heterogeneous-contract-control

name

heterogeneous-contract-control

description

Heterogeneous assume-guarantee contract framework for co-design of layered control architectures. Decomposes safety-liveness specifications across discrete-time planning (MPC) and continuous-time safety layers using vertical refinement, timing compatibility, and explicit reference governors. Use when designing hierarchical control systems, layered control architectures (LCAs), assume-guarantee contracts for CPS, safety-liveness decomposition, MPC + low-level controller integration, reference governor design, hybrid energy storage systems, or compositional verification of multi-timescale control systems. Activation: layered control, heterogeneous contract, assume-guarantee contract, safety liveness, vertical refinement, explicit reference governor, MPC tracker integration, hybrid control architecture, contract-based design, time-scale separation, compositional control verification

Heterogeneous Contract Framework for Layered Control

Based on: Takayama et al. (2026) "Safety by Invariance, Liveness through Refinement: Heterogeneous Contract Framework for Co-Design of Layered Control" — arXiv:2605.04222

Core Problem

Layered control architectures (LCAs) combine a discrete-time (DT) planner (e.g., MPC) with a continuous-time (CT) safety layer. Three challenges:

1. No uniform specification language across discrete planning and continuous execution
2. No formal guarantees for interconnecting subsystems at heterogeneous time scales
3. Naive input-filtering laws that obstruct compositional separation

Safety-Liveness Decomposition Principle

Layer	Responsibility	Mechanism
CT Safety Layer	Safety (unilateral)	Robust forward invariance via reference governor
DT Planning Layer	Liveness (bilateral)	MPC planning with convergence guarantees

Safety: "Something bad never happens" — enforced by invariance at CT layer, regardless of DT commands. Liveness: "Something good eventually happens" — requires both layers; bilateral via vertical refinement.

Architecture Components

ΣH (DT Planner + ZOH)
  ├── Sampler: yk = hy(x(tk))
  ├── Planner (MPC): rk = π(yk, ẑk|k)
  └── Zero-Order Hold: r(t) = rk for t ∈ [tk, tk+1)

ΣL (CT Safety Layer)
  ├── Plant + Tracker: ẋ = f(x, κ(x,v), w)
  └── Reference Governor (ERG): r(t) → v(t)

Signal flow: r → v → x (sequential, no algebraic loops)

Key Contracts

High-Level Contract CH = (Ã_k^mis, (G_k^ref ∧ G_k^ISS))

• Ã_k^mis: Model mismatch assumption — ∥w̃_k∥ ≤ ε_E (abstraction error bound)
• G_k^ref: Reference feasibility — ∥r_k - r_{k-1}∥ ≤ r̄ (max reference gap)
• G_k^ISS: Input-to-state stability — convergence to goal with KL bound

Low-Level Contract CL = ((A_k^env ∧ A_k^ref), (G_k^safe ∧ G_k^track))

• A_k^env: Disturbance bound — w(t) ∈ W
• A_k^ref: Reference rate — same as G_k^ref
• G_k^safe: Safety invariance — x(t) ∈ X_safe for all t
• G_k^track: Tracking guarantee — ∥h_r(x) - r∥ ≤ ε_L

Critical Conditions

Timing Compatibility

Ctss: Ts ≥ τ_LL

Sampling period must exceed low-level settling time.

Vertical Refinement (Cross-Domain Handshakes)

Downward: G_k^ref ⇒ A_k^ref    (DT guarantee satisfies CT assumption)
Upward:   G_k^{track} ⇒ Ã_k^mis  (CT tracking implies model error bound)

Recursive Well-Posedness (Definition 13)

1. Initial conditions satisfy A_0^ref and A_env
2. Local contracts: ΣH |= CH, ΣL |= CL
3. Recursive feasibility of MPC at every step
4. Vertical refinement condition C_r holds

Explicit Reference Governor (ERG) as Contract Realizer

The ERG plays a dual role:

1. Safety enforcement: Robust forward invariance of X_safe
2. Tracking guarantee: Provides G_k^track for vertical refinement

Advantage over CBF-QP: ERG modifies only the reference signal v(t), preserving the low-level controller's stability certificates. CBF-QPs override control inputs and may perturb inner loop behavior.

ERG Dynamics

v̇(t) = Δ(v(t), x(t)) · ρ(v(t), r(t))

where Δ is the Navigation Dynamics (ensures safety) and ρ is the Attraction Field (drives toward reference).

Implementation Pattern

Step 1: Define Contracts

Specify safe set X_safe = {x | Cx ≤ d}, goal y_goal, tolerance ε, disturbance bound W.

Step 2: Design CT Layer

• Implement ISS tracking controller κ(x, v)
• Design ERG with safe set invariance guarantee
• Determine settling time τ_LL and tracking tolerance ε_L

Step 3: Design DT Layer

• Build abstract model f̂ with error bound ε_E
• Design MPC with reference rate constraint r̄
• Ensure recursive feasibility via terminal constraints

Step 4: Verify Composition

• Check Ctss: Ts ≥ τ_LL
• Verify downward refinement: G_k^ref ⊆ A_k^ref
• Verify upward refinement: G_k^{track} ⇒ Ã_k^mis(ε_E)
• Check error budget: ε_E + ε_T(ε_E) + δ < ε_H

Theorem 1 (Correctness)

If the interconnection is recursively well-posed with tolerance ε_H, then:

• Safety: x(0) ∈ X_safe ⇒ x(t) ∈ X_safe for all t ≥ 0
• Liveness: ∃ T < ∞ such that ∥h_y(x(t)) - y_goal∥ ≤ ε for all t ≥ T

Common Pitfalls

1. Algebraic loops: Without explicit ZOH modeling, DT and CT layers may create circular dependencies. ZOH enforces sequential information flow.
2. CBF-QP interference: Direct input modification can invalidate tracking models assumed by the planner. Use ERG instead.
3. Time-scale mismatch: Sampling too fast (Ts < τ_LL) violates timing compatibility and breaks vertical refinement.
4. Unbounded reference steps: Large ∥r_k - r_{k-1}∥ can violate tracking guarantees. Constrain via r̄.
5. Abstraction gap: Mismatch between planner model f̂ and plant dynamics f must be bounded by ε_E and absorbed into ISS analysis.

Application Domains

• Hybrid Energy Storage Systems (HESS): Battery (slow) + Supercapacitor (fast)
• Autonomous vehicle control: Trajectory planning + Low-level tracking
• Power electronics: Energy management + Voltage regulation
• Robotics: Motion planning + Force/position control