎

Note that $u_{i}^{*}$ is a function of $x_{i}$ and $u_{i}^{c}$ is a function
of $x$ and $\nu_{i}$. Thus, by Theorem 4 we may compute the tolerance node $i$
has to neighborhood non-compliance with respect to a given neighborhood state
and choice of $\nu_{i}=\eta_{i}+\kappa_{i}$. This measure of robustness may be
useful in considering parameter selection for each node in the network
depending on the reliability of neighboring nodes and the consequences of node
failure. However, it should also be noted that as (65) increases node $i$ will
place a greater burden of its safety on its neighbors
$j\in\mathcal{N}_{i}^{+}$, which could lead to an over-taxing of neighbor
control resources and under-utilization of the resources of node $i$.
Therefore, the context and consequences of over-requesting by neighbors in
specific model applications should be considered when selecting $\eta_{i}$ and
$\kappa_{i}$. We illustrate these behaviors on networked epidemic processes in
the following section.

##  5 Application: Networked SIS

To illustrate the theoretical results from Sections 3 and 4, we apply our
results to a networked susceptible-infected-susceptible (SIS) model for
epidemic processes. While networked compartmental epidemic models can grow
rapidly in complexity to model complex network interactions (such as multi-
layered transportation networks Vrabac et al. (2021)) and disease behaviors
(such as asymptomatic carriers and delayed symptoms Butler and Paré (2023);
Zhang et al. (2023b); Butler et al. (2021)), we choose a networked SIS model
for the benefit of simplicity in demonstrating the results of this work. We
define a networked system with $n$ nodes where $x_{i}$ is the proportion of
infected population at node $i\in[n]$, with the infection dynamics defined by

$\dot{x}_{i}=-(\gamma_{i}+u_{i})x_{i}+(1-x_{i})\sum_{j\in[n]}\beta_{ij}x_{j}$
(66)

where $\gamma_{i}>0$ is the recovery rate at node $i$,
$u_{i}\in\mathcal{U}_{i}\subset\mathbb{R}_{\geq 0}$ is a control input
boosting the healing rate at node $i$, and $\beta_{ij}\geq 0$ is the networked
connection going from node $j$ to node $i$ (note $\beta_{ii}$ is simply the
infection rate occurring at node $i$). Note that we could also add a control
term that reduces the infection rate $\beta_{ii}$ at each node $i$; however,
we only consider one control term on the healing rate for simplicity. We also
define the full state vector as $x\in[0,1]^{n}$ and the vector of all control
inputs $u\in\mathbb{R}_{\geq 0}$. Let $\mathcal{U}_{i}=[0,\bar{u}_{i}]$, where
$\bar{u}_{i}$ is the upper limit on boosting the healing rate at node $i$. We
let each node define its individual safety constraint set as

$h_{i}(x_{i})=\bar{x}_{i}-x_{i}$ (67)

where $\bar{x}_{i}\in(0,1]$ is the defined safety threshold for the acceptable
proportion of infected individuals at node $i$. Thus, the individual safe sets
for each node are given by

$\mathcal{C}_{i}=\\{x\in[0,1]^{n}:h_{i}(x_{i})\geq 0\\}.$ (68)

In the remainder of this section, we will show how the analytical results of
Section 3.1 may be used to determine the worst-case vulnerability of a node
given the safety constraints of the neighboring population as well as how
Algorithm 1 may be used to ensure network safety using distributed
collaborative control.

###  5.1 Node Vulnerability Analysis

In this section, we apply the results from Section 3.1 to analyze when a
particular node $i\in[n]$ may fail to meet its definitions of safety given its
control limitations and the safety thresholds of its influencing neighbors.
Consider a node $i\in[n]$ and its respective neighbors $\mathcal{N}_{i}$.
Thus, the set of permissible control actions that will guarantee the safety of
node $i$ is given by

$U_{i}^{\mathcal{S}}(x)=\\{u_{i}\in[0,\bar{u}_{i}]:\dot{h}_{i}(x,u_{i})+\alpha_{i}(h_{i}(x_{i}))\geq
0\\}$ (69)

where

$\dot{h}_{i}(x,u_{i})=(\gamma_{i}+u_{i})x_{i}-(1-x_{i})\sum_{j\in\mathcal{N}_{i}^{+}\cup
i}\beta_{ij}x_{j}.$ (70)

Therefore, given $\mathcal{C}_{j},\forall j\in\mathcal{N}_{i}^{+}$, we wish to
evaluate if node $i$ is vulnerable to violating its conditions of safety.
Consider the case when $x_{i}\rightarrow\bar{x}_{i}$, then
$U_{i}^{\mathcal{S}}(x)$ is the set of all $u_{i}\in[0,\bar{u}_{i}]$ such that

$(\gamma_{i}+u_{i})\bar{x}_{i}-(1-\bar{x}_{i})\bar{x}_{i}\beta_{ii}-(1-\bar{x}_{i})\sum_{j\in\mathcal{N}_{i}^{+}}\beta_{ij}x_{j}\geq
0$ (71)

where dividing by $\bar{x}_{i}$ yields

$\gamma_{i}+u_{i}-(1-\bar{x}_{i})\beta_{ii}-(1-\bar{x}_{i})\sum_{j\in\mathcal{N}_{i}^{+}}\beta_{ij}\frac{x_{j}}{\bar{x}_{i}}\geq
0.$ (72)

There are two scenarios that may render $U_{i}^{\mathcal{S}}=\emptyset$ when
considering the limit of the control at node $i$.

  1. 1.

If $\gamma_{i}+\bar{u}_{i}<(1-\bar{x}_{i})\beta_{ii}$, then $\mathcal{C}_{i}$
is not forward invariant, independent of network influences.

  2. 2.

If $\gamma_{i}+\bar{u}_{i}\geq(1-\bar{x}_{i})\beta_{ii}$ but
$\delta_{i}+\bar{u}_{i}-(1-\bar{x}_{i})\beta_{ii}<(1-\bar{x}_{i})\sum_{j\in\mathcal{N}_{i}^{+}}\beta_{ij}\frac{x_{j}}{\bar{x}_{i}}$,
then $\mathcal{C}_{i}$ is not forward invariant due to the network influence
from its neighbors.

We may consider the worst-case scenario where each neighbor
$j\in\mathcal{N}_{i}^{+}$ reaches its safety threshold, yielding the following
result.

######  Proposition 1.

Given the model in (66) and $\mathcal{C}_{i}$ defined by (67) and (68) where
Assumption 1 holds, $\mathcal{C}_{i}$ is forward invariant if and only if

$\gamma_{i}+\bar{u}_{i}-(1-\bar{x}_{i})\beta_{ii}-(1-\bar{x}_{i})\sum_{j\in\mathcal{N}_{i}^{+}}\beta_{ij}\frac{\bar{x}_{j}}{\bar{x}_{i}}\geq
0.$ (73)

###### Proof.

This proof follows directly as a consequence of Theorem 1. Thus, we need only
show that Assumption 2 holds and that
$U_{i}^{\mathcal{S}}(x)\neq\emptyset,\forall
x\in\partial\mathcal{C}_{\mathcal{N}_{i}^{+}}$.

Given our networked spreading model in (66), if given
$x_{j},y_{j}\in\mathcal{C}_{i}\cap\mathcal{C}_{j}$, where $x_{-j}=y_{-j}$ and

$h_{j}(x)=\bar{x}_{i}-x_{i}<\bar{y}_{i}-y_{i}=h_{j}(x),$ (74)

then we have

$\displaystyle\mathcal{L}_{f_{i}}h_{i}(x)$
$\displaystyle=\gamma_{i}x_{i}-(1-x_{i})\left(\sum_{k\in(\mathcal{N}_{i}^{+}\cup
i)\setminus j}\beta_{ik}x_{k}+\beta_{ij}x_{j}\right)$ (75)
$\displaystyle\leq\gamma_{i}x_{i}-(1-x_{i})\left(\sum_{k\in(\mathcal{N}_{i}^{+}\cup
i)\setminus j}\beta_{ik}x_{k}+\beta_{ij}y_{j}\right)$
$\displaystyle=\mathcal{L}_{f_{i}}h_{i}(y)$

which shows that Assumption 2 holds. To show that
$U_{i}^{\mathcal{S}}(x)\neq\emptyset$ we simply evaluate
$\dot{h}_{i}(x,u_{i})+\alpha_{i}(h_{i}(x_{i}))\geq 0$ on the set
$\partial\mathcal{C}_{\mathcal{N}_{i}^{+}}$, which yields

$(\gamma_{i}+u_{i})\bar{x}_{i}-(1-\bar{x}_{i})\sum_{j\in\mathcal{N}_{i}^{+}}\beta_{ij}\bar{x}_{j}\geq
0.$ (76)

Therefore, if (73) holds then it must be that
$U_{i}^{\mathcal{S}}(x)\neq\emptyset$, which completes the proof. ∎

Thus, we can evaluate the forward invariance of $\mathcal{C}_{i}$ given
$\mathcal{U}_{i}$ and $\partial\mathcal{C}_{j},\forall
j\in\mathcal{N}_{j}^{+}$. We extend this condition to the entire network by
simply applying Proposition 1 to each node, where the proof of the result
follows directly from Proposition 1.

######  Corollary 2.

Given the model in (66), $\mathcal{C}=\bigcap_{i\in[n]}\mathcal{C}_{i}$ is
forward invariant if and only if (73) holds for all $i\in[n]$.

Using these results, we may compute the minimum control needed to achieve
safety for the network in the worst case given the safety constraints of
neighbors. However, this result also assumes that neighbors are capable of
achieving their own safety goals and does not account for behavior beyond the
neighborhood localized on node $i$. Therefore, we consider a more cooperative
model of safety using Algorithm 1 in the following seciton.

###  5.2 Collaborative Safety

We now demonstrate the performance of Algorithm 1 in ensuring network safety
for a simulated networked SIS epidemic process defined in (66) using
distributed control. For this example, we construct a simple 3-node system
where $\beta_{ij}=0.25$ and $\beta_{ii}=0.5$ for all $j\neq i$ and $j=i$,
respectively. To induce an endemic state, we set the healing rate
$\gamma_{i}=0.3$ for all nodes. In order to compute $\ddot{h}_{i}$ from (30)
using the networked SIS dynamics from (66) we compute the following Lie
derivative terms:

$\displaystyle\mathcal{L}_{f_{i}}h_{i}(x)$ $\displaystyle=-f_{i}(x)$
$\displaystyle\mathcal{L}_{g_{i}}h_{i}(x)$ $\displaystyle=x_{i}$
$\displaystyle\mathcal{L}_{f_{i}}^{2}h_{i}(x)$
$\displaystyle=(\gamma_{i}-(1-2x_{i})\beta_{ii})f_{i}(x)$
$\displaystyle\mathcal{L}_{g_{i}}^{2}h_{i}(x)$ $\displaystyle=-x_{i}$
$\displaystyle\mathcal{L}_{f_{j}}\mathcal{L}_{f_{i}}h_{i}(x)$
$\displaystyle=-(1-x_{i})\beta_{ij}x_{j}f_{j}(x)$
$\displaystyle\mathcal{L}_{g_{j}}\mathcal{L}_{f_{i}}h_{i}(x)$
$\displaystyle=(1-x_{i})\beta_{ij}x_{j}^{2}$
$\displaystyle\mathcal{L}_{g_{i}}\mathcal{L}_{f_{i}}h_{i}(x)$
$\displaystyle=\left((1-2x_{i})\beta_{ii}-\gamma_{i}-\sum_{j\in\mathcal{N}_{i}^{+}}\beta_{ij}x_{j}\right)x_{i}$
$\displaystyle\mathcal{L}_{f_{i}}\mathcal{L}_{g_{i}}h_{i}(x)$
$\displaystyle=f_{i}(x).$

We set the safety constraints for each node as $\bar{x}_{1}=0.1$,
$\bar{x}_{2}=0.12$, and $\bar{x}_{3}=0.18$, respectively, and constrain the
control input to $\mathcal{U}_{i}=[0,0.75]$ for all $i\in[n]$. First, we test
the performance of Algorithm 1 in computing viable control constraints for
each node given the safety needs of each neighbor. We simulate the system
using Rung-Kutta numerical integration and at each time step of the simulation
we have each node collaborate to communicate safety needs. Note that
Assumption 3 holds for all nodes, therefore by Theorem 3 we have that
Algorithm 1 will always converge to either a feasibly constrained control set
for each node, or at least one node will reach a terminally infeasible control
state. In fact, by construction, Assumption 3 will always hold for any
$x\in[0,1]^{n}$ since

$a_{ij}(x)=\mathcal{L}_{g_{j}}\mathcal{L}_{f_{i}}h_{i}(x)=(1-x_{i})\beta_{ij}x_{j}^{2}\geq
0$

for all $i\in[n]$ and $j\in\mathcal{N}_{i}^{+}$.

Once control constraints are computed via collaboration, each node selects a
control action via (52). Using the initial condition of
$x_{0}=[0.04,0.01,0.02]$, we show in Figure 1 the state trajectories and
corresponding control inputs for systems with different choices of $\eta_{i}$
and $\kappa_{i}$ for all $i\in[n]$. Note that for systems where
$\eta_{i}+\kappa_{i}\gg\nu_{i}^{*}$ (i.e. Figures 1(a) and 1(b)) node $i=1$
reaches its maximum capability, whereas when
$\eta_{i}+\kappa_{i}\leq\nu_{i}^{*}$ we see that node $i=1$ over-requests from
its neighbors (seen in Figures 1(c) and 1(d)), causing it to have a control
surplus while still maintaining its safety constraints.

To better visualize the relationship between $\nu_{1}=\eta_{1}+\kappa_{1}$ and
the communicated capability of node $i=1$, we fix $x_{2}=x_{3}=0.1$ and
compute $\epsilon_{i}(x,\nu_{i})$ using (65) for $x_{i}\in[0,\bar{x}_{1}]$ and
$\nu_{1}\in[0,0.8]$ to generate the surface in Figure 2. Note that for small
$x_{1}$ we have that the linear term
$q_{1}(x)=\mathcal{L}_{g_{i}}\mathcal{L}_{f_{i}}h_{i}(x)^{\top}+\mathcal{L}_{g_{i}}\mathcal{L}_{f_{i}}h_{i}(x)$
overpowers the negative definite quadratic term $Q_{1}(x_{1})$, thereby
setting $\nu_{1}^{*}=0$, as we show in a numerical approximation for
$\nu_{1}^{*}$ in Figure 3, which is used in the computation of the surface in
Figure 2. Thus, we see the tolerance for neighborhood non-compliance grows as
$\nu_{1}$ decreases and as $x_{1}$ approaches the barrier of its safety
constraints it will request a larger amount of surplus control from its
neighbors.

(a) $\eta_{i}=1$, $\kappa_{i}=10$

(b) $\eta_{i}=10$, $\kappa_{i}=1$

(c) $\eta_{i}=0.4$, $\kappa_{i}=0.4$

(d) $\eta_{i}=0.3$, $\kappa_{i}=0.3$

Figure 1: Simulated collaborative distributed controllers for a networked SIS
model with $n=3$ with different selections of $\eta_{i},\kappa_{i}$ for all
$i\in[n]$ where dotted lines represent each node’s safety constraints
$\bar{x}_{i}$ and the black dashed line showing the input constraint of
$\mathcal{U}_{i}=[0,0.75]$ for all nodes $i\in[n]$, respectively. Figures 1(a)
and 1(b) show node $i=1$ utilizing its maximum capability and Figures 1(c) and
1(d) show the network behavior with node $i=1$ over-requesting assistance from
its neighbors.

Figure 2: The error tolerance in neighbor request fulfillment
$\epsilon_{i}(x,\nu_{i})$ defined by (65) computed for $x_{2}=x_{3}=0.1$ with
$x_{1}\in[0,\bar{x}_{1}]$ and $\nu_{1}\in[0,0.8]$. Figure 3: A numerical
approximation of $\nu_{1}^{*}$ for $x_{2}=x_{3}=0.1$ with
$x_{1}\in[0,\bar{x}_{1}]$, where $\nu_{1}$ is incremented by
$\delta_{\nu}=0.01$ until $u_{1}^{*}=u_{1}^{c}$.

##  6 Conclusion

In this work, we have presented methods for the distributed, collaborative
safety-critical control of networked dynamic systems that exploit networked
dynamics and structure to ensure individual safety goals are met. We have
shown that the choice of barrier function hyperparameters (i.e., the choice of
class-$\mathcal{K}$ functions in the higher-order barrier function definition)
has both a qualitative effect on agent behavior and can allow for robustness
in the sense of neighbor error in fulfilling safety requests. This novel
approach leverages knowledge of networked dynamics in order to achieve
stronger runtime assurances that tractably scale with network growth, which is
of utmost importance as the world becomes more interconnected and prone to
widespread failures.

While some foundational theory on safety-critical control of networks has been
presented in this work, many directions of exploration and development remain
open. For example, providing conditions for the convergence of a collaborative
safety algorithm that accounts for potentially conflicting safety requests is
vital for many relevant applications. Additional directions for future work
include considering network influences beyond the 1-hop neighborhood as well
as considerations of edge control in the coupling dynamics of networked
models. Finally, we have considered the case when neighbors readily and
truthfully share information and attempt to satisfy requests by their
neighbors to the best of their ability; however, one may also consider the
case where neighbors are uncooperative, share faulty information, or are
actively malicious.

## References

  * Paré et al. [2020] Philip E Paré, Carolyn L Beck, and Tamer Başar.  Modeling, estimation, and analysis of epidemics over networks: An overview.  _Annual Reviews in Control_ , 50:345–360, 2020.
  * Tuballa and Abundo [2016] Maria Lorena Tuballa and Michael Lochinvar Abundo.  A review of the development of smart grid technologies.  _Renewable and Sustainable Energy Reviews_ , 59:710–725, 2016.
  * Tahir et al. [2019] Anam Tahir, Jari Böling, Mohammad-Hashem Haghbayan, Hannu T Toivonen, and Juha Plosila.  Swarms of unmanned aerial vehicles—a survey.  _Journal of Industrial Information Integration_ , 16:100106, 2019.
  * Chung et al. [2018] Soon-Jo Chung, Aditya Avinash Paranjape, Philip Dames, Shaojie Shen, and Vijay Kumar.  A survey on aerial swarm robotics.  _IEEE Transactions on Robotics_ , 34(4):837–855, 2018.
  * Plathottam and Ranganathan [2018] Siby Jose Plathottam and Prakash Ranganathan.  Next generation distributed and networked autonomous vehicles.  In _Proceedings of the 2018 10th International Conference on Communication Systems & Networks (COMSNETS)_, pages 577–582. IEEE, 2018.
  * Wang et al. [2017a] Li Wang, Aaron D Ames, and Magnus Egerstedt.  Safety barrier certificates for collisions-free multirobot systems.  _IEEE Transactions on Robotics_ , 33(3):661–674, 2017a.
  * Lewis et al. [2013] Frank L Lewis, Hongwei Zhang, Kristian Hengster-Movric, and Abhijit Das.  _Cooperative Control of Multi-agent Systems: Optimal and adaptive design approaches_.  Springer Science & Business Media, 2013.
  * Li and Duan [2017] Zhongkui Li and Zhisheng Duan.  _Cooperative Control of Multi-agent Systems: A Consensus Region Approach_.  CRC Press, 2017.
  * Wang et al. [2017b] Yue Wang, Eloy Garcia, David Casbeer, and Fumin Zhang.  _Cooperative Control of Multi-agent Systems: Theory and Applications_.  John Wiley & Sons, 2017b.
  * Yu et al. [2017] Wenwu Yu, Guanghui Wen, Guanrong Chen, and Jinde Cao.  _Distributed Cooperative Control of Multi-agent Systems_.  John Wiley & Sons, 2017.
  * Nagumo [1942] Mitio Nagumo.  Über die lage der integralkurven gewöhnlicher differentialgleichungen.  _Proceedings of the Physico-Mathematical Society of Japan. 3rd Series_ , 24:551–559, 1942.
  * Blanchini [1999] Franco Blanchini.  Set invariance in control.  _Automatica_ , 35(11):1747–1767, 1999.
  * Ames et al. [2016] Aaron D Ames, Xiangru Xu, Jessy W Grizzle, and Paulo Tabuada.  Control barrier function based quadratic programs for safety critical systems.  _IEEE Transactions on Automatic Control_ , 62(8):3861–3876, 2016.
  * Ames et al. [2019] Aaron D Ames, Samuel Coogan, Magnus Egerstedt, Gennaro Notomista, Koushil Sreenath, and Paulo Tabuada.  Control barrier functions: Theory and applications.  In _Proceedings of the 2019 18th European Control Conference (ECC)_ , pages 3420–3431, 2019.
  * Glotfelter et al. [2017] Paul Glotfelter, Jorge Cortés, and Magnus Egerstedt.  Nonsmooth barrier functions with applications to multi-robot systems.  _IEEE Control Systems Letters_ , 1(2):310–315, 2017.
  * Chen et al. [2020a] Yuxiao Chen, Andrew Singletary, and Aaron D Ames.  Guaranteed obstacle avoidance for multi-robot operations with limited actuation: A control barrier function approach.  _IEEE Control Systems Letters_ , 5(1):127–132, 2020a.
  * Notomista et al. [2020] Gennaro Notomista, Mingyu Wang, Mac Schwager, and Magnus Egerstedt.  Enhancing game-theoretic autonomous car racing using control barrier functions.  In _Proceedings of the International Conference on Robotics and Automation (ICRA)_ , pages 5393–5399, 2020.
  * Ma et al. [2021] Haitong Ma, Jianyu Chen, Shengbo Eben, Ziyu Lin, Yang Guan, Yangang Ren, and Sifa Zheng.  Model-based constrained reinforcement learning using generalized control barrier function.  In _Proceedings of the International Conference on Intelligent Robots and Systems (IROS)_ , pages 4552–4559, 2021.
  * Alan et al. [2022] Anil Alan, Andrew J Taylor, Chaozhe R He, Aaron D Ames, and Gábor Orosz.  Control barrier functions and input-to-state safety with application to automated vehicles.  _arXiv preprint arXiv:2206.03568_ , 2022.
  * Lyu et al. [2022] Yiwei Lyu, Wenhao Luo, and John M Dolan.  Adaptive safe merging control for heterogeneous autonomous vehicles using parametric control barrier functions.  In _Proceedings of the Intelligent Vehicles Symposium (IV)_ , pages 542–547, 2022.
  * Hobbs et al. [2023] Kerianne L Hobbs, Mark L Mote, Matthew CL Abate, Samuel D Coogan, and Eric M Feron.  Runtime assurance for safety-critical systems: An introduction to safety filtering approaches for complex control systems.  _IEEE Control Systems Magazine_ , 43(2):28–65, 2023.
  * Xiao et al. [2023] Wei Xiao, Christos G Cassandras, and Calin Belta.  _Safe Autonomy with Control Barrier Functions: Theory and Applications_.  Springer Nature, 2023.
  * Wang et al. [2016] Li Wang, Aaron Ames, and Magnus Egerstedt.  Safety barrier certificates for heterogeneous multi-robot systems.  In _Proceedings of the American Control Conference (ACC)_ , pages 5213–5218. IEEE, 2016.
  * Glotfelter et al. [2018] Paul Glotfelter, Jorge Cortés, and Magnus Egerstedt.  Boolean composability of constraints and control synthesis for multi-robot systems via nonsmooth control barrier functions.  In _Proceedings of the Conference on Control Technology and Applications (CCTA)_ , pages 897–902, 2018.
  * Panagou et al. [2015] Dimitra Panagou, Dušan M Stipanović, and Petros G Voulgaris.  Distributed coordination control for multi-robot networks using Lyapunov-like barrier functions.  _IEEE Transactions on Automatic Control_ , 61(3):617–632, 2015.
  * Hu et al. [2022] Yifan Hu, Junjie Fu, and Guanghui Wen.  Decentralized robust collision avoidance for cooperative multirobot systems: A Gaussian process-based control barrier function approach.  _IEEE Transactions on Control of Network Systems_ , 2022.
  * Nejati et al. [2020a] Ameneh Nejati, Sadegh Soudjani, and Majid Zamani.  Compositional construction of control barrier functions for networks of continuous-time stochastic systems.  In _Proceedings of the IFAC World Congress_ , volume 53, pages 1856–1861, 2020a.
  * Nejati et al. [2020b] Ameneh Nejati, Sadegh Soudjani, and Majid Zamani.  Compositional construction of control barrier certificates for large-scale stochastic switched systems.  _IEEE Control Systems Letters_ , 4(4):845–850, 2020b.
  * Nejati et al. [2022] Ameneh Nejati, Sadegh Soudjani, and Majid Zamani.  Compositional construction of control barrier functions for continuous-time stochastic hybrid systems.  _Automatica_ , 145:110513, 2022.
  * Jahanshahi et al. [2022] Niloofar Jahanshahi, Abolfazl Lavaei, and Majid Zamani.  Compositional construction of safety controllers for networks of continuous-space POMDPs.  _IEEE Transactions on Control of Network Systems_ , 2022.
  * Jagtap et al. [2020] Pushpak Jagtap, Abdalla Swikir, and Majid Zamani.  Compositional construction of control barrier functions for interconnected control systems.  In _Proceedings of the 23rd International Conference on Hybrid Systems: Computation and Control_ , pages 1–11, 2020.
  * Anand et al. [2022] Mahathi Anand, Abolfazl Lavaei, and Majid Zamani.  From small-gain theory to compositional construction of barrier certificates for large-scale stochastic systems.  _IEEE Transactions on Automatic Control_ , 67(10):5638–5645, 2022.
  * Breeden and Panagou [2023] Joseph Breeden and Dimitra Panagou.  Compositions of multiple control barrier functions under input constraints.  In _Proceedings of the American Control Conference (ACC)_ , 2023.
  * Xiao and Belta [2019] Wei Xiao and Calin Belta.  Control barrier functions for systems with high relative degree.  In _Proceedings of the 58th Conference on Decision and Control (CDC)_ , pages 474–479, 2019.
  * Xiao and Belta [2021] Wei Xiao and Calin Belta.  High-order control barrier functions.  _IEEE Transactions on Automatic Control_ , 67(7):3655–3662, 2021.
  * Zhang et al. [2023a] Songyuan Zhang, Yumeng Xiu, Guannan Qu, and Chuchu Fan.  Compositional neural certificates for networked dynamical systems.  In _Proceedings of the 5th Annual Learning for Dynamics and Control Conference (L4DC)_ , pages 272–285, 2023a.
  * Donzé [2013] Alexandre Donzé.  On signal temporal logic.  In _Proceedings of the 4th International Conference on Runtime Verification_ , pages 382–383, 2013.
  * Raman et al. [2014] Vasumathi Raman, Alexandre Donzé, Mehdi Maasoumy, Richard M Murray, Alberto Sangiovanni-Vincentelli, and Sanjit A Seshia.  Model predictive control with signal temporal logic specifications.  In _Proceedings of the 53rd Conference on Decision and Control (CDC)_ , pages 81–87, 2014.
  * Deshmukh et al. [2017] Jyotirmoy V Deshmukh, Alexandre Donzé, Shromona Ghosh, Xiaoqing Jin, Garvit Juniwal, and Sanjit A Seshia.  Robust online monitoring of signal temporal logic.  _Formal Methods in System Design_ , 51:5–30, 2017.
  * Raman et al. [2015] Vasumathi Raman, Alexandre Donzé, Dorsa Sadigh, Richard M Murray, and Sanjit A Seshia.  Reactive synthesis from signal temporal logic specifications.  In _Proceedings of the 18th International Conference on Hybrid Systems: Computation and Control_ , pages 239–248, 2015.
  * Sadigh and Kapoor [2016] Dorsa Sadigh and Ashish Kapoor.  Safe control under uncertainty with probabilistic signal temporal logic.  In _Proceedings of Robotics: Science and Systems XII_ , 2016.
  * Lindemann and Dimarogonas [2020] Lars Lindemann and Dimos V Dimarogonas.  Barrier function based collaborative control of multiple robots under signal temporal logic tasks.  _IEEE Transactions on Control of Network Systems_ , 7(4):1916–1928, 2020.
  * Lindemann and Dimarogonas [2019a] Lars Lindemann and Dimos V Dimarogonas.  Control barrier functions for multi-agent systems under conflicting local signal temporal logic tasks.  _IEEE Control Systems Letters_ , 3(3):757–762, 2019a.
  * Lindemann and Dimarogonas [2019b] Lars Lindemann and Dimos V Dimarogonas.  Decentralized control barrier functions for coupled multi-agent systems under signal temporal logic tasks.  In _Proceedings of the 18th European Control Conference (ECC)_ , pages 89–94. IEEE, 2019b.
  * Chen et al. [2020b] Yuxiao Chen, James Anderson, Karanjit Kalsi, Aaron D Ames, and Steven H Low.  Safety-critical control synthesis for network systems with control barrier functions and assume-guarantee contracts.  _IEEE Transactions on Control of Network Systems_ , 8(1):487–499, 2020b.
  * Chen et al. [2019] Yuxiao Chen, James Anderson, Karan Kalsi, Steven H Low, and Aaron D Ames.  Compositional set invariance in network systems with assume-guarantee contracts.  In _Proceedings of the 2019 American Control Conference (ACC)_ , pages 1027–1034. IEEE, 2019.
  * Song et al. [2022] Lin Song, Neng Wan, Aditya Gahlawat, Chuyuan Tao, Naira Hovakimyan, and Evangelos A Theodorou.  Generalization of safe optimal control actions on networked multi-agent systems.  _IEEE Transactions on Control of Network Systems_ , 2022.
  * Zhou et al. [2020] Jie Zhou, Ganqu Cui, Shengding Hu, Zhengyan Zhang, Cheng Yang, Zhiyuan Liu, Lifeng Wang, Changcheng Li, and Maosong Sun.  Graph neural networks: A review of methods and applications.  _AI Open_ , 1:57–81, 2020.
  * Wu et al. [2020] Zonghan Wu, Shirui Pan, Fengwen Chen, Guodong Long, Chengqi Zhang, and S Yu Philip.  A comprehensive survey on graph neural networks.  _IEEE Transactions on Neural Networks and Learning Systems_ , 32(1):4–24, 2020.
  * Scarselli et al. [2008] Franco Scarselli, Marco Gori, Ah Chung Tsoi, Markus Hagenbuchner, and Gabriele Monfardini.  The graph neural network model.  _IEEE Transactions on Neural Networks_ , 20(1):61–80, 2008.
  * Fan et al. [2023] Chuchu Fan et al.  Distributed safe multi-agent control using neural graph control barrier functions.  In _Proceedings of the Conference on Robot Learning (CoRL)_ , 2023.
  * Huang et al. [2010] Ching-Ling Huang, Yaser P Fallah, Raja Sengupta, and Hariharan Krishnan.  Adaptive intervehicle communication control for cooperative safety systems.  _IEEE Network_ , 24(1):6–13, 2010.
  * Li et al. [2021] Chunyu Li, Jianan Wang, Jiayuan Shan, Alexander Lanzon, and Ian R Petersen.  Robust cooperative control of networked train platoons: A negative-imaginary systems’ perspective.  _IEEE Transactions on Control of Network Systems_ , 8(4):1743–1753, 2021.
  * Qu [2010] Zhihua Qu.  Cooperative control of networked nonlinear systems.  In _Proceedings of the 49th IEEE Conference on Decision and Control (CDC)_ , pages 3200–3207. IEEE, 2010.
  * Qu and Simaan [2012] Zhihua Qu and Marwan Simaan.  An analytic solution to the optimal design of information structure and cooperative control in networked systems.  In _Proceedings of the 51st IEEE Conference on Decision and Control (CDC)_ , pages 4015–4022. IEEE, 2012.
  * Röbenack [2008] Klaus Röbenack.  Computation of multiple Lie derivatives by algorithmic differentiation.  _Journal of Computational and Applied Mathematics_ , 213(2):454–464, 2008.
  * Gurriet et al. [2020] Thomas Gurriet, Mark Mote, Andrew Singletary, Petter Nilsson, Eric Feron, and Aaron D Ames.  A scalable safety critical control framework for nonlinear systems.  _IEEE Access_ , 8:187249–187275, 2020.
  * Kaown and Liu [2009] Dougsoo Kaown and Jianguo Liu.  A fast geometric algorithm for finding the minimum distance between two convex hulls.  In _Proceedings of the 48h IEEE Conference on Decision and Control (CDC) held jointly with 2009 28th Chinese Control Conference_ , pages 1189–1194. IEEE, 2009.
  * Vrabac et al. [2021] Damir Vrabac, Mingfeng Shang, Brooks A Butler, Joseph Pham, Raphael Stern, and Philip E Paré.  Capturing the effects of transportation on the spread of COVID-19 with a multi-networked SEIR model.  In _Proceedings of the 2021 American Control Conference (ACC)_ , pages 3152–3157. IEEE, 2021.
  * Butler and Paré [2023] Brooks A Butler and Philip E Paré.  Optimal safety-critical control of epidemics.  _IEEE Control Systems Letters_ , 2023.
  * Zhang et al. [2023b] Ciyuan Zhang, Humphrey Leung, Brooks A Butler, and Philip E Paré.  Estimation and distributed eradication of SIR epidemics on networks.  _IEEE Transactions on Control of Network Systems_ , 2023b.
  * Butler et al. [2021] Brooks A Butler, Ciyuan Zhang, Ian Walter, Nishant Nair, Raphael Stern, and Philip E Paré.  The effect of population flow on epidemic spread: Analysis and control.  In _Proceedings of the 2021 60th IEEE Conference on Decision and Control (CDC)_ , pages 4260–4265. IEEE, 2021.