Safety of layered control systems via control barrier morphisms

Introduction

Layered control architectures allow complex systems to be controlled through simpler models [1], [2]. A canonical example is the “planner-tracker” paradigm, where a planning (or safety) layer computes a reference using a reduced-order model, while a low-level controller on the full-order model tracks this reference signal. These architectures have the advantage of decomposing control problems into simpler subproblems that are tractable, but also introduce a question that cannot be answered by analyzing either layer in isolation: when does a guarantee established on the reduced-order model remain valid on the full-order model? This question has increased in importance due to the need to establish safety guarantees for highly dynamic robotic systems.

The problem of identifying architectures has been investigated frequently over the years from a variety of perspectives, including: aggregation [3], hierarchies [4], supervision [5], behavioral interconnection [6], and symbolic abstractions [7], to name a few. More recent approaches formulate layered architectures through contracts [8], [9] and multi-rate control [10]. These complementary perspectives indicate the fundamental nature of control architectures, and the need to make guarantees for complex systems by studying constituent components and their interactions. This paper studies layered architectures from the perspective of safety utilizing the framework of category theory, enabling us to determine how the safety of layered control architectures can be established from the safety of individual layers and their interactions.

The authors are with the California Institute of Technology, Pasadena CA 91125, U.S.A. { ames, jmoeller, mdesa}@caltech.edu and UCLA, Los Angeles CA 90095-1594, [email protected].

This research is funded by the AFOSR SCHEMA CoE and MURI grant Hybrid Dynamics - Deconstruction and Aggregation (HyDDRA).

As an illustration of the results in this paper, consider Figure 2 where a Control Barrier Function (CBF)-based safety filter [11], designed for a Reduced Order Model (RoM), is implemented in a Full Order Model (FoM) via an existing tracking controller. The safety filter utilizes a CBF on the RoM to transform a desired input signal into an input signal that guarantees safety. The FoM realizes the input via a tracking controller, introducing tracking error. Prior results combine the RoM barrier with tracking guarantees on the FoM to obtain a safety guarantee for the FoM [12], [13]. This paradigm provides a starting point for building a theory of composition that yields safety guarantees.

Category theory gives a natural language in which to reason about the composition. Coalgebras provide a general formulation for systems and their structure-preserving maps [14]. Pullbacks describe heterogeneous composition of tagged systems [15] and nonlinear feedback interconnection [16]. Diagrams allow for the interconnection of open dynamical systems [17], for hybrid systems to be composed [18], and for the composition of Lyapunov certificates via assume-guarantee reasoning [19]. This paper explores categorical composition through the lens of safety.

The first contribution of this paper is a categorical formulation of CBFs. To this end, we generalize control systems to a categorical setting by modeling them as coalgebras. Taking inspiration from categorical Lyapunov theory [20], [21], we formulate a control barrier morphism (CBM) as a map from a control coalgebra to a target comparison system. The collection of safe actions is represented by the admissible locus of a CBM. The existence of a feedback controller (section) of the admissible locus yields a closed loop system that is safe: it renders a subobject defined by the CBM forward invariant.

The second contribution is to frame composition as the categorical pullback. This endows composition with a universal property. Given two control systems, their interaction is framed as morphisms to a mediator, and the interconnected system is the pullback. The universal property of the pullback together with barrier morphisms enables the main result: given CBMs on each system that agree on the mediator, the result is a CBM for the composed system implying safety of a subobject. We apply this result to the motivating problem: a CBF-safety filter utilizing a RoM and tracked by a FoM, thus demonstrating that specialization of the main result leads to a CBF guaranteeing safety of the layered architecture. Importantly, the CBF for the layered system emerges as a consequence of the categorical framework, rather than from heuristic constructions, demonstrating its value.

Motivation: Layered Safety Filters

Consider a layered architecture (cf. Figure 2) consisting of a reduced-order model (RoM) and full-order model (FoM):

RoM

FoM

where the states $z$ and $x$ range over open subsets $Z\subseteq\mathbb{R}^{n_z}$ and $X\subseteq\mathbb{R}^{n_x}$, and the inputs $\nu$ and $v$ range over $U_\nu=\mathbb{R}^m$ and $U_v=\mathbb{R}^m$, respectively. We keep separate names for the two input spaces, even though they coincide, because the safety filter in Section V treats them as distinct interfaces. The inputs to the RoM and FoM have the same dimension because we are implicitly assuming that $f_{\mathrm{F}}$ is obtained from the “true” dynamics of the system, $\dot{x}=F(x)+G(x)u$ together with a tracking controller $u=K(x,v)$ wherein $f_{\mathrm{F}}(x,v)=F(x)+G(x)K(x,v)$. Based on the inputs $\nu$ of the RoM and the state $x$ of the FoM, the tracking controller forces the FoM to converge to the RoM’s behavior.

The RoM and FoM are coupled by a safety filter. Given the state projection $\Pi:X\to Z$ and a safety function $h:Z\to\mathbb{R}$ the safe set for the FoM is given by:

We assume that $h$ is a control barrier function (CBF) for the RoM, with the corresponding CBF-QP safety filter:

with $\alpha>0$ (taken to be a constant for simplicity, although a $\mathcal{K}_{\infty}^{e}$ function would also be possible), $L_fh=Dh\,f$ and $L_gh=Dh\,g$ are the Lie derivatives, and the normed squared term is for robustness. In the layered architecture, the safe controller is passed to the FoM via the tracking controller, i.e., setting the reference velocity to $v=\kappa_{\mathrm{safe}}(\Pi(x))$ wherein:

The goal is safety of the FoM, i.e., to keep the state of the system within $\mathcal{C}$. To this end, consider the FoM tracking error associated with the reference $v=\kappa_{\mathrm{safe}}(\Pi(x))$:

where $\Psi:X\to U_v$ is the input projection. That is, the error is the difference between the “actual velocity” of the system projected to the RoM input space via $\Psi$ and the “desired velocity” encoded by $\kappa_{\mathrm{safe}}$.

A tracking function $V$ quantifies the ability of the FoM to bound this error via the assumptions:

for $b:=h\circ\Pi$ and $\gamma,\rho>0$. These assumptions can be used to define the composite barrier function for the FoM:

The main result of [12] is that if $\lambda>\alpha$:

where $c:I=[0,t_f)\subseteq\mathbb{R}\to X$ is a solution: $\dot{c}=f_{\mathrm{cl}}(c(t))$. Therefore, starting from a reduced set of initial conditions defined by the zero superlevel set of $H$, the state remains within $\mathcal{C}$ and, therefore, the FoM is safe. These ideas were generalized in [22] to bounded tracking and in [13] to predictive CBFs. See [23] for a notion of robust CBF, generalizing input-to-state safety used in [12]. This paper will demonstrate in Section V that this result is a natural consequence of categorical composition theory.

Control Barrier Morphisms

Categorical Lyapunov theory [20, 21] generalized Lyapunov theory to a broad class of “systems” by leveraging coalgebras. We build upon this framework and refer the reader to these papers for the background content needed. Importantly, this paper extends categorical Lyapunov theory to “control systems” through the introduction of control coalgebras. We leverage this to generalize safety-critical control to a categorical setting: defining control barrier morphisms (generalizing CBFs categorically) that imply forward invariance of a subobject (via a categorical Nagumo theorem).

Consider a category $\mathcal{C}$ with finite products and terminal object $1$. A point of $B$ is a map $x:1 \to B$, and $!_{X}:X \to1$ denotes the unique map to the terminal object. In the remainder of the paper we will use $\mathcal{F}:\mathcal{C}\to\mathcal{C}$ to denote a functor and $\pi:\mathcal{F}\Rightarrow\operatorname{id}_{\mathcal{C}}$ to denote a natural transformation from $\mathcal{F}$ to the identity functor on $\mathcal{C}$.

Systems, inputs, and feedback

A coalgebra is a morphism $f:B\to\mathcal{F}B$. This generalizes “systems,” e.g., a smooth vector field $\dot{x}=f(x)$ is a $T$-coalgebra $f:M\to TM$ where $T$ is the tangent bundle functor on $\mathcal{C}=\operatorname{Man}$, manifolds with boundary. Control coalgebras generalize this to include inputs.

Definition 1 (Control coalgebra). Let $\mathcal{C}$ be a category with finite products, $\mathcal{F}:\mathcal{C}\to\mathcal{C}$ be an endofunctor, and $\pi:\mathcal{F}\Rightarrow\operatorname{id}_{\mathcal{C}}$ a natural transformation. A control coalgebra, denoted by $\mathbf{P}=(p:E\to B,f)$, consists of (i) a base object $B\in\mathcal{C}$ called the state space (ii) a bundle $p:E\to B$ called the control bundle (iii) a bundle map $f:(p:E\to B)\to(\pi_{B}:\mathcal{F}B\to B)$, i.e., a map $f:E\to\mathcal{F}B$ called the control system, such that $\pi_{B}\circ f=p$ as illustrated by the commutative diagram:

A morphism of control coalgebras $\phi=(\phi^{B},\phi^{E}):\mathbf{P}\to\mathbf{P}'$ consists of maps $\phi^{B}:B\to B'$ and $\phi^{E}:E\to E'$ with:

These objects and maps form the category $\operatorname{Ctrl}_{\mathcal{F}}(\mathcal{C})$.

A feedback controller is a section $k:B\to E$, i.e., $p\circ k=\operatorname{id}_{B}$. It produces the autonomous system $f_{\mathrm{cl}}=f\circ k:B\to\mathcal{F}B$ as illustrated by a commutative diagram:

Autonomous systems are the control coalgebras with $p=\operatorname{id}_{B}$, i.e., $(\operatorname{id}_{B}:B\to B,f_{\mathrm{cl}})$, and therefore satisfy $\pi_{B}\circ f_{\mathrm{cl}}=\operatorname{id}_{B}$.

Example 1 (Continuous-time control systems). For $\mathcal{C}=\operatorname{Man}$ and $\mathcal{F}=T$, the tangent bundle functor, the natural projection is $\pi_{M}:TM\to M$. In the case that $E=M\times U$ and $p=p_{M}$, a control coalgebra is illustrated by:

In local coordinates, we recover the classical notions:

• control system: $\dot{x}=f(x,u)$ for $u\in U$,

• feedback controller: $k(x)=(x,\kappa(x))$,

• closed-loop system: $f_{\mathrm{cl}}(x)=f(x,\kappa(x))$.

Let $T$ be a time object in $\mathcal{C}$, i.e., an object equipped with a distinguished point $0_{T}:1\to T$. Following [24], consider a collection of intervals $I$ consisting of subobjects $l:I\hookrightarrow T$ with initial point $0_{I}:1\to I$ satisfying $\iota\circ0_{I}=0_{T}$. On these intervals, a unit clock $1_{I}:I\to\mathcal{F}I$ is a system with $\pi_{I}\circ1_{I}=\operatorname{id}_{I}$. A solution of an autonomous system $f_{\mathrm{cl}}:B\to\mathcal{F}B$ is a map $c:I\to B$ satisfying¹:

For Example 1, $T=\mathbb{R}$, $I=[0,t_{f})\subset\mathbb{R}$ with $t_{f}>0$, $\iota_{I}(t)=(t,1)$ and (8) implies that $\dot{c}(t)=f_{\mathrm{cl}}(c(t))$.

Lax equalizers, barrier morphisms and safe subobjects

Definition 2 (Orders). An object $R\in\mathcal{C}$ is preordered if, for every object $X\in\mathcal{C}$, the hom-set $\mathcal{C}(X,R)$ is equipped with a preorder, $f_{1}\le f_{2}$, and precomposition is order-preserving: if $g_{1}\le g_{2}:Y\to R$ and $f:X\to Y$, then $g_{1}\circ f\le g_{2}\circ f$. A preordered object $R$ is posetal if the preorder on $\mathcal{C}(X,R)$ is antisymmetric: $f_{1}\le f_{2}$ and $f_{2}\le f_{1}$ implies $f_{1}=f_{2}$.

This notion of preordered objects allows for the formulation of lax equalizers defined via a universal property.

Definition 3 (Lax equalizers). Let $R$ be preordered. The lax equalizer of a pair of maps $a,b:X\to R$ is an object $\operatorname{Eq}^{\leq}(a,b)$ and map $e:\operatorname{Eq}^{\leq}(a,b)\to X$ satisfying:

such that for every $q:Q\to X$,

For a set $X$ with $a,b:X\to\mathbb{R}$, the lax equalizer is $\operatorname{Eq}^{\leq}(a,b)=\{x\in X:a(x)\leq b(x)\}$. Thus a lax commuting diagram describes an inequality, and the lax equalizer describes the locus on which it holds. Lax equalizers always exist in Set and Top, but need not exist in Man. For instance, if $0$ is a not regular value of $h$, then $\operatorname{Eq}^{\leq}(0,h)=\{x\in X:0\leq h(x)\}$ may not be an object of Man, as it may have a nonsmooth boundary. Throughout, we assume that the lax equalizers we use exist in the ambient category.

Choose a posetal measurement object $R$ with distinguished point $0_R:1\to R$, an autonomous comparison system $\sigma:R\to FR$, a preorder on $FR$, and write $0_X:=0_R\circ!_{X}:X\to R$. The posetal order on $R$ and preorder on $FR$ are distinct and related via the following essential assumption.

This assumption is the categorical version of the comparison lemma [25], which is recovered when we make the choice $R=\mathbb{R}$ with comparison system $\dot r=\sigma(r):=-\alpha r$ for $\alpha>0$. The classical comparison lemma gives $u(t)\ge e^{-\alpha t}u(0)\ge0$ for any curve with $\dot u(t)\ge-\alpha u(t)$ and $u(0)\ge0$.

A subobject $s:S\hookrightarrow B$ is forward invariant if every solution $c:I\to B$ starting in $S$ factors through $s$. That is, $c\circ0_I=s\circ x_0$ for some $x_0:1\to S$ implies $c=s\circ\widetilde c$ for a (necessarily unique) $\widetilde c:I\to S$.

Proof. Given a solution $c$ starting in $S_h$, pasting the solution diagram (8) with the lax barrier diagram (11) yields:

Then $u=h\circ c$ satisfies (10), so $0_I\le h\circ c$. The universal property (9) gives the unique factorization of $c$ through $S_h$ implying that $S_h$ is forward invariant. $\square$

Control barrier morphisms

Barrier morphisms can be extended to a control setting yielding control barrier morphisms. Consider a control coalgebra $P=(p:E\to B,f)$ and a target comparison system $\sigma:R\to FR$ with $R$ posetal and $FR$ preordered.

Because $\pi_h$ is point-surjective, every state $x:1\to B$ admits an admissible point $\widetilde{x}:1\to A_h$ satisfying $\pi_h\circ\widetilde{x}=x$. In categories with an underlying set structure, this condition for a CBM recovers the classical CBF feasibility condition

where $E_x=\{e_x\in E:p(e_x)=x\}$.

Proof. The diagram for $A_h$ given in (12) and the section $u_h:B\to A_h$ paste to give the barrier inequality (11) for the closed-loop system: $Fh\circ f_{\mathrm{cl}}\ge\sigma\circ h$. It follows that $h$ is a barrier morphism for the autonomous closed-loop coalgebra $f_{\mathrm{cl}}$. Therefore, by Theorem 1, $S_h$ is forward invariant. $\square$

Remark 1 (Control Lyapunov morphisms). Let $V:B\to R$ be a morphism. Then the same construction as above with the inequality reversed gives the admissible locus:

Let $V$ be positive definite (as defined categorically in [20, 21]) and $\pi_V:=p\circ a_V$ be a point surjective epi, then $V$ is a control Lyapunov morphism (CLM)${}^{3}$. It is straightforward to prove that any section $u_V:B\to A_V$ yields a stabilizing controller $a_V\circ u_V$. Namely, for the closed loop system $f_{\mathrm{cl}}:=f\circ a_V\circ u_V:B\to FB$ the Lyapunov inequality is satisfied: $FV\circ f_{\mathrm{cl}}\le\sigma_V\circ V$. We will leverage this reverse inequality in the context of certificates for the tracking controller.

Example 2 (Continuous-time CBFs). Returning to Example 1, pick the comparison object $R=\mathbb{R}$ with the canonical order $\ge$ and equip $TR\cong\mathbb{R}^2$ with the order: $(r,\dot r)\ge(r',\dot r')$ iff $r=r'$ and $\dot r\ge\dot r'$. Define the comparison system $\sigma_h:R\to TR$ by $\sigma_h(r)=(r,-\alpha(r))$, for $\alpha\in\mathcal{K}_{\infty}$ extended class $\mathcal{K}_{\infty}$.

For $h:M\to\mathbb{R}$, the safe set is

and the admissible locus is given by:

Point-surjectivity of $\pi_h:A_h\to M$ is the usual CBF condition:

A section $u_h(x)=(x,\kappa_h(x))$ is a feedback controller such that the barrier condition is satisfied:

and therefore $S_h$ is forward invariant for the closed-loop system: $f_{\mathrm{cl}}(x)=f(x,\kappa_h(x))$. We have thus captured the classic CBF results categorically.

Composition of Systems and Certificates

The key idea, inspired by [15, 16], is that composition can be described by a pullback. We now make this idea precise in the context of control coalgebras and CBMs.

Composition over a mediator

Consider the case of two control coalgebras $P_1$ and $P_2$ (this framework can be extended to any number of systems via the limit). The essential concept is that control systems must communicate through a mediator $M$, resulting in a cospan of morphisms in $\operatorname{Ctrl}_{\mathcal{F}}(\mathcal{C})$:

The mediator specifies which state and input information must agree. The cospan defines constraints between states and inputs that are imposed by the interconnection between two systems. Composition enforces this agreement via the pullback.

Assumption 2 (Existence of pullbacks). The pullbacks:

exist, and $\mathcal{F}$ preserves the state pullback:

For smooth manifolds, transverse pullbacks are sufficient and are preserved by $T$. Arbitrary pullbacks need not exist.

Proposition 1 (Composition of control coalgebras). Under Assumption 2, there is a unique control coalgebra:

given by the pullback in $\operatorname{Ctrl}_{\mathcal{F}}(\mathcal{C})$:

with projections $p_i=(p_i^B,p_i^E)$ satisfying:

Remark 2. The universal property of the pullback is essential to understanding properties of the composed system. It is summarized by the following system-level diagrams:

Hence, for a system $Z$ with compatible maps to the subsystems $P_1$ and $P_2$, there is a unique induced map to $P$. This map will be essential in extending certificates (e.g., barrier morphisms) from subsystems to the composed closed-loop system.

Proof. The following diagram commutes.

So the maps $f_i\circ p_i^E:E\to\mathcal{F}B_i$, $i=1,2$, form a cone over $\mathcal{F}B_1\to\mathcal{F}B_0\leftarrow\mathcal{F}B_2$. Since $\mathcal{F}$ preserves the state pullback, universal property of pullback gives a unique $f:E\to\mathcal{F}B$ such that the following diagram commutes:

Setting $p:=\pi_B\circ f$ makes $(p,f)$ into a control coalgebra automatically. By standard arguments, it satisfies the universal property of the desired pullback in $\operatorname{Ctrl}_{\mathcal{F}}(\mathcal{C})$. $\square$

Example 3 (Continuous-time interconnection). Consider again continuous-time systems $\operatorname{cf}$. Example 1. Namely, for $\mathcal{F}=T$, let $P_i$ have $E_i=M_i\times U_i$ and dynamics in coordinates $\dot{x}_i=f_i(x_i,u_i)$. A stateless port mediator is

where $f_0(w)=!_W(w)\equiv*$. Any map $\theta_i:E_i\to W$ defines a morphism of control systems $\theta_i:=(!_{M_i},\theta_i):P_i\to M_W$. Consequently,

Cascade interconnection: Take $W=U_1$, wherein $p_0:U_1\to1$, $\theta_1(x_1,u_1)=u_1$, and $\theta_2(x_2,u_2)=y_2(x_2)$ for $M_2\to U_1$. Then $u_1=y_2(x_2)$, so $E\cong M_1\times M_2\times U_2$ and:

The remaining external input is $u_2$, resulting in the cascade interconnection:

Feedback interconnection: Let $W=U_1\times U_2$, $p_0(u_1,u_2)\equiv*$, and pick outputs $y_1:M_1\to U_2$, $y_2:M_2\to U_1$. With $\theta_1(x_1,u_1)=(u_1,y_1(x_1))$, $\theta_2(x_2,u_2)=(y_2(x_2),u_2)$, the pullback enforces $u_1=y_2(x_2)$ and $u_2=y_1(x_1)$. Hence $E\cong M_1\times M_2$ and the composition is autonomous:

This yields the familiar feedback interconnection diagram:

Comparison systems and compatible certificates

To compose guarantees for systems framed as certificates, e.g., control barrier morphisms, it is necessary to compose the target comparison systems for the layered system architecture: $P_1\to M\leftarrow P_2$. Choose autonomous targets $R_i=(R_i,\sigma_i)$, $i=0$ (for $M$) and $i=1,2$ (for $P_i$), and connecting maps $n_i=(n_i,n_i)$:

Assume $R=R_1\times_{R_0}R_2$ exists and is preserved by $\mathcal{F}$. Proposition 1 gives the autonomous pullback:

with projections $p_i^R=(p_i^R,p_i^R)$ where $p_i^R:R\to R_i$. Give each $\mathcal{F}R_i$, $i=1,2$, a preorder $\ge_i$ and equip $\mathcal{F}R$ with the projection-induced preorder:

for every pair $\xi,\eta:X\to\mathcal{F}R$. Precomposition preserves this preorder. The two component orders need not compare the same quantities or use the same direction of scalar inequality. For example, if we are considering a control barrier function $h:M_1\to R_1=\mathbb{R}$ and a control Lyapunov function $V:M_2\to R_2=\mathbb{R}_{\geq0}$, the corresponding preorders on $T\mathbb{R}$ and $T\mathbb{R}_{\geq0}$ would be $\ge_1=\ge$ and $\ge_2=\le$ (since Lyapunov and barrier functions have flipped orders). If the target mediator is terminal, $R_0=1$, this induces a mixed componentwise order on the composed target.

Main Result

We can now present the main result on the composition of certificates, i.e., control barrier morphisms. For this theorem, under Assumption 2, let

be the composed control system from Proposition 1 and the autonomous target system (19), respectively, where $R$ is posetal and $\mathcal{F}R$ has the projection-induced preorder (20).

Remark 3. This theorem can be visualized by the diagram:

where the $\chi_i$ are state maps that lax commute on the dynamics according to (22), and the remaining arrows strictly commute. Therefore, certificates (CBMs) from $P$ to each of the targets $R_i$ induce a unique certificate to the composed target. Additionally, if there are component CBMs $\bar{\chi}_i:B_i\to R_i$ associated with each of the subsystems $P_i$, Theorem 3 can be applied with $\chi_i=\bar{\chi}_i\circ p_i^B$ assuming the conditions of the theorem hold. The existence of sections of $\pi_{\chi_1}$ and $\pi_{\chi_2}$ does not imply the existence of a section of $\pi_A$.

Proof. The compatibility of $\chi_i$ in (22) gives a unique map $\chi:B\to R$ with $p_i^R\circ\chi=\chi_i$. For any $q:X\to E$, strictness of the target projections and the induced preorder give:

Here, the first equivalence follows from the induced preorder (20), the identities $p_i^R \circ\chi= \chi_i$, and strictness of the target projections $p_i^R$. The remaining equivalences follow from the universal properties of the admissible loci and their pullback. Therefore, $A$ satisfies the universal property of the admissible locus of $\chi$, and thus $A_\chi\cong A$ over $E$ and $\pi_\chi$ can be identified with $\pi_A$. Taking $q=a$ yields (23) and $\chi$ is a control barrier morphism. □

Corollary 1 (Safety by certificate composition). Suppose that there is a composed target system $Q=(R,\sigma)$, where $R$ is posetal with distinguished zero $0_R:1\to R$ and $\mathcal{F}_R$ *has the induced order (20), such that Assumption 1 is satisfied. Under Theorem 3, every section $u:B\to A$ renders

forward invariant for $f_{\mathrm{cl}}=f\circ a\circ u:B\to\mathcal{F}B$.

Note that if $R_+:=\operatorname{Eq}^{\leq}(0_R,\operatorname{id}_R)$ exists, the universal property of the lax equalizer and the pullback imply that:

Indeed, $q:X\to B$ satisfies $0_X\leq\chi\circ q$ exactly when $\chi\circ q$ factors through $R_+$. Thus the standard safe subobject is the inverse image of target positivity: $S_\chi=\chi^{-1}(R_+)$.

Remark 4 (General composition). Composition as the pullback extends to any number of systems. In this case, a graph $\Gamma$ describes the interconnection structure, with a system $P_v$ at each node $v$ and a mediator $M_e$ at each edge $e$, giving the cospan

and the composed system is the limit of the resulting diagram, provided this limit exists and $\mathcal{F}$ preserves the corresponding limit of state spaces (cf. [15] for tagged systems). For example, the classic three-layer control architecture, consisting of a planning layer, a trajectory generation layer, and a real-time control layer, composes into a single control coalgebra

We expect Theorem 3 to extend to this case: given CBMs $\chi_v:B\to R_v$ for $P$, one for each node, that are compatible over a diagram of target systems of the same shape, the universal property of the limit induces a CBM on the composed system, provided the joint admissible locus projects onto $B$ by a point-surjective epi.

Layered Safety for Reduced-Order Models

We return to the motivation given in Section II: layered safety architectures leveraging RoMs to guarantee safety on FoMs (see Figure 2 for an illustration of this architecture). The goal of this section is to apply the categorical results on composition to this specific case. We show that the result in (6) follows systematically as a result of the categorical framework. Throughout this section we work in $\mathsf{C}=\mathsf{Man}$.

We begin by noting that assumptions on the interface between the RoM and FoM can be understood categorically.

Assumption 3 (Projection compatibility). There are smooth maps $\Pi:X\to Z$ and $\Psi:X\to U_v$ such that, for every $(x,v)\in X\times U_v$, it follows that:

Equivalently, the following dynamics square commutes:

where $(\Pi,\Psi)(x,v)=(\Pi(x),\Psi(x))$.

Since the FoM is obtained from a tracking controller $u=K(x,v)$ applied to the full order dynamics: $f_F(x,v)=F(x)+G(x)K(x,v)$, sufficient conditions [13] for (27) to hold are: $D\Pi(x)G(x)=0$ and $D\Pi(x)F(x)=f_R(\Pi(x),\Psi(x))$.

The safety-filter mediator and the closed-loop pullback

We can mirror the conceptual safety architecture in Figure 2 with a precise categorical representation as a cospan:

Here, the mediator has copies of $U_v$ and $U_v$ to receive control interfaces from the RoM and FoM. It is these interfaces that encode the safety filter itself, $k_{\mathrm{safe}}$. Throughout this section, let $k_{\mathrm{safe}}$ be a smooth safety filter satisfying the constraint in (3), not necessarily its exact optimizer, which exist by [26].

The closed-loop system is obtained via the pullback.

Proposition 2 (Composition is the safety filtered FoM). Under Assumption 3, the cospan (28) has the pullback

where $f_{\mathrm{cl}}$ is given by (4).

Proof. The pullback imposes equality in the mediator:

This determines $z=\Pi(x)$, $v=\Psi(x)$, and $v=k_{\mathrm{safe}}(\Pi(x))$ uniquely. Hence the state space pullback and control bundle pullback are both $X$, with the identity bundle projection. The FoM projection determines the dynamics of the pullback as $f_F(x,k_{\mathrm{safe}}(\Pi(x)))$. Assumption 3 verifies the RoM projection, completing the pullback cone. □

As in Section II, and specifically (5), we consider a smooth non-negative tracking function $V:X\to\mathbb{R}_{\geq0}$ satisfying:

Let $b:=h\circ\Pi$. To recover the barrier dynamics in (5), by Assumption 3, the RoM CBF inequality, and Assumption 4:

where here $z=\Pi(x)$ and the last inequalities follow from completing the square and (30). The end result is two certificates on the closed loop: $b$, built from the RoM barrier $h$, satisfying $\dot{b}\geq-\alpha b-\gamma V$, and the tracking function $V$, satisfying $\dot{V}\leq-\lambda V$. These two certificates will form the basis for constructing the target systems, and will ultimately generate the induced certificate for $P_{\mathrm{cl}}$.

Comparison targets and their pullback

The barrier lower bound (31) and the tracking decay assumption (30) are encoded by the comparison systems $\mathbf{R}_h$ and $\mathbf{R}_V$ via the cospan:

At equal base points, the preorders on $\mathbf{R}_h$ and $\mathbf{R}_V$ are:

The first order tests the barrier lower bound, while the second order tests the tracking upper bound.

The goal is to find a composed comparison system $\mathbf{Q}\cong\mathbf{R}_h\times_{\mathbf{R}_0}\mathbf{R}_V$ such that the conditions of Corollary 1 are satisfied. Set $a:=\lambda-\alpha>0$. The composed comparison system $\mathbf{Q}$ is given in $(b,\ell)$-coordinates with corresponding projections $p_h^R$ and $p_V^R$ as given in the following pullback diagram (see Remark 5 for additional details on choosing $\mathbf{Q}$):

The fact that $\mathbf{Q}$ is the pullback of (32) follows from the observation that $L:\mathbb{R}^2_{(b,r)}\to\mathbb{R}^2_{(b,\ell)}$, given by $L(b,r)=(b,ab-\gamma r)$ is invertible and satisfies $TL\circ\sigma_h=\sigma\circ L$.

The dynamics preorder on $\mathbf{Q}$, i.e., the preorder on $T\mathbb{R}^2_{(b,\ell)}$, is the one induced by the projections in (34) per (20). In $(b,\ell)$-coordinates at a fixed base point this is given by:

Since $a>0$, this implies the ordinary componentwise preorder on $T\mathbb{R}^2_{(b,\ell)}$. Finally, the dynamics on $\mathbf{Q}$ imply that $\mathbb{R}^2_{\geq0}$ is forward invariant verifying Assumption 1.

Remark 5 (Finding the comparison system). It is important to note that the choice of $\mathbf{Q}$ was guided by the need to satisfy Assumption 1 for the induced preorder (20) as required by Corollary 1. For example, a naive (but valid) choice for the pullback is $\mathbf{R}_h=(\mathbb{R}^2_{(b,r)},\sigma_h)\cong\mathbf{R}_h\times_{\mathbf{R}_0}\mathbf{R}_V$. Yet the dynamics $\sigma_h$ for this system do not satisfy Assumption 1: at $b=0,r>0$, it follows that $\dot{b}=-\gamma r<0$. Now, to understand how we arrived at $\mathbf{Q}$, we can determine the largest forward invariant subset of $\{(b,r):b\geq0\}$:

Defining $L(b,r)=(b,ab-\gamma r)$ as above, it follows that $K=\{(b,r):L(b,r)\geq0\}$ and $L(K)=\mathbb{R}^2_{\geq0}$. Transporting the pullback through $L$ yields $\mathbf{Q}$ as defined above.

The induced certificate and full-order model safety

The goal is now to apply the main result, Theorem 3, to obtain a control barrier function for the closed-loop system $P_{\mathrm{cl}}$ representing the layered architecture. To this end, consider the barrier certificate $\chi_h:=(b,V):X\to\mathbb{R}^2_{(b,r)}$ and the tracking certificate $\chi_V:=V:X\to\mathbb{R}_s$. These are compatible since $\operatorname{pr}_r\circ\chi_h=\chi_V$. Moreover, (31) and (30) imply that:

for the chosen target systems (by design).

The target pullback $\mathbf{Q}$ induces a unique morphism:

Moreover, the conclusion that $T\chi\circ f_{\mathrm{cl}}\geq\sigma\circ\chi$ yields:

This allows us to establish with categorical means safety of $P_{\mathrm{cl}}$, and specifically the closed-loop FoM first considered in (4). Since $P_{\mathrm{cl}}$ is autonomous, $A_{\chi_h}\cong A_{\chi_V}\cong X$.

Conclusion

This paper presented a categorical framework in which to represent and analyze layered control architectures. To this end, we formulated “control systems” categorically via control coalgebras. While $C = \mathrm{Man}$ was considered in this paper for simplicity, the framework is general and can be applied to a wide range of system types. Composition can be understood categorically as the pullback over a mediator. The main result showed how the universal property of the pullback yields CBMs on the composed system given CBMs on each subsystem. We applied this result to a layered architecture representing safety filtering a FoM with a RoM, recapturing previous results as a specialization. Looking forward, the goal is to apply this categorical framework to more complex layered architectures with heterogeneous control systems.