Received September 22, 2020, accepted September 30, 2020, date of publication October 8, 2020, date of current version October 27, 2020.
Digital Object Identifier 10.1109/ACCESS.2020.3029558
Safety-Critical Control of Active Interventions
for COVID-19 Mitigation
AARON D. AMES
1
, (Senior Member, IEEE), TAMÁS G. MOLNÁR
2
,
ANDREW W. SINGLETARY
1
, AND GÁBOR OROSZ
2,3
, (Member, IEEE)
1
Department of Mechanical and Civil Engineering, California Institute of Technology, Pasadena, CA 91125, USA
2
Department of Mechanical Engineering, University of Michigan, Ann Arbor, MI 48109, USA
3
Department of Civil and Environmental Engineering, University of Michigan, Ann Arbor, MI 48109, USA
Corresponding author: Tamás G. Molnár (molnart@umich.edu)
This work was supported in part by the National Science Foundation, Cyber-Physical Systems (CPS) Award 1932091.
ABSTRACT
The world has recently undergone the most ambitious mitigation effort in a century, consisting
of wide-spread quarantines aimed at preventing the spread of COVID-19. The use of influential epidemi-
ological models of COVID-19 helped to encourage decision makers to take drastic non-pharmaceutical
interventions. Yet, inherent in these models are often assumptions that the active interventions are static, e.g.,
that social distancing is enforced until infections are minimized, which can lead to inaccurate predictions
that are ever evolving as new data is assimilated. We present a methodology to dynamically guide the
active intervention by shifting the focus from viewing epidemiological models as systems that evolve in
autonomous fashion to control systems with an ‘‘input’’ that can be varied in time in order to change the
evolution of the system. We show that a safety-critical control approach to COVID-19 mitigation gives active
intervention policies that formally guarantee the safe evolution of compartmental epidemiological models.
This perspective is applied to current US data on cases while taking into account reduction of mobility, and we
find that it accurately describes the current trends when time delays associated with incubation and testing are
incorporated. Optimal active intervention policies are synthesized to determine future mitigations necessary
to bound infections, hospitalizations, and death, both at national and state levels. We therefore provide means
in which to model and modulate active interventions with a view toward the phased reopenings that are cur-
rently beginning across the US and the world in a decentralized fashion. This framework can be converted into
public policies, accounting for the fractured landscape of COVID-19 mitigation in a safety-critical fashion.
INDEX TERMS
Safety-critical control, epidemiology, non-pharmaceutical intervention, COVID-19.
I. INTRODUCTION
As COVID-19 spreads throughout the world [9]–[11], due to
the novelty of the virus and the resulting lack of pharmaceu-
tical options necessary to suppress infection [12], unprece-
dented mitigation steps to slow its progression were taken [1]
in the form of non-pharmaceutical interventions [3], [13],
e.g., social distancing, mask-wearing, quarantining, and stay-
at-home orders. It is largely agreed upon that these slowed
the spread of the virus [2], [14], thereby saving lives. Yet
studies have shown that if these active interventions had been
enforced even a week earlier [15], the result would have been
a substantial reduction in deaths. As a means of mitigating the
spread of COVID-19, the question therefore becomes: when,
where, and how does one decide to take non-pharmaceutical
interventions? This question is especially relevant [16] as
The associate editor coordinating the review of this manuscript and
approving it for publication was Derek Abbott
.
restrictions are being relaxed in a decentralized fashion across
the US and throughout the world.
FIGURE 1.
Illustration of the safety-critical active intervention policies
developed in this paper applied at the state level (for states with
sufficient data) in the US. The states are colored according to whether it is
safe to open further (green), slowly open (yellow) hold the current
mitigation efforts steady (orange), or increase mitigation (red). This is
determined based upon an active intervention policy that formally
guarantees bounded hospitalizations and deaths.
188454
This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
VOLUME 8, 2020
A. D. Ames
et al.
: Safety-Critical Control of Active Interventions for COVID-19 Mitigation
TABLE 1.
Policy summary.
Due to the pressing need to understand past and future
mitigation efforts [4], and the corresponding role of active
interventions, there has been a surge of recent papers on
the modeling of COVID-19 [5], [17]–[20]. Epidemiological
models for predicting the spread of COVID-19 often utilize
dynamical systems obtained from so-called ‘‘compartmen-
tal’’ models wherein the compartments reflect different pop-
ulations of interest [21]–[23], e.g., susceptible (
S
), infected
(
I
), recovered (
R
), etc. More compartments can be added
allowing for higher fidelity models, although one must be
careful of overfitting the largely increased number of param-
eters in more complex models. The most fundamental (and
elementary) of these compartmental models is the SIR model,
which has recently been used in modeling of COVID-19
[24], [25]. More complex models applied for COVID-19
include the SEIR [26], [27] and SIRT [28] models, which
involve exposed (
E
) and threatened (
T
) populations, and the
SIXRD [29] and SIDARTHE models [5] which add even
more compartments. While compartmental models have been
found to be useful when modeling the spread of COVID-19
and the corresponding mitigation procedures, e.g., stay-at-
home orders, the approaches are fundamentally based on
autonomous dynamics [30], [31] as they do not have a
time-varying
control input
that can dynamically change the
evolution of the system. We propose a different approach:
applying
safety-critical control
methods to guide active non-
pharmaceutical interventions wherein we can actively predict
the interventions needed to maintain safety by viewing com-
partmental models as
control systems
.
The main results of this paper are safety-critical ‘‘reopen-
ing’’ policies to guide active interventions – formally guar-
anteeing safety constraint satisfaction – both at the national
and state level in the US. This concept is illustrated in Fig.
1.
To obtain these results, in Section
II we begin by motivat-
ing these ideas with the SIR model, viewed as a control
system, that accurately describes national level US data
on cases when taking into account reduction of mobility.
Safety-critical policies, based upon control barrier functions,
are motivated for the SIR model in Section
III. Section
IV
introduces the higher fidelity SIHRD model which includes
populations for hospitalized and deceased. This model is
utilized for both national and state level data, wherein safety-
critical active interventions bounding hospitalizations and
deaths are synthesized in both cases. Section
V concludes
the paper, while giving policy implications (as summarized
in Table
1). The mathematical formalisms and detailed
derivations that underlie the results presented are given in the
Appendix.
II. THE SIR MODEL AS A CONTROL SYSTEM
At the core of our approach is a fundamental shift in per-
spective on epidemiological models: from viewing them as
dynamical systems that evolve in an autonomous fashion,
to that of control systems for which the evolution can be
dynamically modified. In many ways, this is the
de facto
manner in which these models are implemented, if only in
an implicit fashion, as they are constantly updated as new
data is assimilated, e.g., as changes in social distancing are
observed [32]. We, therefore, will formalize this perspective
by making the control aspect of epidemiological models
explicit. Note that viewing compartmental epidemiological
models as control systems is not unique [33], [34], but has
found only limited application to COVID-19 [35] and has yet
to enjoy formal guarantees on safety. Additionally, there are
examples of control-theoretic concepts being applied, namely
in the the context of time-varying [28], [36], [37] and state-
varying [6], [38] choices of the transmission rate; these can be
viewed as time- and state-varying inputs to a control system.
Our approach differs in that we wish to synthesize
active
intervention policies
(i.e., feedback control laws) that will
determine future actions to take based upon past observations
of the states of the systems.
To motivate the methodology utilized throughout this
paper, we will begin by considering the fundamental epidemi-
ological compartmental model: the SIR model [21], [23].
Importantly, the approach introduced herein can be applied to
any
compartmental model, and will subsequently be applied
to a more descriptive model. The SIR model consists of a
susceptible
population
S
,
infected
population
I
, and
recovered
population
R
. We can view the evolution of these populations
as a control system where active interventions, expressed by
the control input
u
(
t
), modulate the rate of change of the
infected population
:
̇
S
(
t
)
= −
β
0
N
(
1
−
u
(
t
)
︸︷︷︸
Control Input
)
S
(
t
)
I
(
t
)
,
̇
I
(
t
)
=
β
0
N
(
1
−
u
(
t
)
︸︷︷︸
Control Input
)
S
(
t
)
I
(
t
)
−
γ
I
(
t
)
,
̇
R
(
t
)
=
γ
I
(
t
)
.
(1)
VOLUME 8, 2020
188455
A. D. Ames
et al.
: Safety-Critical Control of Active Interventions for COVID-19 Mitigation
FIGURE 2.
Paradigm shift wherein compartmental models are viewed as
control systems rather than dynamical systems. This is illustrated on the
populations
I
(
t
) and
R
(
t
) of the SIR model (top panels) wherein the
control input
u
(
t
) is modulated based upon the intervention policies
estimated from mobility data (bottom panel). The time delay
τ
=
10 days
is highlighted to emphasize that the observed data (shown through
May 30, 2020) corresponds to the delayed counterparts of the
populations, and this delay also appears in the active intervention policy:
u
(
t
)
=
A
(
S
(
t
−
τ
)
,
I
(
t
−
τ
)), given in Eq. (2).
Here the total population
N
=
S
(
t
)
+
I
(
t
)
+
R
(
t
) is constant,
β
0
>
0 is the transmission rate (when no intervention is
present) and
γ >
0 is the recovery rate, yielding the reproduc-
tion number:
R
0
=
β
0
/γ
. This model relates to the traditional
SIR model via the time-varying transmission rate
β
(
t
)
=
β
0
(1
−
u
(
t
)). Time-varying
β
(
t
) has been considered [20]; for
example, we can utilize the policy
u
(
t
)
= −
A
cos(
ω
t
) in the
SIR model [39] to recover models of seasonal variations in
infection [40]. In the setting considered here, taking
u
(
t
)
≡
0
corresponds to
no
intervention, yielding the traditional SIR
model with
β
(
t
)
≡
β
0
, whereas
u
(
t
)
≡
1 can be viewed as
maximum
intervention, full and complete quarantine of the
population. In the latter case the infected population decays
to zero exponentially,
I
(
t
)
=
e
−
γ
t
I
(0), since the susceptible
population is isolated. These effects can be seen, for example,
in the Chinese response to COVID-19 and the corresponding
drop in
R
0
[19].
An illustration of the SIR model as a control system is
shown in Fig.
2 where the interactions between the compart-
ments are denoted by arrows with appropriate rate constants
indicated. The blue arrow represents the time dependent
modulation of the transmission rate
β
(
t
). The control input
u
(
t
) is estimated from mobility data [41] in the US between
March 2 and May 20, 2020 by assuming
u
=
0 at the begin-
ning this period when no non-pharmaceutical interventions
were present. Furthermore, the parameters
β
0
,
γ
and
N
of the
SIR model were fitted to the recorded number of confirmed
cases:
I
(
t
−
τ
)
+
R
(
t
−
τ
) with
τ
the time delay.
Fitting for the time delay
τ
, in the corresponding trans-
mission rate
β
(
t
−
τ
), reveals that the COVID-19 data [42]
depicted publicly [43] are delayed by
τ
≈
10 days. This time
delay originates from the incubation time of the virus (i.e.,
people are being infectious before being symptomatic) and
the time needed for testing [35], [44]–[46]. That is, the data
corresponds to the number of confirmed cases
τ
days ago
while the real current number could be much higher. For
example, in mid-March, when interventions were introduced
in the US,
I
(
t
−
τ
)
+
R
(
t
−
τ
) was reported to be in the range of
a few thousand, while the real number
I
(
t
)
+
R
(
t
) is estimated
to be more than a hundred thousand. This delay also appears
in the active intervention policies which depend on the state
of the system, i.e.,
u
(
t
)
=
A
(
S
(
t
−
τ
)
,
I
(
t
−
τ
)), and it therefore
must be compensated for in order to ensure the safety of these
policies. Finally, we remark that when fitting the model (1)
to the aforementioned data one may obtain good fits while
setting
N
in the range from 7.5 million up to 330 million (see
Appendix G for additional details). Smaller values encode
the fact that not everyone susceptible is necessarily exposed
when the total number of infected is small relative to the
total population, as well as the fact that the total number of
infections is underreported [47]. In Fig.
2 we used the lowest
value
N
=
7
.
5 million; the consequences of this choice will
be discussed in the context of active interventions.
III. SAFETY-CRITICAL CONTROL FOR ACTIVE
INTERVENTION
Utilizing the paradigm of epidemiological models as con-
trol systems, we can synthesize active intervention policies,
i.e., inputs to Eq. (1) expressed as functions of the populations
of the compartmental model. A special case of this is referred
to as shield immunity [6], wherein the policy
u
(
t
)
=
α
R
(
t
)
N
+
α
R
(
t
)
with
α
≥
0 was chosen. Our goal is to synthesize active
intervention policies so as to achieve desired safety-critical
behaviors, that is, to guarantee that the system, with the
policy applied, evolves in a safe fashion. Concretely, we may
quantify safety in the context of the SIR model as limiting
the total number of infected persons:
I
(
t
)
≤
I
max
. To achieve
such goal, we leverage the framework of control barrier func-
tions [7] which gives necessary and sufficient conditions on
the safety, along with tools to generate active intervention
policies that ensure safety.
While there may exist multiple safe policies, it is ben-
eficial to chose one which minimizes the active interven-
tion
u
(
t
), since more aggressive interventions potentially
result in the lose of jobs and other economic and physi-
ological effects [48], [49]. The active intervention policy,
i.e., feedback control law, that gives the minimal possible
(pointwise optimal) interventions so as to ensure the safety
of the system can be explicitly calculated (as described
in Appendix B):
u
(
t
)
=
A
(
S
(
t
)
,
I
(
t
))
:=
max
{
0
,
1
−
γ
β
0
N
S
(
t
)
I
max
I
(
t
)
}
⇒
I
(
t
)
≤
I
max
.
(2)
188456
VOLUME 8, 2020
A. D. Ames
et al.
: Safety-Critical Control of Active Interventions for COVID-19 Mitigation
FIGURE 3.
Application of the safety-critical active intervention policy in
Eq. (2) that keeps the number of infected people under a given limit
I
max
,
to the SIR model in Eq. (1) with the parameters that yielded Fig. 2. The
safety-critical policy is compared against a reference policy where the
control input is reduced linearly. Data are depicted through May 30 and
August 31, 2020, by different colors. The epidemic ends relatively early
due to the reduced population
N
, used in the model.
Notice the
activation function
or
rectified linear unit
[50]
ReLU(
x
)
=
max
{
0
,
x
}
can be used to express the policy;
notably, this is also used in neural networks in the context of
machine learning [51]. This highlights that interventions only
become ‘‘active’’ when safety is in danger of being violated.
However, if one simply uses the obtained feedback control
law in the SIR model with time delay
τ
, i.e., substitutes
u
(
t
)
=
A
(
S
(
t
−
τ
)
,
I
(
t
−
τ
)) into Eq. (1), safety cannot be
ensured due to the delay. In order to compensate for this delay
we construct predictors [52] (as described in Appendix F)
and use the predicted states
S
p
(
t
) and
I
p
(
t
) in the active inter-
vention policy:
u
(
t
)
=
A
(
S
p
(
t
)
,
I
p
(
t
)). If the predictions are
accurate, i.e.,
S
p
(
t
)
=
S
(
t
) and
I
p
(
t
)
=
I
(
t
), then the delay-
free control design can ensure safety. Such predictors play
an essential role in making the active intervention policies,
synthesized from control barrier functions, implementable in
the presence of time delay [8].
Figure
3 depicts the results of applying the safety-critical
active intervention policy in Eq. (2) to the SIR model in
Eq. (1) while compensating for the 10 days delay using
predictors. The control barrier function is able to keep the
infected population under
I
max
=
200
,
000 while gradually
driving the control input (active intervention) to zero, i.e., mit-
igation methods can eventually be removed. Notice that this
opening strategy decreases the control input very slowly at
the beginning followed by a faster opening toward the end.
As a reference we also show the results of another opening
strategy where the control input is reduced to zero linearly in
time. In this case the number of infections peaks at a much
higher value putting a large burden on the health system.
The peak predicted by the reference opening strategy cap-
tures what the US experienced during the summer of 2020
(cf. the data in light blue), although the peak had been pre-
dicted before the summer when the second wave of infections
had not yet emerged (i.e., only the gray shaded data had been
used for model fitting and prediction). The mobility data,
on the other hand, do not reflect that the mitigation efforts
(control input) were reduced over the summer. The mobility
data provide an efficient metric to quantify the level of active
interventions during the early stages of the pandemic when
stay-at-home orders came into action. Later on, however,
as society adapted to the presence of the virus, other means
of human action such as social distancing and mask-wearing
practices also started to play a key role and they allowed
mitigation even when people did not stay at home.
While Fig.
3 vividly illustrates the use of safety-critical
active intervention, and the benefits thereof, it also predicts
that all restrictions can be lifted by mid-July. This is due to
the use of the simplified SIR model that was considered to
illustrate the concepts presented and, more specifically, due
to the fact that the model heavily depends on the
N
(chosen
to be 7.5 million when fitting the data). Selecting a larger
N
would yield a longer mitigation period: the time period where
active intervention is necessary, i.e., where Eq. (2) is non-
zero, can be calculated as
T
≈
N
β
0
I
max
(
β
0
γ
S
0
N
−
1
)
, where
S
0
is the size of the susceptible population when the controller
in Eq. (2) is initiated. Increasing
N
increases the period for
which active intervention is necessary i.e., when the safety
critical intervention policy is applied to the overly simplistic
SIR model. In order to make predictions more reliable it
is necessary to use a higher fidelity compartmental model.
Moreover, doing so allows for additional safety-critical con-
straints to be considered, including hospitalization and death.
IV. SAFETY-CRITICAL ACTIVE INTERVENTIONS
FOR THE SIHRD MODEL
The safety-critical approach to active intervention can be
applied to more complex compartmental models, viewed as
control systems. To better capture other salient populations
for which safety is critical, we consider the SIHRD model
(shown in Fig. 4 detailed in Appendix C) which includes
the
S
,
I
and
R
populations of the SIR model together with
hospitalized and deceased populations denoted by
H
and
D
,
respectively [20], [23]. The equations governing this model
are, therefore, similar to those in Eq. (1) with the addition of
dynamics governing the evolution of populations associated
with hospitalization and deaths. Correspondingly, the control
input again appears via the time varying transmission rate
β
(
t
)
=
β
0
(1
−
u
(
t
)), while
γ
still denotes the recovery rate
of the infected population. The additional parameters
λ >
0,
ν >
0 and
μ >
0 represent the hospitalization rate, recovery
rate in hospitals and death rate, respectively. These rates are
obtained by fitting the model to the data together with the
effective population
N
that becomes 13.2 million for this
model (as discussed in Appendix G).
The evolution of the SIHRD model is shown in Fig.
4
relative to US data, including mobility data, where the fits
accurately capture the data for the infected, hospitalized and
VOLUME 8, 2020
188457
A. D. Ames
et al.
: Safety-Critical Control of Active Interventions for COVID-19 Mitigation
FIGURE 4.
Illustration of the predictive power of the SIHRD model. The
model parameters are estimated using the US data up to May 5, 2020
(dark blue), shown as a vertical blue line, and then used to predict
forward for 25 days until May 30, 2020 (yellow). These are compared to a
fit where the data was used until May 30 (light blue).
deceased populations to present day. Safety-critical active
intervention policies can be synthesized for the SIHRD
model, wherein the additional compartments allow for the
consideration of safety constraints aimed at limiting hospital-
ization and death. In particular, we will consider two active
interventions policies: one policy analogous to Eq. (2) aimed
at limiting the infected population, and another policy aimed
at simultaneously limiting both the number of hospitalized
and dead. The results of applying these two policies are
shown in Fig. 5, with the specific controllers detailed in
Appendix D. Additional policies could be considered, bound-
ing the populations in any compartment or any combination
thereof.
The first safety critical policy considered aims to limit
the number of infected, i.e.,
I
(
t
)
≤
I
max
, with results
qualitatively similar to those of the SIR model in Fig.
3.
Again mitigation measures are enforced over the same dura-
tion as a linear ‘‘opening up’’ policy while the optimality
of the safety-critical policy results in substantially fewer
infections at the peak. The second safety critical policy aims
to limit hospitalizations (
H
(
t
)
≤
H
max
) based upon hospi-
tal capacity, while simultaneously limiting deaths (
D
(
t
)
≤
D
max
). Achieving these objectives, as indicated in Fig.
5,
requires maintaining a non-zero input for a longer dura-
tion, i.e., some form of mitigation must be practiced for
an extended period to limit overall death. This reflects the
practices of countries that successfully mitigated the first
FIGURE 5.
Two safety-critical active intervention policies applied to the
SIHRD model that was fit to data through May 30, 2020. The red policy
keeps the number of infected under
I
max
as in Fig. 3 while the dark
orange policy keeps the number of hospitalized under
H
max
and also
keeps the number of deaths under
D
max
. The reference policy, that is
linear in time, fails to maintain safety and results in a spike in infections
and hospitalizations.
wave of the epidemic [53]. Importantly, both of the syn-
thesized safety-critical active intervention policies guaran-
tee the safety constraints while simultaneously minimizing
mitigation—compared against the naive linear reference pol-
icy which would drive the number of hospitalized above the
limit
H
max
, and result in large number of deceased persons.
This indicates the important role that active intervention poli-
cies can play in guaranteeing safety, encoded by limiting
hospitalizations and deaths.
The safety-critical policies synthesized above can also
be applied to smaller geographical areas. This is especially
relevant from a practical perspective, as specific mitigation
efforts are determined at a state level in the US. In Fig. 6,
the results are shown for four different states with safety-
critical active intervention policies simultaneously bounding
hospitalization and death; the safety bounds
H
max
and
D
max
were chosen as outlined in Appendix D, and different bounds
can be used based upon state-level public policy. Different
states require different levels of mitigation as highlighted by
the color of each state. The gating criterion for state level
mitigation was, as a proof of concept, determined by the value
of the safety-critical control input 30 days after the start of
active intervention; other criterion could be used based upon
public policy.
188458
VOLUME 8, 2020
A. D. Ames
et al.
: Safety-Critical Control of Active Interventions for COVID-19 Mitigation
FIGURE 6.
Safety-critical active interventions at the state level for four states: California, Michigan, New York, and Texas. The SIHRD model,
viewed as a control system, was fit to the data for each state through May 30, 2020. From this, safety-critical active intervention policies
that simultaneously bound hospitalizations and deaths are synthesized. The color of each state is determined by the control input 30 days
after the start of the safety-critical active interventions, as indicated by the vertical line in the control input plots. The safety-critical policy
is compared against the naive linear opening up reference policy which violates the safety bounds—resulting in over twice the deaths in
the at risks states: California and Texas. This illustrates that the way in which states open up has important ramifications.
For the safety-critical public policy considered, Michi-
gan may open up, i.e., relax its mitigation efforts relatively
quickly, reducing the control input to less than 50% of its
current value in 30 days, yet mitigation efforts must be kept in
place throughout the year. Qualitatively similar behavior can
be seen in the case of New York, though active interventions
cannot be reduced as quickly—if relaxed too quickly the
result is a second spike in infections equal to the first already
experienced. By comparison, California needs to very slowly
relax its mitigation efforts and settle into a steady state miti-
gation at 80% of its current value, or the result is an outbreak
with very high number of hospitalized and substantially more
VOLUME 8, 2020
188459
A. D. Ames
et al.
: Safety-Critical Control of Active Interventions for COVID-19 Mitigation
death. Texas should increase its current mitigation efforts
to avoid a sudden and significant rise of infections, hos-
pitalizations and death. In the case of both California and
Texas, the way in which they open has a profound effect on
the total hospitalizations and deaths, with deaths more than
doubling if a naive opening up policy is implemented. There-
fore, the safety-critical approach can determine the optimal
way in which states should open—assuming good data at the
state level—thereby informing policy that has the potential to
dramatically reduce hospitalizations and deaths.
V. CONCLUSION AND POLICY IMPLICATIONS
The approach taken in this paper revolves around a new
paradigm: viewing compartmental epidemiological models
as control systems, viz. Eq. (1). Importantly, this perspective
allows one to view these models not as systems that evolve
independent of human behavior, but rather as systems where
human behavior is an input that can
actively
modify their
evolution (cf. Fig. 2). In this setting, we are able to syn-
thesize active intervention policies that can serve to guide
future mitigation efforts. We specifically synthesized safety-
critical policies that formally guarantee that the evolution of
compartmental models—the SIR and SIHRD—stay within
‘‘safe sets’’. These safe sets encode bounds on the number
of infected, hospitalized, and deceased populations. Closed
form expressions for optimal active intervention policies were
synthesized, as in Eq. (2), that ensure safety. To demonstrate
this approach, US COVID-19 data on cases, hospitalizations
and deaths were utilized to fit the static parameters of the
SIR and SIHRD models. The active component of the con-
trol system, i.e., the control input, was synthesized utilizing
mobility data; the result was models with predictive power
(Fig. 4). Projecting into the future while compensating for
the incubation and testing delays, the active intervention
policies were applied and compared against ‘‘naive opening
up’’ policies. It was shown that the safety-critical policies that
limit hospitalizations and deaths greatly outperformed these
reference policies (Fig.
3), and this was demonstrated at both
the national (Fig.
5) and the state level (Fig.
6).
We remark that safety-critical active intervention is not
limited to our specific choices of models, nor to the datasets
we used. The SIR and SIHRD models were chosen for
their simplicity, which allowed us to synthesize control poli-
cies in closed form such as the one in Eq. (2). In this
study, these models were sufficiently accurate to capture the
confirmed cases, hospitalization, death and mobility data,
however, we do not claim that these models could be applied
universally for all kinds of infection, for all stages of a pan-
demic or for all geographical regions. Yet, for any other—
potentially more descriptive—choices of models, the pro-
posed safety-critical control approach can still be utilized
(and its general formulation is given in Appendix A). The
approach was demonstrated for the case of the USA to high-
light the differences in safety-critical policies needed for
different geographical locations (states) during the course
of phased reopenings. Indeed, the lessons learnt from these
analyses can be applied to models describing other states (see
27 examples in Appendix H) or other countries [20] as well,
despite the fact that they may have significantly different
characteristics (such as reproduction number, recovery rate,
hospitalization rate, death rate, and other features).
The safety-critical approach to active intervention can
directly inform public policy. To wit, the results presented
demonstrate that epidemiological models (viewed as control
systems) can capture the role of human action in mitigating
COVID-19; both to describe observed data, and to actively
modulate future behavior. Active intervention policies (feed-
back control laws) can, therefore, be used to guide non-
pharmaceutical actions that should be taken to achieve a
desired outcome with regard to the COVID-19 pandemic—
or unforeseen future pandemics. Of particular concern are
mitigation efforts devoted to ensuring safety; this encodes
the desire to limit the infected, hospitalized and deceased
population. The safety-critical active intervention policy pre-
sented herein results in concrete guidance on future mit-
igation efforts needed to achieve these guarantees. These
actions can be at a local, state, national or international level
depending on the ability to guide active interventions among
these populations. The end result can be codified in tangible
and specific public policies on ‘‘opening up’’, i.e., on lifting
or increasing mitigation efforts. As demonstrated throughout
this paper on COVID-19 data and the corresponding epi-
demiological models, safety-critical active interventions—if
properly encoded as public policy—have the ability to ensure
available hospital capacity and save lives.
APPENDIX
This appendix formulates the safety-critical control approach
to active intervention for compartmental models. We begin
with a general overview of safety-critical methods. These
are applied to both the SIR model and the SIHRD model.
We then consider the case of multiple safety constraints in the
case of the SIHRD model wherein we formulate controllers
that simultaneously enforce these constraints. A detailed
discussion of our approach to handling time delays is pre-
sented and applied to both the SIR and SIHRD models.
Finally, the method for fitting model parameters is described.
We conclude with the details on the application of the afore-
mentioned methods to state-level data and the synthesis of
safety-critical active interventions for COVID-19 mitigation.
A. SAFETY-CRITICAL CONTROL FOR
GUARANTEED SAFETY
Safety can be framed as set invariance [54]–[56] in the context
of control systems and controller synthesis. Let
R
n
be the
state space of the compartmental model of interest, consisting
of
n
-dimensional Euclidean space, with
n
the number of
compartments, i.e., for the SIR model
n
=
3 and for the
SIHRD model
n
=
5. A state
x
∈
R
n
consists of values of the
populations, e.g.,
x
=
[
S
,
I
,
R
]
>
for the SIR model. A safety
constraint is a function
h
:
R
n
→
R
that encodes the safe
188460
VOLUME 8, 2020
A. D. Ames
et al.
: Safety-Critical Control of Active Interventions for COVID-19 Mitigation
behavior of the system through
:
Safe set
:
C
:={
x
∈
R
n
:
h
(
x
)
≥
0
}
,
(3)
wherein the goal is for the system to evolve in this safe set. For
example, for the SIR model
h
(
S
,
I
,
R
)
=
I
max
−
I
, with the set
C
containing the states for which
I
≤
I
max
. The goal is to give
(necessary and sufficient) conditions for control systems, and
synthesize corresponding policies, that render this set forward
invariant, i.e., that keep the system safe.
A
control system
(in control affine form) is a first order
nonlinear differential equation with a control input
:
̇
x
(
t
)
=
f
(
x
(
t
))
+
g
(
x
(
t
))
u
(
t
)
︸︷︷︸
Control Input
,
(4)
where
x
∈
R
n
and
u
∈
R
is the scalar valued control
input (note that all of the methods presented also hold for
vector valued control inputs). All compartmental models can
be expressed in the general form of Eq. (4); which becomes
an autonomous dynamical system (as they are typically mod-
eled) for
u
(
t
)
≡
0, i.e., the system evolves according to
̇
x
(
t
)
=
f
(
x
(
t
)). The addition of the control input
u
(
t
), as was
done in Eq. (1), allows one to modify the evolution of the
system to achieve desired behaviors. This modification is
done via
control laws
or
policies
:
u
(
t
)
=
K
(
x
(
t
)). The
result is a
closed loop
dynamical system:
̇
x
(
t
)
=
f
(
x
(
t
))
+
g
(
x
(
t
))
K
(
x
(
t
)), wherein
x
(
t
) is a solution to this system with
initial condition
x
(0)
=
x
0
.
We are interested in guarantees of safety framed as set
invariance per Eq. (3). Thus, we say that the control system
in Eq. (4) is
safe
with the policy
u
(
t
)
=
K
(
x
(
t
)) if
x
0
∈
C
implies that
x
(
t
)
∈
C
for all
t
≥
0, where
x
(
t
) is a solution
to the closed loop system with the policy applied. By the
definition of the safe set in Eq. (3), safety is thus equivalent
to satisfying the safety constraint for all time:
h
(
x
(
t
))
≥
0.
Safety-critical control addresses the fundamental question:
how does one synthesize control policies that render the
set
C
safe
, i.e., control policies such that safety constraint
h
(
x
(
t
))
≥
0 is satisfied for the closed loop system?
To achieve safe behavior for the control system in Eq. (4)
representing an abstract compartmental model, we leverage
the framework of control barrier functions [7]. This is a
new methodology for controller synthesis, first introduced
in [57], which has its bases in a long and rich history of
set invariance for dynamical systems and control (cf. [54]
for a review): from dynamical systems [58]–[61], to control
systems [55], [56], [62] with application and experimen-
tal validation on robotic systems [63]. Within the frame-
work of control barrier functions, we consider the function
h
(
x
) that defines the safe set
C
, wherein we find conditions
on the rate of change of this function that guarantee for-
ward set invariance; conditions that can be checked over the
entire set
C
and thereby used to synthesize control policies.
It is this key observation—conditions that can be checked
over the entire set—that yields the safety-critical control
paradigm.
It was discovered [7] that necessary
1
and sufficient condi-
tions for forward set invariance are given by lower bounding
the rate of change of
h
when differentiated along
x
(
t
) with
respect to time
:
d
dt
h
(
x
(
t
))
≥−
α
h
(
x
(
t
))
⇐⇒
h
(
x
(
t
))
≥
0
,
⇐⇒
x
(
t
)
∈
C
∀
t
≥
0
,
⇐⇒
C
is safe
,
(5)
for
α >
0 and all
t
≥
0. The importance of the derivative
condition is that it can be checked at every point of time with
respect to the input
u
. Thus,
h
is a
control barrier function
(CBF)
[7] if there exits a
u
(
t
) such that
:
d
dt
h
(
x
(
t
))
=
̇
h
(
x
(
t
)
,
u
(
t
))
=
∂
h
∂
x
f
(
x
(
t
))
︸
︷︷
︸
:=
L
f
h
(
x
(
t
))
+
∂
h
∂
x
g
(
x
(
t
))
︸
︷︷
︸
:=
L
g
h
(
x
(
t
))
u
(
t
)
≥−
α
h
(
x
(
t
))
.
(6)
As a result, for a control barrier function, one can synthesize
a policy that ensures safety by choosing a controller
u
(
t
) that
satisfies Eq. (6). For example, if
L
g
h
(
x
)
6=
0 then
h
is a control
barrier function as
u
(
t
) satisfying Eq. (6) can be explicitly
solved for through the pseudoinverse. We seek to do this
in an optimal way so as to minimize the amount of active
intervention.
With the goal of achieving safety while minimizing the
input—as is the case with compartmental epidemiological
models where we wish to minimize the active intervention—
the control law synthesis problem can be framed as an opti-
mization problem (as has been done in the context of real-time
control for robotic systems [64]); specifically, a quadratic
program (QP):
u
(
t
)
=
K
(
x
(
t
))
=
arg min
u
∈
[0
,
1]
u
2
s
.
t
.
L
f
h
(
x
(
t
))
+
L
g
h
(
x
(
t
))
u
≥−
α
h
(
x
(
t
))
.
(7)
Note that here we limit
u
∈
[0
,
1] since this corresponds to
the interval of active interventions with
u
=
0 denoting no
intervention and
u
=
1 denoting complete intervention, e.g.,
fully isolating the infected population. Importantly, one can
explicitly solve the optimization problem in Eq. (7) to get a
closed form expression
:
u
(
t
)
=
K
(
x
(
t
))
=
−
L
f
h
(
x
(
t
))
+
α
h
(
x
(
t
))
L
g
h
(
x
(
t
))
if
L
f
h
(
x
(
t
))
<
−
α
h
(
x
(
t
))
0
if
L
f
h
(
x
(
t
))
≥−
α
h
(
x
(
t
))
.
(8)
For this choice of control law, the closed loop system is safe
and, additionally, the minimal input is optimally chosen. This
is represented by the conditional statement, wherein
u
=
0 if
1
Technically, for necessity,
α
must be chosen to be an extended class
K
function [7] not a constant. We utilize a constant for simplicity of exposition
and without loss of generality.
VOLUME 8, 2020
188461
A. D. Ames
et al.
: Safety-Critical Control of Active Interventions for COVID-19 Mitigation
the natural dynamics of the system satisfy the control barrier
function condition in Eq. (6).
If
L
g
h
(
x
(
t
))
>
0, Eq. (8) simplifies to
:
u
(
t
)
=
K
(
x
(
t
))
=
max
{
0
,
−
L
f
h
(
x
(
t
))
+
α
h
(
x
(
t
))
L
g
h
(
x
(
t
))
}
=
ReLU
(
−
L
f
h
(
x
(
t
))
+
α
h
(
x
(
t
))
L
g
h
(
x
(
t
))
)
,
(9)
wherein the max becomes the min when
L
g
h
(
x
(
t
))
<
0.
It is this formulation that leads to the active intervention
policies that we will synthesize for both the SIR and SIHRD
compartmental models, viewed as control systems.
B. APPLICATION OF SAFETY-CRITICAL METHODS
TO THE SIR MODEL
Consider the SIR model, viewed as a control system, as given
in Eq. (1). This is clearly of the form of the general control
system given in Eq. (4) wherein
x
=
[
S
,
I
,
R
]
>
∈
R
3
and
:
f
(
x
(
t
))
=
−
β
0
N
S
(
t
)
I
(
t
)
β
0
N
S
(
t
)
I
(
t
)
−
γ
I
(
t
)
γ
I
(
t
)
,
g
(
x
(
t
))
=
β
0
N
S
(
t
)
I
(
t
)
−
β
0
N
S
(
t
)
I
(
t
)
0
.
(10)
As a result,
̇
x
(
t
)
=
f
(
x
(
t
)) is just the standard SIR model—
viewed as an autonomous dynamical system. As indicated
above, the safety constraint
I
(
t
)
≤
I
max
leads to the function
h
(
I
)
=
I
max
−
I
defining the safe set
:
C
={
[
S
,
I
,
R
]
>
∈
R
3
:
I
≤
I
max
}
,
(11)
as in Eq. (3). For the safety function
h
(
I
)
=
I
max
−
I
calculating Eq. (6) yields
:
̇
h
(
S
(
t
)
,
I
(
t
))
= −
̇
I
(
t
)
= −
β
0
N
S
(
t
)
I
(
t
)
+
γ
I
(
t
)
︸
︷︷
︸
L
f
h
(
S
(
t
)
,
I
(
t
))
+
β
0
N
S
(
t
)
I
(
t
)
︸
︷︷
︸
L
g
h
(
S
(
t
)
,
I
(
t
))
u
(
t
)
≥ −
α
(
I
max
−
I
(
t
))
.
(12)
It follows that
h
is a control barrier function since
I
6=
0 and
S
6=
0 corresponds to having nonzero infected or susceptible
populations, and therefore,
L
g
h
(
S
(
t
)
,
I
(
t
))
6=
0. The explicit
solution in Eq. (9) to the optimization-based controller in
Eq. (7) becomes
:
u
(
t
)
=
A
(
S
(
t
)
,
I
(
t
))
=
ReLU
(
1
−
α
(
I
max
−
I
(
t
))
+
γ
I
(
t
)
β
0
N
S
(
t
)
I
(
t
)
)
⇓
I
(
t
)
≤
I
max
∀
t
≥
0
,
(13)
if
I
(0)
≤
I
max
, since in the domain of interest
:
S
>
0
,
I
>
0
⇒
L
g
h
(
S
(
t
)
,
I
(
t
))
>
0
.
(14)
By picking
α
=
γ
, the control law in Eq. (13) yields Eq. (2)
which was used in Fig.
3.
C. SAFETY-CRITICAL CONTROL APPLIED TO
THE SIHRD MODEL
The SIHRD model is a compartmental epidemiological
model that extends the SIR model to include two additional
compartments related to hospitalized and deceased popula-
tions. These additional compartments will be important in the
synthesis of safety-critical controllers that bound these popu-
lations. The SIHRD model—viewed as a control system—is
illustrated in Fig.
4, where
S
,
I
and
R
are the same populations
as in the SIR model,
H
denotes the population that is currently
hospitalized due to the virus (and assumed not to transmit to
the susceptible population as a result), and
D
is the deceased
population. The rate constants are indicated along the arrows
linking the compartments:
β
0
is the transmission rate while
γ
and
ν
are the recovery rates of the infected and hospitalized
populations, respectively. Additionally,
λ
represents the hos-
pitalization rate and
μ
is the mortality rate. These parameters
are coupled via 1
/
(
γ
+
λ
+
μ
) which is the characteristic infec-
tious period of the virus, accounting for hospitalizations and
deaths, after which there is assumed to be no transmission.
When casting the model in the form of Eq. (4), we use
x
=
[
S
,
I
,
H
,
R
,
D
]
>
∈
R
5
and obtain the following control
system
:
̇
S
(
t
)
̇
I
(
t
)
̇
H
(
t
)
̇
R
(
t
)
̇
D
(
t
)
︸
︷︷
︸
̇
x
(
t
)
=
−
β
0
N
S
(
t
)
I
(
t
)
β
0
N
S
(
t
)
I
(
t
)
−
(
γ
+
λ
+
μ
)
I
(
t
)
λ
I
(
t
)
−
ν
H
(
t
)
γ
I
(
t
)
+
ν
H
(
t
)
μ
I
︸
︷︷
︸
f
(
x
(
t
))
+
β
0
N
S
(
t
)
I
(
t
)
−
β
0
N
S
(
t
)
I
(
t
)
0
0
0
︸
︷︷
︸
g
(
x
(
t
))
u
(
t
)
︸︷︷︸
Control Input
.
(15)
As indicated in Fig.
4, one may design active intervention
policies
2
for the control input
u
(
t
) that modulates the trans-
mission rate:
β
(
t
)
=
β
0
(1
−
u
(
t
)). In particular, we are
interested in synthesizing safety-critical active intervention
policies that bound infections, hospitalization and death for
2
Note that the delayed values of the different populations appear in
the corresponding feedback laws which will be compensated using pre-
dictors based on the fitted model. This will be described in detail later
in Appendix E.
188462
VOLUME 8, 2020