Abstract
Although soft robots show safer interactions with their environment than traditional robots, soft mechanisms and actuators still have significant potential for damage or degradation particularly during unmodeled contact. This article introduces a feedback strategy for safe soft actuator operation during control of a soft robot. To do so, a supervisory controller monitors actuator state and dynamically saturates control inputs to avoid conditions that could lead to physical damage. We prove that, under certain conditions, the supervisory controller is stable and verifiably safe. We then demonstrate completely onboard operation of the supervisory controller using a soft thermally actuated robot limb with embedded shape memory alloy actuators and sensing. Tests performed with the supervisor verify its theoretical properties and show stabilization of the robot limb's pose in free space. Finally, experiments show that our approach prevents overheating during contact, including environmental constraints and human touch, or when infeasible motions are commanded. This supervisory controller, and its ability to be executed with completely onboard sensing, has the potential to make soft robot actuators reliable enough for practical use.
Introduction
One of the most prevalent claims about soft robots is their intrinsic safety when interacting with humans or the environment.1,2 Less commonly discussed are new challenges in safety introduced by the novel soft actuators 3 required for generating motion. For rigid robots, typical electromagnetic actuators (motors) are of little concern in comparison to the robot body's inertia in damaging its surroundings or causing injury.4,5 In contrast, soft actuators can fail dramatically, as practitioners may recognize. Informally, pneumatic balloons can pop, 6 thermal actuators can overheat and cause fire risks or burns to human skin, 7 and dielectrics can cause dangerous arcing,8,9 among others. As of yet, these risks have been mitigated by simple bespoke system designs, hard limits on actuation input, 10 or open-loop actuation.11,12 Incorporating automatic control into soft robots demands more generalizable and robust approaches to actuator safety.
This article proposes a feedback control framework that ensures safety of a class of soft robot actuators. The framework employs a model-based supervisor that works in tandem with a user's arbitrary nominal controller (Fig. 1e–g). We demonstrate our framework on a thermal shape memory alloy (SMA) actuator with two different nominal controllers in the presence of environmental contact (Fig. 1a–d). This task presents a generalizable challenge as the cause of failure, excess heat, can only be indirectly monitored and controlled.

When feedback controllers for soft robots encounter unmodeled physical interactions, such as with the environment or humans, the resulting contact loads or kinematic constraints can cause damage to the robots themselves
Specifically, this article contributes:
A provably safe, provably stable supervisory controller for soft robot actuators modeled as affine systems. A provably safe integration of the supervisor with any underlying nominal controller. A verification of the framework on a soft robot limb, maintaining safe actuator states, in an otherwise dangerous task.
Background: robot safety
Reliable use of robots in practical settings requires maintaining safe operation and consistent performance throughout their life span, regardless of environmental contact or human interaction.4,5 The informal concept of “safety” as limiting force or position13–15 is well suited for soft robots since mechanical conformability to contacting surfaces naturally restricts motions. 16 Even when such limits are exceeded, some soft polymers can self-heal when mechanically damaged and recover their material properties.6,9 However, most soft robots rely on mechanism design for safety,17–20 and there are only few examples of computational intelligence for verifiable behaviors. 21
In contrast, a formal specification of “safety” is a set inclusion problem, where if a robot's state remains within a certain set for all time, then it is considered safe: the set is invariant under the system's dynamics. 22 Computational techniques such as control barrier functions, 23 model-predictive control, 24 and formal methods 25 use this framework for safety verification. However, each approach comes with computation and implementation challenges, particularly the requirement of an accurate low-dimensional dynamics model, which is a longstanding challenge in soft robotics.
Soft actuator safety and degradation
The unique material properties of actuators used in soft robotics introduce additional safety challenges: catastrophic pressure failures, high temperatures and fire, or high-voltage arcing. As of yet, these dangers have been indirectly addressed by reducing actuation force 26 or by introducing design modifications. 27 Feedback control has also only indirectly addressed actuator safety, using approaches such as low impedance 28 without verification, open-loop planning29,30 only in known environments, or optimization-based control with only state constraints. 31
For thermal actuators in particular, prior work in safety has focused on sensing intrinsic actuator states (i.e., temperature) via inverting a constitutive model32,33 and applying a fixed threshold,10,34–36 but these have not shown environmental contact 7 or formal verification. In addition to physical safety, SMA actuators in particular are known to suffer from degradation due to thermal and mechanical cycling,17,37–39 which when viewed as a temperature constraint 40 can also be formulated as a safe control problem.
Approach and applicability
Our framework considers dynamic saturation as a form of supervisory control, motivated by prior work that uses reachability computations to determine “activation” of a supervisor. 41 The proposed framework is a simplistic version of the formal supervisory controller framework42–44 with only a single switching state.
Although our proposed approach makes a number of assumptions about the robot's actuator dynamics, as are relevant to the use of SMA wires in our application case, it may be generalizable among a wider class of soft actuators. This article assumes one internal state and one control input per actuator, that the actuator states are independent, and that actuator dynamics are an affine system. 30 Other soft actuators may also be modeled by a single parameter, such as piston displacement in pneumatic or hydraulic actuators,45,46 or cable retraction for cable-driven soft robots.47–49 All these soft actuators are also monotonic control systems, in that state varies monotonically with input, a key insight for our safety verification. And, many soft actuation methods obey linear or affine dynamics, including motors for cables 47 or internal state for twisted-and-coiled actuators. 50 For nonlinear soft actuators, our supervisor may be applied via local linearizations, which produces affine dynamics when calculated around nonequilibrium points. 31 This article includes a study of our controller's tuning parameter to assist in its application conservatively to such linearizations.
Supervisory Control for a Soft Robotic Actuator
To derive our supervisory controller, we first formulate the model of our system and derive a simple but low-performance static input bound for safety. We then address these limitations by presenting a dynamic saturation condition, combining that saturation with a nominal controller, and finally verifying safety of the composed closed-loop system.
System model
The physical states of our representative soft robot, powered by SMAs, include the robot body's bending curvature and the actuators temperatures, described later in the Robot and Actuator Model and Calibration section. For a formulation that is generally applicable to soft actuators of all kinds, we abstract these states into
. The system's inputs are
where the safety-critical actuator states influence the non-safety-critical states via
Our supervisory control system does not require knowledge of the non-safety-critical dynamics
In addition, we assume that each actuator dynamics function
as motivated by local linearizations around nonequilibrium points, which produce affine dynamics. 31 These affine differential equations also arise from heating of thermal actuators. 30
Dropping the i indexing, we consider each actuator's dynamics individually, as verified safety per-actuator will then verify the whole system. We can use the affine augmentation
to rewrite Equation (3) as
where
The dynamics for each actuator, Equation (4), are a linear single-input system, and we therefore can use linear system control techniques for the actuator itself despite the presumably nonlinear body dynamics
Static bounds on control input are impractical for safety
Our problem statement considers a safety-critical constraint on the actuator state of the form
. We formally define safety as maintaining the actuator state below this limit,
From the physical intuition of our actuator, one concept for meeting this safety specification is a simple bound on the control input. Mathematically, applying an upper bound of a fixed static input of
Observe next that the actuator dynamics in Equation (3) is a monotone control system,
51
that is, for two different inputs u1 and u2 applied at the same known state w, dropping time index for brevity,
In other words, our actuator's state has a lower value if we apply less input: less electrical power applied to our thermal muscles means lower temperature. Section 1 in the Supplementary Information S1 formally shows monotonicity.
An initial concept for safety via saturation might therefore choose
Our initial attempt using this method underperformed so dramatically that it is not reported here. This static bound is impractical for multiple intertwined reasons.
First, the static bound value of
Second, this static bound is open loop and therefore relies entirely on the accuracy of calibration and model fidelity in the
Finally, since
Consequently, we seek a supervisor that balances safety with completion of a nominal task if possible, uses feedback to increase robustness, and has more favorable analysis properties. To do so, we make the important observation that the input magnitude
The supervisor's dynamically saturating controller
To derive a dynamic saturation condition, consider what input magnitude it would take to reach an arbitrary setpoint
From linear systems theory, we have the celebrated result
52
that if
where
and
is the pseudoinverse.
For the aggressive case of a single-step horizon where
Crucially, just as with the static supervisor, monotonicity of this system gives that theoretically
However, this bound also suffers when the dynamics model is imprecise. In contrast to the static supervisor,
To analyze this controller's performance, we close the loop by applying Equation (12) to Equation (4), producing the autonomous dynamics of
Make the following substitution to analyze this system as a linear system, eliminating the setpoint offset:
Substitution into Equation (13) gives
The equilibrium point under consideration for the closed-loop system of Equation (15) is therefore
Notice this equilibrium point is not equal to our setpoint (
Combining Equations (12) and (18), the full form of our supervisor's dynamic saturation bound that takes the actuator state to the boundary of its constraint with a convergence rate of
Finally, we confirm the stability of our system under the feedback controller
This is the same form as Equation (15) with a change of variable, so the closed-loop system is stable if the open-loop system is stable and
Safety verification of the supervisor's controller
Operating the supervisor's controller gives the dynamics in Equation (20). We assume that the closed-loop system has been designed via the criteria in the Supplementary Information S1 to be globally asymptotically stable,
For example, this safety condition would not hold for an underdamped single-input, single-output (SISO) linear system.
Verifying the condition (21) can be done instead by calculating an invariant set for a given constraint.53,54 First, we pose the inequalities of the safety constraint as a polytope in the space of our autonomous system, that is, the error dynamics. Using the definition in Equation (20) for the error,
which define an H-representation polytope of the safe set as
We then calculate a maximum positive invariant set
A set
which, with a polytope in an H-representation, can be readily checked by comparing the
Given the safety constraint polytope
Supervisor integration with the nominal controller
The controller in Equation (19) drives our actuator states (
So, assume that there is a feedback controller
developed independent of the supervisor, that would nominally close the loop of Equation (1) as
where
We note that this composed system is both continuous (in
Finally, we show the most important property of
Proof. Invariance of
Then, by the definition of controller in Equation (26),
Therefore, by induction,
Hardware Testbed
The control system derived above is applicable for any soft robotic system whose equations of motion can be put in the form of Equations (1)–(3). As one particular application, this article considers feedback control of a soft robotic limb constructed with thermally actuated SMA wire coils. Versions of this limb, previously developed as part of a soft underwater robot, 11 have recently been deployed by the authors for both open-loop30,56 and closed-loop 57 control as a free-standing manipulator. For eventual application in locomotion, this article uses the proposed supervisory controller to maintain safe actuator states when significant and sustained contact occurs.
Hardware design
Our soft robotic limb consists of a bulk silicone body embedded with sensors (Fig. 2) and a set of antagonistically arranged actuators. The limb is designed for planar motions only to develop algorithms with a reduced-dimensional state space. The limb's body (Smooth-On Smooth-Sil 945), shown in Figure 2a-1, has these two embedded SMA actuator coils (Dynalloy Flexinol, 0.020″ wire diameter) inserted along a horizontal ridge, as shown in Figure 2a-2, so that actuation forces cause bending deflections.

Our hardware testbed consists of a soft robot limb actuated with SMA wire coils. A cross section of the limb from Figure 1 shows
The two SMA wires are actuated through resistive (Joule) heating. Current through the wires was controlled using pulse-width modulation (PWM) to N-channel power MOSFET transistors connected to a 7V power supply. A microcontroller sets the PWM duty cycle between 0% and 100%, that is, each SMA's control input is
Three sensors are located on the limb: one for the body's pose, and one each for the temperatures of the wires. Temperature is sensed by thermocouples (Omega Engineering, type K, 30 AWG) affixed to the SMA coils at the rear of the limb using thermally conductive epoxy (MG 8329TCF) via the fabrication procedure described in our prior work
56
(Fig. 2a-3, b-3). A soft capacitive bending sensor (Bendlabs, Inc.) is inserted into a groove in the limb (Fig. 2a-4, b-4) and provides a single measurement of angular deflection of the limb,
Robot and actuator model and calibration
We use a simplified model of the limb for this article, with a state space of
where the body pose is deflection angle, and actuator states are the temperatures of the two wires. Importantly, this article is not concerned with developing provably stabilizing controllers for the body pose, and our supervisory controller in Equation (19) does not require a model of body pose dynamics
The thermal dynamics of our SMA actuators can be approximated in the form of Equation (3). As in prior work,30,32 the first-principles model for Joule heating in discrete time is
for the i-th SMA at time k with specific heat capacity Cv, ambient heat convection coefficient hc, surface area Ac, and ambient temperature T0. The input electrical power,
just as in Equation (3). We calibrate Equation (30) for each SMA from data collected in hardware, using the same procedure as in our prior work on this hardware platform.30,56
Nominal Feedback for Pose of an SMA-Actuated Soft Robot
We employ two representative nominal controllers for SMA-actuated robots to demonstrate that our supervisory control scheme is agnostic to choice of
Antagonistic actuation as a SISO system
Our supervisor is derived for an arbitrary number of soft actuators (m) in the form of Equation (3). However, for our particular SMA-powered robot, prior research has shown that a pair of
to a negative range of a single scalar input, which we denote
We therefore only need to specify a (bounded) SISO nominal controller,
Proportional-integral with anti-windup
We first test a proportional-integral (PI) controller. We augment it with an anti-windup (AW) block
62
since our control
where the linear saturation function
Therefore,
Sliding mode controller with boundary layer
In addition to PI feedback as a standard approach, there has been much prior success in control of SMA-based robots and mechanisms using sliding mode control (SMC).58,59,63 SMC naturally addresses saturation issues since switching occurs between some minimum and maximum input.
64
We employ a model-free SMC with a boundary layer, as suggested by Elahinia and Ashrafiuon,
58
with a sliding surface s, using a finite-difference approximation of derivative as
where
Supervisory Control Results
We perform three sets of tests to characterize and validate the action of the supervisor on the above controllers. To test without permanently damaging the robot, we chose temperature constraints
Theoretical performance verification
We first confirmed that our framework functions as intended by implementing both the PI-AW and SMC controllers in contact-free tests, and comparing their operation with versus without the supervisor. We chose an arbitrary, but aggressive, step setpoint angle (
Figure 3 and Supplementary Video S2 show the results of all four tests. Both the PI-AW and SMC controllers, without the supervisor, regulate the limb around the desired setpoint with low error. However, both controllers cause the SMA wire temperatures to drift upwards, representing potentially unsafe operation. In contrast, the controllers with the supervisor cause temperature to saturate at the maximum. This is the intended behavior: the supervisor's activation sacrifices state tracking in favor of safe actuator states and

The two different nominal controllers (PI-AW in red, SMC in orange) stabilize around the desired angle but may overheat the limb. However, imposing the supervisor ensures safe operating temperatures (blue, green) while attempting to reach the control goal. PI-AW, proportional-integral-anti-windup; SMC, sliding mode control.
Supervisory controller tuning
Our next test, with
The data in Figure 4 and Supplementary Video S3 demonstrate large variations in behavior depending on

Controller tuning shows that large values of the parameter
At larger values of
Physical interactions
We finally stress-test our feedback method in three different physical interaction scenarios, each representing an eventual use of our soft limb. These three scenarios, in Figure 5, include environmental contact, human contact, and the attempted tracking of infeasible/unsafe trajectories. All tests again used the PI-AW nominal controller with

Three physical interactions that could cause damage to a soft robot under feedback:
The first test (Fig. 5a) places a wall next to the limb that blocks it from reaching its target bend angle. In the second test (Fig. 5b), a human pushes on the robot causing a disturbance. The third test (Fig. 5c) tracks a trajectory of bending angles recorded beforehand by a human operator moving the limb, as in our prior work.
30
Substituting the recorded trajectory as
The data from these tests are in Figure 6, and demonstrations are shown in Supplementary Videos S4–S6. For the wall interaction, the unsafe control system without the supervisor heats the SMA wire rapidly and was manually deactivated before the test concluded, whereas the supervisor keeps the actuator at a steady maximum temperature. For the human disturbance, the unsafe controller responded dynamically to the disturbance, causing continued heating, whereas the test with the supervisor prevented a changing input during those motions and implicitly bounded the force applied to the human. Finally, for the “learning from demonstration” test, the unsafe controller was able to faithfully track the desired motion; however, the SMA temperatures violated constraints. The corresponding test with the supervisor demonstrates it dynamically activating and deactivating as both wires reach potentially unsafe operation.

In each of the three physical interaction examples, the supervisory controller ensures safe operation when the robot's actuator state would otherwise violate safety constraints. PWM, pulse-width modulation.
Discussion
This article proposes a supervisory control scheme for a generalizable class of soft robot actuators, provably verifying that actuator states remain in a safe region. The proposed supervisor is simple to formulate and implement, with very low online computational cost. Experiments show that the controller can be tuned for conservative operation even in the case when the actuator dynamics are a significant approximation, making the framework applicable for a variety of soft robot actuator designs and modalities. We demonstrate that the controller safely operates on a thermal actuator in hardware tests, maintaining safe temperatures in a variety of contact-rich environments.
This work highlights the inherent relationship between force applied at a manipulator tip and the bounds on its actuator state, for example, in the human contact disturbance test. Recent work has shown that environmental contact forces for a soft robot may be estimated simply from pose measurements. 66 Therefore, if a model for the body dynamics is available, it may be possible to convert between actuator bounds and body force bounds, allowing the concepts from this article to extend to safe interactions of body-to-environment: safety in pose as well as safety in actuator.
Future Work and Conclusions
Multiple directions of future work are anticipated to make the proposed framework more robust and applicable with fewer assumptions required. In particular, a probabilistic actuator dynamics model, and accompanying modifications to the controller, may provide better robustness when the linearization is poor. Similarly, future work will examine adaptive control for capturing unmodeled dynamics. If the actuator dynamics cannot be linearized, we will examine nonlinear optimization techniques for the supervisor, such as model-predictive control. For robots with coupled actuator dynamics or more than one scalar state per actuator, future work may saturate actuators in terms of conic section bounds. 51 And although many soft robot actuators are monotonic control systems, the soft robot itself may not be, prompting future work in extending, for example, optimization-based approaches to safety in nonmonotone systems. 67
The system in this article relies on feedback for the supervisor, requiring sensors for all actuator states. However, if the actuator dynamics model sufficiently captures the underlying physical phenomena, it may be possible to estimate the states
Finally, a major motivation of this article is applying feedback control to soft robots in locomotion and human–robot interaction tasks. We plan to implement our supervisor on SMA-actuated walking soft robots 11 to demonstrate safe, closed-loop locomotion in state-feedback. Safe locomotion with feedback will bring soft robots closer to real-world deployment and increase the acceptance of soft robots for real-world tasks.
Footnotes
Acknowledgments
We thank Xiaonan Huang, Richard Desatnik, and all members of the Soft Machines Laboratory at Carnegie Mellon University for their collaboration in the design framework for the robot studied in this article.
Authors' Contributions
A.P.S.: Conceptualization, formal analysis, methodology, software, funding acquisition, writing—original draft, review and editing. Z.J.P.: Methodology, software, writing—review and editing. A.T.W.: Methodology, software, writing—review and editing. C.M.: Funding acquisition, supervision, writing—review and editing.
Author Disclosure Statement
No competing financial interests exist.
Funding Information
This work was in part supported by the Office of Naval Research under Grant No. N000141712063 (PM: Dr. Tom McKenna), the National Oceanographic Partnership Program (NOPP) under Grant No. N000141812843 (PM: Dr. Reginald Beach), and an Intelligence Community Postdoctoral Research Fellowship through the Oak Ridge Institute for Science and Education.
References
Supplementary Material
Please find the following supplemental material available below.
For Open Access articles published under a Creative Commons License, all supplemental material carries the same license as the article it is associated with.
For non-Open Access articles published, all supplemental material carries a non-exclusive license, and permission requests for re-use of supplemental material or any part of supplemental material shall be sent directly to the copyright owner as specified in the copyright notice associated with the article.
