SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Hongchao Zhang  
Electrical & Systems Engineering  
Washington University in St. Louis  
St. Louis, MO 63130  
hongchao@wustl.edu
Yevgeniy Vorobeychik  
Computer Science & Engineering  
Washington University in St. Louis  
St. Louis, MO 63130  
yvorobeychik@wustl.edu
Junlin Wu  
Computer Science & Engineering  
Washington University in St. Louis  
St. Louis, MO 63130  
junlin.wu@wustl.edu
Andrew Clark  
Electrical & Systems Engineering  
Washington University in St. Louis  
St. Louis, MO 63130  
andrewclark@wustl.edu
Control Barrier Functions (CBFs) are a popular approach for safe control of nonlinear systems. In CBF-based control, the desired safety properties of the system are mapped to nonnegativity of a CBF, and the control input is chosen to ensure that the CBF remains nonnegative for all time. Recently, machine learning methods that represent CBFs as neural networks (neural control barrier functions, or NCBFs) have shown great promise due to the universal representability of neural networks. However, verifying that a learned CBF guarantees safety remains a challenging research problem. This paper presents novel exact conditions and algorithms for verifying safety of feedforward NCBFs with ReLU activation functions. The key challenge in doing so is that, due to the piecewise linearity of the ReLU function, the NCBF will be nondifferentiable at certain points, thus invalidating traditional safety verification methods that assume a smooth barrier function. We resolve this issue by leveraging a generalization of Nagumo's theorem for proving invariance of sets with nonsmooth boundaries to derive necessary and sufficient conditions for safety. Based on this condition, we propose an algorithm for safety verification of NCBFs that first decomposes the NCBF into piecewise linear segments and then solves a nonlinear program to verify safety of each segment as well as the intersections of the linear segments. We mitigate the complexity by only considering the boundary of the safe region and by pruning the segments with Interval Bound Propagation (IBP) and linear relaxation. We evaluate our approach through numerical studies with comparison to state-of-the-art SMT-based methods. Our code is available at https://github.com/HongchaoZhang-HZ/exactverif-reluncbf-nips23.
Safety is a critical property for autonomous systems, including unmanned ground, aerial, and space vehicles [1] and robotic manipulators [2]. The importance of safety has motivated extensive research into verification and synthesis of safe control strategies [3, 4, 5, 6, 7]. Control barrier function (CBF)-based algorithms [8] ensure safety by constructing a CBF that is nonnegative if the system is safe and synthesizing a control policy that ensures that the CBF is nonnegative for all time. Control barrier functions provide a high degree of flexibility, since any control policy that satisfies the control barrier function constraint is provably safe, and have been demonstrated in applications including
robotic manipulation [9], vehicle cruise control [10] and space exploration [11]. Recently, CBFs that are parametrized by neural networks (neural control barrier functions or NCBFs) [12, 13, 14] have been proposed. This novel class of NCBFs is promising due to the universal representability of neural networks (enabling the encoding of complex safety constraints) and the efficiency of learning algorithms, with a comparison in Section A.15 exemplifying numerical difference. However, safety verification of NCBF-based control remains a challenging research problem.
In this paper, we consider the problem of verifying safety of NCBF-based control for nonlinear continuous-time systems. We focus on NCBFs represented by feedforward neural networks with ReLU activation due to their fast convergence in training shown in Section A.16 and widespread use in the safe control literature [12, 13]. The key challenge for this class of NCBFs is that most methodologies for safety verification are based on proving that the derivative of the barrier function is nonnegative at the boundary of the safe region, and hence the barrier function remains nonnegative for all time. Since the ReLU activation function is not continuously differentiable, this approach is inapplicable. We resolve this challenge and derive exact safety conditions for ReLU NCBFs by leveraging a generalization of Nagumo's theorem for proving invariance of sets with nonsmooth boundaries. Based on these conditions, we propose a new class of NCBF-based control policies that do not require the control policy and NCBF to be jointly trained, thus improving flexibility and tunability of the controller design. Our safety conditions also incorporate linear constraints on the control input, which may arise due to limits on actuation.
We propose an algorithm to verify that an NCBF satisfies our derived safety conditions, implying that any control policy that is constrained by the NCBF will be safe. Our approach first decomposes the NCBF into piecewise linear segments. In order to mitigate the complexity of this stage, we show that it suffices to consider linear segments at the boundary of the safe region, and further over-approximate the segments using Interval Bound Propagation and linear relaxation. After decomposing the NCBF, we verify safety by solving a set of nonlinear programs, which check the safety criteria on each linear segment as well as at intersections of the segments. We evaluate our approach through numerical studies, in which we verify NCBFs with our proposed approach and compare to state-of-the-art Satisfiability Modulo Theory (SMT) based methods.
Related Work Energy-based methods have been proposed to guarantee safety by ensuring that a particular energy function remains nonnegative. Barrier certificates for safe control were first proposed in [15]. More recently, CBFs have emerged as promising approaches to safe control, due to their compatibility with a wide variety of control laws [8, 16, 17, 5, 14, 12, 1]. Sum-of-squares (SOS) optimization and other techniques derived from algebraic geometry have been widely used for safety verification of polynomial barrier functions [15, 8, 18, 19, 17]. However, SOS-based approaches for polynomial CBFs cannot be applied directly to NCBF verification, since activation functions used in neural networks are not polynomial and may be non-differentiable.
Neural barrier certificate [20, 21, 22, 23] and NCBFs [12, 13, 14] have been proposed to describe complex safety constraints that cannot be encoded polynomials. Current work, including SMT-based methods [24, 21, 25] and mixed integer programs [26], verify safety by constructing a nominal control policy and proving that it satisfies the NCBF constraints. However, as we show in Section 5, the reliance on a particular control policy may lead to false negatives during safety verification. Another related body of work deals with the problem of verifying neural networks including SMT [27], output reachable set verification [28], polynomial approximations of the barrier function [29], verify input/output relationships [30, 31, 32] and ReLU neural networks focused verification [33, 34]. These methods, however, are not directly applicable to the problem of NCBF verification, which requires joint consideration of the neural network and the underlying nonlinear system dynamics. Methods based on input/output relationship can verify by encode dynamics and control policy with neural networks. However, with approximating error introduced, these methods are not directly applicable for exact verification. Piecewise linear approximations of ReLU neural networks have been used to develop tractable safety verification algorithms using linear [35] and SOS programming [36]. These approaches leads to sound and incomplete verification algorithms and have only been applied for discrete-time systems, whereas the present paper proposes exact verification algorithms for continuous-time systems.
Organization The remainder of the paper is organized as follows. Section 2 gives the system model and background on neural networks and notation. Section 3 presents the problem formulation and
exact conditions for safety. Section 4 presents our approach to verifying that an NCBF satisfies the safety conditions. Section 5 contains simulation results. Section 6 concludes the paper.
In this section, we first present the system model and definition of safety. We then give background and notations of feedforward neural networks.
2.1 System Model and Safety Definition
We consider a continuous-time nonlinear control-affine system with state  $x(t) \in \mathcal{X} \subseteq \mathbb{R}^n$ , control input  $u(t) \in \mathcal{U} \subseteq \mathbb{R}^m$ , and dynamics
$$
\dot {x} (t) = f (x (t)) + g (x (t)) u (t), \tag {1}
$$
where  $f: \mathbb{R}^n \to \mathbb{R}^n$  and  $g: \mathbb{R}^n \to \mathbb{R}^{n \times m}$  are known functions. A control policy is a function  $\mu: \mathbb{R}^n \to \mathcal{U}$  that maps a state  $x$  to a control input  $u$ .
Safety of dynamical systems requires  $x(t)$  to remain in a given region  $\mathcal{C}$ , which we denote as the safe region. We assume the safe region is given by  $\mathcal{C} = \{x : h(x) \geq 0\} \subseteq \mathcal{X}$ , for some function  $h : \mathcal{X} \to \mathbb{R}$ . Safety is related to the property of positive invariance, which we define as follows.
Definition 1. A set  $\mathcal{D} \subseteq \mathbb{R}^n$  is positive invariant under dynamics (1) and control policy  $\mu$  if  $x(0) \in \mathcal{D}$  and  $u(t) = \mu(x(t)) \forall t \geq 0$  imply that  $x(t) \in \mathcal{D}$  for all  $t \geq 0$ .
We define a control policy  $\mu$  to be safe if there is a set  $\mathcal{D}$  such that (i)  $\mathcal{D} \subseteq \mathcal{C}$  and (ii)  $\mathcal{D}$  is positive invariant under dynamics (1) and control policy  $\mu$ .
One approach to designing safe control policies is to choose a function  $b: \mathbb{R}^n \to \mathbb{R}$ , denoted as a Control Barrier Function (CBF), and let  $\mathcal{D} = \{x : b(x) \geq 0\}$ . In the case where  $b$  is continuously differentiable, the following result can be used to guarantee positive invariance of  $\mathcal{D}$ .
Theorem 1 ([8]). Suppose that  $b$  is a CBF,  $b(x(0)) \geq 0$ , and  $u(t)$  satisfies
$$
\frac {\partial b}{\partial x} (f (x) + g (x) u) \geq - \alpha (b (x)). \tag {2}
$$
for all  $t$ , where  $\alpha : \mathbb{R} \to \mathbb{R}$  is a strictly increasing function with  $\alpha(0) = 0$ . Then the set  $\mathcal{D} = \{x : b(x) \geq 0\}$  is positive invariant.
Theorem 1 implies that, if  $b$  is a CBF, then adding (2) as a constraint on the control at each time step suffices to guarantee safety.
Recently, Neural Control Barrier Functions (NCBFs), in which the function  $b$  is encoded by a neural network, have been proposed [12, 13, 14]. The advantage of NCBFs arises from the universal representability of neural networks, which allows them to realize a wide variety of safety constraints.
2.2 Neural Network Background and Notation
We give notations to describe a neural network (NN) with  $L$  layers and  $M_{i}$  neurons in the  $i$ -th layer. We let the input to the NN be denoted  $x$ , the output at the  $j$ -th neuron of the  $i$ -th layer be denoted  $z_{ij}$ , and the output of the network be denoted  $y$ . We let  $\mathbf{z}_{i}$  denote the vector of neuron outputs at the  $i$ -th layer. The outputs are computed as
$$
z _ {i j} = \left\{ \begin{array}{l l} \sigma \left(W _ {i j} ^ {T} x + r _ {i j}\right), & i = 1 \\ \sigma \left(W _ {i j} ^ {T} \mathbf {z} _ {i - 1} + r _ {i j}\right), & i \in \{2, \dots , L - 1 \} \end{array} , y = \Omega^ {T} \mathbf {z} _ {L} + \psi \right. \tag {3}
$$
where  $\sigma : \mathbb{R} \to \mathbb{R}$  is the activation function. The input to the function  $\sigma$  is the pre-activation input to the neuron, and is given by  $W_{1j}^{T}x + r_{1j}$  for the  $j$ -th neuron at the first layer and  $W_{ij}^{T}\mathbf{z}_{i - 1} + r_{ij}$  for the  $j$ -th neuron at the  $i$ -th hidden layer.  $W_{ij}$  has dimensionality  $n \times 1$  for  $i = 1$  and  $M_{i - 1} \times 1$  for  $i > 1$ .  $W_{i}$  is an  $n \times M_{i}$  matrix. In this paper, we assume that  $\sigma$  is the ReLU function  $ReLU(z) = \max \{0, z\}$ . The output of the network is given by  $y = \Omega^{T}\mathbf{z}_{L} + \psi$ , where  $\Omega \in \mathbb{R}^{M_{L}}$  and  $\psi \in \mathbb{R}$ . The  $j$ -th neuron at the  $i$ -th layer is activated by a particular input  $x$  if its pre-activation input is nonnegative, inactivated if the pre-activation input is nonpositive, and unstable if the pre-activation input is zero.
A set of neurons  $\mathbf{S} = (S_{1},\dots ,S_{L})$  , with  $S_{i}\subseteq \{1,\ldots ,M_{i}\}$  denoting a subset of neurons at the  $i$  -th layer, is activated by  $x$  if all of the neurons in  $\mathbf{S}$  are activated by  $x$  and all the neurons not in  $\mathbf{S}$  are inactivated by  $x$  . A set of neurons  $\mathbf{T} = (T_1,\dots ,T_L)$  with  $T_{i}\subseteq \{1,\dots ,M_{i}\}$  is unstable by  $x$  if all of the neurons in  $\mathbf{T}$  are unstable by  $x$
For a given set  $\mathbf{S}$ , if  $\mathbf{S}$  is activated by  $x$ , then the pre-activation input to each neuron and the overall output of the network are affine in  $x$ , with the affine mapping determined by  $\mathbf{S}$  as follows. For the first layer, we define
$$
\overline {{W}} _ {1 j} (\mathbf {S}) = \left\{ \begin{array}{l l} W _ {1 j}, & j \in S _ {1} \\ 0, & \text {e l s e} \end{array} \quad \bar {r} _ {1 j} (\mathbf {S}) = \left\{ \begin{array}{l l} r _ {1 j}, & j \in S _ {1} \\ 0, & \text {e l s e} \end{array} \right. \right. \tag {4}
$$
so that the output of the  $j$ -th neuron at the first layer is  $\overline{W}_{1j}(\mathbf{S})^T x + \overline{r}_{1j}(\mathbf{S})$ . We recursively define  $\overline{W}_{ij}(\mathbf{S})$  and  $\overline{r}_{ij}(\mathbf{S})$  by letting  $\overline{\mathbf{W}}_i(\mathbf{S})$  be a matrix with columns  $\overline{W}_{i1}(\mathbf{S}),\ldots ,\overline{W}_{iM_i}(\mathbf{S})$  and
$$
\overline {{W}} _ {i j} (\mathbf {S}) = \left\{ \begin{array}{l l} \overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) W _ {i j}, & j \in S _ {i} \\ 0, & \text {e l s e} \end{array} \quad \bar {r} _ {i j} (\mathbf {S}) = \left\{ \begin{array}{l l} W _ {i j} ^ {T} \bar {\mathbf {r}} _ {i - 1} (\mathbf {S}) + r _ {i j}, & j \in S _ {i}, \\ 0, & \text {e l s e} \end{array} \right. \right. \tag {5}
$$
where  $\overline{\mathbf{r}}_i(\mathbf{S})$  is the vector with elements  $\overline{r}_{ij}(\mathbf{S}), j = 1,\dots,M_i$ .
We define  $\overline{W}(\mathbf{S}) = \overline{\mathbf{W}}_L(\mathbf{S})\Omega$  and  $\overline{r}(\mathbf{S}) = \Omega^T\overline{\mathbf{r}}_L(\mathbf{S}) + \psi$ . Based on these notations, when an input  $x$  activates the set  $\mathbf{S}$ ,  $z_{ij} = \overline{W}_{ij}(\mathbf{S})^Tx + \overline{r}_{ij}(\mathbf{S})$  and  $y = \overline{W}(\mathbf{S})^Tx + \overline{r}(\mathbf{S})$ .
Lemma 1. Let  $\overline{\mathcal{X}}(\mathbf{S})$  denote the set of inputs  $x$  that activate a particular set of neurons  $\mathbf{S}$ , and let  $\overline{\mathbf{W}}_0(\mathbf{S})$  be equal to the identity matrix, and  $\overline{\mathbf{r}}_0$  to be zero vector. Then
$$
\begin{array}{l} \overline {{\mathcal {X}}} (\mathbf {S}) = \bigcap_ {i = 1} ^ {L} \left(\bigcap_ {j \in S _ {i}} \left\{x: W _ {i j} ^ {T} \left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) ^ {T} x + \bar {\mathbf {r}} _ {i - 1}\right) + r _ {i j} \geq 0 \right\} \right. \\ \left. \cap \bigcap_ {j \notin S _ {i}} \left\{x: W _ {i j} ^ {T} \left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) ^ {T} x + \bar {\mathbf {r}} _ {i - 1}\right) + r _ {i j} \leq 0 \right\}\right). \tag {6} \\ \end{array}
$$
A proof can be found in the supplementary material. Note that in (6), a particular input  $x$  could belong to multiple activation regions  $\overline{\mathcal{X}}(\mathbf{S})$ . This is because if the  $j$ -th neuron at the  $i$ -th layer is unstable, then both  $(S_1, \ldots, S_i \cup \{j\}, \ldots, S_L)$  and  $(S_1, \ldots, S_i \setminus \{j\}, \ldots, S_L)$  can be regarded as activated by  $x$ . We let  $\mathbf{S}(x) \triangleq \{\mathbf{S} : x \in \overline{\mathcal{X}}(\mathbf{S})\}$  and let  $\mathbf{T}(x)$  denote the set of unstable neurons produced by input  $x$ . Given a collection of activation sets  $\mathbf{S}_1, \ldots, \mathbf{S}_r$ , we let
$$
\mathbf {T} (\mathbf {S} _ {1}, \dots , \mathbf {S} _ {r}) = \left(\bigcup_ {l = 1} ^ {r} \mathbf {S} _ {l}\right) \setminus \left(\bigcap_ {l = 1} ^ {r} \mathbf {S} _ {l}\right).
$$
The set  $\mathbf{T}(\mathbf{S}_1, \ldots, \mathbf{S}_r)$  is equal to the set of neurons that must be unstable in order for an input  $x$  to belong to  $\overline{\mathcal{X}}(\mathbf{S}_1) \cap \ldots \cap \overline{\mathcal{X}}(\mathbf{S}_r)$ .
3 Problem Formulation and Safety Conditions
In this section, we first formally define the problem, and then give necessary and sufficient conditions for verifying NCBFs.
We consider a feedforward neural network (NN)  $b: \mathcal{X} \to \mathbb{R}$  with ReLU activation function. Since  $b$  is not continuously differentiable due to the piecewise linearity of the ReLU function, the guarantees of Theorem 1 cannot be applied directly. Our overall goal will be to derive analogous conditions to (2) for ReLU-NCBFs, and then ensure that any control policy  $\mu$  that satisfies the conditions will be safe with  $\mathcal{D} = \{x : b(x) \geq 0\}$ .
Problem 1. Given a nonlinear continuous-time system (1), a neural network function  $b: \mathcal{X} \to \mathbb{R}$ , a set of admissible control inputs  $\mathcal{U} = \{u: Au \leq c\}$  for given matrix  $A \in \mathbb{R}^{p \times m}$  and vector  $c \in \mathbb{R}^p$ , and a safe set  $\mathcal{C} = \{x: h(x) \geq 0\}$ , determine whether (i)  $\mathcal{D} \subseteq \mathcal{C}$  and (ii) there exists a control policy  $\mu$  such that  $\mathcal{D}$  is positive invariant under dynamics (1) and control policy  $\mu$ .
3.2 Exact Conditions for Safety
When a CBF  $b(x)$  is continuously differentiable, ensuring that (2) is satisfied is equivalent to verifying that there is no  $x$  satisfying  $b(x) = 0$ ,  $\frac{\partial b}{\partial x} g(x) = 0$ , and  $\frac{\partial b}{\partial x} f(x) < 0$  [17]. When  $b$  is represented by a ReLU neural network, however,  $b$  will not be differentiable when the input  $x$  leads to neurons having zero pre-activation input, i.e., when  $\mathbf{T}(x) \neq \emptyset$ . Although the set of  $x$  with  $\mathbf{T}(x) \neq \emptyset$  has measure zero, such points can nonetheless cause safety violations as illustrated by the following example.
Example: Let  $x(t) \in \mathbb{R}^2$  and suppose the dynamics of  $x$  are given by
$$
\begin{array}{r c l} \dot {x} _ {1} (t) & = & x _ {1} + u \\ \dot {x} _ {2} (t) & = & - x _ {1} + 5 x _ {2} \end{array} \quad \Rightarrow \quad f (x) = \left( \begin{array}{c c} 1 & 0 \\ - 1 & 5 \end{array} \right) x, g (x) = \left( \begin{array}{c} 1 \\ 0 \end{array} \right)
$$
Suppose that  $\mathcal{U} = \mathbb{R}^m$ , the safe region  $\mathcal{C} = \{x : x_1^2 + x_2^2 \leq 9\}$ , and the candidate CBF is given by  $b(x) = 1 - ||x||_1$ . This CBF can be realized by a neural network with a single layer ( $L = 1$ ) with four neurons ( $M_1 = 4$ ), weights  $W_{11} = (10)^T$ ,  $W_{12} = (-10)^T$ ,  $W_{13} = (01)^T$ ,  $W_{14} = (0 - 1)^T$ ,  $r_{1j} = 0$  for  $j = 1, \ldots, 4$ ,  $\Omega_j = -1$  for  $j = 1, \ldots, 4$ , and  $\psi = 1$ . We observe that  $\mathcal{D} = \{x : b(x) \geq 0\} \subseteq \mathcal{C}$ . Furthermore, whenever  $\frac{\partial b}{\partial x}$  exists, we have  $\frac{\partial b}{\partial x} \in \{(11), (1 - 1), (-11), (-1 - 1)\}$ , each of which satisfies  $\frac{\partial b}{\partial x} g(x) \neq 0$ . On the other hand, the set  $\mathcal{D}$  is not positive invariant. If  $x_2(0) > \frac{1}{5}$ , then  $|x_1(0)| \leq 1$  implies that  $\dot{x}_2(0) > 0$ , and indeed,  $x_2(t)$  will continue to increase until  $x(t) \notin \mathcal{D}$ . More details about this example can be found in Section A.17.
Fundamentally, this safety violation occurs because at  $x = (01)^T$ , we have  $b(x) = 0$ ,  $\mathbf{T}(x) = \{(1,1),(1,2)\}$  (i.e., the preactivation input to the first and second neurons in the hidden layer is zero), creating a discontinuity in the slope of  $b(x)$ . For  $x'$  in the neighborhood of  $(01)^T$ , the value of  $\frac{\partial b}{\partial x}(x')g(x')$  will be either 1 or -1. Since there is no single control input that satisfies (2) for both values of  $\frac{\partial b}{\partial x}g(x')$ , it is impossible to ensure safety of the system in the neighborhood of  $(01)^T$ .
The following lemma addresses this issue by giving exact and general conditions for a NCBF with ReLU activation function to satisfy positive invariance. We let  $\partial \mathcal{D}$  denote the boundary of the set  $\mathcal{D}$ .
Lemma 2. The set  $\mathcal{D}$  is positive invariant under control policy  $\mu$  if and only if, for all  $x\in \partial \mathcal{D}$ , there exist  $\mathbf{S}\in \mathbf{S}(x)$  such that
$$
\left. \left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) W _ {i j}\right) ^ {T} (f (x) + g (x) \mu (x)) \geq 0 \quad \forall (i, j) \in \mathbf {T} (x) \cap \mathbf {S} \right. \tag {7}
$$
$$
\left. \left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) W _ {i j}\right) ^ {T} (f (x) + g (x) \mu (x)) \leq 0 \quad \forall (i, j) \in \mathbf {T} (x) \backslash \mathbf {S} \right. \tag {8}
$$
$$
\overline {{W}} (\mathbf {S}) ^ {T} (f (x) + g (x) \mu (x)) \geq 0 \tag {9}
$$
The proof is based on the generalized Nagumo's Theorem [37] and a novel characterization of the Clarke tangent cone to  $\partial \mathcal{D}$ , and can be found in the supplementary material due to space constraints. Intuitively, conditions (7)-(9) can be interpreted as follows. Condition (9) is similar to (2) when the gradient is given by  $\overline{W}(\mathbf{S})$ , i.e., when  $x$  is in the interior of the activation region defined by  $\mathbf{S}$ . Eq. (7)-(8) can be interpreted as choosing the control input to ensure that  $x$  remains in the activation region of  $\mathbf{S}$  (i.e.,  $\overline{\mathcal{X}}(\mathbf{S})$ ).
Lemma 2 can be used to construct NCBF-based safe control policies, analogous to control policies based on continuously differentiable CBFs. Formally, given a nominal control policy  $\mu_{\text{nom}}$ , at each time  $t$ , we can choose  $u(t)$  by solving the optimization problem
$$
\begin{array}{l l} \min  _ {\mathbf {S} \in \mathbf {S} (x), u} & | | u - \mu_ {\text {n o m}} (x (t)) | | _ {2} ^ {2} \\ \text {s . t .} & \overline {{W}} (\mathbf {S}) ^ {T} (f (x) + g (x) \mu (x)) \geq - \alpha (b (x)) \\ & u \in \mathcal {U}, (7), (8) \end{array} \tag {10}
$$
where  $\alpha$  satisfies the same conditions as in Theorem 1. This problem can be solved by decomposing (10) into  $|\mathbf{S}(x)|$  quadratic programs (one for each  $\mathbf{S}$ ) and then selecting the value of  $u$  that minimizes the objective function across all of the QPs. In particular, if  $\mathbf{S}(x)$  is a singleton, then the constraints on (10) reduce to Eq. (2).
We then give an equivalent condition for  $b(x)$  to be an NCBF. As a preliminary, we say that a collection of activation sets  $\mathbf{S}_1, \ldots, \mathbf{S}_r$  is complete if for any  $\mathbf{S}' \notin \{\mathbf{S}_1, \ldots, \mathbf{S}_r\}$ , we have  $\overline{\mathcal{X}}(\mathbf{S}_1) \cap \cdots \cap \overline{\mathcal{X}}(\mathbf{S}_r) \cap \overline{\mathcal{X}}(\mathbf{S}') = \emptyset$ .
Proposition 1. The function  $b$  is a valid CBF iff the following two properties hold:
(i) For all activation sets  $\mathbf{S}_1, \ldots, \mathbf{S}_r$  with  $\{\mathbf{S}_1, \ldots, \mathbf{S}_r\}$  complete and any  $x$  satisfying  $b(x) = 0$  and
$$
x \in \left(\bigcap_ {l = 1} ^ {r} \overline {{\mathcal {X}}} (\mathbf {S} _ {l})\right), \tag {11}
$$
there exist  $l\in \{1,\ldots ,r\}$  and  $u\in \mathcal{U}$  such that