Member, IEEE Philipp Braun
email: philipp.braun@newcastle.edu.au

Senior Member, IEEE Christopher M Kellett
email: chris.kellett@anu.edu.au

Fellow, IEEE Luca Zaccarian
email: luca.zaccarian@laas.fr.

Explicit construction of stabilizing robust avoidance controllers for linear systems with drift

Keywords: hybrid systems, obstacle avoidance, state constraints, robust controller design, global asymptotic stability

We propose a constructive design method for linear systems with a non-trivial drift term, guaranteeing robust global asymptotic stability of the origin of the closed-loop system, as well as robust obstacle avoidance. To obtain discontinuous input actions, our controller is designed in the framework of hybrid systems. Using our proposed hybrid controller, we demonstrate that solutions do not enter a sphere, which we term an avoidance neighborhood, around specified isolated points. The constructive controller design methodology, as well as the closedloop properties, are investigated via numerical examples.

I. INTRODUCTION

While global asymptotic stability/stabilization (GAS) of nonlinear dynamical systems is well understood, including in terms of possible topological obstructions [START_REF] Brockett | Asymptotic stability and feedback stabilization[END_REF], stability/stabilization of dynamical systems subject to state constraints is more difficult. This is particularly true for the socalled obstacle avoidance problem, where the state constraints exclude a bounded subset of the state space, such as an "unsafe" ball (see, in particular the discussion around [START_REF] Sontag | Nonlinear Feedback Stabilization Revisited[END_REF]Fig. 4]). To simultaneously achieve global asymptotic stability of the origin and avoidance of a bounded obstacle, as discussed in [START_REF] Sontag | Nonlinear Feedback Stabilization Revisited[END_REF], [START_REF] Braun | On (the existence of) control Lyapunov barrier functions[END_REF], [START_REF] Liberzon | Switching in Systems and Control[END_REF]Chapter 4], topological obstructions prevent the possibility of using continuous time-invariant feedback. The natural approach is then to use discontinuous feedback but it is noted in [15, p. 78] that "the resulting closed-loop system is highly sensitive to measurement errors" and [START_REF] Sontag | Clocks and insensitivity to small measurement errors[END_REF] shows that arbitrarily small measurement noise can act to locally stabilize saddle points away from the origin (thereby preventing GAS). We address in this paper these relevant questions by defining and solving robust versions of GAS and obstacle avoidance.

P.

Braun is with the School of One way to preserve robustness of GAS with noncontinuous feedback laws (which was effective for overcoming topological obstructions in the obstacle-free case [START_REF] Mayhew | Hybrid control of planar rotations[END_REF]), is to unite local and global controllers with hybrid feedback. This approach, which is used in this paper, traces back to [START_REF] Teel | Uniting local and global controllers[END_REF] and was further investigated and established using the formalism of hybrid dynamical systems in [START_REF] Poveda | A hybrid adaptive feedback law for robust obstacle avoidance and coordination in multiple vehicle systems[END_REF], [START_REF] Prieur | Uniting local and global controllers with robustness to vanishing noise[END_REF], [START_REF] Prieur | Uniting local and global output feedback controllers[END_REF], [START_REF] Sanfelice | Robust hybrid controllers for continuous-time systems with applications to obstacle avoidance and regulation to disconnected set of points[END_REF], [START_REF] Sanfelice | Robust supervisory control for uniting two output-feedback hybrid controllers with different objectives[END_REF], [START_REF] Tuna | Hybrid MPC: Open-Minded but Not Easily Swayed[END_REF]. Simultaneous obstacle avoidance and GAS is not the main focus of these references, even though this problem is addressed for some specific examples in [START_REF] Poveda | A hybrid adaptive feedback law for robust obstacle avoidance and coordination in multiple vehicle systems[END_REF], [START_REF] Sanfelice | Robust hybrid controllers for continuous-time systems with applications to obstacle avoidance and regulation to disconnected set of points[END_REF], [START_REF] Sanfelice | Robust supervisory control for uniting two output-feedback hybrid controllers with different objectives[END_REF], and [START_REF] Tuna | Hybrid MPC: Open-Minded but Not Easily Swayed[END_REF], using dynamics without a drift term, given by ẋ = u (or equivalently x + = x + u in the discrete-time setting). Inspired by those works, we formalize a concept of robust obstacle avoidance, accounting for unknown disturbances and measurment errors, and extending the well-studied notion of robust GAS (see, [START_REF] Goebel | Hybrid Dynamical Systems: modeling, stability, and robustness[END_REF]Ch. 7]). Then, we discuss the explicit construction of a hybrid controller inducing robust obstacle avoidance and robust GAS for general stabilizable linear systems ẋ = Ax + Bu, with a non-trivial drift term, under some weak assumptions that are proven to be generally necessary.

The presence of a non-trivial drift term in the dynamics complicates the obstacle avoidance task. Such systems are referred to as underactuated in the marine control or mechanical systems literature [START_REF] Do | Control of Ships and Underwater Vehicles: Design for Underactuated and Nonlinear Marine Systems[END_REF] (see also [START_REF] Bullo | Geometric Control of Mechanical Systems: Modeling, Analysis, and Design for Simple Mechanical Control Systems[END_REF]). Intuitively, the difficulty arises as the drift term may push the states into the obstacle while, at the same time, the control may have limited authority to counteract this natural drift (see, e.g., Example 1 below).

While we believe that hybridly uniting controllers is the most natural approach to solve the problem at hand, several alternative routes may be viable.

• One alternative recent approach used for stabilization and obstacle avoidance relies on the combination of (control) Lyapunov functions for stabilization and (control) barrier functions [START_REF] Wieland | Constructive safety using control barrier functions[END_REF] for avoidance. Since these approaches usually rely on continuous feedback laws, the papers in general only address or guarantee global asymptotic stability and avoidance when the obstacle to be avoided is defined by an unbounded subset of the state space. In particular, this impacts approaches in [START_REF] Ames | Control barrier function based quadratic programs for safety critical systems[END_REF], [START_REF] Ngo | Integrator backstepping using barrier functions for systems with multiple state constraints[END_REF], [START_REF] Romdlony | Stabilization with guaranteed safety using control Lyapunov-barrier function[END_REF], [START_REF] Tee | Barrier Lyapunov functions for the control of output-constrainted nonlinear systems[END_REF], which rely on the existence of continuous feedback laws. In [START_REF] Panagou | Distributed coordination control for multi-robot networks using Lyapunov-like barrier functions[END_REF], almost global (nominal) asymptotic stability and obstacle avoidance results are derived using control Lyapunov functions and control barrier functions. However, in contrast to our approach discussed in the following, robustness is not addressed in [START_REF] Panagou | Distributed coordination control for multi-robot networks using Lyapunov-like barrier functions[END_REF].

• In the robotics literature, artificial potential fields, which can be seen as Lyapunov-like functions, are well established for obstacle avoidance controller design and originate from papers by Khatib [START_REF] Khatib | Real-time obstacle avoidance for manipulators and mobile robots[END_REF], [START_REF] Khatib | Real-Time Obstacle Avoidance for Manipulators and Mobile Robots[END_REF] (see also [START_REF] Hernández-Martínez | Convergence and Collision Avoidance in Formation Control: A Survey of the Artificial Potential Functions Approach[END_REF]). In these ap-proaches, artificial potential fields are functions whose gradient can be used to define a feedback law pushing solutions away from bounded obstacles and towards a target set, similar to the role of control Lyapunov and control barrier functions in the control community. The approach is typically used for systems with no drift and guarantees asymptotic stability of the target set for almost all initial conditions due to saddle points of the artificial potential fields [START_REF] Koditschek | Robot navigation functions on manifolds with boundary[END_REF], [START_REF] Rimon | Exact robot navigation using artificial potential functions[END_REF]. It is in fact challenging to design artificial potential fields for the obstacle avoidance problem without local minima, to avoid nonconverging trajectories from initial conditions in a set of non-zero measure [START_REF] Braun | On (the existence of) control Lyapunov barrier functions[END_REF], even though it is possible to transform such local minima to saddle points through appropriate redesigns. Unlike our controller design, these approaches intrinsically lead to continuous feedback laws and therefore cannot be employed, without further modifications, for ensuring GAS and avoidance (neither their nominal nor their robust versions) due to the limitations discussed above.

• A widely and successfully used tool for handling state and input constraints is model predictive control (MPC) [START_REF] Maciejowski | Predictive Control: With Constraints[END_REF], [START_REF] Rawlings | Model Predictive Control: Theory, Computation, and Design[END_REF], which is often combined with motion planning [START_REF] Sucan | The open motion planning library[END_REF] in the obstacle avoidance context. When considered without motion planning, MPC for obstacle avoidance and target set stabilization is particularly challenging, since the feasible domain excluding bounded sets from the state space is necessarily a nonconvex set. This fact complicates the selection of a stabilizing prediction horizon and the calculation of a recursively feasible set since standard arguments relying on forward invariant sublevel sets of Lyapunov functions are not applicable in this case. Additionally, regardless of whether bounded obstacles are encoded as hard constraints in the feasible region or as soft constraints in the objective function, the optimization problem involved in the MPC loop is necessarily nonconvex and thus numerically challenging which makes it particularly difficult to provide guarantees. Despite these difficulties, MPC is an established control approach with many succesful implementations in the obstacle avoidance context. Since, our approach is intrinsically different from MPC and focuses on global stability and robustness results, MPC is out of the scope of this paper. However, [START_REF] Tuna | Hybrid MPC: Open-Minded but Not Easily Swayed[END_REF] investigates exactly the robustness properties of interest in this paper in the MPC context.

• An alternative route to our hybrid approach, to obtain robust GAS and avoidance, may be the use of time-varying feedback. While this approach has been successfully applied in the obstacle-free case to systems that do not satisfy Brockett's covering condition [START_REF] Brockett | Asymptotic stability and feedback stabilization[END_REF] (see [START_REF] Coron | Global asymptotic stabilization for controllable systems without drift[END_REF], [START_REF] Pomet | Explicit design of time-varying stabilizing control laws for a class of controllable systems without drift[END_REF] for systems with no drift or the more recent result [START_REF] Bacciotti | Liapunov functions and stability in control theory[END_REF]Theorem 3.11] allowing for drift, but under some fairly restrictive assumptions), their use for simultaneous stabilization and obstacle avoidance does not appear to be straightforward, despite being a potentially viable route.

In this paper we propose a generalization of our earlier nominal single-obstacle work in [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF] based on building a nonsmooth shell around the obstacle (in the n-dimensional Euclidean space), which appropriately embeds the nonsmooth idea of making a decision (above or below, so to say) about what direction to take for the avoidance. As compared to [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF],

we discuss multiple obstacles, extend the controller to systems with multi-dimensional inputs, and extend the controller to obtain robust obstacle avoidance instead of nominal avoidance, in addition to robust GAS.

Even though the control approaches discussed so far all have their flaws when it comes to the combined robust stabilization and avoidance problem, it is important to note that also our approach does not provide a complete solution to the problem. In particular, unlike other methods, our controller design is restricted to linear systems. Additionally, since we derive theoretical results for robust GAS and robust avoidance, the ensuing constraints on the size and shape of the obstacle for which guarantees can be provided are necessarily conservative.

The paper is structured as follows. In Section II the mathematical setting and the problem under consideration are formalized. In Section III we summarize the results of our earlier work [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF], i.e., the basic avoidance controller is defined and corresponding definitions and notations are provided before a robust controller extension is introduced in Section IV. The results are combined in Section V to obtain a global hybrid control law, following the framework of hybrid dynamical systems in [START_REF] Goebel | Hybrid Dynamical Systems: modeling, stability, and robustness[END_REF]. The closed-loop properties of the hybrid control law for the nominal system dynamics given in Section V are extended to robust GAS and robust obstacle avoidance for perturbed system dynamics in Section VI. The results of the hybrid controller are illustrated on numerical examples in Section VII. The proofs of the main result are shifted to Sections VIII and IX, before the paper concludes with final remarks in Section X.

Throughout the paper the following notation is used. For x ∈ R n we use the vector norm |x| = n i=1 x 2 i . Similarly, the distance to a point y ∈ R n is denoted by |x| y = |x -y|. For a closed set A ∈ R n and r > 0 we define B r (A) = {x ∈ R n | min y∈A |x -y| ≤ r} and for the origin we simplify the notation to B r = B r (0). The closure, the boundary and the interior of a set are denoted by A, ∂A and int(A), respectively. For two sets A 1 , A 2 ⊂ R n , A 1 + A 2 and A 1 -A 2 denote the Minkowski sum and the Minkowski difference, respectively. The identity matrix of appropriate dimension is denoted by I. The natural numbers from 1 to β ∈ N are denoted N β = {1, . . . , β}. Similarly, Z β = {-β, . . . , 0, . . . , β} denotes the integers from -β to β.

II. SETTING & PROBLEM FORMULATION

In this paper we consider stabilizable linear dynamical systems with a non-trivial drift term

ẋ = Ax + Bu + w x , x 0 = x(0) ∈ R n y = x + w y (1) with state x ∈ R n , input u ∈ R m and matrices A ∈ R n×n , B = [b 1 , . . . , b m ] ∈ R n×m .
The unknown disturbances w x , w y : R ≥0 → R n capture model uncertainties via w x and measurement noise via w y . For our initial development, we will assume w x = w y = 0 and then address the perturbed system in Section VI and in the Examples of Section VII. Here, and throughout the paper, by a non-trivial drift term we mean that Ax cannot be cancelled via a feedback transformation u = -Kx + v such that A -BK = 0. As motivated in the introduction, the paper addresses the following general problem and provides a solution under some simplifying assumptions described below.

Problem 1. (Semiglobal x-avoidance augmentation with GAS) Given a set of obstacle centroids {x 1 , . . . , xβ } ∈ R n \ {0}, β ∈ N, that define spherical obstacles which must be avoided by the controller, and a stabilizing state feedback u s (x) = K s x, for each δ > 0, design a feedback selection of u that guarantees (i) (Semiglobal preservation) the feedback u(x) matches the original stabilizer u(x) = K s x for all x ∈ R n \ ∪ β i=1 B δ (x i ); and (ii) (Semiglobal x-avoidance) all solutions starting outside the balls ∪ β i=1 B δ (x i ) never enter a suitable avoidance neighborhood B χi (x i ), having measure greater than zero, around the centroids xi , i ∈ N β ; (iii) (R-GAS) robust uniform global asymptotic stability of the origin, namely the origin is Lyapunov stable for the perturbed dynamics, and all solutions (including those starting at xi , i ∈ N β ), converge uniformly to zero.

Even in dimension n = 2, it is evident from Figure 1 that, for systems with drift, avoiding obstacles of a priori fixed size will require convoluted restrictions on their size and interplay. In higher dimensions, characterizing these restrictions becomes even less intuitive, if not impossible. Our approach to the robust problem (which generalizes the single-obstacle nominal results in [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF]) provides a constructive and explicit control solution based on: 1) enlarging as much as possible the avoidance sets around each centroid, while respecting the constraints in Figure 1; 2) allowing for a heuristic adjustment of the size of these avoidance sets, continuing to ensure avoidance (as long as those sets do not overlap) and providing a margin of robustness of our stabililty properties.

To solve Problem 1 we make the following standing assumptions throughout the paper.

Assumption 1. Basic assumptions: (a) Matrix A s := A + BK s is Hurwitz. (b) The norm x → |x| 2 is contractive under the stabilizer u s (x) = K s x (equivalently, A s + A T s < 0). (c) For each i ∈ N β ,
there exists a b j , j ∈ N m , (i.e., a column of B) such that the vectors A s xi and b j are linearly independent.

Assumption 1(a) simply states that the feedback law u s = K s x stabilizes the origin for system (1), without obstacles. Assumption 1(b) simplifies the notation and can always be achieved through a coordinate transformation. If V (x) = x T Sx is a Lyapunov function for the closed-loop system ẋ = A s x (with u s = K s x), then V (x) = |x| 2 is a Lyapunov function in the coordinates x = S F x, where S T F S F = S denotes the Cholesky factorization of S.

Assumption 1(c) is the only substantial restriction that we make in this paper and will be addressed in future work. Even though Assumption 1(c) appears restrictive, observe that in the case of a multidimensional input B ∈ R n×m , m ≥ 2, Assumption 1(c) is satisfied for all x ∈ R n \{0} if the columns of B are linearly independent. Assumption 1(c) enables us to exploit the convenient property that the transit of solutions through any sufficiently small neighborhood of xi , i ∈ N β , can be made independent of the input u.

This property, introduced as the "wipeout" property in [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF] makes use of the natural drift in the system dynamics [START_REF] Ames | Control barrier function based quadratic programs for safety critical systems[END_REF] and is repeated together with the main results and definitions of [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF] in the next section. The results developed in this paper, which extend the earlier results in [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF], preserve the modularity properties of the corresponding controller design methodology. Example 1. Consider the simple second order example illustrated in Figure 1, left, where (1) is given by A = -1 0 0 1 , B = [ 0 1 ] and w x = w y = 0. Observe that Ax cannot be cancelled by a feedback transformation; i.e., there is no matrix K such that A -BK = 0. Meanwhile, the static state feedback K s = [0 -2] clearly stabilizes the origin so that Assumption 1(a) and (b) are satisfied. Finally, consider an obstacle centroid given by x = [ ζ1 ζ2 ] T . Then satisfaction of Assumption 1(c) requires that ζ1 = 0. In other words, the obstacle cannot be centered on the x 2 -axis. Furthermore, inspecting the phase portrait of Figure 1 (left), it is clear that the avoidance neighborhood in Problem 1(ii) cannot intersect the x 2 -axis. As a consequence, the size of the avoidance neighborhood depends on the distance between the x 2 -axis and the obstacle centroid x. In the notation of the next section, the set E (Equation ( 2)) is the x 2 -axis and the quantity η (Equation ( 5)) is the distance from the centroid x to the x 2 -axis.

Similarly, for the linear dynamics with 1, right, GAS cannot be guaranteed due to the shape of the obstacle (which might be the collection of multiple obstacles close to each other) and the limitations in the input. While this example is quite simple, even more complex scenarios may appear in the context of multiple obstacles of different size whose interplay may create disconnected viable spaces in higher dimensions.

A = -1 0 0 -1 , B = [ 1 0 ] in Figure

III. THE WIPEOUT PROPERTY AND AVOIDANCE CONTROLLER DESIGN

In this section we recall the results of [4, Section III and IV] and extend them to the case of multiple obstacles and multidimensional inputs u ∈ R m . We study properties of an arbitrary obstacle centroid x ∈ {x 1 , . . . , xβ } throughout this section.

A. η-neighborhood and wipeout property

According to Assumption 1(c), for a fixed obstacle centroid x, there exists a j ∈ N m such that

x / ∈ E j := {y ∈ R n : ∃ν * ∈ R, A s y + b j ν * = 0} (2)
and the right-hand side defines a one dimensional subspace of induced equilibria corresponding to b j , j ∈ N m . More generally, for a vector Λ ∈ R m \{0} the one dimensional subspace

E Λ := {y ∈ R n : ∃ν * ∈ R, A s y + BΛν * = 0} (3)
is defined through a linear combination of the columns of B.

The selection of Λ ∈ R m \{0} allows us to locally reduce the multi-dimensional input u ∈ R m to a one-dimensional input ν ∈ R and to concentrate on a specific linear combination of the inputs u = Λν. The selection of Λ as unit vectors, for example, recovers (2) from (3). Since by Assumption 1(a) the matrix A s is Hurwitz, the subspace can alternatively be characterized through E Λ = span(A -1 s BΛ). Remark 1. Note that the existence of j ∈ N m with x / ∈ E j is independent of the stabilizer u s = K s x. In the case m = 1, the definition of the subspace E 1 can be rewritten as

E 1 = {y ∈ R n : ∃u * 1 ∈ R, A s y + b 1 u * 1 = 0} = {y ∈ R n : ∃u * 1 ∈ R, Ay + b 1 (K s y + u * 1 ) = 0} = {y ∈ R n : ∃v * 1 ∈ R, Ay + b 1 v * 1 = 0, u * 1 = v * 1 -K s y},
showing its independence of the stabilizer u s (for m = 1).

If m > 1 and x ∈ E j for a j ∈ N m , then x / ∈ E i , as long as columns b i and b j of B are independent. Therefore, Assumption 1(c) is automatically satisfied if rank(B) ≥ 2.

With the definition (3), the following property was introduced in [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF].

Proposition 1. (Wipeout Property, [4, Prop. 1]). Let Assumption 1 hold and let Λ ∈ R m be defined such that x / ∈ E Λ and |BΛ| = 1. Consider the linear function H(x) := xT A T Λ x, with A Λ defined as

A Λ := (I -BΛΛ T B T )A s (4)
and the scalar η Λ > 0 defined by the optimization problem

η Λ := min y∈EΛ |x -y|. (5)
For each x ∈ B ηΛ (x) we have ∇H, A s x + BΛν ≥ 0 for all ν ∈ R, where we use the notation ∇H = ∇H(x) because of the linearity of H, implying that ∇H is a constant. Moreover, for each η < η Λ , there exists h > 0 such that

∇H, A s x + BΛν ≥ h, ∀ν ∈ R, ∀x ∈ B η (x). (6)
A proof of the statement can be found in [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF]Prop. 1]. Note that in [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF] the matrix A Λ in (4) (and thus the function H) is defined based on A instead of the stabilized closed loop matrix A s . In Proposition 1 the multi dimensional input is reduced to a one dimensional input ν ∈ R. The input ν and the original input u are linked through the vector Λ, i.e., u = Λν.

Remark 2. Due to the linearity of H(x), ∇H is independent of x and defines a direction

d x = ∇H |∇H| = AΛ x √ xT A T Λ AΛ x
, which is well defined by (4) because x / ∈ E Λ . This implies that (6) provides a lower bound on the speed the solution x(t) moves in direction d x for all η ≤ η Λ , i.e., d x, ẋ ≥ h η for h η = h/|∇H|. In particular, a solution x(•) such that x(t) ∈ B η (x) for all t ∈ [0, T ], satisfies

d x, x(T ) -x(0) ≥ T h η . (7)
Moreover, a solution x(•) such that x(t) ∈ B η (x) for all t ∈ [0, T ], satisfies

d x, x(t 2 ) -x(t 1 ) ≥ 0 for all 0 ≤ t 1 ≤ t 2 ≤ T. ( 8
)
The wipeout property ensures that solutions within B ηΛ (x) naturally drift away from small enough neighborhoods of x in a particular direction defined through BΛ ∈ R n regardless of the input u = Λν. As argued in [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF] and in Section V, it turns out that the size of the neighborhood B ηΛ (x) impacts the size of the neighborhood around x which can be guaranteed to be avoided. Therefore, we use the degree of freedom in the vector Λ ∈ R m to maximize η Λ .

Before we optimize η Λ and thus the vector Λ, observe that for a given Λ the value of η Λ can be computed as

η Λ = |x + c Λ A -1 s BΛ| where c Λ :=argmin c∈R |x + cA -1 s BΛ| 2 .
By taking the derivative of the quadratic function, c Λ is explicitly defined through

c Λ = - (A -1 s BΛ) T x (A -1 s BΛ) T (A -1 s BΛ)
.

The distance between x and a one dimensional subspace

span(A -1 s BΛ), Λ ∈ R m \{0} is maximal if x, A -1 s BΛ = 0 is satisfied, i.e, vectors x and A -1
s BΛ are orthogonal. Hence, we can define Λ * as the solution of the optimization problem

Λ * ∈ argmin Λ∈R m x, A -1 s BΛ 2 s.t. |BΛ| 2 = 1. (9)
Optimization problem ( 9) is non-convex since Λ * optimal implies that -Λ * is optimal too. It is however not necessary to solve [START_REF] Do | Control of Ships and Underwater Vehicles: Design for Underactuated and Nonlinear Marine Systems[END_REF] for Proposition 1 to hold (and for our construction to work). Indeed, in our statements we only assume that |b| = |BΛ| = 1 and that A s x and b are linearly independent. For example, using Assumption 1(c) a simple viable selection is b = bj |bj | . When m = n, optimality is also easily ensured by solving x, A -1 s BΛ * = 0. The controller design is not affected if the selected Λ is not optimal with respect to [START_REF] Do | Control of Ships and Underwater Vehicles: Design for Underactuated and Nonlinear Marine Systems[END_REF].

B. The avoidance shell S and the basic avoidance controller

A second ingredient used in this paper, introduced in [4, Sec. IV], whose construction is parallel to, and independent of the wipeout property, is the safety or avoidance controller ûi , acting in a neighborhood of the obstacle centroid xi , i ∈ N β . Before the avoidance controller is discussed, we specify the avoidance shell.

x S(δ) The avoidance shell of a fixed obstacle centroid x ∈ {x 1 , . . . , xβ } is a nonsmooth compact set, having the shape of an eye (in two dimensions) and is based on two geometric parameters and a direction:

x + δµb x -δµb δµ + µδ 2 δµ δ µδ 2 O-1 O+1 µ = 1 µ = 0.5 µ = 1.5
1) the size δ ∈ R >0 of the shell;

2) the aspect ratio µ ∈ (0, 2) of the shell;

3) the orientation b = BΛ ∈ R n , |b| = 1, of the shell. Based on these parameters, the avoidance shell S is the following intersection between two balls centered at some shifted versions of the obstacle centroid x:

δ µ := δ 1 µ -µ 4 , (10a)
O p := B ( µδ 2 +δµ) (x -pδ µ b), p ∈ {+1, -1}, (10b)
S(δ) := O +1 O -1 . (10c)
Note that µ ∈ (0, 2) fixes the aspect ratio of the shell, whose height corresponds to µδ, resembling an eye that is increasingly closed as µ approaches its lower limit 0. Conversely, as µ approaches its upper limit 2, the eye is increasingly open and converges to a circle. In our construction, we will assume that a certain desired aspect ratio µ is fixed a priori, and we will establish suitable results by exploiting the fact that the shell S(δ) can be made arbitrarily large and arbitrarily small by adjusting the positive design parameter δ. A maximal δ * > δ > 0 for which avoidance and stability properties of the closed loop can be guaranteed will be derived in [START_REF] Sucan | The open motion planning library[END_REF]. Figure 2 represents a few possible shapes of these sets together with the distances that go with them. To simplify the notation in the following, we define

c p := x -pδ µ b, p ∈ {-1, +1} (11)
to denote the centers of the balls O p , p ∈ {-1, +1} in (10b). Moreover, Lemma 1 below will be useful to prove our main statements.

Lemma 1. Given an aspect ratio µ ∈ (0, 2) and an orientation b ∈ R m , |b| = 1, for each δ > 0, the following inclusions hold for the shell S(δ) defined in [START_REF] Goebel | Hybrid Dynamical Systems: modeling, stability, and robustness[END_REF]:

B µδ 2 (x) ⊂ S(δ) ⊂ B δ (x). ( 12
) Proof. Let x ∈ B µδ 2 (x), i.e., |x -x| ≤ µδ 2 .
Then for each p ∈ {-1, +1} the triangle inequality leads to the estimate

|x -x + pδ µ b| ≤ |x -x| + |pδ µ b| ≤ µδ 2 + δ µ = δ 1 µ + µ 4 , which implies that x ∈ O p for all p ∈ {-1, +1}, and thus x ∈ S(δ). Hence B µδ 2 (x) ⊂ S(δ) is satisfied.
We define the set

S max := x ∈ S(δ) : |x| x ≥ max y∈S(δ) |y| x .
It is clear that for all x ∈ S max either x ∈ ∂O +1 and/or x ∈ ∂O -1 is satisfied since otherwise the condition

|x| x ≥ max y∈S(δ) |y| x cannot hold. Similarly if x ∈ S max , x ∈ ∂O p and x ∈ int(O -p ), p ∈ {-1, +1}, for all ε > 0 there needs to exist x ∈ B ε (x) ∩ ∂O +1 ∩ O -1 such that |x| x > |x| x.
Thus, the set S max satisfies S max ⊂ ∂O +1 ∩ ∂O -1 . Using the definitions of O +1 and O -1 , and Pythagoras' theorem for pairwise orthogonal vectors provides the identities

|x -x| 2 = δ µ + µδ 2 2 -δ 2 µ = δ 2 1 µ + µ 4 2 -1 µ -µ 4 2 = δ 2
for all x ∈ ∂O +1 ∩ ∂O -1 (visualized in Figure 2). This particularly implies that S(δ) ⊂ B δ (x).

Based on the definition of the shell S(δ) the avoidance control law

ν(x, p) := - x -(x -pδ µ b), A s x x -(x -pδ µ b), b , p ∈ {-1, 1}, (13)
was introduced in [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF] and satisfies the following properties.

û(x, p) = K s x + Λν(x, p) (14)
is well defined. Moreover, the solution to (1) with u = û(x, p) starting at x 0 ∈ S(δ) remains at a constant (non-negative) distance from the center c p = x -pδ µ b of the ball O p until it leaves S(δ).

In [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF] it was shown that this simple control law can be used for obstacle avoidance and global stabilization in the context of a nominal unperturbed system. The main contribution of this paper will be extensions to obtain a robust control law. Note that controller [START_REF] Koditschek | Robot navigation functions on manifolds with boundary[END_REF] depends on the selection of the vector Λ and thus the notation û(x, p; Λ) would be more precise. To simplify the notation, in particular with respect to the following sections, we drop the dependence on Λ in the notation.

Remark 3. The shape of the avoidance shell S(δ) is motivated by the need for a set with a nonsmooth boundary in the case of linear systems with a nontrivial drift term. To understand this, assume the shell S(δ) is replaced by a neighborhood with a smooth boundary, a sphere B δ (x), for example, and assume that B δ (x) does not contain induced equilibria, i.e.,

B δ (x) ∩ {y ∈ R n : ∃u ∈ R m , Ay + Bu = 0} = ∅.
Then there exists (at least one) point x s ∈ ∂B δ (x) on the surface where Ax s points inside B δ (x) and the columns of B are tangent to the surface ∂B δ (x). Thus, the interior of the ball B δ (x) cannot be avoided for all initial conditions x(0) ∈ R n \ int(B δ (x)) using a finite input. Since spheres are not possible as avoidance neighborhoods we design the shell S(δ) as the intersection of two spheres. Through the nonsmooth surface, we can ensure that a finite input such that ẋ = Ax + Bu is pointing outside of the shell always exists. Remark 4. In [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF], ( 13) is defined based on A instead of A s and the control law [START_REF] Koditschek | Robot navigation functions on manifolds with boundary[END_REF] does not contain the stabilizer K s . While these differences lead to different interpretations of the controller, the closed-loop solution coincides. While the controller in [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF] switches between the stabilizing controller and the avoidance controller, ( 14) corrects the stabilizing controller. The interpretation used here seems to be more appropriate for the multi-obstacle and multidimensional input case.

IV. ROBUST CONTROLLER DESIGN

Section III contains all the ingredients for an avoidance controller design. In Section V a hybrid controller is proposed that switches the control law (13) on and off thereby guaranteeing asymptotic stability and obstacle avoidance. However, before we propose the hybrid control law we extend the basic ideas of Section III to obtain a robust controller. To be able to define a robust controller selection that switches the avoidance controller on and off, we define a suitable h-hysteresis switching, based on a region S h (δ) obtained by shrinking S(δ) by a factor h ∈ (0, 1) as follows, and according to the pictorial representation in Figure 3:

A. Definition of hysteresis regions

O h,p := B (h µδ 2 +δµ) (c p ), p ∈ {+1, -1}, (15)
S h (δ) := O h,+1 O h,-1 . ( 16
)
It is clear that for each p ∈ {-1, +1} the set O h,p is a ball sharing the same center as O p but having a smaller radius that approaches δ µ as h approaches 0. As a consequence, S h (δ) is a smaller eye-shaped set, with the same orientation as S(δ) (see Figure 3). Additionally, the definition of the lower and upper part of the shell (with respect to the orientation b) is needed. Thus, we define

S / p := S(δ) ∩ {x ∈ R n : pb T (x -x) ≥ 0}, p ∈ {-1, +1}, (17)
which will be used to decide if the obstacle is passed from above or from below (which again needs to be understood with respect to the orientation b).

B. A repulsive avoidance control law

As shown in [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF], using ( 14) we may define a hybrid obstacle avoidance controller whose nominal stability/avoidance properties have been proven in [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF]Thm. 1]. Here we introduce its robust version. For p ∈ {-1, +1}, control law ( 14) ensures a constant distance to the center c p = x -pδ µ b defined in [START_REF] Hernández-Martínez | Convergence and Collision Avoidance in Formation Control: A Survey of the Artificial Potential Functions Approach[END_REF]. To obtain a control law that increases the distance to c p and thus the distance to x we introduce the function

κ(•; k r , ) : R ≥0 → R ≥0 , κ(s; k r , ) := 1 2 k r (s -) 2 , if s ≤ 0, if s ≥ (18)
with parameters k r ∈ R ≥0 and ∈ R >0 . The argument of the function s = |x| cp measures the distance of the state to c p . The parameter defines the critical distance where the function κ becomes active and k r defines the robustness gain parameter. The extension of ( 13) using function κ leads to the onedimensional input

ν kr (x, p) = κ(|x| cp ; k r , h µδ 2 + δ µ ) -x -c p , A s x x -c p , b (19)
which recovers the original definition ( 13) for k r = 0. With these definitions, Proposition 2 can be extended to contain the following repulsive properties of the control law.

Proposition 3. Let µ ∈ (0, 2/ √ 3), ε ∈ [0, 2/ √ 3 -µ), δ > 0, Λ ∈ R m such that b = BΛ, |b| = 1, k r ≥ 0,
is well defined. Moreover, for k r ≥ 0, the solution to (1) with u = ûkr (x, p) starting at x 0 ∈ S / p ∩ S h (δ), p ∈ {-1, +1}, is associated to a guaranteed increase of the distance from the center c p of the ball O p until it remains in S h (δ). In particular,

d dt |x(t) -c p | 2 = k r |x(t) -c p | -(h µδ 2 + δ µ ) 2 . (21)
Proof. The well definedness of the the control law (20) follows immediately from the the well definedness of the control law [START_REF] Khatib | Real-Time Obstacle Avoidance for Manipulators and Mobile Robots[END_REF] and thus from the proof of Proposition 2 in [4, Prop. 2] applied to µ + ε ∈ (0, 2/ √ 3). To show [START_REF] Poveda | A hybrid adaptive feedback law for robust obstacle avoidance and coordination in multiple vehicle systems[END_REF], using BΛ = b, control law [START_REF] Pomet | Explicit design of time-varying stabilizing control laws for a class of controllable systems without drift[END_REF] ensures that the closed-loop solution satisfies the estimate

1 2 d dt |x(t) -c p | 2 = x -c p , Ax + B ûkr (x, p) = x -c p , A s x + bν kr (x, p) = x -c p , A s x + x -c p , b ν kr (x, p) = x -c p , A s x + κ(|x| cp ; k r , h µδ 2 + δ µ ) -x -c p , A s x = κ(|x| cp ; k r , h µδ 2 + δ µ ). (22)
Thus, the result follows immediately from the definition of the function κ in [START_REF] Ngo | Integrator backstepping using barrier functions for systems with multiple state constraints[END_REF].

Remark 5. Equation ( 21) implies that for k r > 0 the distance |x(t) -x| is strictly increasing whenever |x(t) -x| < h µδ 2 , which is a useful property to establish robust avoidance. The margin ε > 0 is used to show robustness with respect to uncertainties in the state x.

V. A HYBRID CONTROL SOLUTION

In this section we combine the results from the previous sections to derive a hybrid control solution to Problem 1. To distinguish between sets and parameters derived for a specific obstacle centroid x ∈ {x 1 , . . . , xβ } we use • i and • i , i ∈ N β , for sets and parameters, respectively, in the following.

To account for multiple obstacles, we modify [START_REF] Hernández-Martínez | Convergence and Collision Avoidance in Formation Control: A Survey of the Artificial Potential Functions Approach[END_REF] as

c q := x|q| - q |q| δ µ |q| b |q| , q ∈ Z β \{0}. ( 23
)
Note that this requires an obvious modification of ( 19) and ( 20) where q replaces p and the parameters are with respect to each obstacle |q| ∈ N β .

A. Hybrid dynamics selection

To ensure global asymptotic stability of the origin for the closed loop, we need to patch the feedback laws u s (x) = K s (x) (the stabilizing controller), and ûkr (x, q) = K s (x) + Λ |q| ν kr (x, q), Λ |q| ∈ R m (the avoidance controller in ( 20)) for q ∈ Z β \{0}. Such a patching operation is done here using a hybrid switching strategy exploiting the h i -hysteresis margins between S i hi (δ i ) and S i (δ i ) and robustly extends the work [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF] to the multidimensional input and the multiple obstacle setting.

To suitably orchestrate the controller switching, we will use q ∈ Z β as a dynamic jump state responsible for whether solutions should evolve according to the stabilizing controller (q = 0) or slide above (q = i) or below (q = -i) the ith obstacle, i ∈ N β , when using the avoidance controller. Here, above and below is meant with respect to the orientation b i = BΛ i , i ∈ N β , used in the definition of the avoidance controller [START_REF] Pomet | Explicit design of time-varying stabilizing control laws for a class of controllable systems without drift[END_REF]. The control selection is summarized by the feedback law

u = γ(x, q) := u s (x), if q = 0, u s (x) + Λ |q| ν kr (x, q), if q ∈ Z β \{0} (24)
The overall idea of the controller is to modify the feedback law u s when solutions enter the shell S i (δ i ) corresponding to an obstacle centroid xi , i ∈ N β . We will assume that the intersection of arbitrary shells is empty, i.e., S i (δ i )∩S j (δ j ) = ∅ for all i, j ∈ N β , i = j. To ensure a robust switching between the local and global controllers, we exploit the h-hysteresis mechanism and orchestrate the switching of the logic variable q as follows:

q + ∈ G q (x, q), (x, q) ∈ ∪ q∈Z β D q ( 25
)
D +i := S i hi (δ i ) ∩ S / i +1 × {0}, i ∈ N β D -i := S i hi (δ i ) ∩ S / i -1 × {0}, i ∈ N β D 0 := R n \ ∪ i∈N β S i (δ i ) × (Z β \ {0}) G q (x, q) :=          i, if (x, q) ∈ D +i \ D -i , i ∈ N β -i, if (x, q) ∈ D -i \ D +i , i ∈ N β {i, -i}, if (x, q) ∈ D +i ∩ D -i , i ∈ N β 0, if (x, q) ∈ D 0 , (26)
where, according to the representation in Figure 4, the sets D +i and D -i , i ∈ N β , correspond to the upper and lower halves of the shell S i hi (δ i ). Note that these sets have a nonzero intersection, associated to the equator plane of the shell. To ensure suitable regularity properties of the jump map G q in (26), we perform a set-valued selection in D +i ∩ D -i , which allows for either q + = i or q + = -i. Note that this does not generate multiple simultaneous jumps because we impose q = 0 in the jump sets D +i ∪ D -i , so that, once a decision has been made about whether sliding above or below the shell, this decision cannot be changed.

(δ i ) ∩ S / i +1 ) × {0} and D -i = (S i h i (δ i ) ∩ S / i -1
) × {0}, respectively, in [START_REF] Rimon | Exact robot navigation using artificial potential functions[END_REF], for an arbitrary obstacle centroid xi , i ∈ N β .

In order to concisely represent the hybrid closed-loop dynamics define the set Ξ := R n × Z β , and the jump and flow sets, respectively, as

C := Ξ \ (∪ q∈Z β D q ), D := ∪ q∈Z β D q . ( 27
)
Define the combined plant and controller state ξ := (x, q) ∈ R n × Z β and from ( 1) and ( 24) the hybrid closed-loop dynamics are given by

ξ = ẋ q = Ax + Bγ(x, q) 0 , ξ ∈ C, (28)
ξ + = x + q + ∈ x G q (x, q) , ξ ∈ D. (29)
Note that the avoidance controller is a simple, algebraic controller requiring limited online computation and whose complexity does not increase as the plant dimension increases.

The selection above for the proposed jump sets has the important advantage that immediately after a jump the solution is in the interior of the flow set at a distance of at least min i∈N β (1 -h i )µ i δ i /2 from the jump set D. Thus, after each jump the solution starts flowing at a uniform distance from the jump set and the absence of Zeno phenomena follows from the desirable Lipschitz properties of the right-hand side.

Before our main results are given in Section VI, we note that the following structural regularity conditions of the dynamical system are satisfied, whose proof is straightforward and therefore omitted. The result ensures that system (24)-( 27) enjoys the regularity properties proven in [START_REF] Goebel | Hybrid Dynamical Systems: modeling, stability, and robustness[END_REF].

Lemma 2. The closed-loop dynamics ( 24)-( 27) satisfies the hybrid basic conditions in [10, Assumption 6.5] and all maximal solutions are complete.

B. Nominal GAS and local preservation

We now extend the global stability and avoidance results provided in [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF] to the multiple obstacle and multi dimensional input case. We provide quantitative information about maximal sizes δ * i of the shells S i (δ i ), such that the hybrid control solution in ( 24)-( 27) stabilizes the nominal system and avoids the obstacle centroids for any

δ i < δ * i , i ∈ N β . A trivial
corollary of our result is that regardless of all the parameters, there always exist small enough δ i , i ∈ N β , for which our goals are satisfied.

For the definition of δ * i , we need the following quantity

ζ := - 2|A s | λ max (A T s + A s ) > 0, (30)
which is positive due to Assumption 1(b), ensuring that A T s + A s is negative definite. Additionally we will assume that Λ i ∈ R m is defined such that |BΛ i | = 1 and xi / ∈ span(A -1 s BΛ i ), which can be done according to Assumption 1(c). Then, for each i ∈ N β , for a fixed η i ≤ η Λi (with η Λi defined in ( 5)), we define δ * i as

δ * i := 1 2 |x i |+η i +ζ-(|x i | + η i + ζ) 2 -4|x i |η i > 0, (31)
which is notably independent of µ i but depends on the orientation b i = BΛ i ∈ R n (through η i ), and is well characterized in the next lemma.

Λ ∈ R n \ {0} such that 0 < η ≤ η Λ := min y∈span(A -1 s BΛ) |x -y|, (32)
the scalar δ * in ( 31) is a positive real number, and for any value of δ satisfying δ < δ * , we have δ < η.

Proof. Since η, ζ > 0 and η < |x|, by expanding the squared terms, it is straightforward to verify the inequalities.

0 < (|x| -η + ζ) 2 < (|x| + η + ζ) 2 -4|x|η. ( 33
)
Taking the square root and adding 2η on both sides provides

|x| -η + ζ + 2η < (|x| + η + ζ) 2 -4|x|η + 2η.
Finally, moving the square root to the left leads to the estimate

2δ * = |x| + η + ζ -(|x| + η + ζ) 2 -4|x|η < 2η,
which shows the assertion δ * < η. The proof is complete since δ * ∈ R >0 follows from [START_REF] Teel | Uniting local and global controllers[END_REF], showing that the square root in (31) is positive.

With the selection of δ * i , i ∈ N β , in [START_REF] Sucan | The open motion planning library[END_REF] the following main theorem for the nominal system (1) can be shown. To simplify the statement of the main theorem, we collect the necessary parameters in the following lemma, which follows directly from the derivations so far and Assumption 1.

Lemma 4. For a set of obstacle centroids {x 1 , . . . , xβ } assume that Λ i ∈ R m is selected such that |BΛ i | = 1 and xi / ∈ span(A -1 s BΛ i ). Moreover let µ i ∈ (0, 2/ √
3) and h i ∈ (0, 1), i ∈ N β be given. Then, η i ∈ R >0 can be defined such that 0 < η i ≤ η Λi (see [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF] and ( 32)) for i = 1, . . . , β, and such that

int (B ηi (x i )) ∩ int B ηj (x j ) = ∅, ∀ i, j ∈ N β , i = j.
Additionally, with δ * i from [START_REF] Sucan | The open motion planning library[END_REF], it holds that min{δ * i , ηi 1+ζ } > 0 for all i ∈ N β , and any selection

δ i ∈ (0, min{δ * i , ηi 1+ζ }), i ∈ N β , (34)
defines a set of positive parameters.

In the following (Theorems 1, 2, and 3) we will show that for the i th obstacle a neighborhood B χi (x i ),

χ i := hi 2 µiδi 2 , (35)
can be avoided while simultaneously guaranteeing x(t) → 0 for t → ∞. Maximizing the size of the avoidance neighborhood is a reasonable goal to be able to place a possibly large obstacle inside of B χi (x i ), but χ i critically dependent on the system dynamics. The maximal neighborhood B χi (x i ) is associated to the largest δ i in [START_REF] Sucan | The open motion planning library[END_REF], which conservatively depends on η i (the distance to the induced equilibrium subspace E), the eigenvalues of A s (through ζ in ( 30)), and the distance of the avoidance centroid from the origin. Theorems 1, 2, and 3 prove that our construction solves Problem 1, because items (ii) and (iii) are explicitly proven, whereas the semiglobal preservation property in item (i) structurally follows from the fact that the jump sets D q can be made arbitrarily small by shrinking δ i .

Theorem 1. (Nominal avoidance and UGAS) Let Assumption 1 be satisfied and let the control parameters be defined according to Lemma 4. Then the hybrid controller ( 24)-( 27) with k r ≥ 0, guarantees the following properties: (i) (Nominal shell avoidance) For any initial condition ξ(0, 0)

∈ (R n \ ∪ i∈N β S i (δ i )) × Z β , all the arising solutions satisfy |x(t, j)| xi ≥ χ i = hi 2 µiδi 2 , ∀ i ∈ N β , ∀ (t, j) ∈ dom(ξ).
(ii) (Nominal centroid avoidance) For any initial condition ξ(0, 0) ∈ (R n \ ∪ i∈N β {x i }) × {0}, all the arising solutions satisfy x(t, j) / ∈ {x 1 , . . . , xβ } for all (t, j) ∈ dom(ξ). (iii) (Nominal UGAS) The origin ξ = (x, q) = (0, 0) is uniformly globally asymptotically stable.

Proof. Theorem 1 follows immediately from the more general statement of Theorem 2, which is its robust extension.

VI. ROBUSTNESS PROPTERTIES OF THE CONTROL LAW

While the hysteresis parameter h ∈ (0, 1) prevents instantaneous switching of the control law without leaving the jump set and thus ensures that the closed loop is well defined, the parameter does not immediately guarantee that the controller is robust with respect to model uncertainties. In this section we establish robustness of the proposed scheme for cases where the dynamics is affected by perturbations as in (1) with nonzero disturbances w x and w y . With respect to the closed loop ( 25) and ( 28) the perturbed dynamics lead to the model

ẋ = Ax + Bγ(y, q) + w x , [ y q ] ∈ C := Ξ \ D, (36) q + ∈ {i ∈ Z β : [ y q ] ∈ D i }, [ y q ] ∈ D := ∪ i∈Z β D i , (37)
where we assume that the only accessible quantities in the control decisions are q (the controller state) and y (the plant output). The trivial relations q = 0 and x + = x have been omitted for simplicity.

The perturbations B(γ(x + w y , q) -γ(x, q)) + w x in (36) can be summarized using a positive semidefinite function σ : R n → R ≥0 within the continuous dynamics

ξ = ẋ q ∈ Ax + Bγ(x, q) + B σ(x) 0 , ∀ξ ∈ C ρ , (38a)
extending [START_REF] Sanfelice | Robust supervisory control for uniting two output-feedback hybrid controllers with different objectives[END_REF] and where C ρ is defined as

C ρ = {(x, q) ∈ R n × Z β : {x + B ρ(x) } × {q} ∩ C = ∅}
for all x ∈ R n . The controller selection is influenced by the measurement error. Thus, with the definition of the function ρ : R n → R ≥0 the extension of the discrete dynamics ( 25) can be written as

ξ + = x + q + ∈ x {i ∈ Z β : ξ ∈ D ρ i } , ∀ ξ ∈ D ρ , (38b)
where

D ρ i = {(x, q) ∈ R n × Z β : {x + B ρ(x) } × {q} ∩ D i = ∅} (38c)
for all x ∈ R n , for all i ∈ Z β , and

D ρ = ∪ i∈Z β D ρ i .
The definition of the perturbed system (38) follows the exposition in [START_REF] Goebel | Hybrid Dynamical Systems: modeling, stability, and robustness[END_REF]. Since we are only interested in linear plants, the general presentation in [10, Def. 6.27] is simplified here. Definition 1. We say that the continuous functions σ, ρ : R n → R ≥0 form an admissible perturbation pair if ρ(x) > 0 for all x ∈ R n \ {x 1 , . . . , xβ } and σ(x) > 0 for all x ∈ R n \{0}.

The next lemma generalizes the result of Lemma 2 to the perturbed case. Its proof is given in Section VIII-A where an admissible pair is explicitly constructed. Lemma 5. For each continuous non-negative function σ, there exists a sufficiently small ρ where (σ, ρ) is an admissible perturbation pair such that the perturbed closed-loop dynamics (38) satisfies the hybrid basic conditions of [10, Assumption 6.5] and all maximal solutions are complete.

We present two robustness results extending Theorem 1. The first (Theorem 2) relates to robustness in the small (Srobustness) where we prove (robust) avoidance and UGAS of the origin. UGAS clearly implies forward invariance and then the perturbation σ must go to zero as the state x approaches zero. The second result (Theorem 3) relates to robustness in the large (L-robustness) where σ is pre-specified and not required to be zero at the origin, which implies that zero is not anymore an equilibrium for the perturbed dynamics and precludes proving asymptotic stability properties. The assumptions on σ and ρ in Lemma 5 extend the ideas of robust stability in [START_REF] Goebel | Hybrid Dynamical Systems: modeling, stability, and robustness[END_REF]Sec. 6.4] to robust avoidance (and stability).

Theorem 2. (S-robust avoidance and UGAS) Let Assumption 1 be satisfied and let the control parameters be chosen according to Lemma 4. Then the hybrid controller ( 24)-( 27) with robustness gain k r > 0, guarantees the existence of an admissible perturbation pair (σ, ρ) such that the perturbed dynamics (38) satisfy the following properties:

(i) (S-Robust shell avoidance) For any initial condition ξ(0, 0) ∈ (R n \ ∪ i∈N β S i (δ i )) × Z β , all the arising solutions satisfy

|x(t, j)| xi ≥ χ i = hi 2 µiδi 2 , ∀ i ∈ N β , ∀ (t, j) ∈ dom(ξ).
(ii) (S-Robust centroid avoidance) For any initial condition ξ(0, 0) ∈ (R n \ ∪ i∈N β {x i }) × {0}, all the arising solutions satisfy x(t, j) / ∈ {x 1 , . . . , xβ } for all (t, j) ∈ dom(ξ). (iii) (S-Robust UGAS) The origin ξ = (x, q) = (0, 0) is uniformly robustly globally asymptotically stable.

Theorem 2 is proven in Section IX-B. For k r = 0 and σ = ρ ≡ 0 Theorem 2 recovers Theorem 1. While Theorem 1 ensures UGAS and obstacle avoidance for the nominal system, robust obstacle avoidance can only be guaranteed with the additional consideration of the function κ defined in [START_REF] Ngo | Integrator backstepping using barrier functions for systems with multiple state constraints[END_REF] and a strictly positive robustness gain k r > 0. Note that Theorem 2 also provides a sufficient condition for the existence of stabilizing robust avoidance controllers with respect to (1) and Problem 1.

Theorem 2 only guarantees the existence of, possibly arbitrarily small, perturbation functions (σ, ρ). If a global bound c σ ∈ R on the size of perturbation σ is known, obstacle avoidance can still be guaranteed if k r is selected such that1

k r > 8c σ max i∈N β hiδiµi+4δµ i h 2 i µ 2 i δ 2 i . (39)
In particular, exploiting bound (39), the following result establishes robustness in the large, and is proven in Section VIII-B.

Theorem 3. (L-Robust avoidance) Let Assumption 1 be satisfied, let parameters be selected according to Lemma 4, and let c σ ≥ 0 be given. For any non-negative continuous perturbation function σ : R n → R ≥0 with σ(•) ∞ ≤ c σ , there exists a function ρ such that (σ, ρ) is an admissible perturbation pair, with the property that for any selection of k r (in [START_REF] Ngo | Integrator backstepping using barrier functions for systems with multiple state constraints[END_REF]) satisfying (39), the perturbed dynamics (38) satisfies the following properties: (i) (L-Robust Shell avoidance) For any initial condition ξ(0, 0)

∈ (R n \ ∪ i∈N β S i (δ i )) × Z β , all the arising solutions satisfy |x(t, j)| xi ≥ χ i = hi 2 µiδi 2 , ∀ i ∈ N β , ∀ (t, j) ∈ dom(ξ).
(ii) (L-Robust centroid avoidance) For any initial condition ξ(0, 0) ∈ (R n \ ∪ i∈N β {x i }) × {0}, all the arising solutions satisfy x(t, j) / ∈ {x 1 , . . . , xβ } for all (t, j) ∈ dom(ξ).

Theorem 3 states that obstacle avoidance is possible for arbitrarily large perturbations σ if the robustness gain parameter is selected sufficiently large. L-Robust UGAS, on the other hand, cannot be concluded due to the nontrivial perturbations caused by σ around the origin.

Note the key difference between Theorem 2 and Theorem 3 is that the former assumes a pre-specified robustness gain k r and constructs an admissible perturbation pair (σ, ρ), whereas the latter assumes the perturbation σ has been specified which then necessitates a lower bound on the robustness gain given by (39). In particular, in Theorem 2, the constructed σ satisfies σ(0) = 0 to guarantee the S-Robust UGAS property (see ( 56)).

VII. NUMERICAL EXAMPLES A. Closed-loop solutions of the avoidance controller

We first simulate the controller for the simple twodimensional system defined by

A = -1 -3 -2 4 , B = 1 0 -1 2 , ( 40
)
and three obstacles

x1 = [ 0 1 ] , x2 = -1 -1.5
and x3 = 1 -1 . Using pole placement, the stabilizing controller u s is defined such that eig(A + BK s ) = {-1 + i, -1 -i} and eig(A + A T ) = {-2, -2}, i.e., the origin of the closed-loop system is asymptotically stable and V (x) = |x| 2 is a Lyapunov function.

The vectors Λ * i (and thus the orientations b i ) are obtained by solving the optimization problems ( 9) for i = 1, 2, 3. Moreover, in accordance with Lemma 4, µ i = 1.15 < 2/ √ 3 and h i = 0.8 are used for all i ∈ N 3 for the definition of the shells S i (δ i ) and the inner shells S i hi (δ i ). Note that h i < 1 is only necessary to avoid Zeno behavior and in principle h i can be chosen arbitrarily close to 1 without affecting the avoidance and stabilizing properties of the controller. A selection of h i = 0.8 in the numerical simulations allows us to visually distinguish S i (δ i ) and S i hi (δ i ) in the following figures. With these definitions, η 1 = 1, η 2 = 1.8028 and η 3 = 1.4142 are obtained through the optimization problem [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF]. Since the η-balls of x1 and x2 are overlapping we restrict η 1 = 0.64, η 2 = 0.47 and η 3 = 1.4142 to satisfy Lemma 4. Equation [START_REF] Sontag | Nonlinear Feedback Stabilization Revisited[END_REF] provides the value ζ = 1.4142.

With the above definitions, δ * 1 = 0.22, δ * 2 = 0.24 and δ * 3 = 0.54 can be computed using [START_REF] Sucan | The open motion planning library[END_REF]. For the simulations we define δ i = 0.99δ * i , i ∈ N 3 . Hence, the radius of the avoidance neighborhoods for each point xi are given by ( 35) as χ 1 = 0.051, χ 2 = 0.055, and χ 3 = 0.124.

Additionally, the robustness gain parameter is set to k r = 2. The setting and 50 closed-loop solutions with initial values satisfying |x 0 | = 2 are visualized in Figure 5. As expected by the theoretical results, the controller ensures obstacle avoidance and asymptotic stability of the origin for the closed loop.

B. Impact of the robustness gain parameter k r

The impact of k r in the control law [START_REF] Pomet | Explicit design of time-varying stabilizing control laws for a class of controllable systems without drift[END_REF] through the function κ in ( 18) is visualized in Figure 6 around the obstacle centroid x3 for the previous example. Using k r = 0 (left) the closedloop solution keeps a constant distance from the center c q , q ∈ {-3, +3} defined in [START_REF] Prieur | Uniting local and global output feedback controllers[END_REF] until the shell is left. For k r > 0, the distance from c q , q ∈ {-3, 3} increases until the inner shell S h (δ) is left. As visualized in Figure 6 in the middle and right plots, the bigger the value k r , the stronger repulsive properties of the controller, pushing away from c q . Observe that, consistent with Theorem 3, the closed-loop solutions do not enter the avoidance neighborhoods Bχ i (x i ).

C. Perturbed systems

The robustness properties of the avoidance controller are illustrated by the numerical simulations in Figure 7. For the simulations the perturbed dynamics ẋ = Ax+γ(x, q)+w j (x), j ∈ {1, 2}, with

w 1 (x) = min 1, -0.45λ max (A s + A T s )|x| [ 1 0 ] (41)
(Figure 7, left) and

w 2 (x) = min 1, -0.45λ max (A s + A T s )|x| [ 0 1 ] (42)
(Figure 7, right) are used. The perturbations are bounded by 1, i.e., w 1 (x), w 2 (x) ∈ B cσ for c σ = 1. For |x| → 0 the perturbations vanish and the stabilizing control law, active in a neighborhood around the origin, can compensate for the perturbations. The robustness gain parameter is set to k r = 164.68 (satisfying condition (39) so that obstacle avoidance is guaranteed through Theorem 3). To show that our results do not rely on the knowledge of an optimal solution of (9), we have selected

Λ 1 = 1 1 2 , Λ 2 = 0 1 2 and Λ 3 = 1 √ 2 [1 1
] for the simulations in Figure 7 in contrast to Section VII-A where an optimal solution of (9) has been used.

D. A three dimensional example

Theorems 1, 2 and 3 are not restricted to the planar setting. They apply for any n ∈ N, n ≥ 2. To illustrate the controller for a three dimensional system we consider the dynamical system defined through

A = -1 1 2 -1 1 1 0 2 1 , B = 1 1 1 0 0 2 (43)
and three obstacles

x1 = 1 2 1 -1 2 , x2 = 3 2 1 0 and x3 = 0 -1 1 2
.

A stabilizer K s is obtained by solving the LQR-problem minimizing

∞ 0 |x(t)| 2 + 10|u(t)| 2 dt.
Since the columns of B only span a two dimensional subspace of R 3 the elements of the subspaces E Λ * i computed through the optimization problem [START_REF] Do | Control of Ships and Underwater Vehicles: Design for Underactuated and Nonlinear Marine Systems[END_REF] are not orthogonal to xi , i ∈ N 3 . For this setting η Λ * i = 1.2247, η Λ * i = 1.8021 and η Λ * i = 1.1180 are obtained through Equation ( 5) and δ * is given by δ * 1 = 0.2216, δ * 2 = 0.4205 and δ * 3 = 0.1897. The corresponding setting showing the η-balls and the inner shells S i hi (δ * i ) for h i = 0.8 and µ i = 1.15, i ∈ N 3 , are visualized in Figure 8. In the case of the perturbed dynamics (38), the selection of h i may impact the number of jumps (38b) in the closed-loop solution.

In Figure 9 three closed-loop solutions focusing on the avoidance of x2 are visualized. For the simulations the parameters δ 2 and h 2 are defined as δ 2 = 0.99δ * 2 and h 2 = 0.8. As pointed out in the theoretical results and numerically validated in Figure 9 the applicability of the avoidance controller as well as the numerical complexity in the controller design is independent of the dimension of the dynamical system (1).

VIII. PROOF OF OBSTACLE AVOIDANCE

In this section we provide a selection of ρ ensuring the robust obstacle avoidance properties of Theorems 2 and 3, together with the proof of those statements (namely items (i) and (ii) of both theorems). The robust GAS statement of Theorem 2 (iii) is proved in the Section IX.

A. Selection of ρ (and Proof of Lemma 5)

Based on the control parameters selected according to Lemma 4, we explicitly construct the perturbation function ρ : R n → R ≥0 . First, define cρ > 0 as

cρ = min i∈N β (1-hi)µiδi 4 , hiδiµi 4 , δi 2 2 √ 3 -µ i , δµ i 2 , δi-δi 2 (44)
and choose

c ρ ∈ [0, cρ ). (45)
Observe that c ρ is strictly positive since all the terms defining cρ are strictly positive.

For each i ∈ N β , based on the projection

Π i = (I -b i b T i ) (with b i = BΛ i , |b i | = 1), define ρ i (x) := max 1 2 | b i , x-xi , |, δ µi - δ 2 µi -|Π i (x-xi )| 2 ,
where s := max{s, 0} is the projection on R ≥0 , so that the square root is well defined globally. The function ρ i is continuous and positive everywhere outside xi . Indeed the second term is positive outside the one-dimensional set L i := {x i + αb i : α ∈ R}, while the first term is positive for all x ∈ L i \ {x i }. Finally, we define the function ρ as

ρ(x) := min c ρ , min i∈N β ρ i (x) , (46)
which is continuous and satisfies ρ(x) > 0 for all x ∈ R n \{x 1 , . . . , xβ } and ρ(x i ) = 0 for all i ∈ N β .

The role of the constant c ρ is to provide a maximum distance between the boundary of C (respectively D) and that of C ρ (respectively D ρ ). Indeed, from the definitions in (38), since ρ(x) ≤ c ρ for all x, we have

C ρ ⊂ C + (B cρ × {0}), D ρ ⊂ D + (B cρ × {0}). (47)
The shape of the inflated jump set D ρ +i , i ∈ N β , projected on the x-direction compared to the nominal set D +i is shown in Figure 10. Notice that the set is inflated in all directions, except for the point xi , as required by the definition of an admissible perturbation pair in Definition 1. Due to (47) and from the fact that η i > min{δ * i , ηi 1+ζ } = δi , we have, from the last term in (44), that

c ρ < 1 2 min i∈N β η i -δ i (48)
which implies

B ηi-cρ (x i )\B δi+cρ (x i ) = ∅, ∀i ∈ N β . (49)
In addition, as one may visually understand from Figure 10, with the definitions in (38c), due to the second-to-last bound in (44) and from the construction in (46), we have that

D ρ q = (D q + B cρ × {0})\B δµ i (x i ) × {0}, (50)
for all q = ±i ∈ Z β \{0}, thus ensuring |x| cq ≥ δ µi for all (x, q) ∈ D ρ q . Moreover, using the second bound in (44) and the inclusion in (47), we have that

|x| cq ≥ δ µi + 1 4 h i µ i δ i , (51)
for all x ∈ R n with (x, 0) ∈ C ρ and q |q| BΛ T |q| (x -x|q| ) ≥ 0. Before we use the bounds on ρ together with the properties (49) and (50) to prove Theorem 3, we conclude this section with a proof of Lemma 5. Proof of Lemma 5: All we need to show is that the avoidance controller is well defined (i.e., the denominator of ( 19) is nonzero) for all (x, q) ∈ C ρ with q ∈ Z β \ {0}. Based on the definition of the jump set and the flow set, and based on the considerations in (47), the avoidance controller can only be active in the inflated shells S i (δ i ) + B cρ , i ∈ N β . The third bound in (44) ensures that Proposition 3 is applicable with

c ρ = δi 2 ε, for i ∈ N β , (52)
or equivalently ε = 2 δi c ρ , which provides well posedness.

B. Proof of Theorem 3

First notice that, due to the requirement in (39), the repulsive gain k r is large enough to ensure

c σ ∈ 0, min i∈N β kr 8 h 2 i µ 2 i δ 2 i hiδiµi+4δµ i (53)
where c σ is a uniform upper bound for σ(•).

Proof of Item (i): For a solution ξ(•, •) of the hybrid system (38), the x-component x(•, •) will be denoted by solution x in the following. Consider ξ = (x, q) with x(0, 0) / ∈ ∪ i∈N β S i (δ i ). If q(0, 0) ∈ Z β \{0}, then from conditions (47) and the first bound in (44), the solution does not belong to D ρ and must jump to q + (0, 0) = 0. Therefore, let us consider without loss of generality that q(0, 0) = 0. Let i ∈ N β be arbitrary. From (49), we have that int((S i (δ i ) -B cρ ) \ (S i hi (δ i ) + B cρ )) = ∅, and using the second bound in (44), either the solution flows with

|x(t, 0)| xi ≥ h i µiδi 2 -c ρ (44) ≥ hi 2 δiµi
2 , ∀t ≥ 0 (which would prove the item), or otherwise it flows until some time (t 1 , 0) when it jumps. Due to the closedness of C ρ and D ρ , before the jump, we must have ξ(t 1 , 0) ∈ C ρ ∩ D ρ . At the jump time, the solution jumps to q(t 1 , 1) = q + (t 1 , 0) ∈ {-i, +i}, i ∈ N β . Without loss of generality, we consider hereafter the case q(t 1 , 1) = i.

After the jump, u switches to the avoidance controller ûkr (x, i) defined in [START_REF] Pomet | Explicit design of time-varying stabilizing control laws for a class of controllable systems without drift[END_REF] and due to the repelling properties of the avoidance controller [START_REF] Pomet | Explicit design of time-varying stabilizing control laws for a class of controllable systems without drift[END_REF]

, and by using |y| ≤ σ(x) ≤ c σ to denote a generic selection at the right-hand side of (38a), we obtain (omitting the dependence on (t, 1) for compactness)

1 2 d dt |x| 2 c+i = 1 2 d dt |x -c +i | 2 = x -c +i , Ax + y + B ûkr (x, q) = x -c +i , y + kr 2 (|x -c +i | -h i µiδi 2 -δ µi ) 2 ≥ -c σ ( hi 2 µiδi 2 + δ µi ) + kr 2 ( hi 2 µiδi 2 + δ µi -h i µiδi 2 -δ µi ) 2 = -cσ 4 (h i µ i δ i + 4δ µi ) + kr 2 ( hi 2 µiδi 2 ) 2 > 0, (54)
where we used the upper bound on c σ in (53). Hence, we conclude that |x(t, 1)| c+i ≥ hi If the solution jumps again to q + = 0, then, by definition of the jump set D ρ 0 in ( 25) and (38c), respectively, the solution x must be outside S i hi (δ i ) (due to the definition of the shell S i hi (δ i ) and the first bound in (44)) and the reasoning above can be repeated for the subsequent evolution, so that it is impossible for the solution x to enter the interior of S i h i 2 (δ i ), thus proving item (i). Proof of Item (ii): We consider two cases. Case (a): Let x(0, 0) ∈ R n \ ∪ i∈N β S i hi (δ i ) and q(0, 0) = 0.

Then the same arguments as in item (i) imply that |x(t, j)| xi ≥ hi 2 µiδi 2 , i.e., x(t, j) = xi for all (t, j) ∈ dom x for all i ∈ N β . Case (b): Let x(0, 0) ∈ S i hi (δ i ) \ {x i }, i ∈ N β arbitrary, and q(0, 0) = 0. Due to the definition of the jump sets it holds that ξ(0, 0) ⊂ D +i ∪ D -i ⊂ D ρ +i ∪ D ρ -i . Moreover, ξ(0, 0) / ∈ C ρ because of the first upper bound on c ρ in (44), together with (47). Then the solution immediately jumps to ξ(0, 1) = x(0,0) q(0,1) with q(0, 1) ∈ {-i, i}. We assume without loss of generality that x(0, 0) ∈ D ρ +i × {0}, which, using the inequality derived after (50), implies that |x(0, 1)| c+i ≥ δ µi . and q(0, 1) = i.

Proceeding similarly to the proof of item (i) (see, in particular, (54)), we show below that the solution remains bounded away from xi because it is at least δ µi distant from c +i . In particular, by using |y| ≤ σ(x) ≤ c σ to denote a generic selection at the right-hand side of (38a), consider any time (t, 1) ∈ dom(x) such that |x(t, 1)| c+i = δ µi and apply Proposition 3 (specifically ( 21)) to obtain (again omitting the dependence on (t, 1) for compactness)

1 2 d dt |x| 2 c+i = 1 2 d dt |x -c +i | 2 = x -c +i , Ax + y + B ûkr (x, q) = x -c +i , y + kr 2 (|x -c +i | -h i µiδi 2 -δ µi ) 2 ≥ -c σ |x -c pi | + kr 2 (h i µiδi 2 ) 2 = -c σ δ µi + kr 2 (h i µiδi 2 ) 2 ≥ -cσ 4 (h i µ i δ i + 4δ µi ) + kr 2 ( hi 2 µiδi 2 ) 2 > 0, (55)
where, similar to (54), the last step follows from the upper bound on c σ in (53). Note that Proposition 3 is applicable due to the considerations in (52). Due to the strict inequality in (55), it must hold that |x(t, 1)| c+i > δ µi for all (t, 1) ∈ dom(x), t > 0, which particularly implies that x(t, 1) = xi for all t ≥ 0 with (t, 1) ∈ dom(x), because x(0, 0) = xi by assumption. By definition of the jump set D ρ 0 in [START_REF] Rimon | Exact robot navigation using artificial potential functions[END_REF], the solution will jump again (to q + = 0) only when its x component is outside S i hi (δ i ), and then the analysis carried out in case (a) applies.

IX. PROOF OF ROBUST GAS

The conditions on the perturbation σ imposed in the previous section were too mild to allow proving the robust GAS property stated in Theorem 2 item (iii). We provide here a specific feasible selection of σ that, together with the selection of ρ given in Section VIII-A, ensures robust GAS in the small. Robust obstacle avoidance in the small trivially follows from the stronger results established in the previous section.

for a constant c σ ≥ 0, which is constrained to belong to the following intervals:

c σ ∈ 0, min |A -1 s | -1 c ρ , -1 4 λ max (A s + A T s ) (57a) c σ ∈ 0, 2|A s | 2 • min i∈N β ζ -1 (ηi-δi-2cρ-(δi+cρ)ζ) (ηi-δi-2cρ)(2|As|-λmax(As+A T s )) (57b)
S i (δi)

B δ i (xi) Bη i (xi)
x(t0, j0)

x(tin, j0)

x(tout, j1)

x(t1, j1) Fig. 11. The intuition behind the two statements of Proposition 4 and the hybrid times (t 0 , j 0 ) ≤ (t in , j 0 ) ≤ (tout, j 1 ) ≤ (t 1 , j 1 ), characterized in its statement and its proof.

where the interval in (57a) is nonempty because of Assumption 1(b) ensuring that λ max (A s + A T s ) < 0, and where the interval in (57b) is shown to be non-empty in Claim 1 below.

The left bound in (57a) is used in Proposition 4 below to prove a wipeout property generalizing Proposition 1. The right bound in (57a) is used to prove asymptotic stability in the proof of Theorem 2 in Section IX-B. The upper bound in (57b) is necessary to prove positivity of the decrease ε characterized in the next proposition, generalizing our nominal results reported in [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF]Prop. 3] to the robust setting. Proposition 4. Let Assumption 1 hold and let the parameters of the hybrid system (38) be selected according to Lemma 4. Let the perturbation functions (σ, ρ), defined in (46), (56), satisfy conditions (45) and (57). Then the following properties hold for all solutions ξ(•, •) starting at ξ 0 .

(i) (Wipeout property) Let ξ 0 ∈ B δi+cρ (x i ) × Z β for i ∈ N β arbitrary. Then there exists a time (t * , j * ) ∈ dom(ξ) such that either ξ(t * , j * ) ∈ ∂B ηi-cρ (x i ) × Z β or ξ(t, j) / ∈ B δi+cρ (x i ) × Z β for all (t, j) ≥ (t * , j * ).

(ii) (Decrease property) Let ξ 0 ∈ R n \∪ i∈N β (S i (δ i )+B cρ )× Z β . Additionally, consider any four times in the domain of ξ(•, •), such that (t 0 , j 0 ) ≤ (t in , j 0 ) ≤ (t out , j 1 ) ≤ (t 1 , j 1 ), and (58)

ξ(t 0 , j 0 ), ξ(t 1 , j 1 ) ∈ ∂B ηi-cρ (x i ) × {0}, ξ(t in , j 0 ), ξ(t out , j 1 ) ∈ ∂B δi+cρ (x i ) × {0}. ( 59
)
for i ∈ N β , arbitrary. Then either

|x(t 1 , j 1 )|< min z∈S i (δi) |z|-c ρ or |x(t 1 , j 1 )| ≤ |x(t 0 , j 0 )|-ε (60)
for some ε > 0, is satisfied.

Before we prove Proposition 4, the following claim illustrates why conditions (34), (45) and (57) are needed, and provides the selection of a positive ε in (60).

= -(δ i + c ρ ) + ζ -1 (η i -δ i -2c ρ ) -c σ (ηi-δi-2cρ)(2|As|-λmax(As+A T s )) 2|As|(|As|+cσ)
.

(61)

Then the interval (57b) is non-empty and ε > 0 for all c σ in the interval defined through (57b).

Proof. According to (44), c ρ satisfies the condition

2+ζ 1+ζ c ρ < 2c ρ < ηi 1+ζ -δ i , which implies (2 + ζ)c ρ < η i -(1 + ζ)δ i . Since ζ is positive, rearranging we get 0 < ζ -1 (η i -δ i -2c ρ -(δ i + c ρ )ζ) = -(δ i + c ρ ) + ζ -1 (η i -δ i -2c ρ ). (62)
According to (48) and Assumption 1(b),

0 < (η i -δ i -2c ρ )(2|A s | -λ max (A s + A T s )) 2|A s |(|A s | + c σ ) (63)
≤ (η i -δ i -2c ρ )(2|A s | -λ max (A s + A T s )) 2|A s | 2 (64)
for all c σ ≥ 0.

Combining estimate (62) and (63) shows that ε > 0 for c σ small enough. The condition c σ small enough is characterized by the interval (57b), obtained by combining (62) and (64).

Proof of Proposition 4:

Proof of item (i): Let us consider a solution ξ(•, •), whose x-component x(•, •) starts in B δi+cρ (x i ) for i ∈ N β arbitrary. Two cases may happen: either the solution x reaches ∂B ηi-cρ (x i ) in finite time, or it never reaches it. In the first case the item is proven. In the second case, solution x must remain in the interior of B ηi-cρ (x i ) for all times (t, j) ∈ dom(x). Therefore, according to the definition of γ in [START_REF] Rawlings | Model Predictive Control: Theory, Computation, and Design[END_REF], the directional derivative of function H(x), defined in Proposition 1, in the direction of the flow map in (38a), can be written as Ḣ := ∇H, Ax + Bγ(x, q) + y = ∇H, A s x + BΛν + y for some y ∈ B σ and some ν ∈ R. We may then apply Proposition 1 to conclude the robust wipeout properties, which follow from the left upper bound in (57a) that implies

|A -1 s y| ≤ |A -1 s |c σ ≤ c ρ , x ∈ B ηi-cρ (x i ) ⇒ Ḣ = ∇H, A s (x + A -1 s y) + BΛν ≥ 0, x ∈ B η-cρ (x i ) ⇒ Ḣ = ∇H, A s (x + A -1 s y) + BΛν ≥ h, (65)
for any η ∈ [c ρ , η i ), where h > 0 depends on η.

Observe now that δ i + c ρ < η Λi -c ρ , i ∈ N β , from the upper bound on c ρ in (48), and select η in (65) as the average of these two values, namely η = 1 2 (δ i + η Λi ), which satisfies

δ i + c ρ < η < η Λi -c ρ . (66)
(x i ) \ (S i (δ i ) + B cρ ) if q(t, j) = 0.
Let us now split the proof in two cases: Case (a): For some (t * , j * ) ∈ dom(ξ) satisfying (t 0 , j 0 ) ≤ (t * , j * ) ≤ (t 1 , j 1 ) we have |x(t * , j * )| < min z∈S i (δi) |z| -c ρ (> 0 according to (44) and from the assumption in ( 34)). Since from Assumption 1(b) the norm is contractive along flows with q = 0, the solution x satisfies |x(t, j)| ≤ |x(t * , j * )| < min z∈S i (δi) |z| -c ρ for all (t, j) ≥ (t * , j * ), which also includes (t 1 , j 1 ), and the proof is complete.

Case (b): For all (t, j) ∈ dom(ξ) satisfying (t 0 , j 0 ) ≤ (t, j) ≤ (t 1 , j 1 ) we have

|x(t, j)| ≥ min z∈S i (δi) |z| -c ρ ≥ |x i | -δ i -c ρ , (67)
where we used Lemma 1 in the last inequality. In this second case we will prove that |x(t 1 , j 1 )| ≤ |x(t 0 , j 0 )| -ε, where ε is defined based on (61). In particular, due to the stated assumptions, the solution x must go through three phases characterized by the four hybrid times in (58), and corresponding to: 1) flow from x(t 0 , j 0 ) ∈ ∂B ηi-cρ (x i ) to x(t in , j 0 ) ∈ ∂B δi+cρ (x i ), 2) hit the boundary ∂B δi+cρ (x i ) at time (t in , j 0 ) and reach x(t out , j 1 ) ∈ ∂B δi+cρ (x i ) again after some finite time, 3) flow from x(t out , j 1 ) ∈ ∂B δi+cρ (x i ) to x(t 1 , j 1 ) ∈ ∂B ηi-cρ (x i ).

We show below that the increase of |x| over phase 2 is compensated by a suitable decrease in phases 1 and 3, adding up to a net decrease of -2ε, with ε > 0 defined in (61). Phase 2. It holds that min

z∈B δ i +cρ (xi) |z| = |x i | -δ i -c ρ and max z∈B δ i +cρ (xi) |z| = |x i | + δ i + c ρ ,
therefore we obtain the estimate

|x(t out , j 1 )| -|x(t in , j 0 )| ≤ |x i | + δ i + c ρ -(|x i | -δ i -c ρ ) = 2(δ i + c ρ ). (68)
Phases 1 and 3. We will only address phase 1 because parallel arguments apply to phase 3. Since x(t, j) flows within B ηi-cρ (x i ) \ B δi+cρ (x i ) for all (t, j) satisfying (t 0 , j 0 ) ≤ (t, j) < (t in , j 0 ), then q(t, j) = 0 for all such (t, j) and the following inequality holds, where we use y ∈ B σ(x) to denote an arbitrary selection in the right-hand side of (38a):

| ẋ(t, j)| ≤ |A s x(t, j)| + |y| ≤ |A s ||x(t, j)| + |σ(x(t, j))| ≤ (|A s | + c σ )|x(t, j)| ≤ (|A s | + c σ )(|x i | + η i -c ρ ), (69)
where we used the expression for γ in [START_REF] Rawlings | Model Predictive Control: Theory, Computation, and Design[END_REF] and the bound (56) on σ, in addition to the fact that x(t, j) ∈ B ηi-cρ (x i ). Using |x(t in , j 0 ) -x(t 0 , j 0 )| ≥ η i -δ i -2c ρ (which holds because of the distance between ∂B ηi-cρ (x i ) and ∂B δi+cρ (x i ), and is positive due to (48)), it the mean value theorem implies x(t, j) T (A s x(t, j) + y) + (A s x(t, j) + y) T x(t, j) 2|x(t, j)| = x(t, j) T (A s + A T s )x(t, j) + 2y

t in -t 0 ≥ η i -δ i -2c ρ (|A s | + c σ )(|x i | + η i -c ρ ) . ( 70
≤ ( λ + 2c σ )(η i -δ i ) 2(|A s | + c σ ) = λ(η i -δ i ) 2(|A s | + c σ ) + 2c σ (η i -δ i ) 2(|A s | + c σ ) = λ(η i -δ i ) 2|A s | - c σ λ(η i -δ i ) 2|A s |(|A s | + c σ ) + 2c σ (η i -δ i ) 2(|A s | + c σ ) = -ζ -1 (η i -δ i ) + c σ (η i -δ i )(2|A s | -λ) 2|A s |(|A s | + c σ ) (72)
which is a lower bound on the decrease in phase 1 and 3, and ζ was defined in [START_REF] Sontag | Nonlinear Feedback Stabilization Revisited[END_REF]. Combining the increase and decrease bounds established in ( 68) and (72), we get

B. Proof of Theorem 2

Items (i) and (ii) of Theorem 2 hold from the proof of Theorem 3 given in Section VIII-B, which were proven under less restrictive assumptions on the perturbation σ. Proof of Item (iii): To prove uniform global asymptotic stability (UGAS) of the origin, we exploit the fact, established in Lemma 5, that the closed loop satisfies the hybrid basic conditions of [START_REF] Goebel | Hybrid Dynamical Systems: modeling, stability, and robustness[END_REF]As. 6.5] and all maximal solutions are complete. Then, using [START_REF] Goebel | Hybrid Dynamical Systems: modeling, stability, and robustness[END_REF]Thm. 7.12], it is sufficient to prove (local) Lyapunov stability and global (not necessarily uniform) convergence to the origin, to obtain uniform global asymptotic stability. The two properties are proven below.

Local Stability: We first observe that η Λi defined in (5) satisfies η Λi ≤ |x i | for all i ∈ N β , because y = 0 trivially belongs to E Λi in (3). Moreover, from Lemma 3 we have δ i + c ρ < η i ≤ η Λi , whose strict inequality, together with the inclusion S i (δ i ) ⊂ B δi (x i ), (see (48)) established in Lemma 1, implies that 0 / ∈ S i (δ i )+B cρ for all i ∈ N β . As a consequence, there exists an r > 0, such that B r ∩ (∪ i∈N β S i (δ i ) + B cρ ) = ∅. Moreover, for any initial state ξ ∈ B r × Z β the xand qcomponents satisfy the following properties. If q(0, 0) = 0, the dynamics will jump immediately to q(0, 1) = 0 (due to the definition of D ρ 0 ) and the x-component satisfies x + = x across any jump. Thus, either after the first jump, or immediately, the solution ξ(t, j) belongs to the interior of C (and in particular to the interior of C ρ \D ρ ). In addition to ξ(t, j) ∈ B r × {0}, let y ∈ B σ(x) ⊂ B cσ|x| , then using the estimate derived in ( 71

for all |x(t, j)| = 0, which follows from Assumption 1(b) together with the assumption on c σ ≤ -1 2 λ max (A s + A T s ) in (57a). This implies that ξ(t, j) flows forever in the forward invariant set B r ×{0}. (Local asymptotic) stability then follows from estimate (73) as well.

Global Convergence: Consider any solution ξ = (x, q), and based on the two possibilities in Proposition 4(i) we break the analysis in two cases. Case (a): The solution never reaches ∂B ηi-cρ (x i ) for i ∈ N β arbitrary. In this case, from Proposition 4(i) the solution remains in the stabilizing mode (i.e., u = u s and q = 0) on its tail. Then, it converges asymptotically to the origin due to the inequalities in (73) established for the perturbed dynamics ẋ ∈ A s x + B σ(x) . Case (b): The solution reaches ∂B ηi-cρ (x i ), i ∈ N β , at some time (t 0 , j 0 ). In this second case, either there exists a finite time after which the solution does not evolve using the avoidance controller (i.e., using u = γ(x, q) and with q = 0) anymore because the first inequality in (60) is satisfied (and the analysis of case (a) applies), or there exists a sequence of times (t k , j k ), k ∈ N satisfying |x(t k+1 , j k+1 )| ≤ |x(t k , j k )| -ε, according to the second inequality in (60), which leads to a contradiction.

X. CONCLUSIONS

This paper proposes a constructive controller design method for linear systems subject to bounded state constraints. In particular a hybrid control law is introduced which robustly globally stabilizes the origin and guarantees robust obstacle avoidance, where obstacles are described through shells around isolated centroids in the state space.

While the paper provides a rigorous answer to the control problem motivated in Section II, the controller design methodology appears to be promising for more general control tasks and thus immediately opens up future research directions. In this regard, we will investigate the hybrid controller design method for more general nonlinear system dynamics and extend the results accordingly. A second research direction concerns the maximal obstacles size. Even though we are able to constructively compute a maximal domain around each centroid, which can be avoided by the closed loop, its size may be conservative, and numerical simulations suggest that obstacle avoidance and robust GAS could be guaranteed for larger obstacles using the proposed control law.

Fig. 1 .

 1 Fig. 1. Restrictions arising from drift Ax (blue arrows) and the limited control directions B (red arrow). Reaching the target • from initial condition x while avoiding the black obstacle is not possible.

Fig. 2 .

 2 Fig. 2. The construction of the eye-shaped shell S(δ) around an obstacle centroid x, based on the size δ ∈ R >0 the aspect ratio µ ∈ (0, 2) and the orientation b ∈ R n \{0}.

Proposition 2 .

 2 [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF] Prop. 2]) Let µ ∈ (0, 2/ √ 3), δ > 0 and Λ ∈ R m with |b| = |BΛ| = 1 be given. For each p ∈ {-1, 1} and any point x 0 ∈ S(δ), the avoidance controller

Fig. 3 .

 3 Fig. 3. The shrunken shell S h (δ) and the half shells S / +1 and S / -1 considered in Proposition 2.

  and h ∈ (0, 1) be given. For each p ∈ {-1, +1} and any point x ∈ S(δ) + B δε 2 the avoidance controller ûkr (x, p) = K s x + Λν kr (x, p)

Fig. 4 .

 4 Fig. 4. The upper and lower half-shells associated to D +i = (S i h i

Lemma 3 .

 3 [START_REF] Braun | Unsafe point avoidance in linear state feedback[END_REF] Lemma 4]) Let x ∈ {x 1 , . . . , xβ } be an arbitrary obstacle centroid. Under Assumption 1, for a given

Fig. 5 . 4 Fig. 6 .

 546 Fig. 5. (Example VII-A; Setting & closed-loop solutions) Visualization of the setting for the obstacle centroids x1 , x2 , x3 . The shells S i (δ i ) (blue) and S i h i (δ i ) (cyan), the η i -balls (green) and the subspaces E i (red) are shown. The balls Bχ i (x i ) for which avoidance is guaranteed are depicted in red. Additionally, 50 closed-loop solutions avoiding a pre-specified neighborhood around the obstacle centroids x1 , x2 , x3 , and converging to the origin are shown. For two solutions highlighted in blue and red the input u(t) and the jump state q(t) are visualized on the right.

Fig. 7 .

 7 Fig. 7. (Example VII-C) Closed-loop solutions for the perturbed system dynamics w 1 (left) and w 2 (right) defined in (41) and (42), respectively.Observe that, consistent with Theorem 3, the closed-loop solutions do not enter the avoidance neighborhoods Bχ i (x i ).

Fig. 8 .

 8 Fig. 8. (Example VII-D) Visualization of the shells S i h i (δ *i ) (blue), the η iballs (yellow) and the subspaces E i (green) for i = 1, 2, 3.

Fig. 9 .

 9 Fig. 9. (Example VII-D) Closed-loop solutions of the avoidance controller for a three dimensional example focusing on the obstacle centroid x2 . Depending on the initial state, the obstacle is passed by sliding along the surface of the upper or lower shell (with respect to the orientation b).

Fig. 10 .

 10 Fig. 10. Projection on the x-direction of the inflated set D ρ +i , i ∈ N β , as compared to the nominal set D +i . With a slight abuse of notation, the projections are labeled with the names of the extended sets in the figure.

2 µiδi 2 + 2 µiδi 2

 2222 δ µi for all (t, 1) ∈ dom(x), and thus |x(t, 1)| xi ≥ hi is satisfied.

A.

  Selection of perturbation σ and wipeout property Define σ as σ(x) := min{c σ , c σ |x|},

Claim 1 .

 1 (Selection of ε) Under Assumptions 1 and under parameter selection according to Lemma 4, if conditions (45) hold, consider the selection ε

)

  Consider now the following upper bound of the decrease rate of the norm, where we use again y ∈ B σ(x) to denote an arbitrary selection in the right-hand side of (38a):˙ |x(t, j)| = d dt |x(t, j)| 2

=

  )|-|x(t 0 , j 0 )| ≤ 1 2 (t in -t 0 )(λ max (A s +A T s ) + 2c σ )(|x i | + η i -c ρ ).Due to Assumption 1(b), and from the upper bound on c σ in (57a), the right-hand side is negative. Thus, we can use (70) to estimate the decrease (we use the notations δ i := δ i + 2c ρ and λ := λ max (A s + A T s ) < 0 to shorten the expressions)|x(t in , j 0 )|-|x(t 0 , j 0 )| ≤ 1 2 (t in -t 0 )( λ + 2c σ )(|x i | + η i -c ρ ) ≤ ( λ + 2c σ )(|x i | + η i -c ρ )(η i -δ i ) 2(|A s | + c σ )(|x i | + η i -c ρ )

|x(t 1

 1 , j 1 )| -|x(t 0 , j 0 )| = |x(t 1 , j 1 )| -|x(t out , j 1 )| + |x(t out , j 1 )| -|x(t in , j 0 )| + |x(t in , j 0 )| -|x(t 0 , j 0 )| ≤ 2(δ i + c ρ ) -2ζ -1 (η i -δ i ) + 2c σ (ηi-δi)(2|As|-λ) 2|As|(|As|+cσ) = -2ε,where ε, defined in (61), is positive from Claim 1.

  established in Proposition 3, we show below that the solution cannot flow closer than +δ µi to c +i . To show this, first notice that immediately after the jump, since x(t 1 , 0) ∈ C ρ , from (51), |x(t 1 , 1)| c+i = |x(t 1 , 0)| c+i ≥ hi

	hi	µiδi
	2	2 2	µiδi 2 + δ µi is satisfied.
		Consider now any (t, 1) ∈ dom(x) such that |x(t, 1)| c+i =
	hi 2	µiδi 2 + δ µi . We claim that d dt |x(t, 1)| c+i > 0. Indeed, from

  such that each time solution x enters B δi+cρ (x i ), it spends T * ordinary time flowing in B η (x i ). Finally, completeness of solutions established in Lemma 2 implies that the solution spends an arbitrarily large amount of time in B η (x i ) and (65) implies that H grows unbounded, thus establishing a contradiction because H is bounded in B δi+cρ (x i ). Proof of item (ii): Consider any such solution ξ(•, •) and first notice that due to the expression in[START_REF] Sanfelice | Robust hybrid controllers for continuous-time systems with applications to obstacle avoidance and regulation to disconnected set of points[END_REF] of the flow set, the solution x can only flow in B ηi-cρ

(See Lemma 4 for the definition of η Λi .) Since solution x remains in the interior of B ηi-cρ (x i ) for all times, then the upper condition in (65) implies that H is non-decreasing along this solution. Assume now, by contradiction, that solution x keeps revisiting B δi+cρ (x i ) for (t, j) → ∞. Since B δi+cρ (x i ) is a proper subset of B η (x i ) from (66), and since ẋ is uniformly bounded in the compact set B ηi-cρ (x i ) then there exits T * > 0

  (λ max (A s + A T s ) + 2c σ )(|x i | + η i -c ρ ), which is well defined because |x(t, j)| ≥ |x i | -δ i -c ρ > 0 according to (67) and where we used |y| ≤ c σ |x| from (56). Integrating both sides provides the estimate |x(t in , j 0

				T x(t, j)
		2|x(t, j)|
	≤	λ max (A s + A T s ) 2|x(t, j)|	|x(t, j)| 2 +	2c σ |x(t, j)| 2 2|x(t, j)|	(71)
	≤ 1 2

It is emphasized that property (39) is only necessary in the neighborhood of xi , i ∈ N β , where the robust avoidance controller (20) is active.

P. Braun and C. M. Kellett are supported by the Australian Research Council (Grant number: ARC-DP160102138. L. Zaccarian is partially supported by the outgoing mobility program "Mobilité sortante seule" of the Institut National des Sciences Appliquées of Toulouse, France.

The research is supported in part by the Agence Nationale de la Recherche (ANR) via grant "Hybrid And Networked Dynamical sYstems" (HANDY), number ANR-18-CE40-0010.

A preliminary version of the paper was presented at the 57th IEEE Conference on Decision and Control [4].