This paper was converted on www.awesomepapers.org from LaTeX by an anonymous user.
Want to know more? Visit the Converter page.

Safe Perception-Based Control under Stochastic Sensor
Uncertainty using Conformal Prediction

Shuo Yang, George J. Pappas, Rahul Mangharam, and Lars Lindemann S. Yang, G. J. Pappas, and R. Mangharam are with the Department of Electrical and Systems Engineering, University of Pennsylvania, Philadelphia, PA 19104, USA. L. Lindemann is with the Department of Computer Science, University of Southern California, Los Angeles, CA 90089, USA. Email: {yangs1, pappasg, rahulm}@seas.upenn.edu, llindema@usc.edu
Abstract

We consider perception-based control using state estimates that are obtained from high-dimensional sensor measurements via learning-enabled perception maps. However, these perception maps are not perfect and result in state estimation errors that can lead to unsafe system behavior. Stochastic sensor noise can make matters worse and result in estimation errors that follow unknown distributions. We propose a perception-based control framework that i) quantifies estimation uncertainty of perception maps, and ii) integrates these uncertainty representations into the control design. To do so, we use conformal prediction to compute valid state estimation regions, which are sets that contain the unknown state with high probability. We then devise a sampled-data controller for continuous-time systems based on the notion of measurement robust control barrier functions. Our controller uses idea from self-triggered control and enables us to avoid using stochastic calculus. Our framework is agnostic to the choice of the perception map, independent of the noise distribution, and to the best of our knowledge the first to provide probabilistic safety guarantees in such a setting. We demonstrate the effectiveness of our proposed perception-based controller for a LiDAR-enabled F1/10th car.

1 Introduction

Perception-based control has received much attention lately [1, 2, 3, 4]. System states are usually not directly observable and can only be estimated from complex and noisy sensors, e.g., cameras or LiDAR. Learning-enabled perception maps can be utilized to estimate the system’s state from such high-dimensional measurements. However, these estimates are usually imperfect and may lead to estimation errors, which are detrimental to the system safety.

The above observation calls for perception-based control with safety guarantees as it is crucial for many autonomous and robotic systems like self-driving cars. Recent work has been devoted to addressing these safety concerns while applying perception-based control using perception maps, see, e.g.,  [5, 6, 7, 3, 8]. These work, however, either assume simple or no sensor noise models, consider specific perception maps, or lack end-to-end safety guarantees. In realistic settings, stochastic sensor noise may be unknown and follow skewed and complex distributions that do not resemble a Gaussian distribution, as is often assumed. Additionally, perception maps can be complex, e.g., deep neural networks, making it difficult to quantify estimation uncertainty.

In this paper, we study perception-based control under stochastic sensor noise that follows arbitrary and unknown distributions. To provide rigorous safety guarantees, we have to account for estimation uncertainty caused by i) imperfect learning-enabled perception maps, and ii) noisy sensor measurements. As shown in Figure 1, to perform safety-critical control, we first leverage conformal prediction [9], a statistical tool for uncertainty quantification, to obtain state estimation regions that are valid with high probability. We then integrate these uncertain state estimation regions into the control design inspired by the notion of measurement robust control barrier functions from [5]. Specifically, we design a sampled-data controller using idea from self-triggered control to ensure safety for continuous-time systems while avoiding the use of stochastic calculus.

To summarize, we make the following contributions:

  • We use conformal prediction to quantify state estimation uncertainty of complex learning-enabled perception maps under arbitrary sensor and noise models;

  • We use these uncertainty quantifications to design a sampled-data controller for continuous-time systems. We provide probabilistic safety guarantees which, to our knowledge, is the first work to do so in such a setting;

  • We demonstrate the effectiveness of our framework in the LiDAR-enabled F1/10th vehicle simulations.

Refer to caption
Figure 1: Overview of the system and robust safe controller. The stochastic sensor noise and imperfect perception module result in state estimation error. Conformal prediction is used to obtain the estimation error upper bound, which is then integrated into the sampled-data safe controller.

2 Related Work

Perception-based control: Control from high-dimensional sensor measurements such as cameras or LiDAR has lately gained attention. While empirical success has been reported, e.g., [1, 2, 10, 11], there is a need for designing safe-by-construction perception-enabled systems. Resilience of perception-enabled systems to sensor attacks has been studied in [12, 13], while control algorithms that provably generalize to novel environments are proposed in [14, 15]. In another direction, the authors in [16] plan trajectories that actively reduce estimation uncertainty.

Control barrier functions under estimation uncertainty: Control barrier functions (CBFs) have been widely used for autonomous systems since system safety can be guaranteed [17, 18, 19, 20, 21]. For example, an effective data-driven approach for synthesizing safety controllers for unknown dynamic systems using CBFs is proposed in [22]. Perception maps are first presented in combination with measurement-robust control barrier functions in [5, 8] when true system states are not available but only imprecise measurements. In these works, the perception error is quantified for the specific choice of the Nadarya-Watson regressor. Our approach is agnostic to the perception map and, importantly, allows to consider arbitrary stochastic sensor noise which poses challenges for continuous-time control. Measurement robust control barrier functions are learned in different variations in [23, 24, 6]. Perception maps are further used to design sampled-data controllers [25, 26, 27] without explicit uncertainty quantification of the sensor and perception maps.

The works in [28, 29] consider state observers, e.g., extended Kalman filters, for barrier function-based control of stochastic systems. On the technical level, our approach is different as we avoid dealing with Ito^\hat{o} calculus using sampled-data control. Similarly, bounded state observers were considered in [30, 31]. However, state observer-based approaches are generally difficult to use in perception-systems as models of high-dimensional sensors are difficult to obtain. The authors in [32] address this challenge by combining perception maps and state observers. However, the authors assume a bound on the sensor noise and do not explicitly consider the effect of stochastic noise distributions.

Uncertainty quantification of perception maps is vital. In similar spirit to our paper, [7, 33] use (self-)supervised learning for uncertainty quantification of vision-based systems. While success is empirically demonstrated, no formal guarantees are provided as we pursue in this paper.

Conformal prediction for control: Conformal prediction is a statistical method that provides probabilistic guarantees on prediction errors of machine learning models. It has been applied in computer vision [34, 35], protein design [36], and system verification [37, 38]. Recently, there are works that use conformal prediction for safe planning in dynamic environments, e.g., [39, 40]. However, conformal prediction is only used for quantifying the prediction and not perception uncertainty, as we do in this work. To our knowledge, our work is the first to integrate uncertainty quantification from conformal prediction into perception-based control.

3 Preliminaries and Problem Formulation

We denote by \mathbb{R}, \mathbb{N}, and n\mathbb{R}^{n} the set of real numbers, natural numbers, and real vectors, respectively. Let β\beta: \mathbb{R}\rightarrow\mathbb{R} denote an extended class 𝒦\mathcal{K}_{\infty} function, i.e., a strictly increasing function with β(0)=0\beta(0)=0. For a vector vnv\in\mathbb{R}^{n}, let v\|v\| denote its Euclidean norm.

3.1 System Model

We consider nonlinear control-affine systems of the form

x˙(t)\displaystyle\dot{x}(t) =f(x(t))+g(x(t))u(t)=:F(x(t),u(t))\displaystyle=f(x(t))+g(x(t))u(t)=:F(x(t),u(t)) (1)

where x(t)nx(t)\in\mathbb{R}^{n} and u(t)𝒰u(t)\in\mathcal{U} are the state and the control input at time tt, respectively, with 𝒰m\mathcal{U}\subseteq\mathbb{R}^{m} denoting the set of permissible control inputs. The functions f:nnf:\mathbb{R}^{n}\to\mathbb{R}^{n} and g:nn×mg:\mathbb{R}^{n}\to\mathbb{R}^{n\times m} describe the internal and input dynamics, respectively, and are assumed to be locally Lipschitz continuous. We assume that the dynamics in (1) are bounded, i.e., that there exists an upper bound F¯\bar{F} such that F(x,u)F¯\|F(x,u)\|\leq\bar{F} for every (x,u)n×𝒰(x,u)\in\mathbb{R}^{n}\times\mathcal{U}. For an initial condition x(0)nx(0)\in\mathbb{R}^{n} and a piecewise continuous control law u:0mu:\mathbb{R}_{\geq 0}\to\mathbb{R}^{m}, we denote the unique solution to the system in (1) as x:nx:\mathcal{I}\to\mathbb{R}^{n} where 0\mathcal{I}\subseteq\mathbb{R}_{\geq 0} is the maximum time interval on which the solution xx is defined.

In this paper, we assume that we do not have knowledge of x(t)x(t) during testing time, but that we observe potentially high-dimensional measurements y(t)ly(t)\in\mathbb{R}^{l} via an unknown locally Lipschitz continuous senor map p:n×dlp:\mathbb{R}^{n}\!\times\mathbb{R}^{d}\!\to\!\mathbb{R}^{l} as

y(t)\displaystyle y(t) =p(x(t),δ(x(t),t)),\displaystyle=p\big{(}x(t),\delta(x(t),t)\big{)}, (2)

where δ(x(t),t)\delta(x(t),t) is a disturbance modeled as a state-dependent random variable that is drawn from an unknown distribution 𝒟x\mathcal{D}_{x} over d\mathbb{R}^{d}, i.e., δ(x,t)𝒟x\delta(x,t)\sim\mathcal{D}_{x}.111To increase readability, we omit time indices when there is no risk of ambiguity, i.e., in this case we mean δ(x(t),t)𝒟x(t)\delta(x(t),t)\sim\mathcal{D}_{x(t)}. A special case that equation (2) covers is those imperfect and noisy sensors that can be modeled as y(t)=x(t)+δ(t)y(t)=x(t)+\delta(t), e.g., as considered in [4, 41]. The function p(x,δ(x,t))p(x,\delta(x,t)) can also encode a simulated image plus noise emulating a real camera. In general, the function pp can model high-dimensional sensors such as camera images or LiDAR point clouds. A common assumption in recent work that we adopt implicitly in this paper is that there exists a hypothetical inverse sensor map q:lnq:\mathbb{R}^{l}\to\mathbb{R}^{n} that can recover the state xx as q(p(x,0))=xq(p(x,0))=x when there is no disturbance [5, 42]. This inverse sensor map qq is, however, rarely known and hard to model. One can instead learn perception map q^:ln\hat{q}:\mathbb{R}^{l}\to\mathbb{R}^{n} that approximately recovers the state xx such that q(y,0)q^(y)\|q(y,0)-\hat{q}(y)\| is small and bounded, which can then be used for control design [5, 42, 32]. Note that learning an approximation of pp is much harder than learning the approximation q^\hat{q} of qq when lnl\gg n.

Remark 1.

The assumption on the existence of an inverse map qq is commonly made, as in [5, 42, 32], and realistic when the state xx consists of positions and orientations that can, for instance, be recovered from a single camera image. If the state xx additionally consists of other quantities such as velocities, one can instead assume that qq partially recovers the state as q(p(x,0))=Cxq(p(x,0))=Cx for a selector matrix CC while using a contracting Kalman filter to estimate the remaining states when the system is detectable [32]. For the sake of simplicity, we leave this consideration for future work.

Based on this motivation, we assume that we have obtained such a perception map q^:ln\hat{q}:\mathbb{R}^{l}\to\mathbb{R}^{n} that estimates our state x(t)x(t) at time tt from measurements y(t)y(t), and is denoted as

x^(t):=q^(y(t)).\displaystyle\hat{x}(t):=\hat{q}(y(t)).

Note that q^\hat{q} could be any state estimator, such as a convolutional neural network. In our case study, we used a multi-layer perceptron (MLP) as the estimator.

3.2 Safe Perception-Based Control Problem

We are interested in designing control inputs uu from measurements yy that guarantee safety with respect to a continuously differentiable constraint function h:nh:\mathbb{R}^{n}\to\mathbb{R}, i.e., so that h(x(t))0h(x(t))\geq 0 for all t>0t>0 if initially h(x(0))0h(x(0))\geq 0. Safety here can be framed as the controlled forward invariance of the system (1) with respect to the safe set 𝒞:={xn|h(x)0}\mathcal{C}:=\{x\in\mathbb{R}^{n}|h(x)\geq 0\} which is the superlevel set of the function hh. The difficulty in this paper is that we are not able to measure the state x(t)x(t) directly during runtime, and that we have only sensor measurements y(t)y(t) from the unknown and noisy sensor map pp available.

Problem 1.

Consider the system in (1) with initial state x(0)nx(0)\in\mathbb{R}^{n} and sensor model in (2). Let h:nh:\mathbb{R}^{n}\to\mathbb{R} be a continuously differentiable constraint function, 𝒯0\mathcal{T}\subset\mathbb{R}_{\geq 0} be a time interval, and α\alpha be a failure probability. Design a control input uu from sensor measurements yy such that Prob(x(t)𝒞,t𝒯)1α\text{Prob}(x(t)\in\mathcal{C},\forall t\in\mathcal{T})\geq 1-\alpha.

3.3 Uncertainty Quantification via Conformal Prediction

In our solution to Problem 1, we use conformal prediction which is a statistical tool introduced in [9, 43] to obtain valid uncertainty regions for complex prediction models without making assumptions on the underlying distribution or the prediction model [44, 45]. Let Z,Z(1),,Z(k)Z,Z^{(1)},\ldots,Z^{(k)} be k+1k+1 independent and identically distributed real-valued random variables, known as the nonconformity scores. Our goal is to obtain an uncertainty region for ZZ defined via a function Z¯:k\bar{Z}:\mathbb{R}^{k}\to\mathbb{R} so that ZZ is bounded by Z¯(Z(1),,Z(k))\bar{Z}(Z^{(1)},\ldots,Z^{(k)}) with high probability. Formally, given a failure probability α(0,1)\alpha\in(0,1), we want to construct an uncertainty region Z¯\bar{Z} such that Prob(ZZ¯)1α\text{Prob}(Z\leq\bar{Z})\geq 1-\alpha where we omitted the dependence of Z¯\bar{Z} on Z(1),,Z(k)Z^{(1)},\ldots,Z^{(k)} for convenience.

By a surprisingly simple quantile argument, see [46, Lemma 1], the uncertainty region Z¯\bar{Z} is obtained as the (1α)(1-\alpha)th quantile of the empirical distribution over the values of Z(1),,Z(k)Z^{(1)},\ldots,Z^{(k)} and \infty. We recall this result next.

Lemma 1 (Lemma 1 in [46]).

Let Z,Z(1),,Z(k)Z,Z^{(1)},\ldots,Z^{(k)} be k+1k+1 independent and identically distributed real-valued random variables. Without loss of generality, let Z(1),,Z(k)Z^{(1)},\ldots,Z^{(k)} be sorted in non-decreasing order and define Z(k+1):=Z^{(k+1)}:=\infty. For α(0,1)\alpha\in(0,1), it holds that Prob(ZZ¯)1α\text{Prob}(Z\leq\bar{Z})\geq 1-\alpha where

Z¯:=Z(r) with r:=(k+1)(1α)\displaystyle\bar{Z}:=Z^{(r)}\text{ with }r:=\lceil(k+1)(1-\alpha)\rceil

and where \lceil\cdot\rceil is the ceiling function.

Some clarifying comments are in order. First, we remark that Prob(ZZ¯)\text{Prob}(Z\leq\bar{Z}) is a marginal probability over the randomness in Z,Z(1),,Z(k)Z,Z^{(1)},\ldots,Z^{(k)} and not a conditional probability. Second, note that (k+1)(1α)>k\lceil(k+1)(1-\alpha)\rceil>k implies that Z¯=\bar{Z}=\infty.

4 Safe Perception-Based Control with Conformal Prediction

Addressing Problem 1 is challenging for two reasons. First, the perception map q^\hat{q} may not be exact, e.g., even in the disturbance-free case, it may not hold that q^(p(x,0))=x\hat{q}(p(x,0))=x. Second, even if we have accurate state estimates in the disturbance-free case, i.e., when q^(p(x,0))\hat{q}(p(x,0)) is close to xx, this does not imply that we have the same estimation accuracy with disturbances, i.e., q^(p(x,δ))\hat{q}(p(x,\delta)) may not necessarily be close to xx. Our setting is thus distinctively different from existing approaches and requires uncertainty quantification of the noisy error between x^(t)\hat{x}(t) and x(t)x(t).

4.1 Conformal Prediction for Perception Maps

Let us now denote the stochastic state estimation error as

e(x,t):=x^x=q^(p(x,δ(x,t))=y)x.\displaystyle e(x,t):=\|\hat{x}-x\|=\|\hat{q}\big{(}\underbrace{p(x,\delta(x,t))}_{=y}\big{)}-x\|.

For a fixed state xnx\in\mathbb{R}^{n}, our first goal is to construct a prediction region E¯x\bar{E}_{x} so that

Prob(e(x,t)E¯x)1α\displaystyle\text{Prob}\big{(}e(x,t)\leq\bar{E}_{x}\big{)}\geq 1-\alpha (3)

holds uniformly over t0t\in\mathbb{R}_{\geq 0}. Note that the distribution 𝒟x\mathcal{D}_{x} of δ\delta is independent of time tt so that we will get uniformity automatically. While we do not know the sensor map pp, we assume here that we have an oracle that gives us N(N+1)(1α)N\geq\lceil(N+1)(1-\alpha)\rceil state-measurement data pairs (x,y(i))(x,y^{(i)}) called calibration dataset, where i{1,,N}i\in\{1,\ldots,N\} and y(i)=p(x,δ(i))y^{(i)}=p(x,\delta^{(i)}) with δ(i)𝒟x\delta^{(i)}\sim\mathcal{D}_{x}. This is a common assumption, see, e.g., [32, 5], and such an oracle can, for instance, be a simulator that we can query data from. By defining the nonconformity score Z(i):=q^(y(i))xZ^{(i)}:=\|\hat{q}(y^{(i)})-x\|, and assuming that Z(i)Z^{(i)} are sorted in non-decreasing order, we can now obtain the guarantees in equation (3) by applying Lemma 1. In other words, we obtain E¯x:=Z(r)\bar{E}_{x}:=Z^{(r)} with rr from Lemma 1 so that Prob(x^{ζn|xζE¯x})1α\text{Prob}\big{(}\hat{x}\in\{\zeta\in\mathbb{R}^{n}|\|x-\zeta\|\leq\bar{E}_{x}\}\big{)}\geq 1-\alpha holds. Note that this gives us information about the estimate x^\hat{x}, but not about the state xx which was, in fact, fixed a-priori. To revert this argument and obtain a prediction region for xx from x^\hat{x}, we have to ensure that equation (3) holds for a set of states instead of only a single state xx, which will be presented next. To do so, we use a covering argument next.

Consider now a compact subset of the workspace 𝒳n\mathcal{X}\subseteq\mathbb{R}^{n} that should include the safe set 𝒞\mathcal{C}. Let ϵ>0\epsilon>0 be a gridding parameter and construct an ϵ\epsilon-net 𝒳¯\bar{\mathcal{X}} of 𝒳\mathcal{X}, i.e., construct a finite set 𝒳¯\bar{\mathcal{X}} so that for each x𝒳x\in\mathcal{X} there exists an xj𝒳¯x_{j}\in\bar{\mathcal{X}} such that xxjϵ\|x-x_{j}\|\leq\epsilon. For this purpose, simple gridding strategies can be used as long as the set 𝒳\mathcal{X} has a convenient representation. Alternatively, randomized algorithms can be used that sample from 𝒳\mathcal{X} [47]. We can now again apply a conformal prediction argument for each grid point xj𝒳¯x_{j}\in\bar{\mathcal{X}} and then show the following proposition.

Proposition 1.

Consider the Lipschitz continuous sensor map pp in (2) and a perception map q^\hat{q} with respective Lipschitz constants p\mathcal{L}_{p} and q^\mathcal{L}_{\hat{q}}.222We assume that the Lipschitz constant of the sensor map pp is uniform over the parameter δ\delta, i.e., that δ\delta does not affect the value of p\mathcal{L}_{p}. Assume that we constructed an ϵ\epsilon-net 𝒳¯\bar{\mathcal{X}} of 𝒳\mathcal{X}. For each xj𝒳¯x_{j}\in\bar{\mathcal{X}}, let (xj,yj(i))(x_{j},y_{j}^{(i)}) be N(N+1)(1α)N\geq\lceil(N+1)(1-\alpha)\rceil data pairs where yj(i):=p(xj,δ(i))y_{j}^{(i)}:=p(x_{j},\delta^{(i)}) with δ(i)𝒟xj\delta^{(i)}\sim\mathcal{D}_{x_{j}}. Define Zj(i):=q^(yj(i))xjZ_{j}^{(i)}:=\|\hat{q}(y_{j}^{(i)})-x_{j}\|, and assume that Zj(i)Z_{j}^{(i)} are sorted in non-decreasing order, and let E¯xj:=Zj(r)\bar{E}_{x_{j}}:=Z^{(r)}_{j} with rr from Lemma 1. Then, for any x𝒳x\in\mathcal{X}, it holds that

Prob(e(x,t)supjE¯xj+(pq^+1)ϵ)1α,\displaystyle\text{Prob}\Big{(}e(x,t)\leq\sup_{j}\bar{E}_{x_{j}}+(\mathcal{L}_{p}\mathcal{L}_{\hat{q}}+1)\epsilon\Big{)}\geq 1-\alpha, (4)
Proof.

See Appendix. ∎

The above result says that the state estimation error e(x,t)e(x,t) can essentially be bounded, with probability 1α1-\alpha, by the worst case of conformal prediction region E¯xj\bar{E}_{x_{j}} within the grid 𝒳¯\bar{\mathcal{X}} and by the gridding parameter ϵ\epsilon. Under the assumption that our system operates in the workspace 𝒳\mathcal{X} and based on inequality (4), we can hence conclude that

Prob(x{ζn|ζx^supjE¯xj+(pq^+1)ϵ})1α.\displaystyle\text{Prob}\Big{(}\!x\in\!\{\zeta\!\in\!\mathbb{R}^{n}|\|\zeta\!-\!\hat{x}\|\!\leq\!\sup_{j}\bar{E}_{x_{j}}\!\!+\!(\mathcal{L}_{p}\mathcal{L}_{\hat{q}}\!+\!1)\epsilon\}\!\Big{)}\geq\!1-\alpha.
Remark 2.

We note that the Lipschitz constants of the sensor and perception maps are used in the upper bound in (4) (as commonly done in the literature [5, 25, 32]), which may lead to a conservative bound. One practical way to mitigate this conservatism is to decrease the gridding parameter ϵ\epsilon, i.e., to increase the sampling density in the workspace 𝒳\mathcal{X}.

4.2 Sampled-Data Controller using Conformal Estimation Regions

After bounding the state estimation error in Proposition 1, we now design a uncertainty-aware controller based on equation (4). However, a technical challenge in doing so is that the measurements are stochastic. By designing a sampled-data controller, we can avoid difficulties dealing with stochastic calculus. To do so, we first present a slightly modified version of measurement robust control barrier function (MR-CBF) introduced in [5].

Definition 1.

Let 𝒞n\mathcal{C}\subseteq\mathbb{R}^{n} be the zero-superlevel set of a continuously differentiable function h:nh:\mathbb{R}^{n}\rightarrow\mathbb{R}. The function hh is a measurement robust control barrier function (MR-CBF) for the system in (1) with parameter function pair (a,b):l02(a,b):\mathbb{R}^{l}\rightarrow\mathbb{R}^{2}_{\geq 0} if there exists an extended class KK_{\infty} function β\beta such that

supu𝒰[Lfh(x^)+Lgh(x^)u(a(y)+b(y)u)]β(h(x^))\displaystyle\sup_{u\in\mathcal{U}}[L_{f}h(\hat{x})+L_{g}h(\hat{x})u-(a(y)+b(y)\|u\|)]\geq-\beta(h(\hat{x})) (5)

for all (y,x^)V(𝒞)(y,\hat{x})\in V(\mathcal{C}), where V(𝒞):={(y,x^)l×n|(x,δ)𝒞×𝒟x s.t. x^=q^(p(x,δ))}V(\mathcal{C}):=\{(y,\hat{x})\in\mathbb{R}^{l}\times\mathbb{R}^{n}|\exists(x,\delta)\in\mathcal{C}\times\mathcal{D}_{x}\text{ s.t. }\hat{x}=\hat{q}(p(x,\delta))\}, and Lfh(x^)L_{f}h(\hat{x}) and Lgh(x^)L_{g}h(\hat{x}) denote the Lie derivatives.

Compared to regular CBFs [17], a MR-CBF introduces a non-positive robustness term (a(y)+b(y)u)-(a(y)+b(y)\|u\|) which makes the constraint in (5) more strict. Now, given a MR-CBF h(x)h(x), the set of MR-CBF consistent control inputs is

KCBF(y):={u𝒰|Lfh(x^)+Lgh(x^)u\displaystyle K_{CBF}(y):=\{u\in\mathcal{U}|L_{f}h(\hat{x})+L_{g}h(\hat{x})u
(a(y)+b(y)u)+β(h(x^))0}.\displaystyle\quad\quad\quad\quad\quad\quad-(a(y)+b(y)\|u\|)+\beta(h(\hat{x}))\geq 0\}. (6)

Note that we can not simply follow [5, Theorem 2] to obtain a safe control law as u(t)KCBF(y(t))u(t)\in K_{CBF}(y(t)) since y(t)y(t) and consequent u(t)u(t) are stochastic. We hence propose a sampled-data control law that keeps the trajectory x(t)x(t) within the set 𝒞\mathcal{C} with high probability. The sampled-data control law u^\hat{u} is piecewise continuous and defined as

u^(t):=u(ti),t[ti,ti+1),\displaystyle\hat{u}(t):=u(t_{i}),\;\forall t\in[t_{i},t_{i+1}), (7)

where u(ti)u(t_{i}) at triggering time tit_{i} is computed by solving the following quadratic optimization problem

u(ti)\displaystyle u(t_{i}) =argminuKCBF(y)uunom(ti))2,\displaystyle=\underset{u\in K_{CBF}(y)}{\text{argmin}}\quad\lVert u-u_{nom}(t_{i}))\rVert^{2}, (8)

where unom(ti)u_{nom}(t_{i}) is any nominal control law that may not necessarily be safe. Then, we select the triggering instances tit_{i} as follows:

t0\displaystyle t_{0} :=0,\displaystyle:=0,
ti+1\displaystyle t_{i+1} :=(ΔsupjE¯xj(pq^+1)ϵ)/F¯+ti,\displaystyle:=(\Delta-\sup_{j}\bar{E}_{x_{j}}-(\mathcal{L}_{p}\mathcal{L}_{\hat{q}}+1)\epsilon)/\bar{F}+t_{i}, (9)

where Δ\Delta is a user-defined parameter that will define the parameter pair (a,b)(a,b) of the MR-CBF and that has to be Δ>supjE¯xj+(pq^+1)ϵ\Delta>\sup_{j}\bar{E}_{x_{j}}+(\mathcal{L}_{p}\mathcal{L}_{\hat{q}}+1)\epsilon. Naturally, larger Δ\Delta lead to less frequent control updates, but will require more robustness and reduce the set of permissible control inputs in KCBF(y)K_{CBF}(y). Based on the computation of triggering times in (4.2), the following lemma holds.

Lemma 2.

Consider the sampled-data control law u^(t)\hat{u}(t) in (7) with the triggering rules (4.2), it holds that

Prob(x(t)x^(ti)Δ,t[ti,ti+1))1α.\displaystyle\text{Prob}\Big{(}\|x(t)-\hat{x}(t_{i})\|\leq\Delta,\forall t\in[t_{i},t_{i+1})\Big{)}\geq 1-\alpha. (10)
Proof.

See Appendix. ∎

Intuitively, the above lemma says that x(t)x^(ti)Δ\|x(t)-\hat{x}(t_{i})\|\leq\Delta holds with high probability in between triggering times if the sampled-data control law u^(t)\hat{u}(t) in (7) with the triggering rules (4.2) is executed. Then, we can obtain the following probabilistic safety guarantees.

Theorem 1.

Consider a MR-CBF hh with parameter pair (a(y),b(y))=((Lfh+βh)Δ,LghΔ)(a(y),b(y))=((\mathcal{L}_{L_{f}h}+\mathcal{L}_{\beta\circ h})\Delta,\mathcal{L}_{L_{g}h}\Delta) where Lfh,βh,\mathcal{L}_{L_{f}h},\mathcal{L}_{\beta\circ h}, and Lgh\mathcal{L}_{L_{g}h} are the Lipschitz constants of the functions Lfh,βhL_{f}h,\beta\circ h and LghL_{g}h, respectively. Then, for any nominal control law unomu_{nom}, the sampled-data law u^(t)\hat{u}(t) in (7) with the triggering rule in (4.2) will render the set 𝒞\mathcal{C} forward invariant with a probability of at least 1α1-\alpha. In other words, we have that

Prob(x(t)𝒞,t[ti,ti+1))1α.\displaystyle\text{Prob}\Big{(}x(t)\in\mathcal{C},\forall t\in[t_{i},t_{i+1})\Big{)}\geq 1-\alpha. (11)
Proof.

See Appendix. ∎

The above theorem solves Problem 1 for the time interval 𝒯=[ti,ti+1)\mathcal{T}=[t_{i},t_{i+1}). If we want to consider a larger time interval 𝒯=[0,T)\mathcal{T}=[0,T) under the sampled-data control law, we have the following guarantees.

Proposition 2.

Under the same condition as in Theorem 1, for a time interval 𝒯=[0,T)\mathcal{T}=[0,T), we have that:

Prob(x(t)𝒞,t[0,T))(1α)m,\displaystyle\text{Prob}\Big{(}x(t)\in\mathcal{C},\forall t\in[0,T)\Big{)}\geq(1-\alpha)^{m}, (12)

where m>0m\in\mathbb{N}_{>0} such that tm1T<tmt_{m-1}\leq T<t_{m}.

Proof.

See Appendix. ∎

Note that if we want to achieve any probability guarantee p(0,1)p\in(0,1), we can just let (1α)m=p(1-\alpha)^{m}=p and obtain α=1p1/m\alpha=1-p^{1/m}.

5 Simulation Results

To demonstrate our proposed safe perception-based control law, we consider navigating an F1/10th autonomous vehicle in a structured environment [48], which is shown in Figure 2. The vehicle system has the state x=[px,py,θ]x=[p_{x},p_{y},\theta], where [px,py][p_{x},p_{y}] denotes its position and θ\theta denotes its orientation. We have [p˙x,p˙y]=[ux,uy][\dot{p}_{x},\dot{p}_{y}]=[u_{x},u_{y}], where uxu_{x} and uyu_{y} are control inputs denoting velocities, and θ=arctan(uy/ux)\theta=\arctan(u_{y}/u_{x}). The control input constraint is (ux,uy)[1,1]×[1,1](u_{x},u_{y})\in[-1,1]\times[-1,1]. Thus, the assumption that there exists an upper bound F¯\bar{F} for dynamics holds for this system.

Observation model: The vehicle is equipped with a 2D LiDAR scanner from which it obtains LiDAR measurements as its observations. Specifically, the measurement include 64 LiDAR rays uniformly ranging from 3π4-\frac{3\pi}{4} to 3π4\frac{3\pi}{4} relative to the vehicle’s heading direction. To model the uncertainty of measurements, unknown noise conforming to exponential distribution is added to each ray:

ynk=yk+δ,δexp(λ),\displaystyle y^{k}_{n}=y^{k}+\delta,\quad\delta\sim exp(\lambda),

where yky^{k} is the ground truth for ray kk, ynky^{k}_{n} is the corrupted observed ray kk, and λ\lambda is the parameter of exponential distribution, where the noise δ\delta is drawn from. In our experiments, we let λ:=2/3\lambda:=2/3.

Refer to caption
Figure 2: The F1/10 vehicle is equipped with a 2D LiDAR sensor that outputs an array of 64 laser scans. The vehicle starts at a random position on the starting line.

Perception map: We trained a feedforward neural network to estimate the state of the vehicle. The input is the 64-dimensional LiDAR measurement and output is the vehicle’s state. The training dataset DtrainD_{train} contains 4×1054\times 10^{5} data points, and the calibration dataset DcalD_{cal} for conformal prediction contains 1.25×1041.25\times 10^{4} data points. For illustration, under a fixed heading θ\theta and longitudinal position pyp_{y}, the errors e(x)e(x) of the learned perception map with respect to sensor noise δ\delta and horizontal position pxp_{x} is shown in Figure 3.

Refer to caption
Figure 3: The empirical model errors e(x)e(x) w.r.t. pxp_{x} and δ\delta measured on a validation set. pyp_{y} and θ\theta are fixed.

Barrier functions: To prevent collision with the walls, when the vehicle is traversing the long hallway, the CBF is chosen as h(x)=min{h1(x),h2(x)}h(x)=\min\{h_{1}(x),h_{2}(x)\}, where h1(x)=pxh_{1}(x)=p_{x} and h2(x)=1.5pxh_{2}(x)=1.5-p_{x}. Then we have the safe set 𝒞={x3|h(x)0}\mathcal{C}=\{x\in\mathbb{R}^{3}|h(x)\geq 0\}. CBFs can be similarly defined when the vehicle is operating in the corner. To demonstrate the effectiveness of our method, we compare the following two cases in simulations:

  1. 1.

    Measurement robust CBF: as shown in Theorem 1, we choose the parameters pair (a(y),b(y))=((Lfh+βh)Δ,LghΔ)(a(y),b(y))=((\mathcal{L}_{L_{f}h}+\mathcal{L}_{\beta\circ h})\Delta,\mathcal{L}_{L_{g}h}\Delta) to ensure robust safety.

  2. 2.

    Vanilla CBF: we choose the parameters pair (a(y),b(y))=(0,0)(a(y),b(y))=(0,0), which essentially reduces to the vanilla non-robust CBF [17]. However, the perceived state is from perceptual estimation rather than real state, so this CBF cannot provide any safety guarantee.

Note that we obtain necessary Lipschitz constants using sampling-based estimation method in simulations.

Uncertainty and results: The vehicle is expected to track along the hallway and make a successful turn in the corner as shown in Figure 2. The nominal controller is a PID controller. We set the coverage error α=0.25\alpha=0.25, so we desire P(xtx^tϵ)1α=75%P(\|x_{t}-\hat{x}_{t}\|\leq\epsilon^{\prime})\geq 1-\alpha=75\%. Based on calibration of conformal prediction and Proposition 1, we calculate that ϵ=0.34\epsilon^{\prime}=0.34, and we choose Δ=0.35>ϵ\Delta=0.35>\epsilon^{\prime}. The nonconformity score histogram is presented in Figure 4, in which the 75%75\% quantile value is Rx0.75=0.32<ϵR_{x}^{0.75}=0.32<\epsilon^{\prime}, so our Proposition 1 holds in practice. As presented in Figure 5(b), the safety rate of sampled-data measurement robust CBF is 93%93\%, which is significantly higher than vanilla non-robust CBF case (16%16\%).

Refer to caption
Figure 4: Nonconformity scores RxR_{x} histogram during runtime. We select the coverage rate as 75%75\%.
Refer to caption
(a) Measurement robust CBF
Refer to caption
(b) Vanilla CBF
Figure 5: Traces for the sampled-data measurement robust CBF and vanilla CBF (5 traces are presented). All traces are tested with horizon T=30sT=30s. We run 100 traces totally, and the safety rates are 93% and 16%, respectively.

.

6 Conclusion

In this paper, we consider the safe perception-based control problem under stochastic sensor noise. We use conformal prediction to quantify the state estimation uncertainty, and then integrate this uncertainty into the design of sampled-data safe controller. We obtain probabilistic safety guarantees for continuous-time systems. Note that, in this work, the perception map only depends on current observation, which might limit its accuracy in some cases. We plan to incorporate history observations into perception maps in the future. Also, we are interested in providing a more sample-efficient scheme while constructing calibration dataset.

References

  • [1] S. Tang, V. Wüest, and V. Kumar, “Aggressive flight with suspended payloads using vision-based control,” IEEE Robotics and Automation Letters, vol. 3, no. 2, pp. 1152–1159, 2018.
  • [2] Y. Lin, F. Gao, T. Qin, W. Gao, T. Liu, W. Wu, Z. Yang, and S. Shen, “Autonomous aerial navigation using monocular visual-inertial fusion,” Journal of Field Robotics, vol. 35, no. 1, pp. 23–51, 2018.
  • [3] H. Zhou and V. Tzoumas, “Safe perception-based control with minimal worst-case dynamic regret,” arXiv preprint arXiv:2208.08929, 2022.
  • [4] Y. Kantaros, S. Kalluraya, Q. Jin, and G. J. Pappas, “Perception-based temporal logic planning in uncertain semantic maps,” IEEE Transactions on Robotics, 2022.
  • [5] S. Dean, A. J. Taylor, R. K. Cosner, B. Recht, and A. D. Ames, “Guaranteeing safety of learned perception modules via measurement-robust control barrier functions,” arXiv preprint arXiv:2010.16001, 2020.
  • [6] D. Sun, N. Musavi, G. Dullerud, S. Shakkottai, and S. Mitra, “Learning certifiably robust controllers using fragile perception,” arXiv preprint arXiv:2209.11328, 2022.
  • [7] R. K. Cosner, I. D. J. Rodriguez, T. G. Molnar, W. Ubellacker, Y. Yue, A. D. Ames, and K. L. Bouman, “Self-supervised online learning for safety-critical control using stereo vision,” in 2022 International Conference on Robotics and Automation (ICRA).   IEEE, 2022, pp. 11 487–11 493.
  • [8] R. K. Cosner, A. W. Singletary, A. J. Taylor, T. G. Molnar, K. L. Bouman, and A. D. Ames, “Measurement-robust control barrier functions: Certainty in safety with uncertainty in state,” in 2021 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS).   IEEE, 2021, pp. 6286–6291.
  • [9] V. Vovk, A. Gammerman, and G. Shafer, Algorithmic learning in a random world.   Springer Science & Business Media, 2005.
  • [10] M. Abu-Khalaf, S. Karaman, and D. Rus, “Feedback from pixels: Output regulation via learning-based scene view synthesis,” in Learning for Dynamics and Control.   PMLR, 2021, pp. 828–841.
  • [11] X. Sun, M. Zhou, Z. Zhuang, S. Yang, J. Betz, and R. Mangharam, “A benchmark comparison of imitation learning-based control policies for autonomous racing,” in 2023 IEEE Intelligent Vehicles Symposium (IV).   IEEE, 2023, pp. 1–5.
  • [12] A. Khazraei, H. Pfister, and M. Pajic, “Attacks on perception-based control systems: Modeling and fundamental limits,” arXiv preprint arXiv:2206.07150, 2022.
  • [13] ——, “Resiliency of perception-based controllers against attacks,” in Learning for Dynamics and Control Conference.   PMLR, 2022, pp. 713–725.
  • [14] S. Veer and A. Majumdar, “Probably approximately correct vision-based planning using motion primitives,” in Conference on Robot Learning.   PMLR, 2021, pp. 1001–1014.
  • [15] A. Majumdar, A. Farid, and A. Sonar, “Pac-bayes control: learning policies that provably generalize to novel environments,” The International Journal of Robotics Research, vol. 40, no. 2-3, pp. 574–593, 2021.
  • [16] M. Ostertag, N. Atanasov, and T. Rosing, “Trajectory planning and optimization for minimizing uncertainty in persistent monitoring applications,” Journal of Intelligent & Robotic Systems, vol. 106, no. 1, p. 2, 2022.
  • [17] A. D. Ames, X. Xu, J. W. Grizzle, and P. Tabuada, “Control barrier function based quadratic programs for safety critical systems,” IEEE Transactions on Automatic Control, vol. 62, no. 8, pp. 3861–3876, 2016.
  • [18] S. Yang, S. Chen, V. M. Preciado, and R. Mangharam, “Differentiable safe controller design through control barrier functions,” IEEE Control Systems Letters, vol. 7, pp. 1207–1212, 2022.
  • [19] W. Xiao, T.-H. Wang, R. Hasani, M. Chahine, A. Amini, X. Li, and D. Rus, “Barriernet: Differentiable control barrier functions for learning of safe robot control,” IEEE Transactions on Robotics, 2023.
  • [20] L. Lindemann and D. V. Dimarogonas, “Control barrier functions for signal temporal logic tasks,” IEEE control systems letters, vol. 3, no. 1, pp. 96–101, 2018.
  • [21] J. Wang, S. Yang, Z. An, S. Han, Z. Zhang, R. Mangharam, M. Ma, and F. Miao, “Multi-agent reinforcement learning guided by signal temporal logic specifications,” arXiv preprint arXiv:2306.06808, 2023.
  • [22] Y. Chen, C. Shang, X. Huang, and X. Yin, “Data-driven safe controller synthesis for deterministic systems: A posteriori method with validation tests,” in 2023 IEEE 62nd Conference on Decision and Control (CDC), 2023.
  • [23] L. Lindemann, A. Robey, L. Jiang, S. Tu, and N. Matni, “Learning robust output control barrier functions from safe expert demonstrations,” arXiv preprint arXiv:2111.09971, 2021.
  • [24] C. Dawson, B. Lowenkamp, D. Goff, and C. Fan, “Learning safe, generalizable perception-based hybrid control with certificates,” IEEE Robotics and Automation Letters, vol. 7, no. 2, pp. 1904–1911, 2022.
  • [25] L. Cothren, G. Bianchin, and E. Dall’Anese, “Online optimization of dynamical systems with deep learning perception,” IEEE Open Journal of Control Systems, vol. 1, pp. 306–321, 2022.
  • [26] L. Cothren, G. Bianchin, S. Dean, and E. Dall’Anese, “Perception-based sampled-data optimization of dynamical systems,” arXiv preprint arXiv:2211.10020, 2022.
  • [27] D. R. Agrawal and D. Panagou, “Safe and robust observer-controller synthesis using control barrier functions,” IEEE Control Systems Letters, vol. 7, pp. 127–132, 2022.
  • [28] A. Clark, “Control barrier functions for complete and incomplete information stochastic systems,” in 2019 American Control Conference (ACC).   IEEE, 2019, pp. 2928–2935.
  • [29] ——, “Control barrier functions for stochastic systems,” Automatica, vol. 130, p. 109688, 2021.
  • [30] Y. Wang and X. Xu, “Observer-based control barrier functions for safety critical systems,” in 2022 American Control Conference (ACC).   IEEE, 2022, pp. 709–714.
  • [31] Y. Zhang, S. Walters, and X. Xu, “Control barrier function meets interval analysis: Safety-critical control with measurement and actuation uncertainties,” in 2022 American Control Conference (ACC).   IEEE, 2022, pp. 3814–3819.
  • [32] G. Chou, N. Ozay, and D. Berenson, “Safe output feedback motion planning from images via learned perception modules and contraction theory,” in Algorithmic Foundations of Robotics XV: Proceedings of the Fifteenth Workshop on the Algorithmic Foundations of Robotics.   Springer, 2022, pp. 349–367.
  • [33] R. Römer, A. Lederer, S. Tesfazgi, and S. Hirche, “Uncertainty-aware visual perception for safe motion planning,” arXiv preprint arXiv:2209.06936, 2022.
  • [34] A. Angelopoulos, S. Bates, J. Malik, and M. I. Jordan, “Uncertainty sets for image classifiers using conformal prediction,” arXiv preprint arXiv:2009.14193, 2020.
  • [35] A. N. Angelopoulos, A. P. Kohli, S. Bates, M. Jordan, J. Malik, T. Alshaabi, S. Upadhyayula, and Y. Romano, “Image-to-image regression with distribution-free uncertainty quantification and applications in imaging,” in International Conference on Machine Learning.   PMLR, 2022, pp. 717–730.
  • [36] C. Fannjiang, S. Bates, A. Angelopoulos, J. Listgarten, and M. I. Jordan, “Conformal prediction for the design problem,” arXiv preprint arXiv:2202.03613, 2022.
  • [37] L. Bortolussi, F. Cairoli, N. Paoletti, and S. D. Stoller, “Conformal predictions for hybrid system state classification,” in From Reactive Systems to Cyber-Physical Systems.   Springer, 2019, pp. 225–241.
  • [38] F. Cairoli, L. Bortolussi, and N. Paoletti, “Neural predictive monitoring under partial observability,” in Runtime Verification: 21st International Conference, RV 2021, Virtual Event, October 11–14, 2021, Proceedings 21.   Springer, 2021, pp. 121–141.
  • [39] L. Lindemann, M. Cleaveland, G. Shim, and G. J. Pappas, “Safe planning in dynamic environments using conformal prediction,” arXiv preprint arXiv:2210.10254, 2022.
  • [40] A. Dixit, L. Lindemann, S. Wei, M. Cleaveland, G. J. Pappas, and J. W. Burdick, “Adaptive conformal prediction for motion planning among dynamic agents,” arXiv preprint arXiv:2212.00278, 2022.
  • [41] V. M. H. Bennetts, A. J. Lilienthal, A. A. Khaliq, V. P. Sese, and M. Trincavelli, “Towards real-world gas distribution mapping and leak localization using a mobile robot with 3d and remote gas sensing capabilities,” in 2013 IEEE International Conference on Robotics and Automation.   IEEE, 2013, pp. 2335–2340.
  • [42] S. Dean, N. Matni, B. Recht, and V. Ye, “Robust guarantees for perception-based control,” in Learning for Dynamics and Control.   PMLR, 2020, pp. 350–360.
  • [43] G. Shafer and V. Vovk, “A tutorial on conformal prediction.” Journal of Machine Learning Research, vol. 9, no. 3, 2008.
  • [44] A. N. Angelopoulos and S. Bates, “A gentle introduction to conformal prediction and distribution-free uncertainty quantification,” arXiv preprint arXiv:2107.07511, 2021.
  • [45] J. Lei, M. G’Sell, A. Rinaldo, R. J. Tibshirani, and L. Wasserman, “Distribution-free predictive inference for regression,” Journal of the American Statistical Association, vol. 113, no. 523, pp. 1094–1111, 2018.
  • [46] R. J. Tibshirani, R. Foygel Barber, E. Candes, and A. Ramdas, “Conformal prediction under covariate shift,” Advances in neural information processing systems, vol. 32, 2019.
  • [47] R. Vershynin, High-dimensional probability: An introduction with applications in data science.   Cambridge university press, 2018, vol. 47.
  • [48] R. Ivanov, T. J. Carpenter, J. Weimer, R. Alur, G. J. Pappas, and I. Lee, “Case study: verifying the safety of an autonomous racing car with a neural network controller,” in Proceedings of the 23rd International Conference on Hybrid Systems: Computation and Control, 2020, pp. 1–7.

7 Appendix

Proof of Proposition 1: First, note that

p(x,δ)p(x,δ)pxx,\displaystyle\|p(x,\delta)-p(x^{\prime},\delta)\|\leq\mathcal{L}_{p}\|x-x^{\prime}\|,
q^(p(x,δ)p(x,δ))q^(p(x,δ)p(x,δ).\displaystyle\|\hat{q}(p(x,\delta)-p(x^{\prime},\delta))\|\leq\mathcal{L}_{\hat{q}}\cdot\|(p(x,\delta)-p(x^{\prime},\delta)\|.

due to Lipschitz continuity of pp and q^\hat{q}. Since, for any x𝒳x\in\mathcal{X}, there exists a xi𝒳¯x_{i}\in\bar{\mathcal{X}} such that xxiϵ\|x-x_{i}\|\leq\epsilon, we know that

x^x^i\displaystyle\|\hat{x}-\hat{x}_{i}\| =q^(p(x,δ))q^(p(xi,δ))q^p(x,δ),p(xi,δ)\displaystyle=\|\hat{q}(p(x,\delta))-\hat{q}(p(x_{i},\delta))\|\leq\mathcal{L}_{\hat{q}}\|p(x,\delta),p(x_{i},\delta)\|
q^pxxiq^pϵ.\displaystyle\leq\mathcal{L}_{\hat{q}}\mathcal{L}_{p}\|x-x_{i}\|\leq\mathcal{L}_{\hat{q}}\mathcal{L}_{p}\epsilon.

Thus, we can bound the state estimation error e(x,t)e(x,t) with probabability at least 1α1-\alpha as

e(x,t)\displaystyle e(x,t) =x^x=x^x+x^ix^i+xixi\displaystyle=\|\hat{x}-x\|=\|\hat{x}-x+\hat{x}_{i}-\hat{x}_{i}+x_{i}-x_{i}\|
x^x^i+xix+x^ixi\displaystyle\leq\|\hat{x}-\hat{x}_{i}\|+\|x_{i}-x\|+\|\hat{x}_{i}-x_{i}\|
q^pϵ+ϵ+E¯xi(q^p+1)ϵ+supjE¯xj.\displaystyle\leq\mathcal{L}_{\hat{q}}\mathcal{L}_{p}\epsilon+\epsilon+\bar{E}_{x_{i}}\leq(\mathcal{L}_{\hat{q}}\mathcal{L}_{p}+1)\epsilon+\sup_{j}\bar{E}_{x_{j}}.

Particularly, note that the last inequality holds since Prob(x^ixiE¯xi)1α\text{Prob}(\|\hat{x}_{i}-x_{i}\|\leq\bar{E}_{x_{i}})\geq 1-\alpha for each xi𝒳¯x_{i}\in\bar{\mathcal{X}}. Finally, we have that Prob(e(x,t)supjE¯xj+(pq^+1)ϵ)1α\text{Prob}\big{(}e(x,t)\leq\sup_{j}\bar{E}_{x_{j}}+(\mathcal{L}_{p}\mathcal{L}_{\hat{q}}+1)\epsilon\big{)}\geq 1-\alpha.

Proof of Lemma 2: First, recall the system dynamics:

F(x(t),u(t)):=f(x(t))+g(x(t))u(t)=x˙(t).F(x(t),u(t)):=f(x(t))+g(x(t))u(t)=\dot{x}(t).

By integrating the above ODE, we have that

x(t)=x(ti)+titF(x(s),u(s))𝑑s.\displaystyle x(t)=x(t_{i})+\int_{t_{i}}^{t}F(x(s),u(s))\,ds.

Then, for any t[ti,ti+1)t\in[t_{i},t_{i+1}), it holds w.p. 1α1-\alpha that

x(t)x^(ti)\displaystyle\|x(t)-\hat{x}(t_{i})\| =titF(x(s),u(s))𝑑s+x(ti)x^(ti)\displaystyle=\|\int_{t_{i}}^{t}F(x(s),u(s))\,ds\|+\|x(t_{i})-\hat{x}(t_{i})\|
(tti)F¯+supjE¯xj+(pq^+1)ϵΔ,\displaystyle\leq(t-t_{i})\bar{F}+\sup_{j}\bar{E}_{x_{j}}+(\mathcal{L}_{p}\mathcal{L}_{\hat{q}}+1)\epsilon\leq\Delta, (13)

where we used that Prob(x(ti)x^(ti)supjE¯xj+(pq^+1)ϵ)1α(\|x(t_{i})-\hat{x}(t_{i})\|\leq\sup_{j}\bar{E}_{x_{j}}+(\mathcal{L}_{p}\mathcal{L}_{\hat{q}}+1)\epsilon)\geq 1-\alpha according to Proposition 1. Thus, we have that Prob(x(t)x^(ti)Δ,t[ti,ti+1))1α.\text{Prob}\Big{(}\|x(t)-\hat{x}(t_{i})\|\leq\Delta,\forall t\in[t_{i},t_{i+1})\Big{)}\geq 1-\alpha.

Proof of Theorem 1: Let us first define

c(x(t),u(t)):=Lfh(x(t))+Lgh(x(t))u(t)+β(h(x(t))),\displaystyle c(x(t),u(t)):=L_{f}h(x(t))+L_{g}h(x(t))u(t)+\beta(h(x(t))),
c(x^(t),u(t)):=Lfh(x^(t))+Lgh(x^(t))u(t)+β(h(x^(t))).\displaystyle c(\hat{x}(t),u(t)):=L_{f}h(\hat{x}(t))+L_{g}h(\hat{x}(t))u(t)+\beta(h(\hat{x}(t))). (14)

For any t[ti,ti+1)t\in[t_{i},t_{i+1}), we can now upper bound the absolute difference between c(x^(ti),u(ti))c(\hat{x}(t_{i}),u(t_{i})) and c(x(t),u(t))c(x(t),u(t)) as

|c(x^(ti),u(ti))c(x(t),u(t))|\displaystyle|c(\hat{x}(t_{i}),u(t_{i}))-c(x(t),u(t))|
=\displaystyle= |(Lfh(x^(ti))+Lgh(x^(ti))u(ti)+β(h(x^(ti))))\displaystyle|(L_{f}h(\hat{x}(t_{i}))+L_{g}h(\hat{x}(t_{i}))u(t_{i})+\beta(h(\hat{x}(t_{i}))))
(Lfh(x(t))+Lgh(x(t))u(t)+β(h(x(t))))|\displaystyle\quad-(L_{f}h(x(t))+L_{g}h(x(t))u(t)+\beta(h(x(t))))|
=\displaystyle= |(Lfh(x^(ti))Lfh(x(t)))+(Lgh(x^(ti))u(ti)\displaystyle|(L_{f}h(\hat{x}(t_{i}))-L_{f}h(x(t)))+(L_{g}h(\hat{x}(t_{i}))u(t_{i})
Lgh(x(t))u(t))+(β(h(x^(ti)))β(h(x(t))))|\displaystyle\quad-L_{g}h(x(t))u(t))+(\beta(h(\hat{x}(t_{i})))-\beta(h(x(t))))|
\displaystyle\leq (Lfh+Lghu(ti)+βh)x(t)x^(ti)\displaystyle(\mathcal{L}_{L_{f}h}+\mathcal{L}_{L_{g}h}\|u(t_{i})\|+\mathcal{L}_{\beta\circ h})\cdot\|x(t)-\hat{x}(t_{i})\|
\displaystyle\leq (Lfh+Lghu(ti)+βh)Δ(w.p. 1α)\displaystyle(\mathcal{L}_{L_{f}h}+\mathcal{L}_{L_{g}h}\|u(t_{i})\|+\mathcal{L}_{\beta\circ h})\cdot\Delta\quad\text{(w.p. $1-\alpha$)} (15)

Since c(x^(ti),u(ti))(Lfh+Lghu(ti)+βh)Δc(\hat{x}(t_{i}),u(t_{i}))\geq(\mathcal{L}_{L_{f}h}+\mathcal{L}_{L_{g}h}\|u(t_{i})\|+\mathcal{L}_{\beta\circ h})\cdot\Delta, we can quickly obtain c(x(t),u(t))c(x^(ti),u(ti))(Lfh+Lghu(ti)+βh)Δ0c(x(t),u(t))\geq c(\hat{x}(t_{i}),u(t_{i}))-(\mathcal{L}_{L_{f}h}+\mathcal{L}_{L_{g}h}\|u(t_{i})\|+\mathcal{L}_{\beta\circ h})\cdot\Delta\geq 0 using the absolute difference bound we derived above, which implies h(x(t))0h(x(t))\geq 0, t[ti,ti+1)\forall t\in[t_{i},t_{i+1}). Also, x(t)x^(ti)Δ\|x(t)-\hat{x}(t_{i})\|\leq\Delta holds with the probability 1α1-\alpha, so we finally obtain that Prob(h(x(t))0,t[ti,ti+1))1α\text{Prob}\Big{(}h(x(t))\geq 0,\forall t\in[t_{i},t_{i+1})\Big{)}\geq 1-\alpha. This ends the proof.

Proof of Proposition 2: We first prove that

P{x(t)𝒞,t[0,tm)}\displaystyle P\{x(t)\in\mathcal{C},\forall t\in[0,t_{m})\}
\displaystyle\geq (1α)P{x(t)𝒞,t[t0,tm1)},\displaystyle(1-\alpha)\cdot P\{x(t)\in\mathcal{C},\forall t\in[t_{0},t_{m-1})\}, (16)

which can be obtained by the following derivations:

P{x(t)𝒞,t[0,tm)}\displaystyle P\{x(t)\in\mathcal{C},\forall t\in[0,t_{m})\}
=\displaystyle= P{x(t)𝒞,t[0,t1)[t1,t2)[tm1,tm)}\displaystyle P\{x(t)\in\mathcal{C},\forall t\in[0,t_{1})\cup[t_{1},t_{2})\cup\cdots\cup[t_{m-1},t_{m})\}
=\displaystyle= P{x(t)𝒞,t[tm1,tm)|x(t)𝒞,t[t0,tm1)}\displaystyle P\{x(t)\in\mathcal{C},\forall t\in[t_{m-1},t_{m})|x(t)\in\mathcal{C},\forall t\in[t_{0},t_{m-1})\}
P{x(t)𝒞,t[t0,tm1)}\displaystyle\quad\cdot P\{x(t)\in\mathcal{C},\forall t\in[t_{0},t_{m-1})\}
=\displaystyle= P{x(t)𝒞,t[tm1,tm)|x(t)𝒞,t[t0,tm1]}\displaystyle P\{x(t)\in\mathcal{C},\forall t\in[t_{m-1},t_{m})|x(t)\in\mathcal{C},\forall t\in[t_{0},t_{m-1}]\}
P{x(t)𝒞,t[t0,tm1)}\displaystyle\quad\cdot P\{x(t)\in\mathcal{C},\forall t\in[t_{0},t_{m-1})\}
=\displaystyle= P{x(t)𝒞,t[tm1,tm)|x(tm1)𝒞}\displaystyle P\{x(t)\in\mathcal{C},\forall t\in[t_{m-1},t_{m})|x(t_{m-1})\in\mathcal{C}\}
P{x(t)𝒞,t[t0,tm1)}\displaystyle\quad\cdot P\{x(t)\in\mathcal{C},\forall t\in[t_{0},t_{m-1})\}
\displaystyle\geq (1α)P{x(t)𝒞,t[t0,tm1)}\displaystyle(1-\alpha)\cdot P\{x(t)\in\mathcal{C},\forall t\in[t_{0},t_{m-1})\} (17)

Note that the third equality holds due to the continuity of h(x)h(x), i.e., if limttm1h(x(t))0\lim_{t\rightarrow t_{m-1}}h(x(t))\geq 0, then we have that h(x(tm1))0h(x(t_{m-1}))\geq 0, which implies that the event x(t)𝒞,t[t0,tm1)x(t)\in\mathcal{C},\forall t\in[t_{0},t_{m-1}) and the event x(t)𝒞,t[t0,tm1]x(t)\in\mathcal{C},\forall t\in[t_{0},t_{m-1}] are essentially the same event. Finally, we can recursively decompose the probability over time interval [0,T)[0,T):

P{x(t)𝒞,t[0,T)}\displaystyle P\{x(t)\in\mathcal{C},\forall t\in[0,T)\}
=\displaystyle= P{x(t)𝒞,t[0,tm)}\displaystyle P\{x(t)\in\mathcal{C},\forall t\in[0,t_{m})\}
\displaystyle\geq (1α)P{x(t)𝒞,t[t0,tm1)}\displaystyle(1-\alpha)\cdot P\{x(t)\in\mathcal{C},\forall t\in[t_{0},t_{m-1})\}
\displaystyle\geq (1α)(1α)P{x(t)𝒞,t[t0,tm2)}\displaystyle(1-\alpha)\cdot(1-\alpha)\cdot P\{x(t)\in\mathcal{C},\forall t\in[t_{0},t_{m-2})\}
\displaystyle\geq \displaystyle\cdots
\displaystyle\geq (1α)mP{x(0)𝒞}\displaystyle(1-\alpha)^{m}\cdot P\{x(0)\in\mathcal{C}\}
=\displaystyle= (1α)m\displaystyle(1-\alpha)^{m} (18)

This completes the proof.