When a Barrier Filter’s Assumptions Break

A safety inequality is only as useful as its assumptions

Let a scalar margin h represent separation above a minimum allowed value. The desired set is h >= 0. A nominal command wants to reduce the margin, perhaps because another objective rewards progress. A filter can modify that command when it would reduce the margin too quickly. The interesting part is not just the projection formula, but when the formula stops supporting the intended conclusion.

Control Barrier Function Based Quadratic Programs for Safety Critical Systems, especially Sections III-B and IV, relates a differential inequality to forward invariance under stated regularity and feasibility conditions. This article uses a scalar teaching system rather than the paper's automotive models. The margin's derivative is directly commanded; it is not an acceleration-controlled vehicle separation model.

Derive the projection before simulating it

Assume h_dot = u and choose the condition h_dot + alpha*h >= 0, with positive alpha. Admissible commands satisfy u >= -alpha*h. To stay as close as possible to nominal command u_nom, minimize (u-u_nom)^2 subject to that inequality and input bounds. In one dimension, the solution is simply projection onto the feasible interval.

For alpha=2, margin h=0.2, and nominal command -1, the barrier lower bound is -0.4. If actuator bounds are [-1, 1], the projected command is -0.4. Under the exact continuously updated model, the active constraint yields exponential decay toward zero rather than crossing it. This conclusion assumes the command remains admissible as the state changes.

Sampling changes the problem

Now hold command u_k constant for a sampling interval dt. For the stated dynamics h_dot = u_k, the exact evolution within that interval is h(t_k + tau) = h_k + tau*u_k. While the barrier bound is active, u_k = -alpha*h_k, so the next sampled margin is exactly h_next = (1-alpha*dt)*h_k.

With alpha=2 and dt=0.75, the coefficient is -0.5. A positive margin can become negative even though the inequality held when the command was chosen. The update has the form of an Euler step, but there is no integration error here: the held command produces this trajectory exactly. Checking the inequality at a sampling instant does not keep the command admissible throughout the interval.

Model mismatch creates a different failure. If the actual dynamics are h_dot = u-bias, a positive unmodeled bias consumes margin that the nominal inequality did not budget for. The demo tests both a mild bias and a larger one. It reports the minimum margin, number of negative-margin samples, and number of infeasible projections, alongside an unfiltered baseline.

The executed coarse-step case reaches margin -0.125. With the fine step but a 0.2 bias, the margin approaches -0.1. Those two failures have different causes even though both appear as negative samples in the report.

Infeasible means no admissible answer exists

When -alpha*h exceeds the upper input limit, the interval is empty. Silently clipping the result to the upper limit does not solve the constrained problem. The code explicitly increments an infeasibility counter, then applies that upper limit only to continue a diagnostic rollout. It labels the failure instead of presenting the resulting command as a certified safe control.

Negative margins and infeasible projections describe different failures. A negative margin records a state outside the desired set. An infeasible projection means the barrier lower bound and actuator limits leave no admissible command. Reporting them separately preserves the distinction between an observed trajectory and the controls available to change it.

This scalar simulation has no real-system interface and provides no deployment guarantee. Its conclusion depends on the state definition, relative degree, model error, sampling interval, input limits, and handling of an empty feasible set. Those assumptions determine what a barrier filterA function whose conditions help a controller keep the system inside an allowed set of states. can promise.

def simulate(dt, bias, filtered=True):
    h, minimum = 1.0, 1.0
    violations, infeasible = 0, 0
    alpha, lower_limit, upper_limit = 2.0, -1.0, 1.0
    for _ in range(round(6.0/dt)):
        nominal = -1.0
        if filtered:
            lower = max(lower_limit, -alpha*h)
            if lower > upper_limit:
                infeasible += 1
                u = upper_limit  # diagnostic continuation, not a feasible solution
            else:
                u = max(lower, min(upper_limit, nominal))
        else:
            u = nominal
        h += dt*(u-bias)
        minimum = min(minimum, h)
        violations += int(h < -1e-12)
    return minimum, violations, infeasible

cases = ((0.1, 0.0, False), (0.1, 0.0, True), (0.75, 0.0, True),
         (0.1, 0.2, True), (0.1, 2.0, True))
for dt, bias, filtered in cases:
    minimum, violations, infeasible = simulate(dt, bias, filtered)
    print(f'dt={dt:.2f} bias={bias:.1f} filter={filtered} min_h={minimum:.4f} negative_samples={violations} infeasible={infeasible}')
assert simulate(0.1, 0.0)[0] >= 0
assert simulate(0.75, 0.0)[0] < 0
assert simulate(0.1, 2.0)[2] > 0

dt=0.10 bias=0.0 filter=False min_h=-5.0000 negative_samples=50 infeasible=0
dt=0.10 bias=0.0 filter=True min_h=0.0000 negative_samples=0 infeasible=0
dt=0.75 bias=0.0 filter=True min_h=-0.1250 negative_samples=4 infeasible=0
dt=0.10 bias=0.2 filter=True min_h=-0.1000 negative_samples=48 infeasible=0
dt=0.10 bias=2.0 filter=True min_h=-5.8412 negative_samples=57 infeasible=53