Safety-Critical Control of Active Interventions for
COVID-19 Mitigation
Aaron D. Ames
1
, Tam
́
as G. Moln
́
ar
2
, Andrew W. Singletary
1
& G
́
abor Orosz
2
1
California Institute of Technology
2
University of Michigan, Ann Arbor
The world has recently undergone the most ambitious mitigation effort in a century
1
, con-
sisting of wide-spread quarantines aimed at preventing the spread of COVID-19
2
. The use
of influential epidemiological models
3–6
of COVID-19 helped to encourage decision makers
to take drastic non-pharmaceutical interventions. Yet, inherent in these models are often as-
sumptions that the active interventions are static, e.g., that social distancing is enforced until
infections are minimized, which can lead to inaccurate predictions that are ever evolving as
new data is assimilated. We present a methodology to dynamically guide the active inter-
vention by shifting the focus from viewing epidemiological models as systems that evolve in
autonomous fashion to control systems with an “input” that can be varied in time in order
to change the evolution of the system. We show that a safety-critical control approach
7
to
COVID-19 mitigation gives active intervention policies that formally guarantee the safe evo-
lution of compartmental epidemiological models. This perspective is applied to current US
data on cases while taking into account reduction of mobility, and we find that it accurately
describes the current trends when time delays
8
associated with incubation and testing are
incorporated. Optimal active intervention policies are synthesized to determine future miti-
gations necessary to bound infections, hospitalizations, and death, both at national and state
levels. We therefore provide means in which to model and modulate active interventions
with a view toward the phased reopenings that are currently beginning across the US and
the world in a decentralized fashion. This framework can be converted into public policies,
accounting for the fractured landscape of COVID-19 mitigation in a safety-critical fashion.
Figure 0.
Illustration of the safety-
critical active intervention policies de-
veloped in this paper applied at the state
level (for states with sufficient data).
The states are colored according to
whether it is safe to open further (green),
slowly open (yellow) hold the current
mitigation efforts steady (orange), or in-
crease mitigation (red). This is deter-
mined based upon an active intervention
policy that formally guarantees bounded
hospitalizations and deaths.
1
Introduction.
As COVID-19 spreads throughout the world
9–11
, due to the novelty of the virus and
the resulting lack of pharmaceutical options necessary to suppress infection
12
, unprecedented miti-
gation steps to slow its progression were taken in the form of non-pharmaceutical interventions
3, 13
,
e.g., social distancing, mask-wearing, quarantining, and stay-at-home orders. It is largely agreed
upon that these slowed the spread of the virus
2, 14
, thereby saving lives. Yet studies have shown that
if these active interventions had been enforced even a week earlier
15
, the result would have been
a substantial reduction in deaths. As a means of mitigating the spread of COVID-19, the question
therefore becomes: when, where, and how does one decide to take non-pharmaceutical interven-
tions? This question is especially relevant
16
as restrictions are being relaxed in a decentralized
fashion across the US and throughout the world.
Due to the pressing need to understand past and future mitigation efforts, and the corresponding
role of active interventions, there has been a surge of recent papers on the modeling of COVID-
19
5, 17–20
. Epidemiological models for predicting the spread of COVID-19 often utilize dynamical
systems obtained from so-called “compartmental” models wherein the compartments are chosen
to reflect different populations of interest
21–23
, e.g., susceptible (
S
), infected (
I
), recovered (
R
),
etc. More compartments can be added allowing for higher fidelity models, although one must be
careful of overfitting the largely increased number of parameters in more complex models. The
most fundamental (and elementary) of these compartmental models is the SIR model, which has
recently been used in modeling of COVID-19
24
. Examples of more complex compartmental mod-
els applied for COVID-19 include the SEIR
25, 26
and SIRT
27
models, which involve exposed (
E
)
and threatened (
T
) populations, and the SIDARTHE model
5
which adds even more compartments.
While these models have been found to to be useful when modeling the spread of COVID-19 and
the corresponding mitigation procedures, e.g., stay-at-home orders, the approaches are fundamen-
tally based on autonomous dynamics
28, 29
as they do not have a time-varying
control input
that
can dynamically change the evolution of the system. We propose a different approach: applying
safety-critical control
methods to guide active non-pharmaceutical interventions wherein we can
actively predict the interventions needed to maintain safety by viewing compartmental models as
control systems
.
Background
Main Findings
Policy Implications
Epidemiological models provide a
powerful tool to guide the miti-
gation of COVID-19.
Yet these
models are dynamical systems that
must be constantly updated as new
data is assimilated.
Policy de-
cisions, therefore, fail to account
for future active interventions, e.g.,
social distancing and stay-at-home
orders, that can change the evolu-
tion of these models.
Viewing epidemiological models
as control systems allows for the
design of active intervention poli-
cies that can mitigate COVID-19
while modulating these mitigation
efforts as function of time. With
this viewpoint, safety-critical poli-
cies are synthesized that guarantee
safety of the system by bounding
the infected, hospitalized, and de-
ceased populations.
The safety-critical active interven-
tions synthesized can be used to
formulate and inform public and
governmental policy on lifting or
increasing mitigation efforts in a
centralized and decentralized fash-
ion. These policies may, therefore,
guide mitigation efforts at local or
national levels to ensure hospitals
do not reach capacity, and overall
deaths are limited.
Table 1.
Policy summary.
2
SIR model as a Control System.
At the core of our approach is a fundamental shift in per-
spective on epidemiological models: from viewing them as dynamical systems that evolve in an
autonomous fashion, to that of control systems for which the evolution can be dynamically modi-
fied. In many ways, this is the
de facto
manner in which these models are implemented, if only in
an implicit fashion, as they are constantly updated as new data is assimilated, e.g., as changes in
social distancing are observed, predictive models are updated
30
. We, therefore, will formalize this
perspective by making the control aspect of epidemiological models explicit. Note that viewing
compartmental epidemiological models as control systems is not unique
31, 32
, but has found only
limited application to COVID-19
33
and has yet to enjoy formal guarantees on safety. Additionally,
there are examples of control-theoretic concepts being applied, namely in the the context of time-
varying
27, 34
and state-varying
6, 35
choices of the transmission rate; these can be viewed as time- and
state-varying inputs to a control system. Our approach differs in that we wish to synthesize
active
intervention policies
(i.e., feedback control laws) that will determine future actions to take based
upon past observations of the states of the systems.
To motivate the methodology utilized throughout this paper, we will begin by considering the fun-
damental epidemiological compartmental model: the SIR model
21, 23
. Importantly, the approach
introduced herein can be applied to
any
compartmental model, and will subsequently be applied to
a more descriptive model. The SIR model consists of a
susceptible
population
S
,
infected
popula-
tion
I
, and
recovered
population
R
. We can view the evolution of these populations as a control
system where active interventions, expressed by the control input
u
(
t
)
, modulate the rate of change
of the infected population:
̇
S
(
t
) =
−
β
0
N
(
1
−
u
(
t
)
︸︷︷︸
Control Input
)
S
(
t
)
I
(
t
)
,
̇
I
(
t
) =
β
0
N
(
1
−
u
(
t
)
︸︷︷︸
Control Input
)
S
(
t
)
I
(
t
)
−
γI
(
t
)
,
(1)
̇
R
(
t
) =
γI
(
t
)
.
Here the total population
N
=
S
(
t
) +
I
(
t
) +
R
(
t
)
is constant,
β
0
>
0
is the transmission rate (when
no intervention is present) and
γ >
0
is the recovery rate, yielding the reproduction number:
R
0
=
β
0
/γ
. This model relates to the traditional SIR model via the time-varying transmission rate
β
(
t
) =
β
0
(1
−
u
(
t
))
. Time-varying
β
(
t
)
has been considered
20
; for example, we can utilize the policy
u
(
t
) =
−
A
cos(
ωt
)
in the SIR model
36
to recover models of seasonal variations in infection
37
. In
the setting considered here, taking
u
(
t
)
≡
0
corresponds to
no
intervention, yielding the traditional
SIR model with
β
(
t
)
≡
β
0
, whereas
u
(
t
)
≡
1
can be viewed as
maximum
intervention, full and
complete quarantine of the population. In the latter case the infected population decays to zero
exponentially,
I
(
t
) = e
−
γt
I
(0)
, since the susceptible population is isolated. These effects can
be seen, for example, in the Chinese response to COVID-19 and the corresponding drop in
R
0
documented
19
.
3
Figure 1.
Paradigm shift wherein compartmental models are viewed as control systems rather than dynamical systems.
This is illustrated on the populations
I
(
t
)
and
R
(
t
)
of the SIR model (top panels) wherein the control input
u
(
t
)
is
modulated based upon the intervention policies estimated from mobility data (bottom panel). The time delay
τ
= 10
days is highlighted to emphasize that the observed data corresponds to the delayed counterparts of the populations,
and this delay also appears in the active intervention policy:
u
(
t
) =
A
(
S
(
t
−
τ
)
,I
(
t
−
τ
))
, given in Eq. (2).
An illustration of the SIR model as a control system is shown in Fig. 1 where the interactions
between the compartments are denoted by arrows with appropriate rate constants indicated. The
blue arrow represents the time dependent modulation of the transmission rate
β
(
t
)
. The control
input
u
(
t
)
is estimated from mobility data
38
in the US between March 2 and May 20, 2020 by
assuming
u
= 0
at the beginning this period when no non-pharmaceutical interventions were
present. Furthermore, the parameters
β
0
,
γ
and
N
of the SIR model were fitted to the recorded
number of confirmed cases:
I
(
t
−
τ
) +
R
(
t
−
τ
)
. Fitting for the time delay
τ
, in the corresponding
transmission rate
β
(
t
−
τ
)
, reveals that the COVID-19 data
39
depicted publicly
40
are delayed by
τ
≈
10
days. This time delay originates from the incubation time of the virus (i.e., people are
being infectious before being symptomatic) and the time needed for testing
33, 41, 42
. That is, the
4
data corresponds the number of confirmed cases
τ
days ago while the real current number could
be much higher. For example, in mid-March, when interventions were introduced in the US,
I
(
t
−
τ
) +
R
(
t
−
τ
)
was reported to be in the range of a few thousand, while the real number
I
(
t
) +
R
(
t
)
is estimated to be more than a hundred thousand. This delay also appears in the active
intervention policies which depend on the state of the system, i.e.,
u
(
t
) =
A
(
S
(
t
−
τ
)
,I
(
t
−
τ
))
,
and it therefore must be compensated for in order to ensure the safety of these policies. Finally, we
remark that when fitting the model (1) to the aforementioned data one may obtain good fits while
setting
N
in the range from 7.5 million up to 330 million (see the Methods section for additional
details). Smaller values encode the fact that not everyone susceptible is necessarily exposed when
the total number of infected is small relative to the total population, as well as the fact that the total
number of infections is underreported
43
. In Fig. 1 we used the lowest value
N
= 7
.
5
million; the
consequences of this choice will be discussed in the context of active interventions.
Safety-Critical Control for Active Intervention.
Utilizing the paradigm of epidemiological mod-
els as control systems, we can synthesize active intervention policies, i.e., inputs to Eq. (1) ex-
pressed as functions of the populations of the compartmental model. A special case of this is
referred to as shield immunity
6
, wherein the policy
u
(
t
) =
αR
(
t
)
N
+
αR
(
t
)
with
α
≥
0
was chosen. Our
goal is to synthesize active intervention policies so as to achieve desired safety-critical behaviors,
that is, to guarantee that the system, with the policy applied, evolves in a safe fashion. Concretely,
we may quantify safety in the context of the SIR model as limiting the total number of infected per-
sons:
I
(
t
)
≤
I
max
. To achieve such goal, we leverage the framework of control barrier functions
7
which gives necessary and sufficient conditions on the safety, along with tools to generate active
intervention policies that ensure safety.
While there may exist multiple safe policies, it is beneficial to chose one which minimizes the
active intervention
u
(
t
)
, since more aggressive interventions potentially result in the lose of jobs
and other economic and physiological effects
44, 45
. The active intervention policy, i.e., feedback
control law, that gives the minimal possible (pointwise optimal) interventions so as to ensure the
safety of the system can be explicitly calculated (as described in Methods):
u
(
t
) =
A
(
S
(
t
)
,I
(
t
)) := max
{
0
,
1
−
γ
β
0
N
S
(
t
)
I
max
I
(
t
)
}
⇒
I
(
t
)
≤
I
max
.
(2)
Notice the
activation function
or
rectified linear unit
46
ReLU(
x
) = max
{
0
, x
}
can be used to
express the policy; notably, this also used in neural networks in the context of machine learning
47
.
This highlights that interventions only become “active” when safety is in danger of being violated.
However, if one simply uses the obtained feedback control law in the SIR model with time delay
τ
,
i.e., substitutes
u
(
t
) =
A
(
S
(
t
−
τ
)
,I
(
t
−
τ
))
into Eq. (1), safety cannot be ensured due to the delay.
In order to compensate for this delay we construct predictors
48
(as described in Methods) and use
the predicted states
S
p
(
t
)
and
I
p
(
t
)
in the active intervention policy:
u
(
t
) =
A
(
S
p
(
t
)
,I
p
(
t
))
. If the
predictions are accurate, i.e.,
S
p
(
t
) =
S
(
t
)
and
I
p
(
t
) =
I
(
t
)
, then the delay-free control design
can ensure safety. Such predictors play an essential role in making the active intervention policies,
synthesized from control barrier functions, implementable in the presence of time delay
8
.
5
Figure 2.
Application of the safety-critical active intervention policy in Eq. (2) that keeps the number of infected
people under a given limit
I
max
, to the SIR model in Eq. (1) with the parameters that yielded Fig. 1. The safety-critical
policy is compared against a reference policy where the control input is reduced linearly. The epidemic ends relatively
early due to the reduced population
N
, used in the model.
Figure 2 depicts the results of applying the safety-critical active intervention policy in Eq. (2) to
the SIR model in Eq. (1) while compensating for the 10 days delay using predictors. The control
barrier function is able to keep the infected population under
I
max
= 200
,
000
while gradually
driving the control input (active intervention) to zero, i.e., mitigation methods can eventually be
removed. Notice that this opening strategy decreases the control input very slowly at the beginning
followed by a faster opening toward the end. As a reference we also show the results of another
opening strategy where the control input is reduced to zero linearly in time. In this case the number
of infections peaks at a much higher value putting a large burden on the health system. While this
figure vividly illustrates the use of safety-critical active intervention, and the benefits thereof, it also
predicts that all restrictions can be lifted by mid-July. This is due to the use of the simplified SIR
model that was considered to illustrate the concepts presented and, more specifically, due to the fact
that the model heavily depends on the
N
(chosen to be 7.5 million when fitting the data). Selecting
6
a larger
N
would yield a longer mitigation period: the time period where active intervention is
necessary, i.e., where Eq. (2) is non-zero, can be calculated as
T
≈
N
β
0
I
max
(
β
0
γ
S
0
N
−
1
)
, where
S
0
is the size of the susceptible population when the controller in Eq. (2) is initiated. Increasing
N
increases the period for which active intervention is necessary i.e., when the safety critical
intervention policy is applied to the overly simplistic SIR model. In order to make predictions more
reliable it is necessary to use a higher fidelity compartmental model. Moreover, doing so allows for
additional safety-critical constraints to be considered, including hospitalization and death.
Safety-Critical Active Interventions for the SIHRD Model.
The safety-critical approach to
active intervention can be applied to more complex compartmental models, viewed as control
systems. To better capture other salient populations for which safety is critical, we consider the
SIHRD model (detailed in Methods) which includes the
S
,
I
and
R
populations of the SIR model
together with hospitalized and deceased populations,
H
and
D
, respectively
20, 23
. The equations
governing this model are, therefore, similar to those in Eq. (1) with the addition of dynamics gov-
erning the evolution of populations associated with hospitalization and deaths. Correspondingly,
the control input again appears via the time varying transmission rate
β
(
t
) =
β
0
(1
−
u
(
t
))
, while
γ
still denotes the recovery rate of the infected population. The additional parameters
λ >
0
,
ν >
0
and
μ >
0
represent the hospitalization rate, recovery rate in hospitals and death rate, respectively.
These rates are obtained by fitting the model to the data together with the effective population
N
that becomes 13.2 million for this model (as discussed in Methods).
The evolution of the SIHRD model is shown in Fig. 3 relative to US data, including mobility data,
where the fits accurately capture the data for the infected, hospitalized and deceased populations to
present day (the predictive power of this model is illustrated in Methods). Also illustrated in Fig. 3
are policies that allow for future mitigation designed using the safety-critical paradigm. Safety-
critical active intervention policies can be synthesized for the SIHRD model, wherein the additional
compartments allow for the consideration of safety constraints aimed at limiting hospitalization
and death. In particular, we will consider two active interventions policies: one policy analogous
to Eq. (2) aimed at limiting the infected population, and another policy aimed at simultaneously
limiting both the number of hospitalized and dead. The results of applying these two policies
are shown in Fig. 3, with the specific controllers detailed in Methods. Note, additional policies
could be considered, i.e., ones bounding the populations in any compartment, or any combination
thereof.
The first safety critical policy considered aims to limit the number of infected, i.e.,
I
(
t
)
≤
I
max
,
with results qualitatively similar to those of the SIR model in Fig. 2. Again mitigation measures
are enforced over the same duration as a linear “opening up” policy while the optimality of the
safety-critical policy results in substantially fewer infections at the peak. The second safety critical
policy aims to limit hospitalizations (
H
(
t
)
≤
H
max
) based upon hospital capacity, while simul-
taneously limiting deaths (
D
(
t
)
≤
D
max
). Achieving these objectives, as indicated in Fig. 3,
requires maintaining a non-zero input for a longer duration, i.e., some form of mitigation must
be practiced for an extended period to limit overall death. This reflects the practices of countries
7
Figure 3.
Two safety-critical active intervention policies applied to the SIHRD model. The red policy keeps the
number of infected under
I
max
as in Fig. 2 while the dark orange policy keeps the number of hospitalized under
H
max
and also keeps the number of deaths under
D
max
. The reference policy, that is linear in time, fails to maintain safety
and results in a spike in infections and hospitalizations.
8
that successfully mitigated the first wave of the epidemic
49
. Importantly, both of the synthesized
safety-critical active intervention policies guarantee the safety constraints while simultaneously
minimizing mitigation—compared against the naive linear reference policy which would drive the
number of hospitalized above the limit
H
max
, and result in large number of deceased persons.
This indicates the important role that active intervention policies can play in guaranteeing safety,
encoded by limiting hospitalizations and deaths.
The safety-critical policies synthesized above can also be applied to smaller geographical areas.
This is especially relevant from a practical perspective, as specific mitigation efforts are determined
at a state level in the US. In Fig. 4, the results are shown for four different states with safety-critical
active intervention policies simultaneously bounding hospitalization and death; the safety bounds
H
max
and
D
max
were chosen as outlined in Methods, and different bounds can be used based upon
state-level public policy. Different states require different levels of mitigation as highlighted by
the color of each state. The gating criterion for state level mitigation was, as a proof of concept,
determined by the value of the safety-critical control input 30 days after the start of active inter-
vention; other criterion could be used based upon public policy. In this case, Michigan may open
up, i.e., relax its mitigation efforts relatively quickly, reducing the control input to less than 50% of
its current value in 30 days, yet mitigation efforts must be kept in place throughout the year. Qual-
itatively similar behavior can be seen in the case of New York, though active interventions cannot
be reduced as quickly—if relaxed too quickly the result is a second spike in infections equal to
the first already experienced. By comparison, California needs to very slowly relax its mitigation
efforts and settle into a steady state mitigation at 80% of its current value, or the result is an out-
break with very high number of hospitalized and substantially more death. Texas should increase
its current mitigation efforts to avoid a sudden and significant rise of infections, hospitalizations
and death. In the case of both California and Texas, the way in which they open has a profound
effect on the total hospitalizations and deaths, with deaths more than doubling if a naive opening
up policy is implemented. Therefore, the safety-critical approach can determine the optimal way
in which states should open—assuming good data at the state level—thereby informing policy that
has the potential to dramatically reduce hospitalizations and deaths.
Summary.
The approach taken in this paper revolves around a new paradigm: viewing com-
partmental epidemiological models as control systems, viz. Eq. (1). Importantly, this perspective
allows one to view these models not as systems that evolve independent of human behavior, but
rather as systems where human behavior is an input that can
actively
modify their evolution (cf.
Fig. 1). In this setting, we are able to synthesize active intervention policies that can serve to guide
future mitigation efforts. We specifically synthesized safety-critical policies that formally guar-
antee that the evolution of compartmental models—the SIR and SIHRD—stay within “safe sets.”
These safe sets encode bounds on the number of infected, hospitalized, and deceased populations.
Closed form expressions for optimal active intervention policies were synthesized, as in Eq. (2),
that ensure safety. To demonstrate this approach, US COVID-19 data on cases, hospitalizations
and deaths were utilized to fit the static parameters of the SIR and SIHRD models. The active
component of the control system, i.e., the control input, was synthesized utilizing mobility data;
9
Figure 4.
Safety-critical active interventions at the state level for four states: California, Michigan, New York, and
Texas. The SIHRD model, viewed as a control system, was fit to the data for each state through May 30, 2020. From
this, safety-critical active intervention policies that simultaneously bound hospitalizations and deaths are synthesized.
The color of each state is determined by the control input 30 days after the start of the safety-critical active interven-
tions, as indicated by the vertical line in the control input plots. The safety-critical policy is compared against the
naive linear opening up reference policy which violates the safety bounds—resulting in over twice the deaths in the at
risks states: California and Texas. This illustrates that the way in which states open up has important ramifications.
10
the result was models with predictive power. Projecting into the future while compensating for the
incubation and testing delays, the active intervention policies were applied and compared against
“naive opening up” policies. It was shown that the safety-critical policies that limit hospitaliza-
tions and deaths greatly outperformed these reference policies (Fig. 2), and this was demonstrated
at both the national (Fig. 3) and the state level (Fig. 4).
Policy Implications.
The safety-critical approach to active intervention can directly inform public
policy. To wit, the results presented demonstrate that epidemiological models (viewed as control
systems) can capture the role of human action in mitigating COVID-19; both to describe observed
data, and to actively modulate future behavior. Active intervention policies (feedback control
laws) can, therefore, be used to guide non-pharmaceutical actions that should be taken to achieve
a desired outcome with regard to the COVID-19 pandemic—or unforeseen future pandemics. Of
particular concern are mitigation efforts devoted to ensuring safety; this encodes the desire to limit
the infected, hospitalized and deceased population. The safety-critical active intervention policy
presented herein results in concrete guidance on future mitigation efforts needed to achieve these
guarantees. These actions can be at a local, state, national or international level depending on the
ability to guide active interventions among these populations. The end result can be codified in tan-
gible and specific public policies on “opening up”, i.e., on lifting or increasing mitigation efforts.
As demonstrated throughout this paper on COVID-19 data and the corresponding epidemiological
models, safety-critical active interventions—if properly encoded as public policy—have the ability
to ensure available hospital capacity and save lives.
11
Methods
Safety-Critical Control for Guaranteed Safety.
Safety can be framed as set invariance
50–52
in
the context of control systems and controller synthesis. Let
R
n
be the state space of the com-
partmental model of interest, consisting of
n
-dimensional Euclidean space, with
n
the number of
compartments, i.e., for the SIR model
n
= 3
and for the SIHRD model
n
= 5
. A state
x
∈ R
n
consists of values of the populations, e.g.,
x
= [
S,I,R
]
>
for the SIR model. A safety constraint is
a function
h
:
R
n
→R
that encodes the safe behavior of the system through:
Safe set:
C
:=
{
x
∈R
n
:
h
(
x
)
≥
0
}
,
(3)
wherein the goal is for the system to evolve in this safe set. For example, for the SIR model
h
(
S,I,R
) =
I
max
−
I
, with the set
C
containing the states for which
I
≤
I
max
. The goal is to give
(necessary and sufficient) conditions for control systems, and synthesize corresponding policies,
that render this set forward invariant, i.e., that keep the system safe.
A
control system
(in control affine form) is a first order nonlinear differential equation with a
control input:
̇
x
(
t
) =
f
(
x
(
t
)) +
g
(
x
(
t
))
u
(
t
)
︸︷︷︸
Control Input
,
(4)
where
x
∈R
n
and
u
∈R
is the scalar valued control input (note that all of the methods presented
also hold for vector valued control inputs). All compartmental models can be expressed in the
general form of Eq. (4); which becomes an autonomous dynamical system (as they are typically
modeled) for
u
(
t
)
≡
0
, i.e., the system evolves according to
̇
x
(
t
) =
f
(
x
(
t
))
. The addition of the
control input
u
(
t
)
, as was done in Eq. (1), allows one to modify the evolution of the system to
achieve desired behaviors. This modification is done via
control laws
or
policies
:
u
(
t
) =
K
(
x
(
t
))
.
The result is a
closed loop
dynamical system:
̇
x
(
t
) =
f
(
x
(
t
)) +
g
(
x
(
t
))
K
(
x
(
t
))
, wherein
x
(
t
)
is
a solution to this system with initial condition
x
(0) =
x
0
.
We are interested in guarantees of safety framed as set invariance per Eq. (3). Thus, we say that the
control system in Eq. (4) is
safe
with the policy
u
(
t
) =
K
(
x
(
t
))
if
x
0
∈ C
implies that
x
(
t
)
∈ C
for all
t
≥
0
, where
x
(
t
)
is a solution to the closed loop system with the policy applied. By the
definition of the safe set in Eq. (3), safety is thus equivalent to satisfying the safety constraint for
all time:
h
(
x
(
t
))
≥
0
. Safety-critical control addresses the fundamental question:
how does one
synthesize control policies that render the set
C
safe
, i.e., control policies such that safety constraint
h
(
x
(
t
))
≥
0
is satisfied for the closed loop system? To achieve safe behavior for the control system
in Eq. (4) representing an abstract compartmental model, we leverage the framework of control
barrier functions
7
. This is a new methodology for controller synthesis that has its bases in a long
and rich history of set invariance for dynamical systems
50–52
. In particular, by considering the
function
h
(
x
)
that defines the safe set
C
, we wish to find conditions on the rate of change of this
function that guarantee forward set invariance; conditions that can be checked over the entire set
C
and thereby used to synthesize control policies.
12
It was discovered
7
that necessary
1
and sufficient conditions for forward set invariance are given by
lower bounding the rate of change of
h
when differentiated along
x
(
t
)
with respect to time:
d
dt
h
(
x
(
t
))
≥−
αh
(
x
(
t
))
⇐⇒ C
is safe
⇐⇒
h
(
x
(
t
))
≥
0
,
(5)
for
α >
0
and all
t
≥
0
. The importance of the derivative condition is that it can be checked at
every point of time with respect to the input
u
. Thus,
h
is a
control barrier function
7
(CBF) if there
exits a
u
(
t
)
such that:
d
dt
h
(
x
(
t
)) =
̇
h
(
x
(
t
)
,u
(
t
)) =
∂h
∂
x
f
(
x
(
t
))
︸
︷︷
︸
:=
L
f
h
(
x
(
t
))
+
∂h
∂
x
g
(
x
(
t
))
︸
︷︷
︸
:=
L
g
h
(
x
(
t
))
u
(
t
)
≥−
αh
(
x
(
t
))
.
(6)
As a result, for a control barrier function, one can synthesize a policy that ensures safety by choos-
ing a controller
u
(
t
)
that satisfies Eq. (6). For example, if
L
g
h
(
x
)
6
= 0
then
h
is a control barrier
function as
u
(
t
)
satisfying Eq. (6) can be explicitly solved for through the pseudoinverse. We seek
to do this in an optimal way so as to minimize the amount of active intervention.
With the goal of achieving safety while minimizing the input—as is the case with compartmental
epidemiological models where we wish to minimize the active intervention—the control law syn-
thesis problem can be framed as an optimization problem; specifically, a quadratic program:
u
(
t
) =
K
(
x
(
t
)) = argmin
u
∈
[0
,
1]
u
2
(7)
s
.
t
. L
f
h
(
x
(
t
)) +
L
g
h
(
x
(
t
))
u
≥−
αh
(
x
(
t
))
.
Note that here we limit
u
∈
[0
,
1]
since this corresponds to the interval of active interventions with
u
= 0
denoting no intervention and
u
= 1
denoting complete intervention, e.g., fully isolating the
infected population. Importantly, one can explicitly solve the optimization problem in Eq. (7) to
get a closed form expression:
u
(
t
) =
K
(
x
(
t
)) =
{
−
L
f
h
(
x
(
t
))+
αh
(
x
(
t
))
L
g
h
(
x
(
t
))
if
L
f
h
(
x
(
t
))
<
−
αh
(
x
(
t
))
0
if
L
f
h
(
x
(
t
))
≥−
αh
(
x
(
t
))
.
(8)
For this choice of control law, the closed loop system is safe and, additionally, the minimal input
is optimally chosen. This is represented by the conditional statement, wherein
u
= 0
if the natural
dynamics of the system satisfy the control barrier function condition in Eq. (6).
1
Technically, for necessity,
α
must be chosen to be an extended class
K
function
7
not a constant. We utilize a
constant for simplicity of exposition and without loss of generality.
13
If
L
g
h
(
x
(
t
))
>
0
, Eq. (8) simplifies to:
u
(
t
) =
K
(
x
(
t
)) = max
{
0
,
−
L
f
h
(
x
(
t
)) +
αh
(
x
(
t
))
L
g
h
(
x
(
t
))
}
= ReLU
(
−
L
f
h
(
x
(
t
)) +
αh
(
x
(
t
))
L
g
h
(
x
(
t
))
)
,
(9)
wherein the
min
becomes the
max
when
L
g
h
(
x
(
t
))
<
0
. It is this formulation that leads to the
active intervention policies that we will synthesize for both the SIR and SIHRD compartmental
models, viewed as control systems.
Application of Safety-Critical Methods to the SIR Model.
Consider the SIR model, viewed as
a control system, as given in Eq. (1). This is clearly of the form of the general control system given
in Eq. (4) wherein
x
= [
S,I,R
]
>
∈R
3
and:
f
(
x
(
t
)) =
−
β
0
N
S
(
t
)
I
(
t
)
β
0
N
S
(
t
)
I
(
t
)
−
γI
(
t
)
γI
(
t
)
, g
(
x
(
t
)) =
β
0
N
S
(
t
)
I
(
t
)
−
β
0
N
S
(
t
)
I
(
t
)
0
.
(10)
As a result,
̇
x
(
t
) =
f
(
x
(
t
))
is just the standard SIR model—viewed as an autonomous dynamical
system. As indicated above, the safety constraint
I
(
t
)
≤
I
max
leads to the function
h
(
I
) =
I
max
−
I
defining the safe set
C
=
{
[
S,I,R
]
>
∈ R
3
:
I
≤
I
max
}
as in Eq. (3). For the safety function
h
(
I
) =
I
max
−
I
calculating Eq. (6) yields:
̇
h
(
S
(
t
)
,I
(
t
)) =
−
̇
I
(
t
) =
−
β
0
N
S
(
t
)
I
(
t
) +
γI
(
t
)
︸
︷︷
︸
L
f
h
(
S
(
t
)
,I
(
t
))
+
β
0
N
S
(
t
)
I
(
t
)
︸
︷︷
︸
L
g
h
(
S
(
t
)
,I
(
t
))
u
(
t
)
≥−
α
(
I
max
−
I
(
t
))
.
(11)
It follows that
h
is a control barrier function since
I
6
= 0
and
S
6
= 0
corresponds to having nonzero
infected or susceptible populations, and therefore,
L
g
h
(
S
(
t
)
,I
(
t
))
6
= 0
. The explicit solution in
Eq. (9) to the optimization-based controller in Eq. (7) becomes:
u
(
t
) =
A
(
S
(
t
)
,I
(
t
)) = ReLU
(
1
−
α
(
I
max
−
I
(
t
)) +
γI
(
t
)
β
0
N
S
(
t
)
I
(
t
)
)
⇒
I
(
t
)
≤
I
max
,
(12)
if
I
(0)
≤
I
max
, since in the domain of interest
S >
0
,I >
0
⇒
L
g
h
(
S
(
t
)
,I
(
t
))
>
0
. By picking
α
=
γ
, the control law in Eq. (12) yields Eq. (2) which was used in Fig. 2.
Safety-Critical Control Applied to the SIHRD Model.
The SIHRD model is a compartmental
epidemiological model that extends the SIR model to include two additional compartments related
to hospitalized and deceased populations. These additional compartments will be important in the
synthesis of safety-critical controllers that bound these populations. The SIHRD model—viewed
as a control system—is illustrated in Fig. 5, where
S
,
I
and
R
are the same populations as in the
SIR model,
H
denotes the population that is currently hospitalized due to the virus (and assumed
not to transmit to the susceptible population as a result), and
D
is the deceased population. The
rate constants are indicated along the arrows linking the compartments:
β
0
is the transmission rate
14
while
γ
and
ν
are the recovery rates of the infected and hospitalized populations, respectively.
Additionally,
λ
represents the hospitalization rate and
μ
is the mortality rate. These parameters are
coupled via
1
/
(
γ
+
λ
+
μ
)
which is the characteristic infectious period of the virus, accounting for
hospitalizations and deaths, after which there is assumed to be no transmission.
Figure 5.
Illustration of the predictive power of the SIHRD model. The model parameters are estimated using the US
data up to May 5, 2020 (dark blue), shown as a vertical blue line, and then used to predict forward for 25 days until
May 30, 2020 (yellow). These are compared to a fit where the data was used until May 30 (light blue).
15
When casting the model in the form of Eq. (4), we use
x
= [
S,I,H,R,D
]
>
∈ R
5
and obtain the
following control system:
̇
S
(
t
)
̇
I
(
t
)
̇
H
(
t
)
̇
R
(
t
)
̇
D
(
t
)
︸
︷︷
︸
̇
x
(
t
)
=
−
β
0
N
S
(
t
)
I
(
t
)
β
0
N
S
(
t
)
I
(
t
)
−
(
γ
+
λ
+
μ
)
I
(
t
)
λI
(
t
)
−
νH
(
t
)
γI
(
t
) +
νH
(
t
)
μI
︸
︷︷
︸
f
(
x
(
t
))
+
β
0
N
S
(
t
)
I
(
t
)
−
β
0
N
S
(
t
)
I
(
t
)
0
0
0
︸
︷︷
︸
g
(
x
(
t
))
u
(
t
)
︸︷︷︸
Control Input
.
(13)
As indicated in Fig. 5, one may design active intervention policies
2
for the control input
u
(
t
)
that modulates the transmission rate:
β
(
t
) =
β
0
(1
−
u
(
t
))
. In particular, we are interested in
synthesizing safety-critical active intervention policies that bound infections, hospitalization and
death for the SIHRD model. The corresponding safety functions are given by:
h
I
(
I
) :=
I
max
−
I,
h
H
(
H
) :=
H
max
−
H,
(14)
h
D
(
D
) :=
D
max
−
D,
with corresponding safe sets
C
I
,
C
H
, and
C
D
defined as in Eq. (3). In the case of
h
I
, a similar
calculation to that in Eq. (11) yields the active intervention policy (analogous to Eq. (12)):
u
(
t
) =
A
I
(
S
(
t
)
,I
(
t
)) = ReLU
(
1
−
α
I
(
I
max
−
I
(
t
)) + (
γ
+
λ
+
μ
)
I
(
t
)
β
0
N
S
(
t
)
I
(
t
)
)
⇒
I
(
t
)
≤
I
max
,
(15)
assuming
I
(0)
≤
I
max
, wherein we selected
α
I
= (
γ
+
λ
+
μ
)
/
10
in Fig. 3.
For the safety functions,
h
i
for
i
∈ {
H,D
}
, associated with hospitalization and death, additional
steps are needed to synthesize the active intervention policy. In particular, the input
u
(
t
)
does not
appear when differentiating these functions as was the case in Eq. (6). Yet, we know by Eq. (5)
that sufficient conditions for the sets
C
i
to be safe are given by
̇
h
i
+
α
i
h
i
≥
0
for
i
∈ {
H,D
}
,
where now
̇
h
i
does not depend on the input
u
(
t
)
as
L
g
h
i
(
x
) = 0
. As a result, define the following
extended safety functions
50, 53
:
h
e
i
(
x
(
t
)) :=
̇
h
i
(
x
(
t
)) +
α
i
h
i
(
x
(
t
)) =
∂h
i
∂
x
f
(
x
(
t
))
︸
︷︷
︸
̇
h
i
(
x
(
t
))=
L
f
h
i
(
x
(
t
))
+
α
i
h
i
(
x
(
t
))
,
(16)
with associated safe sets:
C
e
i
=
{
x
∈R
5
:
h
e
i
(
x
)
≥
0
}
. Importantly,
h
e
i
are now themselves control
2
Note that the delayed values of the different populations appear in the corresponding feedback laws which will be
compensated using predictors based on the fitted model. This will be described in detail later in Methods.
16