# A converse robust-safety theorem for differential inclusions

Mohamed Maghenem, Masoumeh Ghanbarpour

► To cite this version:

Mohamed Maghenem, Masoumeh Ghanbarpour. A converse robust-safety theorem for differential inclusions. ESAIM: Control, Optimisation and Calculus of Variations, 2025, 31, pp.48. 10.1051/cocv/2025034. hal-05098695

HAL Id: hal-05098695

https://hal.science/hal-05098695v1

Submitted on 5 Jun 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# A CONVERSE ROBUST-SAFETY THEOREM FOR DIFFERENTIAL INCLUSIONS

MOHAMED MAGHENEM* AND MASOUMEH GHANBARPOUR

**Abstract.** This paper establishes the equivalence between robust safety and the existence of a barrier function certificate for differential inclusions. More precisely, for a robustly-safe differential inclusion, a barrier function is constructed as the time-to-impact function with respect to a specifically-constructed reachable set. Using techniques from set-valued and nonsmooth analysis, we show that such a function, although being possibly discontinuous, certifies robust safety by verifying a condition involving the system's solutions. Furthermore, we refine this construction, using smoothing techniques from the literature on converse Lyapunov theorems, to provide a smooth barrier certificate that certifies robust safety by verifying a condition involving only the barrier function and the system's dynamics. In comparison with existing converse robust-safety theorems, our results are more general as they allow the safety region to be unbounded, the dynamics to be a general continuous set-valued map, and the solutions to be non-unique.

**Mathematics Subject Classification.** 93A10-26B05.

Received November 28, 2023. Accepted March 21, 2025.

## 1. INTRODUCTION

Safety for a dynamical system requires the solutions starting from a given set of initial conditions to never reach a given unsafe set [1]. Depending on the application, reaching the unsafe set may correspond to non-applicability of a predefined feedback law, due to saturation or a change in the dynamics or, simply, due to collisions with physical obstacles. Ensuring safety is in fact key in many engineering applications including traffic regulation [2], aerospace [3], and human-robot interactions [4].

### 1.1. Motivation

This notion of safety is not robust in nature, as it is possible to construct safe differential equations that become unsafe when arbitrarily small perturbations are added to their right-hand side [5], Example 1. As a result, we say, roughly speaking, that a dynamical system is robustly safe if it remains safe in the presence of a perturbation term added to its dynamics. This robust-safety notion was first introduced in [6] for systems defined on compact manifolds. A similar notion is studied in [7, 8] for continuous-time systems modeled by differential equations. The same notion is considered in [5] in the context of differential inclusions, which generalize

<footnote>Keywords and phrases: Robust safety; Differential inclusions; Barrier functions; Converse theorem.</footnote>

<footnote n="1">¹ CNRS, Gipsa-lab, Grenoble INP, Université Grenoble Alpes, Grenoble, France.</footnote>

<footnote n="2">² Department of Electrical and Computer Engineering, University of Colorado Boulder, Colorado, USA.</footnote>

<footnote>* Corresponding author: mohamed.maghenem@gipsa-lab.fr</footnote>
differential equations by allowing the right-hand side to be a general set-valued map [9], and thus the solutions to be non-unique.

As the analytical expression of the solutions of a dynamical system is usually impossible to obtain, and since the precise approximation can be computationally expensive, barrier functions have been widely used to verify safety and robust safety, without computing nor approximating system's solutions. This framework is analogous to Lyapunov theory for stability. A *barrier function candidate* is a scalar function taking a negative sign on the initial set and the opposite sign on the unsafe set. It certifies safety (resp., robust safety) provided that its variations along system's solutions (lying in a vicinity of its zero-level set) is upper-bounded by a non-positive (resp., negative) term. Under some regularity conditions, the aforementioned conditions are verified provided that inequality constraints, involving the barrier function candidate itself and the system's dynamics, hold. In which case, the conditions become *infinitesimal* or *solution independent* and the barrier function candidate becomes a *barrier certificate* [5, 10]. Such conditions are well documented in the literature of safety under different smoothness properties of the barrier function candidate [11–13] and the system's dynamics [14]. Furthermore, in the context of robust safety, when an upper bound on the perturbation is known, safety conditions involving the (worst-case) perturbed dynamics are used in [15, 16]. In [17], specific classes of perturbations, solution to some dynamical models and verifying a certain integral constraint are considered. Perturbation-free conditions ensuring robust safety are proposed in [5, 18], provided that mild regularity assumptions on the dynamics and the barrier function candidate hold. Showing the necessity of such perturbation-free conditions is the main subject of the current paper.

## 1.2. Background

Converse safety and robust-safety problems pertain to show the existence of a barrier certificate for safety and robust safety, provided that the system is safe and robustly safe, respectively.

* In the context of safety, it is shown in [10] that, in general, the existence of a continuous barrier certificate is not necessary for safety, unless special cases are considered [19]. Alternatively, time-varying barrier certificates are introduced and their existence is shown in [10] to be necessary as well as sufficient, under some assumptions on the system.

* In the context of robust safety, [6] solved the converse robust-safety problem by constructing a smooth barrier certificate for systems defined on smooth and compact manifolds, provided that the system's dynamics are represented by a smooth single-valued map, the initial and unsafe sets are compact and disjoint, and a *Meyer function* exists.

* In [7], when the system's dynamics are represented by a smooth single-valued map, the complement of the unsafe set is bounded, and the closures of the initial and unsafe sets are disjoint, robust safety is shown to be equivalent to the existence of a smooth barrier certificate. In particular, to prove the converse robust-safety theorem in [7], the reachable set, denoted by $K_{\bar{\epsilon}}$, along the solutions to a perturbed version of the system starting from the initial set is introduced, where the subscript $\bar{\epsilon}$ stands for the perturbation term added to the original-system's dynamics. After that, a barrier function candidate is defined, at any point in the state space, as the first to impact the boundary of the set $K_{\bar{\epsilon}}$ by a solution starting from that point. Such a function is shown to be a valid barrier function candidate. Although being only continuous, it is shown to be strictly decreasing along the solutions to the original system, when $\bar{\epsilon}$ is a robustness margin. After that, a smooth barrier certificate is deduced using boundedness of the safe set and the density property of the class of smooth functions in the space of continuous functions.

* A very similar converse robust-safety theorem is established in [8] using converse Lyapunov theorems for asymptotic stability. Indeed, when a uniform separation exists between the unsafe region and the set $K_{\bar{\epsilon}}$, the latter set is shown to be uniformly asymptotically stable for the original system provided that either the $K_{\bar{\epsilon}}$ is bounded or the system's dynamics is globally Lipschitz. Note that neither one of the two assumptions is used in our case, and we do not believe that it is possible to guarantee uniform asymptotic stability of $K_{\bar{\epsilon}}$ outside one of the aforementioned assumptions. Hence, a link to converse Lyapunov theory cannot be that direct in our case.
## 1.3. Contribution

In this paper, we prove two converse robust-safety theorems under mild regularity assumptions on the system's dynamics. Indeed, the latter is allowed to be represented by a set-valued map. Moreover, we do not restrict the safety region to be bounded. As in [7], we show that a specifically defined time-to-impact function with respect to the boundary of a reachable set $K_{\bar{\epsilon}}$, when $\bar{\epsilon}$ is a robustness margin, is strictly decreasing when evaluated along the solutions to the original system lying on a neighborhood of $K_{\bar{\epsilon}}$. However, since the solutions are not necessarily unique, this function is not necessarily continuous. Nonetheless, for an appropriate choice of the robustness margin $\bar{\epsilon}$, the constructed function is shown to be a (non-smooth) barrier certificate. That is, it satisfies a sufficient condition for robust safety that is non-infinitesimal; namely, a condition involving the system's solutions. To construct a smooth barrier certificate, inspired by [20], we propose to smoothen the constructed nonsmooth one. However, for the resulting smooth function to be a barrier function candidate; namely, to have opposite signs on the initial and unsafe sets, we need to carefully choose the set with respect to which the time-to-impact function is defined, as well as the different parameters involved in its construction. As a consequence, we show the existence of smooth barrier certificate provided that the system's dynamics are represented by a set-valued map that is continuous and the closures of the initial and unsafe sets are disjoint. Finally, we show the utility of our converse result in the context of safety for self-triggered control systems.

The rest of the paper is organized as follows. Preliminaries on set-valued maps, differential inclusions, and invariance and attractivity notions are in Section 2. The problem formulation, the main results, and a motiva- tional example are in Section 3. Preparatory materials towards the proofs of the main results are in Section 4. The proofs of the main results are in Sections 5 and 7, while the proofs of the key intermediate results used Sections 5 and 7 are in Sections 6 and 8, respectively. Finally, technical lemmas are reported in the Appendix A.

In the preliminary version of this work, presented in [21], the system's solutions are restricted to be forward complete. Moreover, the proofs, detailed explanations, and the application example are omitted.

**Notation.** For $x, y \in \mathbb{R}^n$, $x^\top$ denotes the transpose of $x$, $|x|$ the Euclidean norm of $x$ and $\langle x, y \rangle := x^\top y$ the inner product between $x$ and $y$. For a set $K \subset \mathbb{R}^n$, we use $\text{int}(K)$ to denote its interior, $\partial K$ to denote its boundary, $U(K)$ to denote any open neighborhood of the set $K$, and $|x|_K$ to denote the distance between $x$ and the set $K$. Furthermore, we use $C_K(x)$ to denote the contingent cone of $K$ at $x$, which is given by

$$C_K(x) := \left\{ v \in \mathbb{R}^n : \liminf_{h \to 0^+} |x + hv|_K / h = 0 \right\}.$$

For $O \subset \mathbb{R}^n$, $K \setminus O$ denotes the subset of elements of $K$ that are not in $O$. The sum of two sets is defined as $O + K := \{x + y : x \in O, y \in K\}$. For a function $\phi : \text{dom} \phi \to \mathbb{R}^m$, $\text{dom} \phi \subset \mathbb{R}^n$ denotes the domain of definition of $\phi$. By $F : \mathbb{R}^m \to \mathbb{R}^n$, we denote a set-valued map associating each element $x \in \mathbb{R}^m$ with a subset $F(x) \subset \mathbb{R}^n$. In particular, $\text{Proj}_K : \mathbb{R}^n \to K$ represents the projection set-valued map on $K$; namely, $\text{Proj}_K(x) := \{y \in K : |x - y| = |x|_K\}$. For a set $D \subset \mathbb{R}^m$, $F(D) := \{\eta \in F(x) : x \in D\}$. For a differentiable map $B : \mathbb{R}^n \to \mathbb{R}$, $\nabla_{x_i} B$ denotes the derivative of $B$ with respect to $x_i$, $i \in \{1, 2, ..., n\}$, and $\nabla B$ denotes the gradient of $B$ with respect to $x$. Finally, we use $\mathbb{B}$ to denote the closed unit ball of appropriate dimension centered at the origin, and $C_+$ to denote the space of continuous functions from $\mathbb{R}^n$ to $\mathbb{R}_{>0}$.

# 2. PRELIMINARIES

## 2.1. Set-valued vs single-valued maps

Consider a set-valued map $F : K \to \mathbb{R}^n$, where $K \subset \mathbb{R}^m$.

* $F$ is outer semicontinuous at $x \in K$ if, for every sequence $\{x_i\}_{i=0}^\infty \subset K$ and for every sequence $\{y_i\}_{i=0}^\infty \subset \mathbb{R}^n$ with $\lim_{i \to \infty} x_i = x$, $\lim_{i \to \infty} y_i = y \in \mathbb{R}^n$, and $y_i \in F(x_i)$ for all $i \in \mathbb{N}$, we have $y \in F(x)$; see [22].

* $F$ is upper semicontinuous at $x \in K$ if, for each $\varepsilon > 0$, there exists a neighborhood of $x$, denoted by $U(x)$, such that for each $y \in U(x) \cap K$, $F(y) \subset F(x) + \varepsilon\mathbb{B}$; see [23], Definition 1.4.1.
* F is continuous at $x \in K$ if, for each $\epsilon > 0$, there exists $\delta > 0$ such that

$$|F(x_1) - F(x_2)|_H \le \epsilon \quad \forall x_1, x_2 \in x + \delta\mathbb{B}, \qquad (2.1)$$

where $|F(x) - F(y)|_H$ stands for the Hausdorff distance between the sets $F(x)$ and $F(y)$.

* F is locally bounded at $x \in K$ if there exists a neighborhood of $x$, denoted by $U(x)$, and $\beta > 0$ such that $|\zeta| \le \beta$ for all $\zeta \in F(y)$ and for all $y \in U(x) \cap K$.

Furthermore, the map F is upper, outer semicontinuous, continuous, or locally bounded if, respectively, so it is for all $x \in K$.

## 2.2. Differential inclusions

We recall the notion of a Carathéodory solution to a differential inclusion of the form

$$\Sigma: \dot{x} \in F(x) \quad x \in \mathbb{R}^n. \qquad (2.2)$$

**Definition 2.1.** A function $\phi: \text{dom } \phi \to \mathbb{R}^n$, with $\text{dom } \phi \subset \mathbb{R}$ an interval containing $\{0\}$, is a solution to $\Sigma$ if it is locally absolutely continuous and $\dot{\phi}(t) \in F(\phi(t))$ for almost all $t \in \text{dom } \phi$.

A solution $\phi$ to $\Sigma$ is said to start from $x$ if $\phi(0) = x$. A solution $\phi$ to $\Sigma$ is maximal if there is no solution $\psi$ to $\Sigma$ such that $\psi(t) = \phi(t)$ for all $t \in \text{dom } \phi$ and $\text{dom } \phi$ is strictly included in $\text{dom } \psi$. Furthermore, we use $S_\Sigma(x)$ to denote the set of maximal solutions $\phi$ to $\Sigma$ starting from $x$.

We now propose to view the sets of points reached by the solutions to $\Sigma$, starting from a given initial condition and over a given window of time, as set-valued maps. Indeed, as in [24], Section 4.2 and [9], p. 104, we, respectively, recall the set-valued maps $R_\Sigma: \mathbb{R} \times \mathbb{R}^n \Rightarrow \mathbb{R}^n$ and $R_\Sigma^b: \mathbb{R} \times \mathbb{R}^n \Rightarrow \mathbb{R}^n \cup \emptyset$ given by

$$R_{\Sigma}(t, x) := \{\phi(s) : \phi \in S_{\Sigma}(x), s \in \text{dom } \phi \cap I_t\}, \quad R_{\Sigma}^{b}(t, x) := \{\phi(t) : \phi \in S_{\Sigma}(x), t \in \text{dom } \phi\},$$

where $I_t := [\min\{0, t\}, \max\{0, t\}]$. In simple words, the set $R_\Sigma(t, x)$ includes all the elements reached by the solutions to $\Sigma$ starting from $x$ over the interval $I_t$. Furthermore, the set $R_\Sigma^b(t, x)$ includes the value of the solutions starting from $x$ at $t$, when $t$ is part of their domain.

Finally, we introduce the following assumption on F.

**Assumption 2.2.** The map F is upper semicontinuous and $F(x)$ is nonempty, compact, and convex for all $x \in \mathbb{R}^n$.

Assumption 2.2 guarantees the existence of a non-trivial solution from any $x \in \mathbb{R}^n$ as well as useful structural properties for the set of solutions to $\Sigma$; see [9, 24, 25].

**Remark 2.3.** Given a set-valued map $F: K \Rightarrow \mathbb{R}^n$, where $K \subset \mathbb{R}^m$, we recall, based on [22], Theorem 5.19 and [26], Lemma 5.15, that the following two properties are equivalent.

* F is upper semicontinuous and $F(x)$ is compact for all $x \in K$.

* F is outer semicontinuous and locally bounded.

## 3. PROBLEM FORMULATION AND RESULTS

Given a set of initial conditions $X_o \subset \mathbb{R}^n$ and an unsafe set $X_u \subset \mathbb{R}^n$ such that $X_o \cap X_u = \emptyset$, we recall that $\Sigma$ is safe with respect to $(X_o, X_u)$ if, for each solution $\phi$ with $\phi(0) \in X_o$, we have $\phi(\text{dom } \phi \cap \mathbb{R}_{\ge 0}) \subset \mathbb{R}^n \setminus X_u$. In words, the solutions starting from $X_o$ never reach the set $X_u$ at any positive time. Note that safety with respect to $(X_o, X_u)$ is verified if and only if there exists a set $K \subset \mathbb{R}^n$, with $X_o \subset K$ and $K \cap X_u = \emptyset$, that is forward invariant. In turn, a set $K \subset \mathbb{R}^n$ is forward invariant if, for each solution $\phi$ to $\Sigma$ with $\phi(0) \in K$, $\phi(\text{dom } \phi \cap \mathbb{R}_{\ge 0}) \subset K$. In words, the solutions starting from $K$ never leave the set $K$ at any positive time.
Next, we consider the perturbed version of $\Sigma$, denoted by $\Sigma_{\epsilon}$, and given by

$$ \Sigma_{\epsilon}: \quad \dot{x} \in F(x) + \epsilon(x)\mathbb{B} \quad x \in \mathbb{R}^n. \qquad (3.1) $$

Following [5], we recall a definition of robust safety, which we study in this paper.

**Definition 3.1** (Robust safety). System $\Sigma$ is robustly safe with respect to $(X_o, X_u)$ if there exists $\epsilon \in C_+$ such that $\Sigma_{\epsilon}$ in (3.1) is safe with respect to $(X_o, X_u)$. The function $\epsilon$ is, in this case, named *robust-safety margin*.

We next recall the definition of a barrier function candidate.

**Definition 3.2.** A scalar function $B: \mathbb{R}^n \to \mathbb{R}$ is a barrier function candidate with respect to $(X_o, X_u)$ if

$$ B(x) > 0 \quad \forall x \in X_u \quad \text{and} \quad B(x) \le 0 \quad \forall x \in X_o. $$

Note that a barrier function candidate $B$ defines the zero sub-level set

$$ K := \{x \in \mathbb{R}^n : B(x) \le 0\}, \qquad (3.2) $$

which necessarily verifies

$$ X_o \subset K \quad \text{and} \quad K \cap X_u = \emptyset. $$

## 3.1. Sufficient conditions for robust safety

Since we can guarantee robust safety for $\Sigma$ by guaranteeing safety for $\Sigma_{\epsilon}$, for some $\epsilon \in C_+$, then robust safety is verified if

C0) There exists a barrier function candidate $B: \mathbb{R}^n \to \mathbb{R}$ such that the set $K$ in (3.2) is forward invariant for $\Sigma_{\epsilon}$, for some $\epsilon \in C_+$.

The latter allows us to recall the following solution-dependent sufficient condition for robust safety [10].

**Proposition 3.3.** $\Sigma$ is robustly safe with respect to $(X_o, X_u) \in \mathbb{R}^n \times \mathbb{R}^n$ provided that

C1) There exists a barrier function candidate $B$ such that the set $K$ in (3.2) is closed, there exists $U(\partial K)$, an open neighborhood of $\partial K$, and there exists $\epsilon \in C_+$ such that, along every solution (not necessarily maximal) $\phi$ to $\Sigma_{\epsilon}$ satisfying $\phi(\text{dom } \phi) \subset U(\partial K)$, the map $t \mapsto B(\phi(t))$ is non increasing.

Note that C1) does not require from $B$ to be smooth neither $F$ to satisfy Assumption 2.2. However, it involves the solutions to $\Sigma_{\epsilon}$ (hence, it also involves the perturbation term $\epsilon$).

We now recall from [5, 18] a sufficient condition for robust safety that uses only the barrier function candidate $B$ and the nominal dynamics $F$.

**Proposition 3.4.** Consider system $\Sigma$ such that Assumption 2.2 holds. $\Sigma$ is robustly safe with respect to $(X_o, X_u) \in \mathbb{R}^n \times \mathbb{R}^n$ provided that

C2) There exists a continuously differentiable barrier function candidate $B$ such that

$$ \langle \nabla B(x), \eta \rangle < 0 \quad \forall \eta \in F(x), \quad \forall x \in \partial K. \qquad (3.3) $$

Note that (3.3) involves only the barrier function candidate $B$, which is now required to be continuously differentiable, and the nominal dynamics $F$, which is required to verify Assumption 2.2.
## 3.2. Converse robust-safety theorems

We start introducing the following two assumptions.

**Assumption 3.5.** The map $F$ is continuous and $F(x)$ is nonempty, compact, and convex for all $x \in \mathbb{R}^n$.

**Assumption 3.6.** $\text{cl}(X_o) \cap X_u = \emptyset$.

Using the latter two assumptions, we can formulate our first converse robust-safety theorem.

**Theorem 3.7.** Consider system $\Sigma$ that is robustly safe with respect to $(X_o, X_u)$ and such that Assumptions 3.5 and 3.6 hold. Then, C1) holds.

In the next converse robust-safety theorem, instead of Assumption 3.6, we use the following relatively stronger assumption.

**Assumption 3.8.** $\text{cl}(X_o) \cap \text{cl}(X_u) = \emptyset$.

**Theorem 3.9.** Consider system $\Sigma$ that is robustly safe with respect to $(X_o, X_u)$ and such that Assumptions 3.5 and 3.8 hold. Then, C2) holds.

**Remark 3.10.** Our proof of Theorem 3.9 actually allows us to conclude that, for any $k \in \{1, 2, ...\}$, there exists a continuously-differentiable barrier certificate $B$ such that

$$ \langle \nabla B(x), \eta \rangle < -1 \quad \forall \eta \in F(x), \quad \forall x \in \partial K. $$

**Remark 3.11.** We believe that relaxing Assumption 2, and using Assumption 1 instead, would require a totally different approach to prove Theorems 3.7 and 3.9. Indeed, a key property allowing our barrier-function construction is established in Lemma 4.1 below. This property does not hold when only Assumption 2.2 is verified; see Example 4.2. Similarly, relaxing Assumptions 3.6 and 3.8 would require using a completely different approach to prove Theorems 3.7 and 3.9, respectively. Indeed, such separations between the two sets $X_o$ and $X_u$ are necessary to squeeze the zero-level set of the constructed barrier function between the two sets; see the forthcoming Section 6.1 for more details.

## 3.3. Application: Safety for self-triggered control systems

Consider the control system $\Sigma_u$ given by

$$ \Sigma_u : \dot{x} = f(x, u) \quad (x, u) \in \mathbb{R}^n \times \mathbb{R}^m, $$

where $f: \mathbb{R}^n \times \mathbb{R}^m \to \mathbb{R}^n$ is a continuous function. Furthermore, we let $\kappa: \mathbb{R}^n \to \mathbb{R}^m$ be a continuous feedback law such that the resulting closed-loop system

$$ \Sigma: \dot{x} = F(x) := f(x, \kappa(x)) \quad x \in \mathbb{R}^n \quad (3.4) $$

is safe with respect to $(X_o, X_u) \subset \mathbb{R}^n \times \mathbb{R}^m$.

In a self-triggered (ST) control framework [27], we construct a monotonically increasing sequence $\{t_i\}_{i=0}^{\infty} \subset \mathbb{R}_{\ge 0}$ and we ask the controller to remain constant between each two time samples $t_i$ and $t_{i+1}$, i.e.,

$$ u(t) = \kappa(x(t_i)) \quad \forall t \in [t_i, t_{i+1}), \quad i \in \mathbb{N}. $$

Hence, a solution $\phi$ to the ST closed-loop system must satisfy

$$ \dot{\phi}(t) = F(\phi(t)) + \Gamma(\phi(t), \phi(t_i)) \quad \forall t \in [t_i, t_{i+1}), \quad \Gamma(\phi(t), \phi(t_i)) := f(\phi(t), \kappa(\phi(t))) - f(\phi(t), \kappa(\phi(t))). $$
Our goal here, knowing that system Σ in (3.4) is robustly safe, is to address the following problem.

**Problem 3.12.** Prove the existence of a sequence {$t_i$}$_{i=0}^\infty \subset \mathbb{R}_{\ge 0}$ and $T > 0$ such that $t_{i+1} - t_i > T$ for all $i \in \mathbb{N}$ and the resulting ST closed-loop system is safe with respect to $(X_o, X_u)$.

We will show that Theorem 3.9 is key to solve Problem 3.12. Indeed, Theorem 3.9 allows us to formulate the following corollary.

**Corollary 3.13.** Consider the control system $\Sigma_u$ and a feedback law $\kappa$ such that the resulting closed-loop system $\Sigma$ in (3.4) is robustly safe with respect to $(X_o, X_u)$.

Then, there exist a continuously-differentiable barrier certificate $B$ and continuously-differentiable functions $\alpha : \mathbb{R}^n \to \mathbb{R}$ and $\gamma : \mathbb{R}^n \times \mathbb{R}^n \to \mathbb{R}$ such that

$$ \alpha(x) \geq 3/4 \quad \forall x \in \partial K, \quad \gamma(x, x) \leq 1/8 \quad \forall x \in \mathbb{R}^n, \qquad (3.5) $$

and

$$ \langle \nabla B(x), f(x, \kappa(y)) \rangle \leq -\alpha(x) + \gamma(x, y) \quad \forall (x, y) \in \mathbb{R}^n \times \mathbb{R}^n. \qquad (3.6) $$

*Proof.* The existence of the continuously-differentiable barrier certificate $B$ is guaranteed by Theorem 3.9. Furthermore, according to Remark 3.10, we can choose the barrier certificate $B$ to satisfy

$$ \hat{\alpha}(x) := -\langle \nabla B(x), F(x) \rangle > 1 \quad \forall x \in \partial K \quad \text{and} \quad \hat{\gamma}(x, x) := \langle \nabla B(x), \Gamma(x, x) \rangle = 0 \quad \forall x \in \mathbb{R}^n. $$

As a result, using Whitney approximation theorem for continuous functions, we conclude that we can always find continuously-differentiable functions $\gamma$ and $\alpha$ such that (3.5) holds and at the same time

$$ \alpha(x) \leq \hat{\alpha}(x) \quad \forall x \in \mathbb{R}^n \quad \text{and} \quad \gamma(x, y) \geq \hat{\gamma}(x, y) \quad \forall (x, y) \in \mathbb{R}^n \times \mathbb{R}^n. \qquad (3.7) $$

The choice in (3.7) allows us to verify (3.6). □

The proposed solution to Problem 3.12 requires the following assumption.

**Assumption 3.14.** The set $\mathbb{R}^n \setminus X_u$ is bounded, and there exists $\tau > 0$ such that the solutions to $\Sigma_y : \dot{x} = f(x, \kappa(y))$ starting from $y \in \mathbb{R}^n \setminus X_u$ cannot blow up on the time interval $[0, \tau]$.

Under the first part of Assumption 3.14, we conclude that the zero sub-level set $K$ of the barrier certificate is compact. Hence, there exist $\beta > 0$ and $T_1 > 0$ such that the following properties hold.

Pr1) For each $y \in G := \{x \in K : |x|_{\partial K} \le \beta\}$, we have $\alpha(y) - \gamma(y, y) \ge \alpha(y) - 1/8 \ge 1/4$. This is true because $\alpha$ is continuously differentiable.

Pr2) The solutions to $\Sigma_y : \dot{x} = f(x, \kappa(y))$ starting from $y \in L := \{x \in K : |x|_{\partial K} \ge \beta\}$ remain in $K$ on the interval $[0, T_1]$. This is because $f$ and $\kappa$ are continuous and $K$ is compact.

The following result addresses Problem 3.12.

**Proposition 3.15.** Consider the control system $\Sigma_u$ whose dynamics $f$ is continuous. Consider $(X_o, X_u) \subset \mathbb{R}^n \times \mathbb{R}^n$ and a continuous feedback law $\kappa$ such that the resulting closed-loop system $\Sigma$ in (3.4) is robustly safe with respect to $(X_o, X_u)$ and Assumption 3.14 holds. Then, a solution to Problem 3.12 is given by

$$ t_{i+1} := \begin{cases} t_i + \max\{T_1, T_r(\phi(t_i))\} & \text{if } \phi(t_i) \in L \\ t_i + T_r(\phi(t_i)) & \text{if } \phi(t_i) \in G, \end{cases} $$
where G and $(T_1, L)$ are introduced in Pr1) and Pr2), respectively. Furthermore, the map $y \mapsto T_r(y)$ is defined, for all $y \in K$, as

$$ 
\begin{array}{ll}
T_r(y) := 0 & \text{if } \alpha(y) - \gamma(y, y) \le 0, \\
T_r(y) := \left\{ \begin{array}{ll} \tau & \text{if } M_r(\tau, y) \le 0 \\ \min\left\{\tau, \frac{2(\alpha(y) - \gamma(y, y))}{M_r(\tau, y)}\right\} & \text{otherwise} \end{array} \right. & \text{otherwise,}
\end{array}
$$

where $\tau$ is introduced in Assumption 3.14 and

$$ M_r(\tau, y) := \sup\{\langle \nabla_x \gamma(x, y), f(x, \kappa(y)) \rangle : x \in R_{\Sigma_y}(\tau, y)\} + \sup\{\langle -\nabla \alpha(x), f(x, \kappa(y)) \rangle : x \in R_{\Sigma_y}(\tau, y)\}, \quad (3.8) $$

$R_{\Sigma_y}(\tau, y)$ is the set of points reached by the solutions to $\Sigma_y$ starting from $y$ over the window of time $[0, \tau]$, and the functions $\alpha$ and $\gamma$ are introduced in Corollary 3.13.

*Proof.* Using Pr1), we conclude that $T_r(y) > 0$ for all $y \in G$. Furthermore, using Pr2), we conclude that $t_{i+1} - t_i > 0$ for all $i \in \mathbb{N}$.

Next, we show that any solution $\phi$ to $\dot{x} = f(x, \kappa(y))$, starting from $y \in K$, satisfies $\phi([0, T_r(y)]) \subset K$. This is enough to conclude that the self-triggered closed-loop system is safe with respect $(X_o, X_u)$. To this end, we note that $\phi$ is locally absolutely continuous, and since $\alpha$ and $\gamma$ are continuously differentiable, it follows that $t \mapsto \alpha(\phi(t))$ and $t \mapsto \gamma(\phi(t), y)$ are also locally absolutely continuous. Hence, for each $t \in \text{dom } \phi$, there exists a sequence $\{\tau_n\}_{n=0}^N \subset [0, t]$, with $N \in \mathbb{N}^* \cup \{\infty\}$, such that

$$ \lim_{n \to N} \tau_n = t, \quad \tau_n - \tau_{n-1} > 0, $$

and the maps $t \mapsto \alpha(\phi(t))$ and $t \mapsto \gamma(\phi(t), y)$ are differentiable on each $(\tau_{n-1}, \tau_n)$.
Consider the map $\bar{\gamma}(\cdot) := \gamma(\cdot, y)$ and note that

$$ \bar{\gamma}(\phi(t)) - \bar{\gamma}(y) = \sum_{n=1}^{N} (\bar{\gamma}(\phi(\tau_n)) - \bar{\gamma}(\phi(\tau_{n-1}))), \quad \alpha(\phi(t)) - \alpha(y) = \sum_{n=1}^{N} [\alpha(\phi(\tau_n)) - \alpha(\phi(\tau_{n-1}))]. $$

As a result, using the classical mean-value theorem, we conclude that, for each $n \in \{1, 2, \dots, N\}$, there exist $c_n, d_n \in (\tau_{n-1}, \tau_n)$ such that

$$ \bar{\gamma}(\phi(t)) - \bar{\gamma}(y) = \sum_{n=1}^{N} \left( \left. \frac{d}{dt} \bar{\gamma}(\phi(t)) \right|_{t=c_n} (\tau_n - \tau_{n-1}) \right), \quad \alpha(\phi(t)) - \alpha(y) = \sum_{n=0}^{N} \left( \left. \frac{d}{dt} \alpha(\phi(t)) \right|_{t=d_n} (\tau_{n+1} - \tau_n) \right). $$

As a result, when $t \in [0, \tau]$, we conclude that

$$ 
\begin{aligned}
\bar{\gamma}(\phi(t)) - \bar{\gamma}(y) &\le t \sup\{\langle \nabla \bar{\gamma}(x), f(x, \kappa(y)) \rangle : x \in R_{\Sigma_y}(\tau, y)\}, \\
-\alpha(\phi(t)) + \alpha(y) &\le t \sup\{\langle -\nabla \alpha(x), f(x, \kappa(y)) \rangle : x \in R_{\Sigma_y}(\tau, y)\}.
\end{aligned}
\quad (3.9) $$

Next, we note that

$$ \frac{d}{dt} B(\phi(t)) = \langle \nabla B(\phi(t)), \dot{\phi}(t) \rangle \quad \text{for almost all } t \in \text{dom } \phi. $$
Integrating the previous equality from 0 to $t \le \tau$, we obtain

$$ 
\begin{aligned}
B(\phi(t)) - B(y) &\le \int_0^t [-\alpha(\phi(s)) + \bar{\gamma}(\phi(s))]ds \le \int_0^t [-\alpha(y) + \bar{\gamma}(y) + sM_r(\tau, y)]ds \\
&\le -t(\alpha(y) - \bar{\gamma}(y)) + \frac{t^2}{2}M_r(\tau, y) \quad \forall t \in [0, \tau].
\end{aligned}
$$

To obtain the latter inequalities, we used (3.6), (3.9), and (3.8).

Now, we note that, when $\alpha(y) - \bar{\gamma}(y) > 0$ and $M_r(\tau, y) > 0$, it follows that

$$ B(\phi(t)) - B(y) \le 0 \quad \forall t \in [0, 2\frac{(\alpha(y) - \bar{\gamma}(y))}{M_r(\tau, y)}] \cap [0, \tau]. $$

Otherwise, when $\alpha(y) - \bar{\gamma}(y) > 0$ and $M_r(\tau, y) \le 0$, we conclude that

$$ B(\phi(t)) - B(y) \le 0 \quad \forall t \in [0, \tau]. $$

The latter is enough to conclude that the proposed triggering sequence guarantees safety for the resulting self-triggered closed-loop system.

In the rest of the proof, we show the existence of $T > 0$ such that $t_{i+1} - t_i > T$ for all $i \in \mathbb{N}$. To do so, it is enough to show that the maps $y \mapsto T_r(y)$ is lower semicontinuous on $G$. Indeed, since it is already positive on $G$ and $G$ is compact, it would follow using [28], Theorem B.2 that $T_r$ reaches its minimum on $G$. As a result, we can take $T := \min\{\min\{T_r(y) : y \in G\}, T_1\}$.

To show that $T_r$ is lower semicontinuous on $G$, we start noting that the set-valued map $y \mapsto R_{\Sigma_y}(\tau, y)$ is upper semicontinuous with compact images on $G$; see Lemma A.1 in the Appendix. Next, we use [23], Theorem 1.4.16, under smoothness properties of $\gamma$ and $\alpha$, to conclude that the single-valued map $y \mapsto M_r(\tau, y)$ is upper semicontinuous on $G$. It is also locally bounded on $G$ since so is the set-valued map $y \mapsto R_{\Sigma_y}(\tau, y)$.

Now, since $\alpha$ is positive and continuous on $G$, we conclude that $y \mapsto \frac{\alpha(y) - \bar{\gamma}(y)}{M_r(\tau, y)}$ is lower semicontinuous and positive on $G$. To complete the proof, we consider a sequence $\{x_i\}_{i=0}^{\infty} \subset G$ that converges to $x_o \in G$. Since $y \mapsto M_r(\tau, y)$ is upper semicontinuous, we conclude that $\limsup_{i \to \infty} M_r(\tau, x_i) \le M_r(\tau, x_o)$. Moreover, by selecting an appropriate subsequence, we can assume, without loss of generality, that $\liminf_{i \to \infty} T_r(x_i) = \lim_{i \to \infty} T_r(x_i) = a > 0$. Also, since $M_r$ is locally bounded, one can select another subsequence to conclude the existence of $\beta \in \mathbb{R}$ such that $\lim_{i \to \infty} M_r(\tau, x_i) = \beta \le M_r(\tau, x_o)$. To finalize the proof, we distinguish the following three scenarios:

1. When $\beta < 0$, we conclude that $M_r(\tau, x_i) < 0$ for all $i \in \mathbb{N}$ sufficiently large. In this case, $T_r(x_i) = \tau$ for all $i \in \mathbb{N}$ sufficiently large, thus, $\lim_{i \to \infty} T_r(x_i) = \tau \ge T_r(x_o)$.

2. When $\beta > 0$, we conclude that $M_r(\tau, x_i) > 0$ for all $i \in \mathbb{N}$ sufficiently large. In this case, we conclude that $T_r(x_i) = \min\{\tau, \frac{\alpha(x_i) - \bar{\gamma}(x_i)}{M_r(\tau, x_i)}\}$ for all $i \in \mathbb{N}$ large. Hence, $\lim_{i \to \infty} T_r(x_i) = \min\{\tau, \lim_{i \to \infty} \frac{\alpha(x_i) - \bar{\gamma}(x_i)}{M_r(\tau, x_i)}\} \ge \min\{\tau, \frac{\alpha(x_o) - \bar{\gamma}(x_o)}{M_r(\tau, x_o)}\} \ge T_r(x_o)$.

3. When $\beta = 0$, we conclude that $|\frac{\alpha(x_i) - \bar{\gamma}(x_i)}{M_r(\tau, x_i)}| \ge \tau$ for all $i \in \mathbb{N}$ sufficiently large. Hence, $T_r(x_i) = \tau$ for all $i \in \mathbb{N}$ sufficiently large. $\square$

## 4. PREPARATORY MATERIAL

In this section, we present key intermediate results that allow us to construct a smooth barrier certificate for robustly-safe systems.
## 4.1. Perturbed differential inclusions

We will show that when Assumption 3.5 is verified, given $x \in \mathbb{R}^n$ and $\epsilon \in C_+$, we can find $T > 0$ such that $R_{\Sigma}^b(T, x) \subset \text{int}(R_{\Sigma_e}^b(T, x))$. A similar result requiring $F$ to be locally Lipschitz can be found in [29] and [7].

**Lemma 4.1.** Consider system $\Sigma$ such that Assumption 3.5 holds. Then, for each $x \in \mathbb{R}^n$ and for each $\epsilon \in C_+$, there exists $T > 0$ such that, for each $t \in (0, T]$, there exists $\delta > 0$ such that

$$y + \delta \mathbb{B} \subset R_{\Sigma_e}^b(t, x) \quad \forall y \in R_{\Sigma}^b(t, x) \setminus \{x\}, \qquad (4.1)$$

$$x + \delta \mathbb{B} \subset R_{\Sigma_e}^b(-t, y) = R_{\Sigma_e}^b(t, y) \quad \forall y \in R_{\Sigma}^b(t, x) \setminus \{x\}, \qquad (4.2)$$

where $\Sigma^- : \dot{x} \in -F(x)$ with $x \in \mathbb{R}^n$.

*Proof.* Given $x \in \mathbb{R}^n$ and $\epsilon \in C_+$, we pick $\Delta \in (0, 1)$ such that, for each $x_1, x_2 \in x + \Delta \mathbb{B}$ and for each $f_1 \in F(x_1)$, there exists $f_2 \in F(x_2)$ such that

$$|f_1 - f_2| \le \epsilon/2, \quad \epsilon := \min\{\epsilon(y) : y \in x + \mathbb{B}\}. \qquad (4.3)$$

The latter is possible since the set-valued map $F$ is assumed to be continuous.

Now, using Lemma A.2 in the Appendix, we conclude the existence of $b$ and $\bar{T} > 0$ such that $R_{\Sigma}(\bar{T}, (x + b\mathbb{B}))$ and $R_{\Sigma^-}(\bar{T}, (x + b\mathbb{B}))$ are bounded. As a result, we invoke Lemma A.1 in the appendix to conclude that $R_{\Sigma}$ and $R_{\Sigma^-}$ are outer semicontinuous and locally bounded on $[0, \bar{T}] \times (x + b\mathbb{B})$, which implies, according to Remark 2.3, that $R_{\Sigma}$ and $R_{\Sigma^-}$ are upper semicontinuous and have compact images on $[0, \bar{T}] \times (x + b\mathbb{B})$. Hence, we can find $T \in (0, \bar{T}]$ such that

$$R_{\Sigma}(T, x) \subset \left(x + \frac{\Delta}{2}\mathbb{B}\right), \qquad (4.4)$$

$$R_{\Sigma^-}(T, R_{\Sigma}(T, x)) \subset \left(x + \frac{\Delta}{2}\mathbb{B}\right). \qquad (4.5)$$

To prove (4.1), we let $\delta \in (0, \Delta/2]$ and we let $y \in R_{\Sigma}^b(t, x) \setminus \{x\}$ for some $t \in (0, T]$. Hence, there exists a solution $\phi \in S_{\Sigma}(x)$ such that $\phi(0) = x$ and $\phi(t) = y$.

Now, given $z \in y + \delta \mathbb{B}$, we consider the function $\eta : [0, t] \to \Delta \mathbb{B}$ given by

$$\eta(s) := \phi(s) - \frac{s}{t}(y-z) \quad \forall s \in [0, t].$$

Note that

$$\dot{\eta}(s) = \dot{\phi}(s) - \frac{1}{t}(y-z) \quad \text{for almost all } s \in [0, t].$$

Next, for almost all $s \in [0, t]$, we let $f_{\eta}(s) \in F(\eta(s))$ be such that $|f_{\eta}(s) - \dot{\phi}(s)| \le \epsilon/2$. This is possible using (4.3). Hence, we conclude that

$$\dot{\eta}(s) = f_{\eta}(s) + (\dot{\phi}(s) - f_{\eta}(s)) - \frac{1}{t}(y-z) \in F(\eta(s)) + \left(\frac{\epsilon}{2} + \frac{\delta}{t}\right) \mathbb{B} \quad \text{for almost all } s \in [0, t].$$

As a result, by taking $\delta := \frac{\min\{\epsilon t, \Delta\}}{2}$, we conclude that

$$\dot{\eta}(s) \in F(\eta(s)) + \underline{\mathbb{B}} \subset F(\eta(s)) + \epsilon(\eta(s))\mathbb{B} \quad \text{for almost all } s \in [0, t].$$
Hence, $\eta: [0, t] \to x + \Delta\mathbb{B}$ is a solution to $\Sigma_\epsilon$ verifying $\eta(0) = x$ and $\eta(t) = z$, which proves (4.1) since $z$ is arbitrary within $y + \delta\mathbb{B}$.

The proof of (4.2) follows using the same steps used to prove (4.1), while invoking (4.5) instead of (4.4). $\square$

It is important to note that, when only Assumption 2.2 is verified; namely, when $F$ is not required to be continuous, then we can find a system $\Sigma, x \in \mathbb{R}^n$, and $\epsilon \in C_+$ such that

$$R_{\Sigma}^{b}(t, x) \setminus \{x\} \not\subset \text{int}(R_{\Sigma_{\epsilon}}^{b}(t, x)) \quad \forall t > 0.$$

**Example 4.2.** Consider system $\Sigma$ with $n = 2$ and

$$F(x) := \begin{cases} [0 \quad 1]^{\top} & \text{if } x_2 < 0 \\ \text{co}\{[0 \quad 1]^{\top}, [-1 \quad 0]^{\top}\} & \text{otherwise.} \end{cases}$$

Let the constant function $\epsilon: \mathbb{R}^2 \to \{1/2\}$.

Note that $\Sigma$ admits a solution $\phi$ starting from $x_o := (0,0)$ that is given by $\phi(t) := [-t \quad 0]^{\top}$ for all $t \ge 0$. Note that, for each $t > 0$, we have $\phi(t) \in R_{\Sigma}^{b}(t, x_o) \setminus \{x_o\}$.

Now, given $t \ge 0$, we show that

$$\phi(t) - [0 \quad 1/i]^{\top} \notin R_{\Sigma_{\epsilon}}(t, x_o) \quad \forall i \in \{1, 2, \dots\}.$$

To do so, we show that the set $K := \{x \in \mathbb{R}^2: x_2 \ge 0\}$ is forward invariant for $\Sigma_{\epsilon:=1/2}$ by applying [14], Theorem 1. Indeed, using the barrier function candidate $B(x) := -x_2$, we note that

$$\nabla B(x) = [0 \quad -1]^{\top} \quad \text{and} \quad F(x) + \mathbb{B}/2 = \{[\alpha/2 \quad (\beta/2) + 1]^{\top}: \sqrt{\alpha^2 + \beta^2} \le 1\} \quad \forall x \in \mathbb{R}^2 \setminus K.$$

Hence,

$$\langle \nabla B(x), F(x) + \mathbb{B}/2 \rangle \subset [-3/2, -1/2] \quad \forall x \in \mathbb{R}^2 \setminus K.$$

## 4.2. The time to impact contractive and recurrent sets

We start recalling a definition of forward contractivity of a closed subset $K$ for a differential inclusion $\Sigma$ [30].

**Definition 4.3 (Forward contractivity).** A closed subset $K \subset \mathbb{R}^n$ is forward contractive for $\Sigma$ if it is forward invariant for $\Sigma$ and, for every $x_o \in \partial K$ and for every $\phi \in S_{\Sigma}(x_o)$, there exists $T > 0$ such that

$$\phi(t) \in \text{int}(K) \quad \forall t \in \text{dom} \, \phi \cap (0, T].$$

Next, we recall a definition of global recurrence of a subset $K \subset \mathbb{R}^n$ for a differential inclusion $\Sigma$ [20].

**Definition 4.4 (Global recurrence).** A set $K \subset \mathbb{R}^n$ is globally recurrent for $\Sigma$ if, for each $\phi \in S_{\Sigma}(x)$ with $x \in \mathbb{R}^n$, there exists $t \in \text{dom} \, \phi \cap \mathbb{R}_{\ge 0}$ such that $\phi(t) \in \text{int}(K)$.

Finally, we deduce a definition of local recurrence, which we will use in our work.

**Definition 4.5 (Local recurrence).** A set $K \subset \mathbb{R}^n$ is locally recurrent for $\Sigma$ on a neighborhood of $\partial K$, denoted by $U(\partial K)$, if, for each $\phi \in S_{\Sigma}(x)$ with $x \in U(\partial K)$, there exists $t \in \text{dom} \, \phi \cap \mathbb{R}_{\ge 0}$ such that $\phi(t) \in \text{int}(K)$.

**Remark 4.6.** Note that local (respectively, global) recurrence of the set $K \subset \mathbb{R}^n$ implies, respectively, local (resp. global) recurrence of the set $\text{cl}(K)$ and vice versa.
We recall here a variant of the time-to-impact function (also known as the hitting-time function [31]) with respect to a closed subset $K \subset \mathbb{R}^n$ along the solutions to $\Sigma$, which we denote by $B_K : \mathbb{R}^n \to \mathbb{R}$. We will show that such a function enjoys some regularity properties when $K$ is locally recurrent and forward contractive for $\Sigma$. We additionally show that $B_K$ is strictly decreasing along the solutions that lie within a neighborhood of $\partial K$.

Before defining $B_K$, we start introducing the map $\hat{B}_K : U_1 \to \mathbb{R} \cup \{\pm\infty\}$ given by

$$ \hat{B}_K(x) := \begin{cases} \inf\{T_K(\phi) : \phi \in S_\Sigma(x)\} & \text{if } x \in \text{int}(K) \\ 0 & \text{if } x \in \partial K \\ \sup\{T_K(\phi) : \phi \in S_\Sigma(x)\} & \text{otherwise,} \end{cases} \quad (4.6) $$

where, for each $\phi \in S_\Sigma(U_1)$, the functional $T_K : S_\Sigma(U_1) \to \mathbb{R} \cup \{\pm\infty\}$ is given by

$$ T_K(\phi) := \arg\min\{|t| : t \in \text{dom} \phi, \phi(t) \in \partial K\}. $$

Roughly speaking, $T_K(\phi)$ associates to each $\phi \in S_\Sigma(x)$ the time, with the smallest norm, at which $\phi$ hits $\partial K$. Then, $\hat{B}_K(x)$ is defined to be the smallest (respectively, the largest) value among such times, over all the $\phi$s in $S_\Sigma(x)$, when $x \in \text{int}(K)$ (respectively, when $x \in \mathbb{R}^n \setminus K$).

In [31], functionals similar to $T_K$ are introduced under the name hitting- and exit-time functionals, denoted by $\theta_K$ and $\tau_K$, respectively. Note that, under Assumption 4.7 below, the latter two functionals coincide, and are related to $T_K$ through the relationship:

$$ T_K(\phi) = \theta_{\mathbb{R}^n \setminus K}(\phi) = \tau_{\mathbb{R}^n \setminus K}(\phi) \quad \forall \phi \in S_\Sigma(x) \text{ with } x \in \mathbb{R}^n \setminus K. $$

**Assumption 4.7.** There exists a closed subset $U_1 \subset \mathbb{R}^n$ such that $\partial K \subset \text{int}(U_1)$ and

A4.71) The set $K$ is locally recurrent for $\Sigma$ on $U_1$.

A4.72) The set $\mathbb{R}^n \setminus K$ is locally recurrent for $\Sigma^-$ on $U_1$.

A4.73) The set $K$ is forward contractive for $\Sigma$.

A4.74) The set $\mathbb{R}^n \setminus \text{int}(K)$ is forward contractive for $\Sigma^-$.

Using [31], Proposition 4.2.4, we can guarantee that $\hat{B}_K(x) = \sup\{T_K(\phi) : \phi \in S_\Sigma(x)\}$ is upper semicontinuous on $\mathbb{R}^n \setminus K$ provided that Assumption 2.2 holds and $F$ is strict Marchaud. In the following lemma, we establish the same conclusion, among others, using Assumptions 2.2 and 4.7 ($F$ is not required to be strict Marchaud).

**Lemma 4.8.** Consider system $\Sigma$ such that Assumption 2.2 holds. Furthermore, consider a closed subset $K \subset \mathbb{R}^n$ for which Assumption 4.7 holds. Then, the following properties are satisfied.

P4.81) $\hat{B}_K$ is well defined on $U_1$; i.e., for each $x \in U_1$, $\hat{B}_K(x)$ exists and is finite.

P4.82) $\hat{B}_K$ is upper semicontinuous on $U_1 \setminus \text{int}(K)$.

P4.83) $\hat{B}_K$ is lower semicontinuous on $K \cap U_1$.

*Proof.* We first use A4.71) and A4.72) to conclude that each maximal solution $\phi \in S_\Sigma(x)$ with $x \in U_1$ reaches $\partial K$ at some time, which can be either positive or negative. Hence, $T_K(\phi)$ exists and it is finite for all $\phi \in S_\Sigma(U_1)$.

Next, we will show that the map $x \mapsto T_K(S_\Sigma(x))$ is locally bounded on $U_1 \setminus K$. To find a contradiction, we pick $x_o \in U_1 \setminus K$, a sequence $\{x_i\}_{i=1}^\infty \subset U_1 \setminus K$ such that $\lim_{i \to \infty} x_i = x_o$, and a sequence $\{\phi_i\}_{i=1}^\infty$ of solutions (not necessarily maximal) to $\Sigma$ such that $\phi_i(0) = x_i$, $\text{dom} \phi_i = [0, T_K(\phi_i)]$ for all $i \in \{1, 2, ...\}$, and $\lim_{i \to \infty} T_K(\phi_i) = +\infty$. Without loss of generality, we also assume that $i \mapsto T_K(\phi_i)$ is strictly increasing. Since $F$ is locally bounded, using Lemma A.2 in the Appendix, we conclude the existence of $\bar{T} \in \mathbb{R}_{>0} \cup \{+\infty\}$ the largest time such that, on any interval $[0, T] \subset [0, \bar{T})$, the sequence $\{\phi_i\}_{i=0}^\infty$ is uniformly bounded. As a result, by passing to an appropriate
subsequence and using [26], Theorem 5.29 recursively on each closed interval $[0, T] \subset [0, \bar{T})$, we conclude the existence of $\phi : [0, \bar{T}) \to \mathbb{R}^n$ solution to $\Sigma$ starting from $x_o$ such that

$$ \lim_{i \to \infty} \phi_i(t) = \phi(t) \quad \forall t \in [0, \bar{T}). \qquad (4.7) $$

Now, since $x_o \in U_1 \setminus K$, we conclude the existence of $\alpha \in (0, \bar{T})$ such that $T_K(\phi) < \alpha$. Indeed, $\alpha$ must be smaller than $\bar{T}$ because $T_K(\phi)$ exists and is finite, and when $\bar{T}$ is finite, we necessarily have $\lim_{t \to \bar{T}} \phi(t) = +\infty$. Next, by forward contractivity of the set $K$ for $\Sigma$, we conclude that $\phi(\alpha) \in \text{int}(K)$; thus, there exists $\beta > 0$ such that $|\phi(\alpha)|_{\mathbb{R}^n \setminus K} \ge \beta$. However, there exists $i^* \in \mathbb{N}$ such that $\phi_i(\alpha) \notin K$ for all $i \ge i^*$, which implies that $|\phi(\alpha) - \phi_i(\alpha)| \ge \beta$ for all $i \ge i^*$. The latter contradicts (4.7); hence, the map $x \mapsto T_K(S_\Sigma(x))$ is locally bounded and thus P4.81) follows as a direct consequence.

To prove P4.82), we start re-expressing $\hat{B}$ as

$$ \hat{B}(x) := \sup\{t_\phi : t_\phi \in T_K(S_\Sigma(x))\} \quad \forall x \in U_1 \setminus \text{int}(K). $$

Furthermore, we propose to show that the set-valued map $x \mapsto T_K(S_\Sigma(x))$ is outer semicontinuous on $U_1 \setminus \text{int}(K)$. For this, we consider a sequence $\{x_i\}_{i=1}^\infty \subset U_1 \setminus \text{int}(K)$ that converges to $x_o \in U_1 \setminus \text{int}(K)$ and a sequence $\{t_i\}_{i=1}^\infty \subset \mathbb{R}_{\ge 0}$ that converges to $t_o \in \mathbb{R}_{\ge 0}$ such that $t_i \in T_K(S_\Sigma(x_i))$ for all $i \in \{1, 2, ...\}$, and we show that $t_o \in T_K(S_\Sigma(x_o))$. Indeed, let a sequence of solutions $\{\phi_i\}_{i=1}^\infty$, with $\text{dom} \phi_i = [0, t_i]$, $t_i = T_K(\phi_i)$, and $\phi_i(0) = x_i$ for all $i \in \{1, 2, ...\}$. Here, we distinguish between two cases.

* When the sequence $\{\phi_i\}_{i=1}^\infty$ is uniformly bounded, using [26], Theorem 5.29, we conclude the existence of a solution $\phi : [0, t_o] \to \mathbb{R}^n$ that is the graphical limit of an appropriate subsequence of $\{\phi_i\}_{i=1}^\infty$. Next, we show that $t_o = T_K(\phi)$. To find a contradiction, we assume that $t_o \ne T_K(\phi)$. Hence, using A4.71) and A4.73), it follows that there exists $\delta > 0$ such that either $|\phi(t_o)|_K \ge \delta$ or $|\phi(t_o)|_{\mathbb{R}^n \setminus K} \ge \delta$. On the other hand, by graphical convergence and continuity of solutions, we conclude that $\lim_{i \to \infty} \phi_i(t_i) = \phi(t_o)$. Hence, there exists $i^* \in \{1, 2, ...\}$ such that $|\phi_i(t_i) - \phi(t_o)| \le \delta/2$ for all $i \ge i^*$. The latter implies that $|\phi_i(t_i)|_{\partial K} \ge \delta/2$ for all $i \ge i^*$, and the contradiction follows.

* If the sequence is not uniformly bounded, we exploit local boundedness of $F$ and Lemma A.2 in the Appendix, to conclude the existence of $\bar{T} \in (0, t_o]$ the largest time such that the sequence $\{\phi_i\}_{i=1}^\infty$ is uniformly bounded on any $[0, T] \subset [0, \bar{T})$. Using [26], Theorem 5.29 recursively on each interval $[0, T] \subset [0, \bar{T})$, we conclude the existence of an unbounded solution $\phi : [0, \bar{T}) \to \mathbb{R}^n$ such that, after passing to an appropriate subsequence, we obtain

$$ \lim_{i \to \infty} \phi_i(t) = \phi(t) \quad \forall t \in [0, \bar{T}). \qquad (4.8) $$

In this case, we conclude that $\phi$ must reach $\partial K$ at some $\alpha := T_K(\phi) \in [0, \bar{T})$. Since $K$ is contractive, then we can find $\beta \in (\alpha, t_o)$ such that $|\phi(\beta)|_{\mathbb{R}^n \setminus K} = \gamma$ for some $\gamma > 0$. Now, using (4.8), we conclude that $\lim_{i \to \infty} |\phi_i(\beta)|_{\mathbb{R}^n \setminus K} = \gamma > 0$ with $\beta < t_o$; hence, $\beta < t_i$ for $i$ large enough. This yields to a contradiction implying that $\alpha = t_o$.

Having the map $x \mapsto T_K(S_\Sigma(x))$ locally bounded and outer semicontinuous on $U_1 \setminus \text{int}(K)$ implies that the map $x \mapsto T_K(S_\Sigma(x))$ is upper semicontinuous with compact images on $U_1 \setminus \text{int}(K)$; see Remark 2.3. Therefore, using [23], Theorem 1.4.16, we conclude that $\hat{B}_K$ is upper semicontinuous on $U_1 \setminus \text{int}(K)$.

Finally, to prove P4.83), it is enough to notice that

$$ \inf\{T_K(\phi) : \phi \in S_\Sigma(x)\} = -\sup\{-T_K(\phi) : \phi \in S_\Sigma(x)\} = -\sup\{T_K(\phi) : \phi \in S_{\Sigma^{-}}(x)\}. $$

Therefore, the previous arguments apply, under A4.72) and A4.74), to conclude that $-\hat{B}_K$ is upper semicontinuous on $K \cap U_1$; thus, $\hat{B}_K$ is lower semicontinuous on $K \cap U_1$. $\square$
Next, we introduce the function $B_K : \mathbb{R}^n \to \mathbb{R}$, which extends $\hat{B}_K$ to the entire $\mathbb{R}^n$ and is given by

$$ B_K(x) := \begin{cases} \inf\{\hat{B}_K(y) : y \in \text{Proj}_{U_1}(x)\} & \text{if } x \in \text{int}(K) \\ 0 & \text{if } x \in \partial K \\ \sup\{\hat{B}_K(y) : y \in \text{Proj}_{U_1}(x)\} & \text{otherwise.} \end{cases} \quad (4.9) $$

**Lemma 4.9.** Consider system $\Sigma$ such that Assumption 2.2 holds. Furthermore, consider $(X_o, X_u) \subset \mathbb{R}^n \times \mathbb{R}^n$ and a closed subset $K \subset \mathbb{R}^n$ such that $X_o \subset K$, $X_u \cap K = \emptyset$, and Assumption 4.7 holds.

Then, the following properties are satisfied.

P4.91) $B_K$ is a barrier function candidate with respect to $(X_o, X_u)$ and $K = \{x \in \mathbb{R}^n : B_K(x) \le 0\}$.

P4.92) $B_K$ is upper semicontinuous on $\mathbb{R}^n \setminus \text{int}(K)$.

P4.93) $B_K$ is lower semicontinuous on $K$.

P4.94) Along each solution $\phi$ to $\Sigma$ (not necessarily maximal) such that $\phi(\text{dom } \phi) \subset U_1$, the map $t \mapsto B_K(\phi(t))$ is decreasing. In particular, we have

$$ B_K(\phi(t')) - B_K(\phi(t)) \le t - t' \quad \forall t, t' \in \text{dom } \phi \text{ with } t \le t'. $$

*Proof.* To prove P4.91), we use the fact that the set $K$ is forward contractive for $\Sigma$. Hence, the solutions to $\Sigma$ starting outside the set $K$ cannot reach $K$ at negative times. This implies that $B_K(x) > 0$ for all $x \in \mathbb{R}^n \setminus K$. Similarly, the set $\mathbb{R}^n \setminus \text{int}(K)$ is forward contractive for $\Sigma^-$. Hence, the solutions to $\Sigma$ starting from $K$ cannot reach $\mathbb{R}^n \setminus \text{int}(K)$ at positive times. This implies that $B_K(x) \le 0$ for all $x \in K$.

To prove P4.92), we start noting that

$$ B_K(x) = \hat{B}_K(x) \quad \forall x \in U_1, \quad (4.10) $$

which implies, using A4.72), that $B_K$ is upper semicontinuous on the set $U_1 \setminus K$. Furthermore, using [22], Example 5.23, we conclude that $\text{Proj}_{U_1}$ is outer semicontinuous and locally bounded; hence, admits compact images. Thus, using [23], Theorem 1.4.16, P4.92) follows.

Similarly, to prove P4.93), we use (4.10) and P4.83) to conclude that $B_K$ is lower semicontinuous on $U_1 \cap K$. Furthermore, for each $x \in K \setminus U_1$, we have $B_K(x) := -\sup\{-\hat{B}_K(y) : y \in \text{Proj}_{U_1}(x)\}$. Hence, using [22], Example 5.23, we know that $\text{Proj}_{U_1}$ is outer semicontinuous and locally bounded; thus, admits compact images. Thus, using [23], Theorem 1.4.16, we conclude that $-B_K$ is upper semicontinuous; thus, $B_K$ is lower semicontinuous on $K$.

Finally, to prove P4.94), we let $\phi$ be a solution to $\Sigma$ (not necessarily maximal) starting from $x_o \in U_1$ and such that $\phi(\text{dom } \phi) \subset U_1$. Furthermore, we let $t \in \text{dom } \phi$ and $\sigma > 0$ such that $[t, t + \sigma] \subset \text{dom } \phi$. Hence,

$$ B_K(\phi(s)) = \hat{B}_K(\phi(s)) \quad \forall s \in [t, t + \sigma]. $$

Next, we distinguish three situations.

1) When $\phi([t, t + \sigma]) \subset U_1 \setminus K$, there exists a solution $\psi \in S_\Sigma(\phi(t + \sigma))$ such that $B_K(\phi(t + \sigma)) = T_K(\psi)$. Additionally, we introduce the solution $\hat{\psi} \in S_\Sigma(\phi(t))$ satisfying

$$ \hat{\psi}(s) = \begin{cases} \psi(s - \sigma) & \forall s \ge \sigma, \\ \phi(t + s) & \forall s \in [0, \sigma]. \end{cases} $$

Then, $T_K(\hat{\psi}) = \sigma + T_K(\psi)$. Hence, (4.6) implies that

$$ B_K(\phi(t)) \ge T_K(\hat{\psi}) = \sigma + B_K(\phi(t + \sigma)). $$
2) When $\phi([t, t + \sigma]) \subset U_1 \cap \text{int}(K)$, there exists a solution $\psi \in S_\Sigma(\phi(t))$ such that $B_K(\phi(t)) = T_K(\psi)$. Additionally, we introduce the solution $\hat{\psi} \in S_\Sigma(\phi(t + \sigma))$ satisfying

$$ \hat{\psi}(s) = \begin{cases} \psi(s + \sigma) & \forall s \le -\sigma, \\ \phi(t + \sigma + s) & \forall s \in [-\sigma, 0]. \end{cases} $$

As a result, we have $T_K(\hat{\psi}) = -\sigma + T_K(\psi)$ and (4.6) implies that

$$ B_K(\phi(t + \sigma)) \le T_K(\hat{\psi}) = -\sigma + B_K(\phi(t)). $$

3) Finally, we consider a solution $\phi$ satisfying $\phi(t) \in U_1 \setminus K$, $\phi(t + \sigma) \in U_1 \cap \text{int}(K)$, and such that there exists a unique $t_1 \in (t, t + \sigma)$ for which $\phi(t_1) \in \partial K$. Indeed, the aforementioned scenario complement the scenarios in the previous two items since, due to A4.73) and A4.74), the solutions cannot slide on $\partial K$. Now, as in the previous steps, we conclude that

$$ B_K(\phi(t + t'_1)) - B_K(\phi(t)) \le -t'_1 \quad \forall t'_1 \in [0, t_1) $$

and

$$ B_K(\phi(t + \sigma)) - B_K(\phi(t + t'_1)) \le -(\sigma - t'_1) \quad \forall t'_1 \in (t_1, \sigma]. $$

Next, we note that

$$ B_K(\phi(t + t'_1)) > 0 = B_K(\phi(t + t_1)) \quad \forall t'_1 \in [0, t_1) $$

and

$$ B_K(\phi(t + t'_1)) < 0 = B_K(\phi(t + t_1)) \quad \forall t'_1 \in (t_1, \sigma]. $$

Hence,

$$ B_K(\phi(t + t_1)) - B_K(\phi(t)) \le -t_1 \quad \text{and} \quad B_K(\phi(t + \sigma)) - B_K(\phi(t + t_1)) \le -(\sigma - t_1), $$

implying that $B_K(\phi(t + \sigma)) - B_K(\phi(t)) \le -\sigma$.

□

## 5. PROOF OF THEOREM 3.7

We propose to prove Theorem 3.7 by following three steps.

**Step 1** Given $\bar{\epsilon} \in C_+$, we introduce the set

$$ K_{\bar{\epsilon}} := \bigcup_{t \ge 0} \bigcup_{x \in X_o} R_{\Sigma_{\bar{\epsilon}}}(t, x). \qquad (5.1) $$

**Lemma 5.1.** Consider system $\Sigma$ such that Assumption 3.5 holds. Consider $(X_o, X_u) \subset \mathbb{R}^n \times \mathbb{R}^n$ such that $\Sigma$ is robustly safe with respect to $(X_o, X_u)$. Then, given a robustness margin $\bar{\epsilon}_o$, we conclude that, for each $\bar{\epsilon} \in C_+$ satisfying

$$ \bar{\epsilon}(x) < \bar{\epsilon}_o(x) \quad \forall x \in \mathbb{R}^n, $$
the following properties hold.

1) If Assumption 3.8 holds, then

$$ \mathrm{cl}(X_u) \cap \mathrm{cl}(K_{\bar{\epsilon}}) = \emptyset. \qquad (5.2) $$

2) If Assumption 3.6 holds, then

$$ X_u \cap \mathrm{cl}(K_{\bar{\epsilon}}) = \emptyset. \qquad (5.3) $$

**Step 2** It is shown in [7], Lemma 2 that, given $\bar{\epsilon} \in C_+$, when $\mathrm{cl}(K_{\bar{\epsilon}})$ is bounded and $F$ is single valued and smooth, every maximal solution to $\Sigma$ starting from $R_{\Sigma}(t, \partial K_{\bar{\epsilon}})$, for some $t \in \mathbb{R}$, must cross $\partial K_{\bar{\epsilon}}$ only one time. Motivated by this fact, we establish contractivity of $\mathrm{cl}(K_{\bar{\epsilon}})$ for $\Sigma_{\epsilon}$, for an appropriate choice of the perturbation $\epsilon$.

**Lemma 5.2** (Contarctivity of the set $\mathrm{cl}(K_{\bar{\epsilon}})$). Consider system $\Sigma$ such that Assumption 3.5 holds. Consider $X_o \subset \mathbb{R}^n$, $\bar{\epsilon} \in C_+$, and the set $K_{\bar{\epsilon}}$ introduced in (5.1). Then, for each $\epsilon \in C_+$ satisfying

$$ \epsilon(x) < \bar{\epsilon}(x) \quad \forall x \in \mathbb{R}^n, \qquad (5.4) $$

the following properties hold.

P5.21) The set $\mathrm{cl}(K_{\bar{\epsilon}})$ is forward contractive for $\Sigma_{\epsilon}$.

P5.22) The set $\mathbb{R}^n \setminus \mathrm{int}(K_{\bar{\epsilon}})$ is forward contractive for $\Sigma_{\bar{\epsilon}}^-$.

P5.23) The solutions to $\Sigma_{\epsilon}$ starting from $\mathrm{int}(K_{\bar{\epsilon}})$ never reach $\partial K_{\bar{\epsilon}}$ for positive times.

P5.24) The solutions to $\Sigma_{\epsilon}$ starting from $\mathbb{R}^n \setminus \mathrm{cl}(K_{\bar{\epsilon}})$ never reach $\partial K_{\bar{\epsilon}}$ for negative times.

**Step 3** It is shown in [7], Lemma 3 that, when the set $\mathrm{cl}(K_{\bar{\epsilon}})$ is bounded and when $F$ is single-valued and smooth, there exists a neighborhood of $\partial K_{\bar{\epsilon}}$, denoted $U \subset \mathbb{R}^n$, such that every maximal solution to $\Sigma$ starting from $U$ reaches $\partial K_{\bar{\epsilon}}$ in finite (positive or negative) time. Inspired by this observation and using Lemma 5.2, we establish local recurrence of the set $K_{\bar{\epsilon}}$ on a neighborhood of $\partial K_{\bar{\epsilon}}$.

**Lemma 5.3** (Recurrence of the set $\mathrm{cl}(K_{\bar{\epsilon}})$). Consider system $\Sigma$ such that Assumption 3.5 holds. Consider $X_o \subset \mathbb{R}^n$, $\epsilon_1, \bar{\epsilon} \in C_+$ such that

$$ \epsilon_1(x) < \bar{\epsilon}(x) \quad \forall x \in \mathbb{R}^n. \qquad (5.5) $$

Then, there exists a closed subset $U_1 \subset \mathbb{R}^n$ such that

$$ \partial K_{\bar{\epsilon}} \subset \mathrm{int}(U_1), \qquad (5.6) $$

where the set $K_{\bar{\epsilon}}$ is introduced in (5.1). Moreover, for each $\epsilon \in C_+$ satisfying

$$ \epsilon(x) \le \epsilon_1(x) \quad \forall x \in \mathbb{R}^n, \qquad (5.7) $$

the following properties hold:

P5.31) The set $K_{\bar{\epsilon}}$ is locally recurrent for $\Sigma_{\epsilon}$ on $U_1$.

P5.32) The set $\mathbb{R}^n \setminus K_{\bar{\epsilon}}$ is locally recurrent for $\Sigma_{\bar{\epsilon}}$ on $U_1$.

As a consequence, when $\Sigma$ is robustly safe with respect to $(X_o, X_u)$ and the assumptions in Theorem 3.7 hold, using Lemmas 5.1, 5.2, and 5.3, we are able to prove the existence of robust-safety margins $\bar{\epsilon}$ and $\epsilon_1$ satisfying (5.5) such that, for each $\epsilon \in C_+$ satisfying (5.7), Assumption 4.7 is verified while replacing $(\Sigma, K)$ therein by $(\Sigma_{\epsilon}, \mathrm{cl}(K_{\bar{\epsilon}}))$, $X_o \subset \mathrm{cl}(K_{\bar{\epsilon}})$, and $X_u \cap \mathrm{cl}(K_{\bar{\epsilon}}) = \emptyset$. Hence, applying Lemma 4.9, we conclude that C1) is verified
for $B = B_{cl(K_{\bar{\epsilon}})}$ as defined in (4.6) and (4.9) while replacing $(\Sigma, K)$ therein by $(\Sigma_{\epsilon_1}, cl(K_{\bar{\epsilon}}))$ and for any $\epsilon \in C_+$ satisfying (5.4).

**Remark 5.4.** It is worth-noting that our approach to prove Theorem 3.7 shares the following common steps with the proof in [7].

1. The invariance and recurrence properties of the set $K_{\bar{\epsilon}}$ established in Lemmas 5.2 and 5.3, which are based on Lemma 4.1. The latter lemma is also inspired by [7], where the conclusions hold only when $F$ is locally Lipschitz.

2. The construction of the time-to-impact function with respect to the set $K_{\bar{\epsilon}}$ and its regularity and decay properties established in Lemma 4.8. Such a function in [7] is defined under unique solutions and it is shown to be continuous, while in our case it is defined for non-unique solutions and shown to be only semicontinuous.

Past the latter two (common) steps, [7] uses boundedness of the set $\mathbb{R}^n \setminus X_u$ to smoothen the continuous time-to-impact function using a density argument. Clearly, this last step cannot be followed in our case, since we do not assume boundedness of the safe region and since the time-to-impact function is only semicontinuous.

# 6. PROOFS OF LEMMAS 4-6

## 6.1. Proof of Lemma 5.1

We prove 1) using contradiction. That is, when (5.2) is not satisfied, we conclude that there exists $x \in \partial X_u \cap \partial K_{\bar{\epsilon}}$ and such that $x \in \partial K_{\bar{\epsilon}_o}$. The latter is the only possibility since $\bar{\epsilon}_o$ is a robustness margin and since $K_{\bar{\epsilon}} \subset K_{\bar{\epsilon}_o}$. Furthermore, using Assumption 3.8, we conclude that $x \notin cl(X_o)$. Next, we consider a sequence $\{x_i\}_{i=0}^{\infty} \subset K_{\bar{\epsilon}}$ that converges to $x$. For $\epsilon := \min\{\bar{\epsilon}_o(y) - \bar{\epsilon}(y) : y \in x + \mathbb{B}\}$, we pick $\Delta \in (0, 1)$ such that $(x + \Delta\mathbb{B}) \cap cl(X_o) = \emptyset$ and, for each $(x_1, x_2) \in (x + \Delta\mathbb{B}) \times (x + \Delta\mathbb{B})$ and for each $\eta_1 \in F(x_1)$, there exists $\eta_2 \in F(x_2)$ such that

$$|\eta_1 - \eta_2| \le \frac{\epsilon}{2}. \qquad (6.1)$$

The latter is possible since the set-valued map $F$ is assumed to be continuous. Without loss of generality, we assume that

$$x_i \in x + \frac{\Delta}{4} \mathbb{B} \quad \forall i \in \mathbb{N}. \qquad (6.2)$$

Furthermore, we consider a sequence of solutions $\{\phi_i\}_{i=0}^{\infty}$ to $\Sigma_{\bar{\epsilon}}$ such that each solution $\phi_i$ starts from $x_{oi} \in cl(X_o)$. Moreover, for each $i \in \mathbb{N}$, there exist $t_i^1 > t_i^o > 0$ such that $\phi_i([t_i^o, t_i^1]) \subset x + \frac{\Delta}{2}\mathbb{B}$, $\phi_i([t_i^o, t_i^1]) \subset K_{\bar{\epsilon}}$, $|\phi_i(t_i^o) - x| = \frac{\Delta}{2}$, and $\phi_i(t_i^1) = x_i$. Next, using (6.2) and local boundedness of the map $F + \bar{\epsilon}\mathbb{B}$, we conclude the existence of $t > 0$ such that

$$t_i^1 - t_i^o \ge t \quad \forall i \in \mathbb{N}. \qquad (6.3)$$

Now, we let $\tilde{\Sigma} := \Sigma_{\bar{\epsilon}}$; which implies that $\tilde{\Sigma}_{\epsilon:=\bar{\epsilon}_o-\bar{\epsilon}} = \Sigma_{\bar{\epsilon}_o}$. Furthermore, using a similar approach as in the proof of Lemma 4.1, we will show the existence of $\delta > 0$ such that

$$\phi_i(t_i^1) + \delta \mathbb{B} \subset R_{\tilde{\Sigma}_{\bar{\epsilon}}}^b (t_i^1 - t_i^o, \phi_i(t_i^o)) \quad \forall i \in \mathbb{N}. \qquad (6.4)$$

Indeed, let $\delta \in (0, \Delta/4]$ and note that $x_i \in R_{\tilde{\Sigma}}^b (t_i^1 - t_i^o, y_i) \setminus \{y_i\}$, where $y_i := \phi_i(t_i^o)$.
Now, given $z \in x_i + \delta\mathbb{B}$, we consider the function

$$ \eta_{zi}(s) := \phi_i(s + t_i^o) - \frac{s}{t_i^1 - t_i^o} (x_i - z) \quad \forall s \in [0, t_i^1 - t_i^o]. $$

Note that $\eta_{zi}(s) \in x + \Delta\mathbb{B}$ for all $s \in [0, t_i^1 - t_i^o]$, and for all $i \in \mathbb{N}$. Furthermore, for almost all $s \in [0, t_i^1 - t_i^o]$, we have

$$ \dot{\eta}_{zi}(s) := \dot{\phi}_i(s + t_i^o) - \frac{1}{t_i^1 - t_i^o} (x_i - z). $$

Next, for almost all $s \in [0, t_i^1 - t_i^o]$, we let $\eta_{1i}(s) \in F(\eta_{zi}(s))$ be such that $|\eta_{1i}(s) - \dot{\phi}_i(s + t_i^o)| \le \epsilon/2$. The latter is possible using (6.1). Hence, for almost all $s \in [0, t_i^1 - t_i^o]$, we have

$$ \dot{\eta}_{zi}(s) := \eta_{1i}(s) + (\dot{\phi}_i(s + t_i^o) - \eta_{1i}(s)) - \frac{1}{t_i^1 - t_i^o} (x_i - z) \in F(\eta_{zi}(s)) + \left(\frac{\epsilon}{2} + \frac{\delta}{t_i^1 - t_i^o}\right) \mathbb{B}. $$

Hence, by taking $\delta := \min\{\epsilon t, \Delta\}/4$, where $t$ comes from (6.3), we conclude that, for almost all $s \in [0, t_i^1 - t_i^o]$, $\eta_{zi}(s) \in F(\eta_{zi}(s)) + \epsilon\mathbb{B} \subset F(\eta_{zi}(s)) + \epsilon(\eta_{zi}(s))\mathbb{B}$.

$$ \dot{\eta}_{zi}(s) \in F(\eta_{zi}(s)) + \epsilon\mathbb{B} \subset F(\eta_{zi}(s)) + \epsilon(\eta_{zi}(s))\mathbb{B}. $$

Hence, $\eta_{zi} : [0, t_i^1 - t_i^o] \to x + \Delta\mathbb{B}$ is a solution to $\tilde{\Sigma}_\epsilon$ with $\eta_{zi}(0) = y_i$ and $\eta_{zi}(t_i^1 - t_i^o) = z$, which proves (6.4). Next, since $\delta$ is uniform in $i$, we conclude the existence of $i \in \mathbb{N}$ sufficiently large such that

$$ x \in \text{int} \left( R_{\tilde{\Sigma}_\epsilon}^b (t_i^1 - t_i^o, y_i) \right). $$

Hence, since $x \in \partial K_{\bar{\epsilon}_o}$, we conclude that there exists $y \notin \text{cl}(K_{\bar{\epsilon}_o})$ such that $y \in R_{\tilde{\Sigma}_\epsilon}^b (t_i^1 - t_i^o, y_i)$. However, $y_i = \phi_i(t_i^o) \in K_{\bar{\epsilon}} \subset K_{\bar{\epsilon}_o}$ and the latter set is, by definition, forward invariant for $\tilde{\Sigma}_\epsilon = \Sigma_{\bar{\epsilon}_o}$, which yields to a contradiction.

Finally, we prove 2)) using contradiction. That is, when (5.3) is not satisfied, we conclude that there exists $x \in \partial X_u \cap \partial K_{\bar{\epsilon}} \cap X_u$ such that $x \in \partial K_{\bar{\epsilon}_o}$. The latter is the only possibility since $\bar{\epsilon}_o$ is a robustness margin and $K_{\bar{\epsilon}} \subset K_{\bar{\epsilon}_o}$ by definition. Furthermore, we distinguish two situations:

* When $x \notin \text{cl}(X_o)$, the contradiction follows using the same steps as in the proof of 1)).

* When $x \in \text{cl}(X_o)$, the contradiction follows using Assumption 3.6.

## 6.2. Proof of Lemma 5.2

We prove P5.21) by first proving that the set $\text{cl}(K_{\bar{\epsilon}})$ is forward invariant for $\Sigma_\epsilon$. To find a contradiction, we assume the existence of $x \in \partial K_{\bar{\epsilon}}$ and $\phi \in S_{\Sigma_\epsilon}(x)$ such that, for some $T_1 > 0$,

$$ \phi(s) \in \mathbb{R}^n \setminus \text{cl}(K_{\bar{\epsilon}}) \quad \forall s \in (0, T_1]. $$

Next, we take $t \in (0, \min\{T_1, T\})$, where $T > 0$ is such that, for each $t \in (0, T]$, there exists $\delta > 0$ such that $x + \delta\mathbb{B} \subset R_{\tilde{\Sigma}_\epsilon}^b(-t, \phi(t))$; see Lemma 4.1. Hence, there exists $y \in \text{int}(K_{\bar{\epsilon}})$ and a solution $\psi$ to $\Sigma_{\bar{\epsilon}}$ such that $\psi(0) = y$ and $\psi(t) = \phi(t)$. The latter implies that the set $K_{\bar{\epsilon}}$ is not forward invariant for $\Sigma_{\bar{\epsilon}}$, which yields to a contradiction.
To complete the proof, we show that the solutions to $\Sigma_{\epsilon}$ cannot slide on $\partial K_{\bar{\epsilon}}$; namely, for each $x \in \partial K_{\bar{\epsilon}}$ and for each $\phi \in S_{\Sigma_{\epsilon}}(x)$, there exists $T > 0$ such that

$$ \phi(t) \in \mathrm{int}(K_{\bar{\epsilon}}) \quad \forall t \in (0, T]. $$

To find a contradiction, we assume the existence of a solution $\phi$ to $\Sigma_{\epsilon}$ starting from $x_o \in \mathbb{R}^n$ and an interval $(t_1, t_2) \subset \mathrm{dom}\,\phi$, with $t_2 > t_1$, such that $\phi(s) \in \partial K_{\bar{\epsilon}}$ for all $s \in (t_1, t_2)$. Next, we pick $t_3 \in (t_1, t_2)$ and we take $t \in (0, \min\{(t_2 - t_3), T\})$, where $T > 0$ is such that, for each $t \in (0, T]$, there exists $\delta > 0$ such that

$$ \phi(t + t_3) + \delta \mathbb{B} \subset R_{\Sigma_{\bar{\epsilon}}}^{b}(t, \phi(t_3)); \qquad (6.5) $$

see Lemma 4.1. Similarly, we take $t \in (0, \min\{(t_3 - t_1), T\})$, where $T > 0$ is such that, for each $t \in (0, T]$, there exists $\delta > 0$ such that

$$ \phi(-t + t_3) + \delta \mathbb{B} \subset R_{\Sigma_{\bar{\epsilon}}}^{b}(t, \phi(t_3)); \qquad (6.6) $$

see Lemma 4.1. Finally, combining (6.5) and (6.6), we conclude the existence of a solution to $\Sigma_{\bar{\epsilon}}$ starting from $\mathrm{int}(K_{\bar{\epsilon}})$ and that leaves the set $K_{\bar{\epsilon}}$, which yields to a contradiction.

To prove P5.22), we recall that the solutions to $\Sigma_{\epsilon}$ cannot slide on $\partial K_{\bar{\epsilon}}$ along positive time intervals. Hence, the same property must hold for the solutions to $\Sigma_{\bar{\epsilon}}$. As a result, if P5.22) is not satisfied, then there exists a maximal solution $\phi \in S_{\Sigma_{\bar{\epsilon}}}^{-}(x_o)$, for some $x_o \in \partial K_{\bar{\epsilon}}$, and $T_o > 0$ such that $\phi((0, T_o]) \subset \mathrm{int}(K_{\bar{\epsilon}})$. Using Lemma 4.1, we conclude the existence of $T \in (0, T_o]$ and $\delta > 0$ such that, for $y := \phi(T) \in K_{\bar{\epsilon}}$, we have

$$ x_o + \delta \mathbb{B} \subset R_{\Sigma_{\bar{\epsilon}}}^{b}(-T, y) = R_{\Sigma_{\bar{\epsilon}}}^{b}(T, y). $$

However, the latter contradicts forward invariance of the set $K_{\bar{\epsilon}}$ for $\Sigma_{\bar{\epsilon}}$.

To prove P5.23) using contradiction, we assume the existence of a solution $\phi$ to $\Sigma_{\epsilon}$ starting from $x \in \mathrm{int}(K_{\bar{\epsilon}})$ such that, for some $t_1 > 0$, we have $\phi(t_1) \in \partial K_{\bar{\epsilon}}$ and $\phi([0, t_1)) \in \mathrm{int}(K_{\bar{\epsilon}})$. Next, we take $y := \phi(t_1) \in R_{\Sigma_{\bar{\epsilon}}}^{b}(t_1, x)\setminus\{x\}$ and

$$ z := \phi(t_1 - t) \in R_{\Sigma_{\bar{\epsilon}}}^{b}(-t, y)\setminus\{y\} = R_{\Sigma_{\bar{\epsilon}}}^{b}(t, y)\setminus\{y\}, $$

for some $t \in (0, t_1]$ to be determined. Hence, $z \in \mathrm{int}(K_{\bar{\epsilon}})$. Next, using Lemma 4.1 while replacing $(x, y, \Sigma, \Sigma_{\epsilon})$ by $(y, z, \Sigma_{\bar{\epsilon}}^{-}, \Sigma_{(\epsilon+\bar{\epsilon})/2}^{-})$, we conclude the existence of $T > 0$ such that, for $t := \min\{T, t_1\}$, there exists $\delta > 0$ such that $y + \delta \mathbb{B} \subset R_{\Sigma_{(\epsilon+\bar{\epsilon})/2}}^{b}(t, z)$. However, according to P5.21), the set $\mathrm{cl}(K_{\bar{\epsilon}})$ must be forward invariant for $\Sigma_{(\epsilon+\bar{\epsilon})/2}$, since

$$ 0 < (\bar{\epsilon}(x) + \epsilon(x))/2 < \bar{\epsilon}(x) \quad \forall x \in \mathbb{R}^n, \qquad (6.7) $$

which yields to a contradiction.

Similarly, to prove P5.24) using contradiction, we assume the existence of a solution $\phi$ to $\Sigma_{\epsilon}$ starting from $x \in \mathbb{R}^n \setminus \mathrm{cl}(K_{\bar{\epsilon}})$ such that, for some $t_1 > 0$, we have $\phi(-t_1) \in \partial K_{\bar{\epsilon}}$ and $\phi([-t_1, 0)) \subset \mathrm{int}(K_{\bar{\epsilon}})$. Next, we take

$$ y := \phi(-t_1) \in R_{\Sigma_{\bar{\epsilon}}}^{b}(-t_1, x)\setminus\{x\} $$

and

$$ z := \phi(t - t_1) \in R_{\Sigma_{\bar{\epsilon}}}^{b}(t, y)\setminus\{y\} = R_{\Sigma_{\bar{\epsilon}}}^{b}(-t, y)\setminus\{y\}, $$
for some $t \in (0, t_1]$ to be determined. Hence, $z \in \mathbb{R}^n \setminus \text{cl}(K_{\bar{\epsilon}})$. Next, using Lemma 4.1 while replacing $(x, y, \Sigma, \Sigma_{\epsilon})$ by $(y, z, \Sigma_{\epsilon}, \Sigma_{(\epsilon+\bar{\epsilon})/2})$, we conclude the existence of $T > 0$ such that, for $t := \min\{T, t_1\}$, there exists $\delta > 0$ such that

$$y + \delta \mathbb{B} \subset R_{\Sigma_{(\bar{\epsilon}+\epsilon)/2}}^{b}(t, z) = R_{\Sigma_{(\epsilon+\bar{\epsilon})/2}}^{b}(-t, z).$$

However, according to P5.22), the set $\text{cl}(K_{\bar{\epsilon}})$ must be forward invariant for $\Sigma_{(\epsilon+\bar{\epsilon})/2}$, since (6.7) holds, which yields to a contradiction.

### 6.3. Proof of Lemma 5.3

To prove P5.31), we will show that, for each $x_o \in \partial K_{\bar{\epsilon}}$, there exists $\delta > 0$ such that, for each $x \in (x_o + \delta \mathbb{B}) \setminus \text{cl}(K_{\bar{\epsilon}})$ and for each solution $\phi \in S_{\Sigma_{\epsilon}}(x)$, there exists $T_{\phi} > 0$ such that $\phi(T_{\phi}) \in \text{int}(K_{\bar{\epsilon}})$. First, using Lemma 5.2 and according to P5.21) and P5.23), we conclude that $R_{\Sigma_{\epsilon}}^{b}(T, x_o) \subset \text{int}(K_{\bar{\epsilon}})$ for all $T > 0$. Furthermore, since $F$ is locally bounded, using Lemmas A.2 and A.1, we conclude that, for each $T > 0$ small, the set $R_{\Sigma_{\epsilon}}^{b}(T, U(x_o))$ is compact, for $U(x_o)$ a sufficiently small neighborhood of $x_o$. Hence, there exists $\alpha > 0$ such that

$$\min\{|y|_{\partial K_{\bar{\epsilon}}} : y \in R_{\Sigma_{\epsilon}}^{b}(T, x_o)\} \geq \alpha.$$

Now, using Lemma A.1 in the Appendix, we conclude that there exists $\delta > 0$ such that, for each $x \in (x_o + \delta \mathbb{B}) \setminus \text{cl}(K_{\bar{\epsilon}})$, we have

$$R_{\Sigma_{\epsilon}}^{b}(T, x) \subset R_{\Sigma_{\epsilon}}^{b}(T, x_o) + \alpha/2\mathbb{B} \subset \text{int}(K_{\bar{\epsilon}}),$$

which proves P5.31). Finally, P5.32) can be proved following the exact steps, while using P5.22) and P5.24) instead of P5.21) and P5.23).

## 7. PROOF OF THEOREM 3.9

The build a smooth barrier certificate based on the one constructed in Theorem 3.7, additional tools that are different from those used in [7], are required. Thanks to the literature on converse Lyapunov Theorems, a classical smoothening technique is applicable. To do so, we first need to introduce some new constructs and to prove some new intermediate results. In particular, given $\delta$, $\bar{\epsilon} \in C_+$, we introduce the set $K_{\bar{\epsilon},\delta}$ given by

$$K_{\bar{\epsilon},\delta} := \bigcup_{x \in K_{\bar{\epsilon}}} (x + \delta(x)\mathbb{B}). \qquad (7.1)$$

Furthermore, given $\rho_o, \epsilon_1 \in C_+$, we introduce the set $K_{\bar{\epsilon},\rho_o,\epsilon_1}$ given by

$$K_{\bar{\epsilon}, \rho_o, \epsilon_1} := \bigcup_{t \ge 0} \bigcup_{x \in K_{\bar{\epsilon}, \rho_o}} R_{\Sigma_{\epsilon_1}}(t, x), \quad K_{\bar{\epsilon}, \rho_o} := \bigcup_{x \in K_{\bar{\epsilon}}} (x + \rho_o(x)\mathbb{B}). \qquad (7.2)$$

The proof of Theorem 3.9 follows in five steps.

**Step 1** The next statement establishes recurrence of the set $K_{\bar{\epsilon},\delta}$. This result is similar to [20], Theorem 2 which, although formulated for general hybrid systems, studies recurrence of bounded sets.
**Lemma 7.1.** Consider system $\Sigma$ such that Assumption 3.5 holds. Consider two subsets $(X_o, X_u) \in \mathbb{R}^n \times \mathbb{R}^n$ such that $\text{cl}(X_o) \cap \text{cl}(X_u) = \emptyset$ and $\bar{\epsilon}, \epsilon_1 \in C_+$ such that

$$ \epsilon_1(x) < \bar{\epsilon}(x) \quad \forall x \in \mathbb{R}^n. $$

Consider the set $K_{\bar{\epsilon}}$ introduced in (5.1) and a closed set $U_1 \subset \mathbb{R}^n$ such that the conclusions of Lemmas 5.2 and 5.3 hold. Then, there exists $\delta \in C_+$ such that the set $K_{\bar{\epsilon},\delta}$ in (7.1) satisfies

$$ \text{cl}(K_{\bar{\epsilon},\delta}) \setminus \text{int}(K_{\bar{\epsilon}}) \subset \text{int}(U_1), \quad \text{cl}(K_{\bar{\epsilon},\delta}) \cap \text{cl}(X_u) = \emptyset \quad (7.3) $$

and, for each $\epsilon \in C_+$ satisfying

$$ \epsilon(x) \le \epsilon_1(x) \quad \forall x \in \mathbb{R}^n, \quad (7.4) $$

the following properties hold.

P7.11) The set $K_{\bar{\epsilon},\delta}$ is locally recurrent for $\Sigma_{\epsilon}$ on $U_1$.

P7.12) The set $\mathbb{R}^n \setminus K_{\bar{\epsilon},\delta}$ is locally recurrent for $\Sigma_{\bar{\epsilon}}$ on $U_1$.

**Step 2** Since we fail to establish contractivity of the set $K_{\delta,\bar{\epsilon}}$, we consider the set $K_{\bar{\epsilon},\rho_o,\epsilon_1}$ which we show to be both recurrent and contractive.

**Lemma 7.2.** Consider system $\Sigma$ such that Assumption 3.5 holds. Consider two subsets $(X_o, X_u) \subset \mathbb{R}^n \times \mathbb{R}^n$ such that $\text{cl}(X_o) \cap \text{cl}(X_u) = \emptyset$ and $\bar{\epsilon}, \epsilon_1, \epsilon_2 \in C_+$ such that

$$ \epsilon_2(x) < \epsilon_1(x) < \bar{\epsilon}(x) \quad \forall x \in \mathbb{R}^n. $$

Consider the set $K_{\bar{\epsilon}}$ introduced in (5.1), a closed subset $U_1 \subset \mathbb{R}^n$, and $\delta \in C_+$ such that the conclusions in Lemmas 5.2, 5.3, and 7.1 hold. Then, there exists $\rho_o \in C_+$ such that:

$$ K_{\bar{\epsilon}} \subset \text{int}(K_{\bar{\epsilon},\rho_o,\epsilon_1}) \quad (7.5) $$

$$ \text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1}) \subset \text{int}(K_{\bar{\epsilon},\delta}), \quad (7.6) $$

$$ \bigcup_{x \in \mathbb{R}^n \setminus \text{int}(K_{\bar{\epsilon},\delta})} (x + \rho_o(x)\mathbb{B}) \cap \text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1}) = \emptyset, \quad (7.7) $$

and the following properties hold.

P7.21) There exists a closed subset $\hat{U}_1 \subset \text{int}(U_1)$ such that

$$ \text{cl}(K_{\bar{\epsilon},\delta}) \setminus \text{int}(K_{\bar{\epsilon}}) \subset \text{int}(\hat{U}_1), \quad (7.8) $$

$$ \bigcup_{x \in \hat{U}_1} (x + \rho_o(x)\mathbb{B}) \subset U_1, \quad (7.9) $$

P7.22) For each $\epsilon \in C_+$ satisfying

$$ \epsilon(x) \le \epsilon_2(x) \quad \forall x \in \mathbb{R}^n, $$

(a) $K_{\bar{\epsilon},\rho_o,\epsilon_1}$ is locally recurrent for $\Sigma_{\epsilon}$ on $U_1$.

(b) $\mathbb{R}^n \setminus K_{\bar{\epsilon},\rho_o,\epsilon_1}$ is locally recurrent for $\Sigma_{\bar{\epsilon}}$ on $U_1$.

(c) $\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})$ is forward contractive for $\Sigma_{\epsilon}$.
(d) $\mathbb{R}^n \setminus \text{int}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})$ is forward contractive for $\Sigma_{\bar{\epsilon}}$.

**Step 3** We assume that $\text{cl}(X_o) \cap \text{cl}(X_u) = \emptyset$ and we let $\bar{\epsilon}_o, \bar{\epsilon}, \epsilon_1$, and $\epsilon_2$ be robust-safety margins satisfying

$$ \epsilon_2(x) < \epsilon_1(x) < \bar{\epsilon}(x) < \bar{\epsilon}_o(x) \quad \forall x \in \mathbb{R}^n. $$

Moreover, we consider $\delta, \rho_o \in C_+$, the sets $(K_{\bar{\epsilon}}, K_{\bar{\epsilon},\delta}, K_{\bar{\epsilon},\rho_o,\epsilon_1})$ defined in (5.1), (7.1), and (7.2), respectively, and closed subsets $U_1 \subset \mathbb{R}^n$ and $\hat{U}_1 \subset \mathbb{R}^n$ such that the conclusions of Lemmas 5.3, 7.1, and 7.2 hold.

We introduce the map $B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})} : \mathbb{R}^n \to \mathbb{R} \cup \{\pm\infty\}$ defined in (4.9) while replacing $(K, \Sigma)$ therein by $(\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1}), \Sigma_{\epsilon_2})$, and we show that

S31) $\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1}) = \{x \in \mathbb{R}^n : B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}(x) \le 0\}$ and $B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}$ is a barrier candidate with respect to $(X_o, X_u)$.

S32) $B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}$ is upper semicontinuous on $\mathbb{R}^n \setminus \text{int}(K_{\bar{\epsilon},\rho_o,\epsilon_1})$.

S33) $B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}$ is lower semicontinuous on $\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})$.

S34) Along each solution $\phi$ (not necessarily maximal) to $\Sigma_{\epsilon_2}$ with $\phi(\text{dom}\,\phi) \subset U_1$, we have

$$ B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}(\phi(t')) - B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}(\phi(t)) \le -(t' - t) \quad \forall (t, t') \in \text{dom}\,\phi \times \text{dom}\,\phi \text{ s.t. } t' \ge t. $$

We establish the proof by verifying the conditions in Lemma 4.9 when $(K, \Sigma) = (\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1}), \Sigma_{\epsilon_2})$. Indeed, we start using (7.3), (7.6)-(7.7), and the definition of the set $K_{\bar{\epsilon},\rho_o,\epsilon_1}$, to conclude that $\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1}) \cap \text{cl}(X_u) = \emptyset$, $\partial K_{\bar{\epsilon},\rho_o,\epsilon_1} \subset \text{int}(U_1)$, and $X_o \subset \text{int}(K_{\bar{\epsilon},\rho_o,\epsilon_1})$. Hence, S31) is verified. Next, we show that A4.71)-A4.74) are verified for $(K, \Sigma) = (\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1}), \Sigma_{\epsilon_2})$. Indeed, using P7.22)a, we conclude that A4.71) holds, using P7.22)b, we conclude that A4.72) holds, using P7.22)c, we conclude that A4.73) holds, and, finally, using P7.22)d, we conclude that A4.74) holds.

**Step 4** Given a smooth function $\rho_2 : \mathbb{R}^n \to \mathbb{R}_{>0}$ and $v \in \mathbb{B}$, we introduce the function $B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}^v : \mathbb{R}^n \to \mathbb{R}$ given by

$$ B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}^v(x) := B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}(x + \rho_2(x)v), \quad (7.10) $$

and we show that, for each $\rho_2 \in C_+$ satisfying

$$ \rho_2(x) \le \rho_1(x) := \min\{\epsilon_2(x), \rho_o(x)\} \quad \forall x \in \mathbb{R}^n, \quad (7.11) $$

the following properties hold.

S41) $B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}^v$ is a barrier function candidate with respect to $(X_o, X_u)$.

S42) $B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}^v$ is upper semicontinuous on the set $K_{vo} := \{x \in \mathbb{R}^n : B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}^v(x) \ge 0\}$.

S43) $B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}^v$ is lower semicontinuous on the set $K_{vi} := \{x \in \mathbb{R}^n : B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}^v(x) \le 0\}$.

Furthermore, we show the existence of a smooth function $\rho_2 : \mathbb{R}^n \to \mathbb{R}_{>0}$ satisfying (7.11) such that, for each $v \in \mathbb{B}$, the function $B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}^v$ in (7.10) satisfies the property:

S45) Along each solution $\phi$ (not necessarily maximal) to $\Sigma$ with $\phi(\text{dom}\,\phi) \subset \hat{U}_1$, we have

$$ B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}^v(\phi(t')) - B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}^v(\phi(t)) \le -(t' - t) \quad \forall (t', t) \in \text{dom}\,\phi \times \text{dom}\,\phi \text{ s.t. } t' \ge t. $$

Indeed, we already showed that $B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}$ is well defined on $\mathbb{R}^n$. Therefore, $B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}^v$ is also well defined on $\mathbb{R}^n$. Next, by definition, we know that

$$ B_{\text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1})}(y) \le 0 \quad \forall y \in \text{cl}(K_{\bar{\epsilon},\rho_o,\epsilon_1}). $$
Then, given $v \in \mathbb{B}$, we conclude that

$$B_{\text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}^v(x) \le 0 \quad \forall (x + \rho_2(x)v) \in \text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1}).$$

To show that

$$B_{\text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}^v(x) \le 0 \quad \forall x \in X_o, \qquad (7.12)$$

it is enough to use (7.11) and the definition of the set $K_{\bar{\epsilon}, \rho_o, \epsilon_1}$ in (7.2), to conclude that

$$\rho_2(x) \le \rho_o(x) \quad \forall x \in \mathbb{R}^n \quad \text{and} \quad x + \rho_o(x)v \in K_{\bar{\epsilon}, \rho_o, \epsilon_1} \quad \forall x \in K_{\bar{\epsilon}}.$$

Next, since $X_o \subset K_{\bar{\epsilon}}$, we conclude that

$$x + \rho_2(x)v \in K_{\bar{\epsilon}, \rho_o, \epsilon_1} \quad \forall x \in X_o,$$

which proves (7.12).

Next, to show that

$$B_{\text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}^v(x) > 0 \quad \forall x \in X_u, \qquad (7.13)$$

we start noting that

$$B_{\text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}(y) > 0 \quad \forall y \in \mathbb{R}^n \setminus \text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1}).$$

Next, using Lemma 7.1 and (7.3), we conclude that $\text{cl}(K_{\bar{\epsilon}, \delta}) \cap \text{cl}(X_u) = \emptyset$. Hence,

$$x \in \mathbb{R}^n \setminus \text{cl}(K_{\bar{\epsilon}, \delta}) \quad \forall x \in X_u.$$

Moreover, using (7.6)-(7.7), we conclude that

$$x + \rho_o(x)v \notin \text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1}) \quad \forall x \in \mathbb{R}^n \setminus \text{cl}(K_{\bar{\epsilon}, \delta}).$$

Therefore, (7.13) is satisfied and $B_{K_{\bar{\epsilon}, \rho_o, \epsilon_1}}^v$ is a barrier function candidate with respect to $(X_o, X_u)$.

Now, since the function $\rho_2$ is continuous, the upper and lower semicontinuity properties of $B_{\text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}^v$ are inherited from the those of $B_{\text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}$. Indeed, for each $x \in K_{vo}, y := x + \rho_2(x)v \in \mathbb{R}^n \setminus \text{int}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})$. According to item S32), the function $B_{\text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}^v$ is upper semicontinuous at $y$. Hence, $B_{\text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}^v$ is upper semicontinuous on $K_{vo}$. Similarly, for each $x \in K_{vi}, y := x + \rho_2(x)v \in \text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})$. Using item S33), the function $B_{\text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}^v$ is lower semicontinuous at $y$. Hence, $B_{\text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}^v$ is lower semicontinuous on $K_{vi}$.

Finally, using Lemma A.4, we conclude the existence of a smooth function $\rho_2: \mathbb{R}^n \to \mathbb{R}_{>0}$ satisfying (7.11), such that PA.41 holds. That is, for this choice of the function $\rho_2$, for each $v \in \mathbb{B}$, for each $\phi$ solution to $\Sigma$ starting from $x_o \in \hat{U}_1$ and remaining in $\hat{U}_1$, and given $(t, t') \in \text{dom}\phi \times \text{dom}\phi$ with $t' \ge t$, we conclude the existence of $\psi: [t, t'] \to \mathbb{R}^n$ solution to $\Sigma_{\rho_1}$ such that $\psi(s) := \phi(s) + \rho_2(\phi(s))v$ for all $s \in [t, t']$. Thus, the function $\psi$ is solution to $\Sigma_{\epsilon_2}$. Next, using the last item in Lemma 7.2, we conclude that $\psi(s) := \phi(s) + \rho_2(\phi(s))v \in U_1$ for all $s \in [t, t']$. Finally, using S34), we conclude that

$$B_{\text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}^v(\phi(t')) - B_{\text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}^v(\phi(t)) = B_{\text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}(\psi(t')) - B_{\text{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}(\psi(t)) \le -(t' - t),$$

which implies that S45) is satisfied.
**Step 5** We consider the function $B: \mathbb{R}^n \to \mathbb{R}$ given by

$$B(x) := \int_{\mathbb{R}^n} B_{\text{cl}(K_{\tilde{\epsilon}, \rho_o, \epsilon_1})}(x + \rho_2(x)v) \Psi(v) dv,$$

where $\rho_o: \mathbb{R}^n \to \mathbb{R}_{>0}$ and $\Psi: \mathbb{R}^n \to [0, 1]$ are smooth functions such that

$$\Psi(v) = 0 \quad \forall v \in \mathbb{R}^n \setminus \mathbb{B} \quad \text{and} \quad \int_{\mathbb{R}^n} \Psi(v) dv = 1,$$

is continuously differentiable. We show that the following properties hold.

S51) $B$ is a barrier candidate with respect to $(X_o, X_u)$.

S52) $B$ is continuously differentiable.

S53) $\langle \nabla B(x), \eta \rangle \le -1$ for all $\eta \in F(x)$ and for all $x \in \hat{U}_1$.

S54) $\partial K \subset \text{int}(\hat{U}_1)$, where $K := \{x \in \mathbb{R}^n : B(x) \le 0\}$.

To prove S51), we use S41) to conclude that

$$B_{\text{cl}(K_{\tilde{\epsilon}, \rho_o, \epsilon_1})}^v(x) \le 0 \quad \forall v \in \mathbb{B}, \quad \forall x \in X_o.$$

Hence, since $\Psi$ is nonnegative, we conclude that

$$\int_{\mathbb{R}^n} B_{\text{cl}(K_{\tilde{\epsilon}, \rho_o, \epsilon_1})}^v(x) \Psi(v) dv \le 0 \quad \forall x \in X_o.$$

Furthermore, we have that

$$B_{\text{cl}(K_{\tilde{\epsilon}, \rho_o, \epsilon_1})}^v(x) > 0 \quad \forall v \in \mathbb{B}, \quad \forall x \in X_u.$$

Hence, using the fact that $\psi$ is nonnegative and there exist points in $\mathbb{B}$ where $\psi$ not zero, we conclude that

$$\int_{\mathbb{R}^n} B_{\text{cl}(K_{\tilde{\epsilon}, \rho_o, \epsilon_1})}^v(x) \Psi(v) dv > 0 \quad \forall x \in X_u.$$

To prove S52), we use Lemma A.5 under the fact that $B_{\text{cl}(K_{\tilde{\epsilon}, \rho_o, \epsilon_1})}$ is locally bounded and, at every $x \in \mathbb{R}^n$, either upper or lower semicontinuous.

To prove S53), we consider a solution $\phi$ to $\Sigma$ (not necessarily maximal) such that $\phi(\text{dom}(\phi)) \subset \hat{U}_1$. For each $(t, t') \in \text{dom}\,\phi \times \text{dom}\,\phi$ with $t' \ge t$, we have

$$\begin{align*}
B(\phi(t')) &= \int_{\mathbb{B}} B_{\text{cl}(K_{\tilde{\epsilon}, \rho_o, \epsilon_1})}^v(\phi(t')) \Psi(v) dv \\
&\le \int_{\mathbb{B}} \left[ B_{\text{cl}(K_{\tilde{\epsilon}, \rho_o, \epsilon_1})}^v(\phi(t)) - (t' - t) \right] \Psi(v) dv \\
&= \int_{\mathbb{B}} B_{\text{cl}(K_{\tilde{\epsilon}, \rho_o, \epsilon_1})}^v(\phi(t)) \Psi(v) dv - (t' - t) \\
&= B(\phi(t)) - (t' - t),
\end{align*}$$

where the first inequality is obtained using S45). Next, using Lemma A.3 in the Appendix, under the fact that $B$ is continuously differentiable, S53) follows.
To prove S54), we propose to show that

$$K_{\bar{\epsilon}} \subset K := \{x \in \mathbb{R}^n : B(x) \le 0\} \subset K_{\bar{\epsilon}, \delta}. \quad (7.14)$$

Indeed, we use (7.11) and (7.2) to conclude that

$$x + \rho_2(x)\mathbb{B} \subset x + \rho_o(x)\mathbb{B} \subset K_{\bar{\epsilon}, \rho_o, \epsilon_1} \quad \forall x \in K_{\bar{\epsilon}}.$$

Hence, for each $v \in \mathbb{B}$, we have

$$B_{\mathrm{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}^v(x) = B_{\mathrm{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}(x + \rho_2(x)v) \le 0 \quad \forall x \in K_{\bar{\epsilon}}.$$

The latter implies that

$$B(x) \le 0 \quad \forall x \in K_{\bar{\epsilon}}. \quad (7.15)$$

Next, using (7.6)–(7.7) and (7.11), we obtain

$$x + \rho_2(x)\mathbb{B} \subset x + \rho_o(x)\mathbb{B} \subset \mathbb{R}^n \setminus \mathrm{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1}) \quad \forall x \in \mathbb{R}^n \setminus \mathrm{int}(K_{\bar{\epsilon}, \delta}).$$

Hence, for each $v \in \mathbb{B}$,

$$B_{\mathrm{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}^v(x) = B_{\mathrm{cl}(K_{\bar{\epsilon}, \rho_o, \epsilon_1})}(x + \rho_2(x)v) > 0 \quad \forall x \in \mathbb{R}^n \setminus \mathrm{int}(K_{\bar{\epsilon}, \delta}).$$

The latter yields

$$B(x) > 0 \quad \forall x \in \mathbb{R}^n \setminus \mathrm{int}(K_{\bar{\epsilon}, \delta}). \quad (7.16)$$

Finally, using (7.15)–(7.16), we conclude that (7.14) follows, which implies that S54) also follows using (7.3).

**Remark 7.3.** Since the safety notion is not robust in nature (as opposed to uniform asymptotic stability [32]), we are left with the freedom to introduce the robust-safety notion we aim to work on. That is, one can alternatively define robust safety as the property requiring the existence of $\epsilon \in C_+$ such that safety holds true for the system

$$\dot{x} \in \mathrm{co}(F(x + \epsilon(x)\mathbb{B})) + \epsilon(x)\mathbb{B} \quad \forall x \in \mathbb{R}^n,$$

where $\mathrm{co}(\cdot)$ stands for the convex hull of $(\cdot)$. As shown in [33], this alternative notion and the one in Definition 3.1 become equivalent under Assumption 3.5. An interesting consequence of this equivalence, according [32], Proposition 3.5, is that robust safety of $\Sigma$ implies the existence of a locally-Lipschitz set-valued map $x \mapsto F_L(x)(\supset F(x))$ over approximating $F$ such that

$$\dot{x} \in F_L(x) \quad \forall x \in \mathbb{R}^n$$

is robustly safe. Hence, to address the converse robust-safety problem, one could solely focus on constructing a barrier certificate in the case of locally-Lipschitz dynamics. Although this would allow us to recover Lemma 4.1 from [29], the remaining technical steps would still require proofs, to the best of our knowledge. Indeed, these results are not formulated in the literature of Lipschitz-continuous dynamics.
8. PROOFS OF LEMMAS 7 AND 8

**8.1. Proof of lemma 7.1**

We start using Lemma 5.1 to conclude that $cl(X_u) \cap cl(K_{\bar{\epsilon}}) = \emptyset$. We next use Lemma 5.3 to conclude the existence of a closed subset $U_1 \subset \mathbb{R}^n$ such that (5.6) holds and P5.31)–P5.32) hold for each $\epsilon \in C_+$ satisfying (7.4). As a result, to prove the existence of $\delta \in C_+$ for which (7.3) holds, we combine (5.6) and the fact that $cl(X_u) \cap cl(K_{\bar{\epsilon}}) = \emptyset$ to conclude that (7.3) is verified for

$$ \delta(x) := \frac{1}{2} \min \{ |x|_{\mathbb{R}^n \setminus U_1}, |x|_{cl(X_u)} \}. $$

To prove P7.11), we use P5.31), which shows that the set $K_{\bar{\epsilon}}$ is locally recurrent for $\Sigma_{\bar{\epsilon}}$ on $U_1$. Hence, P7.11) follows since, by definition, $K_{\bar{\epsilon}} \subset K_{\bar{\epsilon},\delta}$.

To prove P7.12), we decompose the set $\partial K_{\bar{\epsilon}}$ using a sequence of nonempty compact subsets $\{\partial K_i\}_{i=1}^N$, where $N \in \{1, 2, ..., \infty\}$. That is, we assume that $\bigcup_{i=1}^{\infty} \partial K_i = \partial K_{\bar{\epsilon}}$. Furthermore, for each $i \in \{1, 2, ..., N\}$, there exists a finite set $N_i \subset \{1, 2, ..., N\}$ and $\beta_i > 0$ such that

$$ (\partial K_i + \beta_i \mathbb{B}) \cap \partial K_j = \emptyset \quad \forall j \notin N_i \quad \text{and} \quad \text{int}_{\partial K_i}(\partial K_i \cap \partial K_j) = \emptyset \quad \forall j \in N_i, \quad (8.1) $$

where $\text{int}_{\partial K_{\bar{\epsilon}}}(\cdot)$ denotes the interior of $(\cdot)$ relative $\partial K_{\bar{\epsilon}}$. Such a decomposition always exists according to the Whitney Covering Lemma [34].

Next, we make the following claim that we prove later.

**Claim 8.1.** For each $i \in \{1, 2, ..., N\}$, we can find $t_i > 0$ and $\alpha_i > 0$ such that

$$ \bigcup_{i \in \{1, 2, ..., N\}} R_{\Sigma_{\bar{\epsilon}}}^{b}(t_i, \partial K_i) \bigcap \bigcup_{i \in \{1, 2, ..., N\}} \bigcup_{x \in \partial K_i} (x + \alpha_i \mathbb{B}) = \emptyset. \quad (8.2) $$

Under Claim 8.1, we introduce the function $\alpha : \partial K_{\bar{\epsilon}} \to \mathbb{R}_{>0}$ given by

$$ \alpha(x) := \min\{\alpha_i/2 : i \in \{1, 2, ..., N\} \text{ s.t. } x \in \partial K_i\}. $$

The function $\alpha$ is lower semicontinuous and allows, in view of (8.2), to conclude that

$$ \bigcup_{i \in \{1, 2, ..., N\}} R_{\Sigma_{\bar{\epsilon}}}^{b}(t_i, \partial K_i) \bigcap \bigcup_{x \in \partial K_{\bar{\epsilon}}} (x + \alpha(x) \mathbb{B}) = \emptyset. $$

Hence, using [35], Theorem 1, we conclude the existence of a continuous function $\bar{\alpha} : \partial K_{\bar{\epsilon}} \to \mathbb{R}_{>0}$ such that

$$ \bar{\alpha}(x) \leq \alpha(x) \quad \forall x \in \partial K_{\bar{\epsilon}}. $$

Hence,

$$ \bigcup_{i \in \{1, 2, ..., N\}} R_{\Sigma_{\bar{\epsilon}}}^{b}(t_i, \partial K_i) \bigcap \bigcup_{x \in \partial K_{\bar{\epsilon}}} (x + \bar{\alpha}(x) \mathbb{B}) = \emptyset. \quad (8.3) $$

That is, every solution to $\Sigma_{\bar{\epsilon}}^-$ starting from $\partial K_{\bar{\epsilon}}$ leaves the set $K_{\bar{\epsilon}} \cup \bigcup_{x \in \partial K_{\bar{\epsilon}}} (x + \bar{\alpha}(x) \mathbb{B})$.

Next, we show that, for each $i \in \{1, 2, ..., N\}$, we can find $\sigma_i > 0$ such that

$$ \bigcup_{i \in \{1, 2, ..., N\}} R_{\Sigma_{\bar{\epsilon}}}^{b}(t_i, \partial K_i + \sigma_i \mathbb{B}) \bigcap \bigcup_{x \in \partial K_{\bar{\epsilon}}} (x + \bar{\alpha}(x) \mathbb{B}) = \emptyset. $$

Indeed, the latter follows from a direct combination of Lemmas A.1 and A.2 in the Appendix and (8.3).
As a result, the function $\sigma : \partial K_{\bar{\epsilon}} \to \mathbb{R}_{>0}$ given by

$$ \sigma(x) := \min\{\sigma_i : i \in \{1, 2, \dots, N\} \text{ s.t. } x \in \partial K_i\} $$

is lower semicontinuous and allows, using [35], Theorem 1, to conclude the existence of a continuous function $\bar{\sigma} : \partial K_{\bar{\epsilon}} \to \mathbb{R}_{>0}$ such that

$$ \bar{\sigma}(x) \leq \sigma(x) \quad \forall x \in \partial K_{\bar{\epsilon}}, $$

and, at the same time, the solutions to $\Sigma_{\bar{\epsilon}}^-$ starting from the set $\bigcup_{x \in \partial K_{\bar{\epsilon}}} (x + \bar{\sigma}(x)\mathbb{B}) \subset$ leave the set $K_{\bar{\epsilon}} \cup \bigcup_{x \in \partial K_{\bar{\epsilon}}} (x + \bar{\alpha}(x)\mathbb{B})$. Finally, after continuously extending $\bar{\sigma}$ to $\mathbb{R}^n$, we take

$$ \delta(x) := \begin{cases} \min\{\bar{\sigma}(x), |x|_{\partial(K_{\bar{\epsilon}} \cup K_1)}\} & \text{if } x \in \text{int}(K_{\bar{\epsilon}}) \\ \bar{\sigma}(x) & \text{otherwise,} \end{cases} \quad K_1 := \bigcup_{x \in \partial K_{\bar{\epsilon}}} (x + \bar{\sigma}(x)\mathbb{B}). $$

Using P5.32), we conclude that the solutions to $\Sigma_{\bar{\epsilon}}^-$ starting from $K_{\bar{\epsilon},\delta} \cap U_1$ leave the set $K_{\bar{\epsilon},\delta}$. Hence, P7.12) is verified.

To prove Claim 8.1, we use Lemma 5.2 to conclude that, for each $i \in \{1, 2, \dots, N\}$ and for each $t_i > 0$, we have

$$ R_{\Sigma_{\bar{\epsilon}}}^{b}(t_i, \partial K_i) \cap \text{cl}(K_{\bar{\epsilon}}) = \emptyset. $$

Furthermore, using Lemma A.2 in the Appendix, we conclude that, for each $i \in \{1, 2, \dots, N\}$, we can make $t_i > 0$ small enough such that $R_{\Sigma_{\bar{\epsilon}}}^b(t_i, \partial K_i)$ is compact. Furthermore, in view of (8.1) and Lemma A.1, we can make each $t_i$ even smaller such that

$$ (\partial K_j + \beta_j \mathbb{B}) \cap R_{\Sigma_{\bar{\epsilon}}}^b (t_i, \partial K_i) = \emptyset \quad \forall j \notin \mathcal{N}_i. \qquad (8.4) $$

As a result, for each $i \in \{1, 2, \dots, N\}$, we can find $\alpha_i \in (0, \beta_i)$ such that

$$ R_{\Sigma_{\bar{\epsilon}}}^{b}(t_i, \partial K_i) \cap \bigcup_{j \in \{i, \mathcal{N}_i\}} (\partial K_j + \alpha_j \mathbb{B}) = \emptyset. \qquad (8.5) $$

The claim is proved by combining (8.4) and (8.5).

## 8.2. Proof of lemma 7.2

The proof of (7.5) is obvious for any $\rho_o \in C_+$.

Furthermore, to find $\rho_o : \mathbb{R}^n \to \mathbb{R}_{>0}$ such that (7.6)-(7.7) hold, we propose to decompose the set $\text{cl}(K_{\bar{\epsilon}})$ using a sequence of nonempty compact subsets $\{K_i\}_{i=1}^N$, where $N \in \{1, 2, \dots, \infty\}$. That is, we assume that

$$ \bigcup_{i=1}^{N} K_i = \text{cl}(K_{\bar{\epsilon}}) $$

and, for each $i \in \{1, 2, \dots, N\}$, there exists a finite set $\mathcal{N}_i \subset \{1, 2, \dots, N\}$ such that

$$ K_i \cap K_j = \emptyset \quad \forall j \notin \mathcal{N}_i \quad \text{and} \quad \text{int}_{\text{cl}(K_{\bar{\epsilon}})}(K_i \cap K_j) = \emptyset \quad \forall j \in \mathcal{N}_i, $$

where $\text{int}_K(\cdot)$ is the interior of $(\cdot)$ relative to $K$.
A key step consists in proving the following claim.

**Claim 8.2.** For each $i \in \{1, 2, ..., N\}$, there exists $\rho_i > 0$ such that

$$ \bigcup_{t \ge 0} \bigcup_{i \in \mathbb{N}} R_{\Sigma_{\epsilon_1}}(t, K_i + \rho_i \mathbb{B}) \subset \text{int}(K_{\bar{\epsilon}, \delta}). $$

Next, we introduce the function $\rho: \text{cl}(K_{\bar{\epsilon}}) \to \mathbb{R}_{>0}$ given by

$$ \rho(x) := \min\{\rho_i : i \in \{1, 2, ..., N\} \text{ s.t. } x \in K_i\} $$

which is lower semicontinuous and allows us to conclude that

$$ \bigcup_{t \ge 0} \bigcup_{x \in \text{cl}(K_{\bar{\epsilon}})} R_{\Sigma_{\epsilon_1}}(t, x + \rho(x)\mathbb{B}) \subset \text{int}(K_{\bar{\epsilon}, \delta}). $$

Furthermore, we use [35], Theorem 1 to conclude the existence of $\rho_1: K_{\bar{\epsilon}} \to \mathbb{R}_{>0}$ continuous and satisfying $\rho_1(x) \le \rho(x)$ for all $x \in K_{\bar{\epsilon}}$. Hence,

$$ K_{\bar{\epsilon}, \rho_1, \epsilon_1} = \bigcup_{t \ge 0} \bigcup_{x \in \text{cl}(K_{\bar{\epsilon}})} R_{\Sigma_{\epsilon_1}}(t, x + \rho_1(x)\mathbb{B}) \subset \text{int}(K_{\bar{\epsilon}, \delta}). $$

On the other hand, using the continuous function $\rho_2: \mathbb{R}^n \setminus \text{int}(K_{\bar{\epsilon}, \delta}) \to \mathbb{R}_{>0}$ given by $\rho_2(x) := \frac{1}{2}|x|_{K_{\bar{\epsilon}, \rho_1, \epsilon_1}}$, we conclude that

$$ x + \rho_2(x)\mathbb{B} \subset \mathbb{R}^n \setminus \text{cl}(K_{\bar{\epsilon}, \rho_1, \epsilon_1}) \quad \forall x \in \mathbb{R}^n \setminus \text{int}(K_{\bar{\epsilon}, \delta}). $$

Finally, after extending $\rho_2$ to $\mathbb{R}^n$ and taking $\rho_o(x) := \min\{\rho_1(x), \rho_2(x)\}$ for all $x \in \mathbb{R}^n$, (7.6)-(7.7) follow.

To prove Claim 8.2, we start using the fact that the set $\text{cl}(K_{\bar{\epsilon}})$ is forward contractive for $\Sigma_{\epsilon_1}$ and the solutions to $\Sigma_{\epsilon_1}$ starting from $\text{int}(K_{\bar{\epsilon}})$ never reach $\partial K_{\bar{\epsilon}}$ for positive times, to conclude that

$$ R_{\Sigma_{\epsilon_1}}(t, K_i) \setminus K_i \subset \text{int}(K_{\bar{\epsilon}}) \quad \forall i \in \{1, 2, ..., N\}, \quad \forall t > 0. $$

Next, using Lemma A.2 in the Appendix, we conclude that, for each $i \in \{1, 2, ..., N\}$, there exist $\bar{\rho}_i > 0$ and $T_i > 0$ such that $R_{\Sigma_{\epsilon_1}}(T_i, K_i + \bar{\rho}_i \mathbb{B})$ is bounded. Furthermore, using Lemma A.1 in the Appendix, we conclude that, for each $i \in \{1, 2, ..., N\}$, there exists $\eta_i > 0$ and $\rho_i \in (0, \bar{\rho}_i)$ such that

$$ |y|_{\partial K_{\bar{\epsilon}, \delta}} \ge \eta_i \quad \forall y \in R_{\Sigma_{\epsilon_1}}(T_i, K_i), \quad |y|_{\partial K_{\bar{\epsilon}}} \ge \eta_i \quad \forall y \in R_{\Sigma_{\epsilon_1}}^b(T_i, K_i), $$

and at the same time

$$ |y|_{\partial K_{\bar{\epsilon}, \delta}} \le \eta_i/2 \quad \forall y \in R_{\Sigma_{\epsilon_1}}(T_i, K_i + \rho_i \mathbb{B}) \quad \text{and} \quad |y|_{\partial K_{\bar{\epsilon}_1}} \le \eta_i/2 \quad \forall y \in R_{\Sigma_{\epsilon_1}}^b(T_i, K_i + \rho_i \mathbb{B}). $$

In particular, we conclude that

$$ R_{\Sigma_{\epsilon_1}}^b(T_i, K_i + \rho_i \mathbb{B}) \subset \text{int}(K_{\bar{\epsilon}}) \quad \forall i \in \{1, 2, ..., N\}, $$

which implies that

$$ |y|_{\partial K_{\bar{\epsilon}, \delta}} \le \eta_i/2 \quad \forall y \in R_{\Sigma_{\epsilon_1}}(t, K_i + \rho_i \mathbb{B}) \quad \forall t \ge 0. $$

The latter is enough to prove the claim.
To prove P7.21), we use (7.3) to conclude that $cl(K_{\epsilon,\delta})\int(K_{\epsilon}) \subset int(U_1)$. Hence, we can always find a closed set $\hat{U}_1 \subset int(U_1)$ such $cl(K_{\epsilon,\delta})\int(K_{\epsilon}) \subset int(\hat{U}_1)$, which implies that (7.8) holds. Next, we let the function $\rho_3: \hat{U}_1 \to \mathbb{R}_>0$ given by $\rho_3(x) := |x|_{\mathbb{R}^n \setminus U_1}$. After extending $\rho_3$ to $\mathbb{R}^n$ and taking $\rho_o(x) := \min\{\rho_i(x) : i \in \{1, 2, 3\}\}$ for all $x \in \mathbb{R}^n$, both (7.6)–(7.7) and P7.21) follow.

To prove P7.22)a), we use the fact $K_{\epsilon} \subset K_{\epsilon,\rho_o,\epsilon_1}$ and P5.31). Similarly, to prove P7.22)b), we combine (7.6)–(7.7) and P7.12). To prove P7.22)c) and P7.22)d), we use Lemma 5.2 while replacing the sets $(X_o, K_{\epsilon})$ therein by the sets $(K_{\epsilon,\rho_o}, K_{\epsilon,\rho_o,\epsilon_1})$.

9. CONCLUSION

In this paper, we establish the equivalence between robust safety and the existence of a smooth barrier certificate, in the context of continuous-time systems modeled by differential inclusions. Our result requires only continuity of the set-valued dynamics and empty intersection between the closures of the initial and unsafe sets. We relax most of the assumptions used in existing literature such as boundedness of the safety region, smoothness of the system’s dynamics, and uniqueness of solutions. Future works pertain to address the considered problem in the more general context of hybrid dynamical systems.

REFERENCES

[1] S. Prajna, A. Jadbabaie and G.J. Pappas, A framework for worst-case and stochastic safety verification using barrier certificates. *IEEE Trans. Automatic Control* **52** (2007) 1415–142.

[2] T. Ersal, I. Kolmanovsky, N. Masoud, N. Ozay, J. Scruggs, R. Vasudevan and G. Orosz, Connected and automated road vehicles: state of the art and future challenges. *Veh. Syst. Dyn.* **58** (2020) 672–704.

[3] J. Breeden and D. Panagou, Guaranteed safe spacecraft docking with control barrier functions. *IEEE Control Syst. Lett.* **6** (2022) 2000–2005.

[4] F. Ferraguti, C. Talignani Landi, A. Singletary, H-C. Lin, A. Ames, C. Secchi and M. Bonfe, Safety and efficiency in robotics: the control barrier functions approach. *IEEE Robot. Autom. Mag.* **29** (2022) 139–151.

[5] M. Ghanbarpour, M. Maghenem and A. Saoud, Barrier functions for robust safety in differential inclusions, Part I: sufficient conditions, in *60th IEEE Conference on Decision and Control* (2021) 5338–5343.

[6] R. Wisniewski and C. Sloth, Converse barrier certificate theorems. *IEEE Trans. Autom. Control* **61** (2016) 1356–1361.

[7] S. Ratschan, Converse theorems for safety and barrier certificates. *IEEE Trans. Autom. Control* **63** (2018) 2628–2632.

[8] J. Liu, Converse barrier functions *via* Lyapunov functions. *IEEE Trans. Autom. Control* **67** (2022) 497–503.

[9] J.P. Aubin and A. Cellina, Differential Inclusions: Set-Valued Maps and Viability Theory, Vol. 264. Springer Science & Business Media (2012).

[10] M. Maghenem and R.G. Sanfelice, On the converse safety problem for differential inclusions: Solutions, regularity, and time-varying barrier functions. *IEEE Trans. Autom. Control* (2022) 1.

[11] A.D. Ames, X. Xu, J.W. Grizzle and P. Tabuada, Control barrier function based quadratic programs for safety critical systems. *IEEE Trans. Autom. Control* **62** (2017) 3861–3876.

[12] R. Konda, A.D. Ames and S. Coogan, Characterizing safety: minimal control barrier functions from scalar comparison systems. *IEEE Control Syst. Lett.* **5** (2020) 523–528.

[13] H. Kong, F. He, X. Song, W.N.N. Hung and M. Gu, Exponential-condition-based barrier certificate generation for safety verification of hybrid systems, in *Proceedings of the Computer Aided Verification*, Springer Berlin Heidelberg, Berlin, Heidelberg (2013) 242–257.

[14] M. Maghenem and R.G. Sanfelice, Sufficient conditions for forward invariance and contractivity in hybrid inclusions using barrier functions. *Automatica* (2020) 109328.

[15] J. Liu, Converse barrier functions *via* Lyapunov functions. *IEEE Transactions on Automatic Control.* **67** (2021) 497–503.

[16] M. Jankovic, Robust control barrier functions for constrained stabilization of nonlinear systems. *Automatica* **96** (2018) 359–367.

[17] P. Seiler, M. Jankovic and E. Hellstrom, Control barrier functions with unmodeled input dynamics using integral quadratic constraints. *IEEE Control Syst. Lett.* **6** (2021) 1664–1669.
[18] M. Maghenem, M. Ghanbarpour and A. Saoud, Sufficient conditions for robust safety in differential inclusions using barrier functions. Automatica 171 (2025) 111938.

[19] S. Prajna and A. Rantzer, On the necessity of barrier certificates. IFAC Proc. Vol. 38 (2005) 526–531.

[20] A. Subbaraman and A.R. Teel, On the equivalence between global recurrence and the existence of a smooth Lyapunov function for hybrid systems. Syst. Control Lett. 88 (2016) 54–61.

[21] M. Ghanbarpour and M. Maghenem, Barrier Functions for Robust Safety in Differential Inclusions. Part II: the Converse Problem, in 60th IEEE Conference on Decision and Control (2021) 5344–5349.

[22] R.T. Rockafellar and J.B.R Wets, Variational Analysis, Vol. 317. Springer Science & Business Media (1997).

[23] J.P. Aubin and H. Frankowska, Set-valued Analysis. Springer Science & Business Media (2009).

[24] A.R. Teel and L. Praly, A smooth Lyapunov function from a class-KL estimate involving two positive semidefinite functions. ESAIM: COCV 5 (2000) 313–367.

[25] A.F. Filippov, Differential Equations with Discontinuous Righthand Sides: Control Systems, Vol. 18. Springer Science & Business Media (2013).

[26] R. Goebel, R.G. Sanfelice and A.R. Teel, Hybrid Dynamical Systems: Modeling, Stability, and Robustness. Princeton University Press (2012).

[27] M. Di Benedetto, S. Di Gennaro and A. D'Innocenzo, Digital self-triggered robust control of nonlinear systems. Int. J. Control 86 (2013).

[28] M.L. Puterman, Markov Decision Processes: Discrete Stochastic Dynamic Programming. John Wiley & Sons (2014).

[29] A. Puri, V. Borkar and P. Varaiya, $\varepsilon$-approximation of differential inclusions, in International Hybrid Systems Workshop. Springer (1995) 362–376.

[30] F. Blanchini, Survey paper: Set invariance in control. Automatica 35 (1999) 1747–1767.

[31] J.P. Aubin, Viability Theory. Birkhauser Boston Inc., Cambridge, MA, USA (1991).

[32] F.H. Clarke, Y.S. Ledyaev and R.J. Stern, Asymptotic stability and smooth Lyapunov functions. J. Differ. Equ. 149 (1998) 69–114.

[33] M. Maghenem and D. Karaki, On a strong robust-safety notion for differential inclusions. IEEE Trans. Autom. Control 69 (2024) 2237–2248.

[34] H. Whitney, Analytic extensions of differentiable functions defined in closed sets. Trans. Am. Math. Soc. 36 (1934) 63–89.

[35] M. Katětov, On real-valued functions in topological spaces. Fundam. Math. 1 (1951) 85–91.

[36] M. Maghenem and M. Ghanbarpour, A converse robust-safety theorem for differential inclusions. arXiv preprint arXiv:2208.11364 (2022).

[37] F.H. Clarke, Y.S. Ledyaev, R.J. Stern and P.R. Wolenski, Nonsmooth Analysis and Control Theory, Vol. 178. Springer Science & Business Media (2008).

[38] L. Hormander, Linear Partial Differential Operators. Springer (1963).

[39] F.W. Wilson, Smoothing derivatives of functions and applications. Trans. Am. Math. Soc. 139 (1969) 413–428.

<figure><img src="image_2.png" /></figure>
APPENDIX A

In the following lemma, we recall three different consequences of Assumption 2.2 on the regularity of the reachability set-valued maps $R_Σ$ and $R_Σ^b$. A similar result can be found in [9], Theorem 1, p. 103 under a slightly different set of assumptions.

**Lemma A.1.** Consider system $Σ$ such that Assumption 2.2 holds and let $T$ and $U ⊂ R^n$ such that $R_Σ(T, U)$ is bounded. Then, the maps $R_Σ$ and $R_Σ^b$ are both upper and outer semicontinuous on $[0, T] × U$.

*Proof.* In view of Remark 2.3, when the maps $R_Σ$ and $R_Σ^b$ are locally bounded, then showing outer semicontinuity is enough to conclude upper semicontinuity. Thus, we propose to only show outer semicontinuity of $R_Σ^b$. Indeed, let $(t, x) ∈ [0, T] × U$ and let two sequences $\{(t_i, x_i)\}_{i=0}^∞ ⊂ [0, T] × U$ and $\{y_i\}_{i=0}^∞ ⊂ R^n$ such that $\lim_{i→∞}(t_i, x_i) = (t, x)$, $y_i ∈ R_Σ^b(t_i, x_i)$, and $\lim_{i→∞} y_i = y ∈ R^n$. Outer semicontinuity of $R_Σ^b$ at $(t, x)$ follows if we show that $y ∈ R_Σ^b(t, x)$. To this end, we consider a sequence of solutions $\{\phi_i\}_{i=0}^∞$ to $Σ$ such that

$$ \mathrm{dom} \phi_i = [0, t_i] \quad \text{and} \quad y_i = \phi_i(t_i) \quad \forall i \in \{0, 1, \dots\}. $$

Now, since the sequence $\{\phi_i\}_{i=0}^∞$ is uniformly bounded, by passing to an adequate subsequence, we conclude the existence of a continuous function $\phi : [0, T] → R^n$ constituting the graphical limit of the sequence $\{\phi_i\}_{i=0}^∞$ such that

$$ \lim_{i \to \infty} \phi_i(t) = \phi(t) \quad \forall t \in [0, T], \quad T = \lim_{i \to \infty} t_i. $$

Hence, $\phi(0) = x$ and $y = \lim_{i→∞} \phi_i(t_i) = \phi(t)$. Finally, using [26], Theorem 5.29, we conclude that $\phi$ is solution to $Σ$ and thus $y ∈ R_Σ^b(t, x)$.

Now, to show outer semicontinuity of $R$, we consider two sequences $\{(t_i, x_i)\}_{i=0}^∞ ⊂ [0, T] × U$ and $\{y_i\}_{i=0}^∞ ⊂ R^n$ such that $\lim_{i→∞}(t_i, x_i) = (t, x)$, $y_i ∈ R(t_i, x_i)$, and $\lim_{i→∞} y_i = y ∈ R^n$. Outer semicontinuity of $R$ at $(t, x)$ follows if we show that $y ∈ R(t, x)$. Having $y_i ∈ R(t_i, x_i)$, for each $i ∈ N$, implies the existence of $t'_i ∈ [0, t_i]$ such that $y_i ∈ R^b(t'_i, x_i)$, for each $i ∈ N$. By passing to an adequate subsequence, we conclude the existence of $t' ∈ [0, t]$ such that $t' = \lim_{i→∞} t'_i$. Hence, since $R^b$ is outer semicontinuous, we conclude that $y ∈ R^b(t', x) ⊂ R(t, x)$. □

We next present two useful consequences of having $F$ locally bounded. A proof is included in [36].

**Lemma A.2.** Consider the differential inclusion $Σ$ and assume that the map $F$ therein is locally bounded. Then, the following properties are true:

* For each compact set $K ⊂ R^n$, there exist $b > 0$ and $\bar{T} > 0$ such that the sets $R_Σ(\bar{T}, (K+bB))$ and $R_{Σ-}(\bar{T}, (K+bB))$ are bounded.

* Given a sequence of solutions $\{\phi_i\}_{i=0}^∞$ to $Σ$ starting from a compact set $K$ such that, for each $i ∈ \{1, 2, \dots\}$, $\mathrm{dom} \phi_i = [0, t_i]$, $t_i > 0$, and $\lim_{i→∞} t_i = t_o ∈ (0, +∞]$. Then, there exists $\bar{T} ∈ (0, t_o]$, the largest time, such that the sequence $\{\phi_i\}_{i=1}^∞$ is uniformly bounded on any interval $[0, T] ⊂ [0, \bar{T})$.

The following lemma can be deduced from [37], Theorem 6.3. Although formulated in the nonsmooth setting and for locally-Lipschitz dynamics, the same proof applies to our case. A detailed proof is in [36].

**Lemma A.3.** Consider system $Σ$ in (2.2) such that Assumption 3.5 holds. Consider an open set $O ⊂ R^n$ and a continuously-differentiable function $B : R^n → R$ such that, along each solution $\phi$ satisfying $\phi(\mathrm{dom} \phi) ⊂ O$, the map $t ↦→ B(\phi(t))$ is nonincreasing. Then,

$$ \langle \nabla B(x), \eta \rangle \le 0 \quad \forall \eta \in F(x), \quad \forall x \in O. $$

The next lemma is deduced from [26], Lemma 7.37, where it is formulated for the general context of hybrid inclusions. A simpler proof can be found in [36].

**Lemma A.4.** Consider system $Σ$ in (2.2) such that Assumption 3.5 holds. Then, for each $\rho_1 ∈ C_+$, there exists a smooth function $\rho_2 ∈ C_+$ satisfying

$$ \rho_2(x) \le \rho_1(x) \quad \forall x \in R^n \qquad (A.1) $$
such that the following property holds.

PA.41) For each $\phi \in S_{\Sigma}(x_o)$, for each $v \in \mathbb{B}$, and for each $t \in \text{dom} \phi \cap \mathbb{R}_{\ge 0}$, the function $\psi : [0, t] \to \mathbb{R}^n$ given by
$$ \psi(s) := \phi(s) + \rho_2(\phi(s))v \text{ is solution to } \Sigma_{\rho_1}. $$

The last lemma recalls a classical result in analysis; see [38], Chapter I, which has been often applied to deduce a smooth Lyapunov function starting from a nonsmooth one; see [39], Proposition 1.1, [32], Lemma 5.1, [24], Proof of Lemma 16, and [26], Section 7.6.0.3. A proof is included in [36].

**Lemma A.5.** Let $B_o : \mathbb{R}^n \to \mathbb{R}$ be locally bounded. Assume that, at every $x \in \mathbb{R}^n$, $B_o$ is either upper or lower semicontinuous. Then, the function $B : \mathbb{R}^n \to \mathbb{R}$ given by

$$ B(x) := \int_{\mathbb{R}^n} B_o(x + \rho_o(x)v)\Psi(v)dv, \qquad (A.2) $$

where $\rho_o : \mathbb{R}^n \to \mathbb{R}_{>0}$ and $\Psi : \mathbb{R}^n \to [0, 1]$ are smooth functions such that

$$ \Psi(v) = 0 \quad \forall v \in \mathbb{R}^n \setminus \mathbb{B} \quad \text{and} \quad \int_{\mathbb{R}^n} \Psi(v)dv = 1, \qquad (A.3) $$

is continuously differentiable.