Paper deep dive
Decentralized Contingency MPC based on Safe Sets for Nonlinear Multi-agent Collision Avoidance
Max Studt, Georg Schildbach
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 95%
Last extracted: 7/8/2026, 1:30:10 PM
Summary
This paper introduces a decentralized contingency Model Predictive Control (MPC) framework for nonlinear multi-agent systems to achieve collision-free motion without trajectory communication. By coupling a nominal performance trajectory with a contingency backup plan within local safe sets, the method ensures recursive feasibility and Lyapunov-type convergence to a safe equilibrium. A novel freeze-or-shift update mechanism dynamically adjusts safe sets to prevent feasibility loss, with simulations validating performance in sparse, dense, and plug-and-play scenarios.
Entities (6)
Relation Signals (6)
Decentralized Contingency MPC → appliesto → Multi-agent systems
confidence 98% · This paper develops a decentralized contingency MPC framework for multi-agent systems with nonlinear dynamics that achieves collision-free motion under a state-only information pattern.
Decentralized Contingency MPC → ensures → Collision Avoidance
confidence 97% · achieves collision-free motion under a state-only information pattern.
Decentralized Contingency MPC → guarantees → Recursive Feasibility
confidence 96% · The resulting scheme guarantees recursive feasibility, including collision avoidance, and establishes a Lyapunov-type convergence result to an admissible safe equilibrium.
Decentralized Contingency MPC → uses → Safe Sets
confidence 95% · A novel geometric and decentralized safe-set update mechanism prevents feasibility loss between consecutive time steps.
Decentralized Contingency MPC → employs → Freeze-or-Shift Update
confidence 94% · The proposed method combines a local dual-plan formulation with a novel freeze-or-shift (FoS) safe-set update that preserves disjointness of active local safe regions over time.
Safe Sets → enable → Collision Avoidance
confidence 93% · The active safe sets are chosen such that, from the current state of each agent, there exists a feasible backup maneuver that remains inside the set, reaches an admissible safe equilibrium in finite steps, and can subsequently be maintained there indefinitely.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Decentralized collision avoidance remains challenging, particularly when agents do not communicate any information related to planned trajectories. Most existing approaches either rely on conservative coordination mechanisms or provide limited guarantees on recursive feasibility and convergence. This paper develops a decentralized contingency MPC framework for multi-agent systems with nonlinear dynamics that achieves collision-free motion under a state-only information pattern. Each agent follows the same consensual rule set, enabling safe decentralized planning without communication. Each agent solves a local optimization problem that couples a nominal trajectory with a contingency certificate ensuring a feasible backup maneuver under receding-horizon operation. A novel geometric and decentralized safe-set update mechanism prevents feasibility loss between consecutive time steps. The resulting scheme guarantees recursive feasibility, including collision avoidance, and establishes a Lyapunov-type convergence result to an admissible safe equilibrium. Simulation results demonstrate performance in both sparse and dense multi-agent environments, including cluttered bottleneck scenarios and under plug-and-play operation.
Tags
Links
- Source: https://arxiv.org/abs/2605.10738v1
- Canonical: https://arxiv.org/abs/2605.10738v1
Trouble viewing inline? Open PDF directly →
Full Text
93,205 characters extracted from source content.
Expand or collapse full text
Decentralized Contingency MPC based on Safe Sets for Nonlinear Multi-agent Collision Avoidance Max Studt∗ m.studt@uni-luebeck.de Georg Schildbach georg.schildbach@uni-luebeck.de Institute for Electrical Engineering in Medicine, University of Luebeck, Luebeck, Germany Abstract Decentralized collision avoidance remains challenging, particularly when agents do not communicate any information related to planned trajectories. Most existing approaches either rely on conservative coordination mechanisms or provide limited guarantees on recursive feasibility and convergence. This paper develops a decentralized contingency MPC framework for multi-agent systems with nonlinear dynamics that achieves collision-free motion under a state-only information pattern. Each agent follows the same consensual rule set, enabling safe decentralized planning without communication. Each agent solves a local optimization problem that couples a nominal trajectory with a contingency certificate ensuring a feasible backup maneuver under receding-horizon operation. A novel geometric and decentralized safe-set update mechanism prevents feasibility loss between consecutive time steps. The resulting scheme guarantees recursive feasibility, including collision avoidance, and establishes a Lyapunov-type convergence result to an admissible safe equilibrium. Simulation results demonstrate performance in both sparse and dense multi-agent environments, including cluttered bottleneck scenarios and under plug-and-play operation. keywords: Decentralized MPC; Contingency MPC; Nonlinear systems; Multi-agent systems; Collision avoidance; Recursive feasibility; Safe sets; Lyapunov constraint , 1 Introduction Multi-agent navigation and control problems require hard collision avoidance while simultaneously achieving mission objectives such as reference tracking. Model Predictive Control (MPC) provides a natural framework for this setting, since constraints can be handled explicitly while optimizing performance over a receding horizon [14]. 1.1 Literature overview Centralized planning A first class of approaches enforces collision avoidance in a centralized manner by solving a coupled optimization problem for the entire fleet. Such formulations can encode global constraints directly, but typically scale poorly and require a coordinator with access to global information. Mixed-integer linear programs (MILPs) are a prominent example, enabling explicit collision-avoidance logic at the price of combinatorial complexity [21, 16]. Receding-horizon MILP/MPC variants have also been demonstrated in aerospace guidance applications, highlighting both the potential and computational burden of centralized approaches [22]. Distributed / decentralized MPC with coordination To improve scalability, many distributed or decentralized MPC schemes let agents solve local problems while coordinating to handle coupling constraints [19, 15]. This coordination may rely on repeated communication rounds [3], negotiation of predicted trajectories [13], consensus/agreement protocols [12], or distributed optimization methods such as ADMM/ALADIN [7]. Related non-iterative approaches exchange compact descriptions of neighbor behavior, e.g., contracts of guaranteed future coupling-variable trajectories, which can support recursive feasibility and stability while limiting communication to local neighbors [11]. However, such schemes still rely on communication and may introduce latency or coordination assumptions that are undesirable in safety-critical settings [23, 8, 26]. An intermediate regime considers limited or time-varying communication, including bounded ranges, changing neighbor sets, and plug-and-play operation. Recent MPC formulations address this by reasoning about topology changes over the prediction horizon, for example via multi-trajectory MPC schemes that couple a nominal trajectory with a worst-case topology-change trajectory [18]. More broadly, plug-and-play concepts have been studied in networked control and MPC for systems with changing components [24, 17, 11]. Several MPC-based approaches further reduce coordination effort toward single exchanges or local sensing. Examples include decentralized cooperative and reactive MPC-style navigation in unknown environments [6], multi-robot NMPC with feasibility and stability analyses [9], and decentralized deadlock-prevention layers that trigger coordination maneuvers in dense settings [10]. Decentralized approaches without communication In purely decentralized settings, agents observe only the current multi-agent configuration and cannot exchange planned trajectories or intentions. Geometric and reactive methods such as velocity obstacles [5] and ORCA [25] are computationally attractive and can provide collision avoidance under specific modeling assumptions. However, they are typically not designed to incorporate multi-step performance objectives, hard state/input constraints, and MPC-style closed-loop guarantees. Safety filters and barrier-function based safety Optimization-based safety filters and control barrier functions enforce safety by rendering a safe set forward invariant via online correction problems [2]. Predictive safety filters connect this idea to MPC by embedding constraint satisfaction into a predictive structure [27]. However, combining multi-step planning, collision avoidance, and state-only decentralized information patterns with strong guarantees such as recursive feasibility and convergence remains challenging. 1.2 Contributions To bridge these gaps, this paper adopts a contingency MPC perspective. Contingency MPC couples a nominal plan with a safety or backup plan, thereby certifying the existence of an emergency maneuver under receding-horizon implementation [1]. A related communicationless multi-agent collision-avoidance setting has been addressed for linear systems using pairwise bisecting-plane separation constraints and a deterministic backup evolution [20]. In contrast, this paper develops a decentralized contingency MPC framework for nonlinear multi-agent systems under a state-only information pattern. The proposed method combines a local dual-plan formulation with a novel freeze-or-shift (FoS) safe-set update that preserves disjointness of active local safe regions over time. The resulting scheme provides tractable guarantees on recursive feasibility, collision avoidance, and Lyapunov-type convergence. The main contributions of this paper are: C1 A fully decentralized FoS update rule for time-varying convex local safe regions that preserves disjointness of the active safe sets. C2 A decentralized contingency MPC formulation for nonlinear multi-agent systems that couples a nominal performance plan with a backup safety certificate via a shared first input. C3 A constructive recursive-feasibility and collision-avoidance proof based on shifted contingency candidates and invariant disjoint safe sets. C4 A Lyapunov-type convergence result obtained by enforcing a monotone decrease condition on a contingency-related cost bound. C5 A simulation study demonstrating effectiveness in sparse, dense, cluttered bottleneck, and plug-and-play multi-agent scenarios. 2 Preliminaries and problem statement 2.1 Notation The sets of real and integer numbers are denoted by ℝR and ℤZ, respectively. Moreover, ℝ+R_+ and ℤ+Z_+ denote the sets of nonnegative real and nonnegative integer numbers, respectively, and ℤ>0Z_>0 denotes the set of positive integers. For integers a,b∈ℤa,b with a≤ba≤ b, the (inclusive) index set is defined as ℤab:=k∈ℤ∣a≤k≤b.Z_a^b:=\k a≤ k≤ b\. The set of agents is ℐ:=1,…,M.I:=\1,…,M\. Discrete time is indexed by t∈ℤ+t _+ with sampling time Ts>0T_s>0, while continuous time is denoted by τ∈ℝ+τ _+. The next discrete time instant is denoted by t+:=t+1t^+:=t+1 and the previous one by t−:=t−1t^-:=t-1. For a vector x∈ℝnx ^n, ‖x‖\|x\| denotes the Euclidean norm. Let np∈ℤ>0n_p _>0 denote the dimension of the position space. For c∈ℝnpc ^n_p and R≥0R≥ 0, the closed Euclidean ball centered at c with radius R is defined as (c,R):=p∈ℝnp:‖p−c‖≤R.B(c,R):=\p ^n_p:\|p-c\|≤ R\. The MPC prediction index (k|t)(k|t) is used throughout: xi,(k|t)x_i,(k|t) denotes the prediction of xi(t+k)x_i(t+k) for agent i computed at time t. An equilibrium of agent i is denoted by (x¯i,u¯i)( x_i, u_i) and satisfies x¯i=fi(x¯i,u¯i). x_i=f_i( x_i, u_i). When needed, the associated equilibrium position is denoted by p¯i:=Cix¯i p_i:=C_i x_i. For the contingency plan, terminal safe equilibria are denoted by (x¯ic,u¯ic)( x_i^c, u_i^c). 2.2 Agent Dynamics and Constraints Let ⊆ℝnpW ^n_p denote the workspace. For each agent i∈ℐi , define the body-feasible position set i:=pi(t)∈ℝnp:(pi(t),ri)⊆.W_i:=\p_i(t) ^n_p:B(p_i(t),r_i) \. Thus, pi(t)∈ip_i(t) _i means that the full body of agent i, modeled as a closed Euclidean ball of radius rir_i centered at pi(t)p_i(t), is contained in the workspace. If no workspace-boundary constraints are present, one may simply take =i=ℝnpW=W_i=R^n_p. Each agent i∈ℐi is modeled by a discrete-time nonlinear system xi(t+)=fi(xi(t),ui(t)),x_i(t^+)=f_i(x_i(t),u_i(t)), (1) with state xi(t)∈ℝnix_i(t) ^n_i and input ui(t)∈ℝmiu_i(t) ^m_i. The position of agent i is given by pi(t)=Cixi(t)∈ℝnp,p_i(t)=C_ix_i(t) ^n_p, where Ci∈ℝnp×niC_i ^n_p× n_i extracts the position component of the state. The sets of admissible states and admissible inputs for agent i are denoted by i⊂ℝni,i⊂ℝmi.X_i ^n_i,\ U_i ^m_i. The closed-loop system trajectory is required to satisfy, for all t∈ℤ+t _+ xi(t)∈i,ui(t)∈i.x_i(t) _i,\ u_i(t) _i. It is assumed that the state constraints are chosen such that pi(t)∈ip_i(t) _i whenever xi(t)∈ix_i(t) _i. Each agent i is assigned an individual global reference state xiref∈ℝni,x_i^ref ^n_i, with corresponding reference position piref=Cixiref∈i.p_i^ref=C_ix_i^ref _i. Throughout the paper, xirefx_i^ref is assumed to denote an admissible equilibrium state for agent i, i.e., there exists an admissible input uiref∈iu_i^ref _i such that xiref=fi(xiref,uiref).x_i^ref=f_i(x_i^ref,u_i^ref). 2.3 Collision Model and Safety Objective Let ℬi(t):=(pi(t),ri).B_i(t):=B(p_i(t),r_i). denote the closed Euclidean ball occupied by agent i. A collision between two distinct agents i≠ji≠ j at time t occurs if ℬi(t)∩ℬj(t)≠∅,B_i(t) _j(t)≠ , equivalently if ‖pi(t)−pj(t)‖<ri+rj\|p_i(t)-p_j(t)\|<r_i+r_j. The safety objective is collision-free closed-loop execution, ℬi(t)∩ℬj(t)=∅,∀i≠j,∀t∈ℤ+,B_i(t) _j(t)= , ∀ i≠ j,\ ∀ t _+, while driving each agent towards its reference or, if necessary, towards a safe admissible equilibrium. Assumption 1 (Exact nominal dynamics). The closed-loop evolution of each agent is exactly described by (1) under the input and state constraints ui(t)∈iu_i(t) _i and xi(t)∈ix_i(t) _i, for all t∈ℤ+t _+. In particular, no model mismatch and no further uncertainties are considered. Assumption 2 (Position invariance). The dynamics (1) are translation invariant. More precisely, for every agent i, there exists an embedding ϕi:ℝnp→ℝni _i:R^n_p ^n_i such that Ciϕi(δ)=δC_i _i(δ)=δ and fi(xi+ϕi(δ),ui)=fi(xi,ui)+ϕi(δ)f_i(x_i+ _i(δ),u_i)=f_i(x_i,u_i)+ _i(δ) for all admissible (xi,ui)(x_i,u_i) and all δ∈ℝnpδ ^n_p. Assumption 3 (Information pattern). At each time t∈ℤ+t _+, agent i∈ℐi can measure its own state xi(t)x_i(t) and the current states xj(t)x_j(t) of all other agents j∈ℐ∖ij \i\. The reference positions (or objectives) of other agents and their future inputs or predicted trajectories are not available. 3 Local safe sets This section introduces the geometric object used to enforce decentralized safety, namely the active local safe set associated with each agent. The active safe sets are chosen such that, from the current state of each agent, there exists a feasible backup maneuver that remains inside the set, reaches an admissible safe equilibrium in finite steps, and can subsequently be maintained there indefinitely. At each time t∈ℤ+t _+, each agent i∈ℐi is associated with an active and time-varying local safe set Si∗(t):=(ci(t),Ri(t))⊆ℝnp,S_i (t):=B (c_i(t),R_i(t) ) ^n_p, (2) where ci(t)∈ℝnpc_i(t) ^n_p is the center and Ri(t)≥0R_i(t)≥ 0 is the radius. The active pair (ci(t),Ri(t))(c_i(t),R_i(t)) is determined by a deterministic update rule based on a state-dependent safe-set generator. More precisely, for each agent i∈ℐi , let Γi:i→(c,R)⊆ℝnp:c∈ℝnp,R≥0 _i:X_i→ \B(c,R) ^n_p\,:\,c ^n_p,\ R≥ 0 \ denote a deterministic map that assigns to every admissible state xi∈ix_i _i a generated local safe set. For a given state xix_i, this generated safe set is written as Γi(xi)=(ci(xi),Ri(xi)). _i(x_i)=B (c_i(x_i),R_i(x_i) ). The active safe set Si∗(t)S_i (t) used by the controller need not coincide with the generated set Γi(xi(t)) _i(x_i(t)). Instead, the generated set may either be accepted or rejected by the FoS update rule introduced in Section 5. Thus, reconstructing active safe sets generally requires the current state information together with one-step memory of the previously active safe-set parameters. Independent of this update rule, the footprint of the agent must satisfy ℬi(t)⊆Si∗(t),∀t∈ℤ+.B_i(t) S_i (t), ∀ t _+. (3) Assumption 4 (Local reconstructability). The deterministic safe-set generation and update rules are commonly known to all agents. During closed-loop operation, each agent i∈ℐi can reconstruct the active safe set Sj∗(t)S_j (t) of every other agent j∈ℐ∖ij \i\ from the observed state xj(t)x_j(t) and one-step memory of the previously active safe-set parameters Sj∗(t−)S_j (t^-), without communication of planned trajectories or control inputs. Assumption 5 (Contingency recoverability). For every agent i∈ℐi and every time t∈ℤ+t _+, the active safe set Si∗(t)S_i (t) is chosen such that there exists a feasible contingency maneuver starting from xi(t)x_i(t) that remains inside Si∗(t)S_i (t), satisfies all state and input constraints, and reaches an admissible safe equilibrium in finite time. Definition 1 (Admissible safe equilibrium). For every agent i∈ℐi and every time t∈ℤ+t _+ the state-input pair (x¯i,u¯i)( x_i, u_i) satisfying x¯i=fi(x¯i,u¯i),p¯i:=Cix¯i∈Si∗(t), x_i=f_i( x_i, u_i), p_i:=C_i x_i∈ S_i (t), and (p¯i,ri)⊆Si∗(t)∩i,B ( p_i,r_i ) S_i (t) _i, represents an admissible safe equilibrium. Moreover, once this equilibrium is reached, the agent can be kept inside Si∗(t)S_i (t) for all future times by applying the constant equilibrium input u¯i u_i. Together, Assumption 5 and Definition 1 formalize the intended role of the active safe set: It must support both finite-time recovery and indefinite safe holding. In particular, the active safe set must be chosen such that it contains a reachable admissible safe equilibrium and the agent can remain there indefinitely once this equilibrium has been reached. Remark 1 (Non-equilibrium-based terminal set). The present paper considers systems for which terminal safety can be represented by an admissible safe equilibrium contained in the active safe set. For systems that do not admit such a fixed equilibrium, e.g., certain aircraft models, the same conceptual role could instead be played by a compact positively invariant terminal safe set Xif(t)⊆Si∗(t)X_i^f(t) S_i (t) that is reachable in finite time and can be rendered invariant by a backup policy. Remark 2 (Model-dependent realization). The concrete realization of Assumption 5 depends on the agent model. For some systems, local safe sets can be obtained from closed-form stopping bounds; for more general nonlinear systems, they may be constructed by reachable-set over-approximations, invariant-set arguments, or other conservative backup designs. 4 Decentralized contingency MPC formulation This section states the decentralized contingency MPC problem solved by each agent i∈ℐi at time t∈ℤ+t _+. At each time step, a single optimization simultaneously computes (i) a nominal trajectory for performance and reference tracking and (i) a contingency trajectory that guarantees the existence of a feasible backup maneuver within the local safe set. The two plans are coupled by enforcing a shared first control input. 4.1 Decision variables and horizons Two prediction horizons are introduced: a nominal horizon Nn∈ℤ+N_n _+ and a contingency horizon Nc∈ℤ+N_c _+. The nominal horizon NnN_n is chosen to shape tracking performance. The contingency horizon NcN_c is selected sufficiently large such that a feasible contingency maneuver to an admissible safe equilibrium can be represented within the active local safe set. Its choice depends on the agent dynamics, input and state constraints, and the construction of the local safe sets. At time t, agent i optimizes the following state–input sequences: Nominal trajectory: Xin(t)=xi,(k|t)nk=0Nn,Uin(t)=ui,(k|t)nk=0Nn−1.X_i^n(t)=\x^n_i,(k|t)\_k=0^N_n, U_i^n(t)=\u^n_i,(k|t)\_k=0^N_n-1. Contingency trajectory: Xic(t)=xi,(k|t)ck=0Nc,Uic(t)=ui,(k|t)ck=0Nc−1.X_i^c(t)=\x^c_i,(k|t)\_k=0^N_c, U_i^c(t)=\u^c_i,(k|t)\_k=0^N_c-1. Each state xi,(k|t)∙∈ℝnix _i,(k|t) ^n_i is associated with a position pi,(k|t)∙=Cixi,(k|t)∙∈ℝnp,p _i,(k|t)=C_ix _i,(k|t) ^n_p, where ∙∈n,c ∈\n,c\ distinguishes nominal and contingency trajectories. In addition, the optimization includes the terminal contingency equilibrium pair as a decision variable, x¯ic(t)∈i,u¯ic(t)∈i, x^c_i(t) _i, u^c_i(t) _i, (4) satisfying x¯ic(t)=fi(x¯ic(t),u¯ic(t)). x^c_i(t)=f_i ( x^c_i(t), u^c_i(t) ). The closed-loop system evolves according to (1) with the applied input given by the shared first move, ui(t)=ui,(0|t)n,∗=ui,(0|t)c,∗,u_i(t)=u^n,*_i,(0|t)=u^c,*_i,(0|t), (5) where (⋅)∗(·) denotes an optimal solution of the MPC problem at time t. 4.2 Objective function The local objective is kept generic, as the theoretical guarantees derived later rely on structural properties rather than on a specific (e.g., quadratic) choice. A typical design penalizes deviations of the nominal trajectory from a desired reference and regularizes the selection of the contingency equilibrium. Let ℓin(⋅,⋅) _i^n(·,·) denote a tracking-related stage cost and Vin(⋅)V_i^n(·) a terminal tracking cost. Moreover, let Vic(x¯ic(t),xiref)V_i^c( x^c_i(t),x_i^ref) denote an offset cost that measures the distance of the contingency equilibrium to the desired target state. Ji(Xin(t), J_i (X_i^n(t), Uin(t),x¯ic(t),xiref):= U_i^n(t), x^c_i(t),x_i^ref )= (6) ∑k=0Nn−1 _k=0^N_n-1 ℓin(xi,(k|t)n,ui,(k|t)n)+Vin(xi,(Nn|t)n,xiref) _i^n\! (x^n_i,(k|t),u^n_i,(k|t) )\;+\;V_i^n\! (x^n_i,(N_n|t),x_i^ref ) +γVic(x¯ic(t),xiref). \;+\;γ\,V_i^c\! ( x^c_i(t),x_i^ref ). The scalar γ>0γ>0 weights the preference for contingency equilibria that are close to the desired reference. Note that the cost term related to the selected terminal contingency equilibrium state is required in order to enforce a Lyapunov-like decrease through an additional constraint (Section 4.3.3). Definition 2 (Optimal contingency equilibrium). At each time step t∈ℤ+t _+, an optimal reachable contingency equilibrium minimizes the equilibrium-offset cost, i.e., (x¯ic,∗(t),u¯ic,∗(t))∈argmin(x¯ic,u¯ic)∈ic(t)Vic(x¯ic,xiref),( x_i^c, (t), u_i^c, (t))∈ _( x_i^c, u_i^c) _i^c(t)V_i^c\! ( x_i^c,x_i^ref ), where ic(t)Z_i^c(t) denotes the set of admissible terminal contingency equilibrium pairs. Remark 3 (Role of the equilibrium-offset weight). The scalar γ>0γ>0 regularizes the selection of the contingency equilibrium. In related multi-trajectory MPC formulations, it can be shown that for sufficiently large equilibrium-offset weights, the equilibrium selected by the optimizer can be made arbitrarily close to the offset-minimizing admissible equilibrium [18, Lemma 1]. 4.3 Constraints Both predicted trajectories start from the measured state, xi,(0|t)n=xi,(0|t)c=xi(t).x^n_i,(0|t)=x^c_i,(0|t)=x_i(t). (7) For the nominal trajectory, the dynamics (1) are enforced for k=0,…,Nn−1k=0,…,N_n-1, xi,(k+1|t)n=fi(xi,(k|t)n,ui,(k|t)n),x^n_i,(k+1|t)=f_i (x^n_i,(k|t),u^n_i,(k|t) ), and analogously for the contingency trajectory for k=0,…,Nc−1k=0,…,N_c-1, xi,(k+1|t)c=fi(xi,(k|t)c,ui,(k|t)c).x^c_i,(k+1|t)=f_i (x^c_i,(k|t),u^c_i,(k|t) ). Stagewise state and input constraints are imposed by xi,(k+1|t)n∈i,ui,(k|t)n∈i,∀k∈ℤ0Nn−1,x^n_i,(k+1|t) _i,\ \ u^n_i,(k|t) _i, ∀ k _0^N_n-1, xi,(k+1|t)c∈i,ui,(k|t)c∈i,∀k∈ℤ0Nc−1.x^c_i,(k+1|t) _i,\ \ u^c_i,(k|t) _i, ∀ k _0^N_c-1. To ensure that the predicted contingency trajectory represents a valid backup plan, the terminal equilibrium constraint xi,(Nc|t)c=x¯ic(t),x¯ic(t)=fi(x¯ic(t),u¯ic(t)),x^c_i,(N_c|t)= x^c_i(t), x^c_i(t)=f_i ( x^c_i(t), u^c_i(t) ), (8) is imposed. The terminal position is required to satisfy p¯ic(t):=Cix¯ic(t)∈Si∗(t). p^c_i(t):=C_i x^c_i(t)∈ S_i (t). Moreover, the terminal equilibrium must be reachable from the current state xi(t)x_i(t) within NcN_c steps by a feasible contingency trajectory that remains inside the active local safe set, i.e., x¯ic(t)∈reachNc(xi(t)). x_i^c(t) _N_c(x_i(t)). 4.3.1 Local Safe-Set Constraints The entire contingency position plan is required to remain inside the current active local safe set Si∗(t)S_i (t). To account for the agent size, the constraint is imposed with a radius margin rir_i, i.e., ‖pi,(k|t)c−ci(t)‖≤Ri(t)−ri,∀k∈ℤ0Nc.\|p^c_i,(k|t)-c_i(t)\|≤ R_i(t)-r_i, ∀ k _0^N_c. (9) Equivalently, (pi,(k|t)c,ri)⊆Si∗(t)B (p^c_i,(k|t),r_i ) S_i (t) for all k∈ℤ0Nck _0^N_c. Furthermore, for every prediction step k, the remainder of the contingency trajectory (from step k onward) is required to remain inside the local safe set generated by Γi _i from the predicted contingency state xi,(k|t)cx^c_i,(k|t). Let this generated safe set be given by Γi(xi,(k|t)c)=(ci(xi,(k|t)c),Ri(xi,(k|t)c)). _i (x^c_i,(k|t) )=B (c_i(x^c_i,(k|t)),R_i(x^c_i,(k|t)) ). Then the tail-containment constraint is ‖pi,(l|t)c−ci(xi,(k|t)c)‖≤Ri(xi,(k|t)c)−ri, \|p^c_i,(l|t)-c_i(x^c_i,(k|t))\|≤ R_i(x^c_i,(k|t))-r_i, (10) ∀k∈ℤ0Nc,∀l∈ℤkNc. ∀ k _0^N_c,\ ∀ l _k^N_c. Constraint (10) enforces a receding-horizon recoverability property: At each prediction stage k, the planned tail xi,(l|t)cl=kNc \x^c_i,(l|t) \_l=k^N_c remains entirely inside the candidate local safe set generated from the predicted state xi,(k|t)cx^c_i,(k|t). In particular, after applying the first input, the shifted tail xi,(l+1|t)cl=0Nc−1 \x^c_i,(l+1|t) \_l=0^N_c-1 is contained in the candidate safe set generated from the new initial condition xi(t+)=xi,(1|t)c.x_i(t^+)=x^c_i,(1|t). Hence, if the active safe set at the next time step is chosen as this generated candidate safe set, the shifted contingency tail remains admissible with respect to the newly induced active safe set. This property is a key ingredient for establishing recursive feasibility under receding-horizon implementation, including the case where the active safe set is updated by the FoS rule. Figure 1 illustrates why constraint (10) is necessary. Even if the local problem is feasible at time t with active safe set Si∗(t)S_i (t), recursive feasibility may be lost after applying the first input if the remaining contingency tail is not guaranteed to lie inside the safe set induced at the successor state. Figure 1: Loss of recursive feasibility without constraint (10). Although the local MPC problem is feasible at time t with active safe set S∗(t)S (t) (red), the naive update to t+t^+ yields a set S∗(t+)S (t^+) (dashed) that no longer contains the complete tail of the contingency plan (blue) from previous time step. This violates the safe-set containment constraints and renders the next-step problems infeasible. 4.3.2 Collision avoidance w.r.t. static obstacles Collision avoidance with respect to static obstacles is enforced explicitly along the contingency trajectory. Let ⊂ℝnpO ^n_p denote the obstacle set (union of closed obstacle regions) and define a continuous obstacle-avoidance function h:ℝnp→ℝh:R^n_p such that h(pi(t))≥0⟺ℬi∩=∅.h(p_i(t))≥ 0\ \ B_i = . Then the following hard constraints are imposed for all predicted contingency positions: h(pi,(k|t)c)≥0,∀i∈ℐ,∀k∈ℤ0Nc.h(p^c_i,(k|t))≥ 0, ∀\,i ,\ ∀\,k _0^N_c. (11) 4.3.3 Convergence constraint Following the contingency MPC rationale, a decrease in a contingency-cost functional is enforced through an inequality constraint. Let ℓic(⋅,⋅) _i^c(·,·) denote a continuous, nonnegative contingency stage cost, and define Jic(t):=∑k=0Nc−1 J_i^c(t)= _k=0^N_c-1 ℓic(xi,(k|t)c−x¯ic(t),ui,(k|t)c−u¯ic(t)) _i^c\! (x^c_i,(k|t)- x^c_i(t),\,u^c_i,(k|t)- u^c_i(t) ) (12) +Vic(x¯ic(t),xiref). \;+\;V_i^c\! ( x^c_i(t),x_i^ref ). A bound J^ic(t)∈ℝ+ J_i^c(t) _+ is maintained recursively and the following constraint is imposed: Jic(t)≤J^ic(t).J_i^c(t)≤ J_i^c(t). (13) The update law for J^ic(t) J_i^c(t) is constructed from the shifted tail of the previously optimal contingency trajectory and yields the one-step bound J^ic(t+):=Jic,∗(t)−ℓic(xi(t)−x¯ic,∗(t),ui(t)−u¯ic,∗(t)), J_i^c(t^+):=J_i^c, (t)- _i^c\! (x_i(t)- x_i^c, (t),\,u_i(t)- u_i^c, (t) ), (14) where xi(t)=xi,(0|t)c,∗x_i(t)=x_i,(0|t)^c, and ui(t)=ui,(0|t)c,∗u_i(t)=u^c, _i,(0|t) is the applied shared first input. The feasibility of this shifted-tail bound and its role in the convergence proof are established in the Appendix. Remark 4 (Equilibrium). Since the optimizer may select a different terminal contingency equilibrium state x¯ic(t) x^c_i(t) at different time steps, two situations can occur. (i) Reference becomes reachable within the active safe set. There exists a time instant t¯∈ℤ+ t _+ such that the global reference is feasible as a contingency terminal state thereafter, i.e., ∃t¯∈ℤ+:x¯ic(t)=xiref∀t≥t¯,∃\, t _+: x^c_i(t)=x_i^ref ∀ t≥ t, In this case the selected terminal equilibrium is constant for all t≥t¯t≥ t and the Lyapunov-type analysis yields convergence to the reference state. (i) Reference is not reachable due to persistent blocking. There exists a time instant t¯∈ℤ+ t _+ such that the reference cannot be selected as a feasible terminal state, and the optimal reachable terminal state remains constant thereafter, i.e., ∃t¯∈ℤ+,∃x¯ic,⋆:x¯ic(t)=x¯ic,⋆∀t≥t¯.∃\, t _+,\ ∃\, x^c, _i: x^c_i(t)= x^c, _i ∀ t≥ t. Then the convergence constraint implies convergence to the fixed terminal state x¯ic,⋆ x^c, _i. If x¯ic(t) x^c_i(t) changes infinitely often, the constraint (13) still enforces a monotonic decrease of the contingency-cost bound generated by the shifted-tail update, but a standard “convergence to a fixed equilibrium” statement is no longer immediate. In this case, the constraint is interpreted as enforcing progress towards the currently selected contingency terminal state and providing a stabilizing regularization of the contingency plan. 4.4 Local finite-horizon optimal control problem For each agent i∈ℐi and time t∈ℤ+t _+, a local finite-horizon optimal control problem (FHOCP) is solved: minXin,c,Uin,cx¯ic,u¯icJi(Xin(t),Uin(t),x¯ic(t),xiref) _X_i^n,c,\,U_i^n,c\, x_i^c,\, u_i^c\ J_i (X_i^n(t),U_i^n(t), x^c_i(t),x_i^ref ) (15a) subject to: xi,(0|t)n=xi,(0|t)c=xi(t) x^n_i,(0|t)=x^c_i,(0|t)=x_i(t) (15b) ui,(0|t)n=ui,(0|t)c u^n_i,(0|t)=u^c_i,(0|t) (15c) xi,(k+1|t)n=fi(xi,(k|t)n,ui,(k|t)n),∀k∈ℤ0Nn−1 x^n_i,(k+1|t)=f_i (x^n_i,(k|t),u^n_i,(k|t) ),∀ k _0^N_n-1 (15d) xi,(k+1|t)c=fi(xi,(k|t)c,ui,(k|t)c),∀k∈ℤ0Nc−1 x^c_i,(k+1|t)=f_i (x^c_i,(k|t),u^c_i,(k|t) ),∀ k _0^N_c-1 (15e) xi,(k+1|t)n∈i,ui,(k|t)n∈i,∀k∈ℤ0Nn−1 x^n_i,(k+1|t) _i,\ \ u^n_i,(k|t) _i,∀ k _0^N_n-1 (15f) xi,(k+1|t)c∈i,ui,(k|t)c∈i,∀k∈ℤ0Nc−1 x^c_i,(k+1|t) _i,\ \ u^c_i,(k|t) _i,∀ k _0^N_c-1 (15g) h(pi,(k|t)c)≥0,∀k∈ℤ0Nc h (p^c_i,(k|t) )≥ 0,∀ k _0^N_c (15h) xi,(Nc|t)c=x¯ic(t) x^c_i,(N_c|t)= x^c_i(t) (15i) x¯ic(t)=fi(x¯ic(t),u¯ic(t)),(x¯ic(t),u¯ic(t))∈i×i x^c_i(t)=f_i ( x^c_i(t), u^c_i(t) ),\ ( x^c_i(t), u^c_i(t) ) _i×U_i (15j) Cix¯ic(t)∈Si∗(t) C_i x^c_i(t)∈ S_i (t) (15k) ‖pi,(k|t)c−ci(t)‖≤Ri(t)−ri,∀k∈ℤ0Nc \|p^c_i,(k|t)-c_i(t)\|≤ R_i(t)-r_i,∀ k _0^N_c (15l) ‖pi,(l|t)c−ci(xi,(k|t)c)‖≤Ri(xi,(k|t)c)−ri, \|p^c_i,(l|t)-c_i(x^c_i,(k|t))\|≤ R_i(x^c_i,(k|t))-r_i, (15m) ∀k∈ℤ0Nc,∀l∈ℤkNc ∀ k _0^N_c,\ ∀ l _k^N_c Jic(t)≤J^ic(t) J_i^c(t)≤ J_i^c(t) (15n) Problem (4.4) is, generally, a non-convex Nonlinear Program (NLP), even if the dynamics are linear. It is solved in receding-horizon fashion. The applied input is the shared first input (15c). Remark 5 (Performance and safety). No explicit inter-agent collision-avoidance constraints are imposed on the nominal prediction XinX_i^n. Safety is ensured by the contingency trajectory XicX_i^c via (15l)–(15m). The nominal part can therefore be used flexibly for performance shaping, e.g., through additional objectives or soft constraints; the theoretical guarantees rely only on the contingency-plan feasibility structure. 5 FoS update of the local safe sets Recall that each agent i is associated with an active local safe set as described in (2). After solving the local FHOCPs at time t and applying the shared first input, the closed-loop dynamics of each agent follow (1). The successor state of agent i is denoted by xi(t+)∈i.x_i(t^+) _i. Recall the deterministic state-dependent safe-set generator Γi _i introduced in Section 3. Given the successor state xi(t+)x_i(t^+), the candidate safe set for the next time step is defined as S~i(t+):=Γi(xi(t+))=(c~i(t+),R~i(t+)), S_i(t^+):= _i (x_i(t^+) )=B ( c_i(t^+), R_i(t^+) ), (16) where c~i(t+):=ci(xi(t+)) c_i(t^+):=c_i(x_i(t^+)) and R~i(t+):=Ri(xi(t+)) R_i(t^+):=R_i(x_i(t^+)). At time t, agent i checks whether updating its active safe set to the candidate S~i(t+) S_i(t^+) would create an overlap with either (i) the candidate safe set S~j(t+) S_j(t^+) of another agent j≠ij≠ i, or (i) the currently active safe set Sj∗(t)S_j (t) of another agent j≠ij≠ i. Accordingly, the freeze indicator (χ) for agent i at time t is defined as χi(t):=1if∃j∈ℐ∖i:S~i(t+)∩S~j(t+)≠∅orS~i(t+)∩Sj∗(t)≠∅,0otherwise. _i(t):= cases1\ if&∃ j \i\: aligned & S_i(t^+)∩ S_j(t^+)≠ \\ \ \ &or\ S_i(t^+)∩ S_j (t)≠ , aligned\\[1.99997pt] 0&otherwise. cases (17) Since all local safe sets are Euclidean balls, the above condition is equivalent to the distance tests ∃j≠i: ∃ j≠ i:\ ‖c~i(t+)−c~j(t+)‖<R~i(t+)+R~j(t+) \| c_i(t^+)- c_j(t^+)\|< R_i(t^+)+ R_j(t^+) or‖c~i(t+)−cj(t)‖<R~i(t+)+Rj(t). \ \| c_i(t^+)-c_j(t)\|< R_i(t^+)+R_j(t). (18) The FoS update rule for the active local safe sets is then defined as (ci(t+),Ri(t+)):=(ci(t),Ri(t)),if χi(t)=1,(c~i(t+),R~i(t+)),if χi(t)=0.(c_i(t^+),R_i(t^+)):= cases (c_i(t),R_i(t) ),&if _i(t)=1,\\[1.99997pt] ( c_i(t^+), R_i(t^+) ),&if _i(t)=0. cases (19) Equivalently, Si∗(t+)=Si∗(t),if χi(t)=1,S~i(t+),if χi(t)=0.S_i (t^+)= casesS_i (t),&if _i(t)=1,\\[1.99997pt] S_i(t^+),&if _i(t)=0. cases Remark 6 (Decentralized update). By Assumption 3 and the deterministic construction of the candidate safe sets, each agent can locally reconstruct Sj∗(t)S_j (t) and S~j(t+) S_j(t^+) for all j≠ij≠ i from the current state and one-step memory of the previously active safe sets. Figure 2: Loss of recursive feasibility without FoS. Although the local MPC problems are feasible at time t with disjoint active safe sets Si∗(t)S_i (t) (red), the naive update to t+t^+ yields sets Si∗(t+)S_i (t^+) (dashed) that are no longer pairwise disjoint. The resulting overlaps can violate the safe-set constraints and render the next-step problems infeasible. Without the FoS update rule, pairwise disjointness of the active safe sets is not forward invariant. Even if Sj∗(t)j∈ℐ\S_j (t)\_j is pairwise disjoint, the naive update Si∗(t+)=Γi(xi(t+))S_i (t^+)= _i(x_i(t^+)), applied independently by all agents, may yield overlapping safe sets for some i≠ji≠ j; see Fig. 2. Such overlaps can invalidate the geometric separation used in the contingency constraints and may lead to loss of recursive feasibility. The FoS rule prevents this by decoupling the model-dependent generation of candidate safe sets from the geometric decision whether to shift the active safe set to the new candidate or to freeze it at its previously active value. In the following, the closed-loop execution of the proposed decentralized contingency MPC scheme is given in algorithmic form. Algorithm 1 Decentralized Contingency MPC with FoS Safe Sets 1:Agents M, sampling time TsT_s, horizons Nn,NcN_n,N_c, local constraints, xirefx_i^ref, and generators Γi(⋅) _i(·) 2:Initialize t←0t← 0 and pairwise disjoint safe sets Si∗(0)S_i (0), i∈ℐi 3:while termination criterion not met do 4: for all i∈ℐi (in parallel) do 5: Measure xi(t)x_i(t), observe xj(t)j≠i\x_j(t)\_j≠ i, and reconstruct Sj∗(t)j∈ℐ\S_j (t)\_j 6: Solve the local FHOCP (4.4) 7: ui(t)←ui,(0|t)n,∗=ui,(0|t)c,∗u_i(t)← u^n, _i,(0|t)=u^c, _i,(0|t) 8: end for 9: Apply ui(t)i∈ℐ\u_i(t)\_i and measure xi(t+)i∈ℐ\x_i(t^+)\_i 10: for all i∈ℐi do 11: Compute S~i(t+) S_i(t^+) via (16) 12: Update Si∗(t+)S_i (t^+) via (19) and J^ic(t+) J_i^c(t^+) via (14) 13: end for 14: t←t+t← t^+ 15:end while 5.1 Plug-and-play (PnP) operation PnP operation allows agents to enter or leave the workspace online while preserving safety and recursive feasibility without centralized coordination or access to past communication logs. At time tjoint_join, a joining agent observes the current states of the already active agents and evaluates the state-induced safe sets Γj(xj(tjoin)) _j(x_j(t_join)). If two such sets overlap, the corresponding candidates must have been rejected by the preceding FoS update, i.e., χj(tjoin−)=1 _j(t_join^-)=1 for the involved agents. Hence, their current active safe sets cannot be inferred from Γj(xj(tjoin)) _j(x_j(t_join)) alone and are replaced by the history-free overapproximation. If no such rejection is indicated, the active safe-sets of other agents can be generated by Γj _j. 5.1.1 Frozen-set overapproximation For each agent j∈ℐj , let Sj∗(t)S_j (t) denote the active local safe set and let rj>0r_j>0 denote the agent radius. By the safe-set containment constraint (15l) enforced in the local FHOCP, the current body set satisfies ℬj(t)⊆Sj∗(t),B_j(t) S_j (t), which implies ‖pj(t)−cj(t)‖≤Rj(t)−rj.\|p_j(t)-c_j(t)\|≤ R_j(t)-r_j. (20) Assume moreover that a known upper bound Rj,max>0R_j, >0 on the active safe-set radius is available, i.e., Rj(t)≤Rj,max,∀t∈ℤ+.R_j(t)≤ R_j, , ∀ t _+. (21) Such a bound may be obtained from the chosen safe-set generator and the admissible state set. Definition 3 (History-free reconstruction ball). Given the current position pj(t)∈ℝnpp_j(t) ^n_p of agent j and an upper bound Rj,maxR_j, on the possibly frozen safe-set radius, define the history-free reconstruction ball Sjrec(t):=(pj(t),Rjrec),Rjrec:=2Rj,max−rj.S_j^rec(t):=B\! (p_j(t),\,R_j^rec ), R_j^rec:=2R_j, -r_j. (22) Lemma 1 (Outer approximation of frozen sets). Suppose that (20) and (21) hold. Then, for any time t at which agent j is frozen, the active safe set is contained in the reconstruction ball, i.e., Sj∗(t)⊆Sjrec(t).S_j (t) S_j^rec(t). (23) Proof. Fix such a time t and let q∈Sj∗(t)=(cj(t),Rj(t))q∈ S_j (t)=B(c_j(t),R_j(t)). By the triangle inequality, ‖q−pj(t)‖≤‖q−cj(t)‖+‖cj(t)−pj(t)‖.\|q-p_j(t)\|≤\|q-c_j(t)\|+\|c_j(t)-p_j(t)\|. The first term satisfies ‖q−cj(t)‖≤Rj(t)\|q-c_j(t)\|≤ R_j(t) by definition of Sj∗(t)S_j (t), and the second term satisfies ‖cj(t)−pj(t)‖≤Rj(t)−rj\|c_j(t)-p_j(t)\|≤ R_j(t)-r_j by (20). Hence, ‖q−pj(t)‖≤2Rj(t)−rj≤2Rj,max−rj=Rjrec.\|q-p_j(t)\|≤ 2R_j(t)-r_j≤ 2R_j, -r_j=R_j^rec. Therefore, q∈(pj(t),Rjrec)=Sjrec(t),q (p_j(t),R_j^rec )=S_j^rec(t), which proves (23). ∎ Lemma 1 provides a conservative measurement-based substitute for an unknown frozen safe set. For non-frozen agents, no overapproximation is needed because the active safe set is reconstructable from the current state via Γj _j. Assumption 6 (Feasible join initialization). At time tjoint_join, a joining agent i can select an initial active safe set Si∗(tjoin)S_i (t_join) according to the deterministic safe-set construction framework such that it does not overlap with the safe-set representations of already active agents, i.e., Si∗(tjoin)∩S^j(tjoin)=∅,∀j∈ℐ,S_i (t_join)∩ S_j(t_join)= , ∀ j , (24) where S^j(tjoin):=Sj∗(tjoin),if χj(tjoin)=0,Sjrec(tjoin),if χj(tjoin)=1. S_j(t_join):= casesS_j (t_join),&if _j(t_join)=0,\\[1.99997pt] S_j^rec(t_join),&if _j(t_join)=1. cases 5.1.2 Join and leave protocol Algorithm 2 PnP join protocol 1:Safe-set generators Γj(⋅) _j(·), radius bounds Rj,maxR_j, , and local FHOCP ingredients 2:Obtain xj(tjoin)j∈ℐ\x_j(t_join)\_j and infer χj(tjoin−)j∈ℐ\ _j(t_join^-)\_j for overlapping agents from Γj(xj(tjoin)) _j(x_j(t_join)) 3:Construct the safe-set representations ∀j∈ℐ∀ j S^j(tjoin)=Sjrec(tjoin),χj(tjoin−)=1.Γj(xj(tjoin)),otherwise. S_j(t_join)= \ array[]@l@S_j^rec(t_join),&\!\! _j(t_join^-)=1.\\[1.99997pt] _j(x_j(t_join)),&\!\!otherwise. array . 4:Choose Si∗(tjoin)=Γi(xi(tjoin))S_i (t_join)= _i(x_i(t_join)) such that Si∗(tjoin)∩S^j(tjoin)=∅,∀j∈ℐ.S_i (t_join)∩ S_j(t_join)= , ∀ j . 5:if no such Si∗(tjoin)S_i (t_join) exists then 6: Reject or postpone the join 7: return 8:end if 9:Solve the FHOCP (4.4) for agent i using Si∗(tjoin)S_i (t_join) 10:Apply the shared first input and update ℐ←ℐ∪iI ∪\i\ A leaving protocol is immediate in the decentralized setting: When an agent exits, it is removed from the set of observed agents and from the locally reconstructed constraints. The remaining agents continue to solve their local contingency MPC problems, and the closed-loop guarantees are preserved by construction. 6 System-theoretic analysis This section establishes the main closed-loop guarantees of the proposed decentralized contingency MPC scheme combined with the FoS update rule. First, for a fixed set of active agents, recursive feasibility and collision avoidance are addressed. After that, the Lyapunov-type decrease induced by the shifted-tail bound update is analyzed and the corresponding convergence statement is derived. The PnP protocol introduced in Section 5 is treated separately and does not enter the core recursive-feasibility statement below. The recursive-feasibility and Lyapunov-type arguments developed in this section follow the classical shifted-candidate logic of MPC and NMPC, adapted here to the decentralized contingency formulation with FoS-based safe-set updates [4, 14]. The detailed proofs are deferred to the Appendix. Assumption 7 (Initial feasibility and separation). At time t0=0t_0=0, the local FHOCP (4.4) is feasible for every agent i∈ℐi , and the initial active local safe sets are pairwise disjoint, i.e., Si∗(0)∩Sj∗(0)=∅,∀i≠j.S_i (0)∩ S_j (0)= , ∀ i≠ j. Assumption 8 (Nominal completion). Whenever a feasible contingency candidate at time t+t^+ is available, there exists a feasible nominal candidate at time t+t^+ satisfying the nominal initialization, dynamics, and state/input constraints in (4.4). This is, for example, satisfied if the nominal part is chosen identical to the contingency part. Lemma 2 (Disjointness invariance). Under Assumption 7 and the update rule (19), the active local safe sets remain pairwise disjoint for all t∈ℤ+t _+, i.e., Si∗(t)∩Sj∗(t)=∅,∀i≠j.S_i (t)∩ S_j (t)= , ∀ i≠ j. Theorem 1 (Recursive feasibility). Suppose that Assumptions 1–5, 7, and 8 hold. Consider the proposed decentralized contingency MPC scheme with the FoS update rule (19) and the shifted-tail update of the Lyapunov bound (14). Then the local FHOCP (4.4) remains feasible for all times, i.e., for every agent i∈ℐi , (4.4) is feasible at every t∈ℤ+t _+. Theorem 2 (Closed-loop collision avoidance). Suppose that the assumptions of Theorem 1 hold. Then, under the proposed decentralized contingency MPC scheme with the FoS update rule, the closed-loop execution is collision-free for all times, i.e., ℬi(t)∩ℬj(t)=∅,∀i≠j,∀t∈ℤ+.B_i(t) _j(t)= , ∀ i≠ j,\ ∀ t _+. Corollary 1 (Preservation under PnP events). Consider the proposed decentralized contingency MPC scheme with the FoS update rule. Join: Let a new agent inew∉ℐi_new request insertion at time tjoint_join. If Assumption 6 holds, then recursive feasibility and collision avoidance are preserved for the augmented active set ℐ+:=ℐ∪inew∀t≥tjoin.I^+:=I∪\i_new\ ∀ t≥ t_join. Leave: If an agent j∈ℐj leaves the workspace at time tleavet_leave and is removed from the locally reconstructed constraints of the remaining agents. Recursive feasibility and collision avoidance are preserved for the reduced active set ℐ−:=ℐ∖j∀t≥tleave.I^-:=I \j\ ∀ t≥ t_leave. The convergence mechanism is induced by the Lyapunov-type constraint (15n). The argument follows the standard receding-horizon value-function logic: feasibility of the shifted contingency candidate yields an explicit feasible upper bound for the successor problem, and the imposed Lyapunov constraint then enforces a monotone decrease of the optimal contingency-cost sequence. This is the same shifted-candidate proof architecture used in classical MPC stability proofs; see, e.g., [4, 14]. Definition 4 (∞K_∞ function). A continuous function α:ℝ+→ℝ+α:R_+ _+ is said to belong to class ∞K_∞ if α(0)=0,α(0)=0, α is strictly increasing, and α(s)→∞as s→∞.α(s)→∞\ as s→∞. Assumption 9 (Regularity and coercivity). Let i:=i×i,Z_i:=X_i×U_i, and let ¯i Z_i denote its closure. For each agent i∈ℐi , the following properties hold: 1. Continuity of dynamics and cost. The mappings fi:ℝni×ℝmi→ℝni,ℓic:ℝni×ℝmi→ℝ+,f_i:R^n_i×R^m_i ^n_i,\ _i^c:R^n_i×R^m_i _+, and the offset cost Vic:ℝni×ℝni→ℝ+V_i^c:R^n_i×R^n_i _+ are continuous on the relevant admissible sets. 2. Incremental continuity of the dynamics. There exists a function αf,i∈∞ _f,i _∞ such that ‖fi(x,u)−fi(x~,u~)‖≤αf,i(‖[x−x~u−u~]‖), \|f_i(x,u)-f_i( x, u)\|≤ _f,i\! ( \| bmatrixx- x\\ u- u bmatrix \| ), ∀(x,u),(x~,u~)∈¯i. ∀(x,u),( x, u)∈ Z_i. 3. Positive definiteness. There exist functions α¯ℓ,i,α¯ℓ,i∈∞ α_ ,i,\, α_ ,i _∞ such that α¯ℓ,i(‖(e,δu)‖)≤ℓic(e,δu)≤α¯ℓ,i(‖(e,δu)‖), α_ ,i\! (\|(e,δ u)\| )≤ _i^c(e,δ u)≤ α_ ,i\! (\|(e,δ u)\| ), (25) ∀(e,δu)∈¯ie, ∀(e,δ u)∈ Z^e_i, where ¯ie Z^e_i denotes the relevant closed admissible set in error coordinates: e=xic−x¯ice=x_i^c- x_i^c and δu=uic−u¯icδ u=u_i^c- u_i^c. In particular, ℓic _i^c is positive definite with respect to (e,δu)=(0,0)(e,δ u)=(0,0). 4. Positive definiteness of the offset cost. There exist functions α¯V,i,α¯V,i∈∞ α_V,i,\, α_V,i _∞ such that α¯V,i(‖x¯ic−xiref‖)≤Vic(x¯ic,xiref)≤α¯V,i(‖x¯ic−xiref‖) α_V,i\! (\| x_i^c-x_i^ref\| )≤ V_i^c( x_i^c,x_i^ref)≤ α_V,i\! (\| x_i^c-x_i^ref\| ) for all relevant admissible equilibrium candidates x¯ic x_i^c. For a fixed agent i∈ℐi , define the equilibrium-tracking errors associated with the optimal contingency equilibrium by ei(t):=xi(t)−x¯ic,∗(t),δui(t):=ui(t)−u¯ic,∗(t),e_i(t):=x_i(t)- x_i^c, (t), δ u_i(t):=u_i(t)- u_i^c, (t), where ui(t)=ui,(0|t)c,∗=ui,(0|t)n,∗u_i(t)=u_i,(0|t)^c, =u_i,(0|t)^n, is the applied shared first input and xi(t)x_i(t) is as in (15b). Proposition 1. Fix an agent i∈ℐi and suppose that recursive feasibility of the local FHOCP (4.4) holds for all t∈ℤ+t _+. Assume that the Lyapunov constraint (15n) is enforced at every time step, that the bound J^ic(⋅) J_i^c(·) is updated by the shifted-tail rule (14), and that Assumption 9 holds. Then Jic,∗(t+)≤Jic,∗(t)−ℓic(ei(t),δui(t)),∀t∈ℤ+.J_i^c, (t^+)≤ J_i^c, (t)- _i^c\! (e_i(t),δ u_i(t) ), ∀ t _+. (26) In particular, the sequence Jic,∗(t)t∈ℤ+\J_i^c, (t)\_t _+ is monotonically nonincreasing and lower bounded, hence convergent, and ∑t=0∞ℓic(ei(t),δui(t))<∞. _t=0^∞ _i^c\! (e_i(t),δ u_i(t) )<∞. (27) Consequently, ℓic(ei(t),δui(t))→0as t→∞, _i^c\! (e_i(t),δ u_i(t) )→ 0\ as t→∞, and by the lower bound in (25), ‖(ei(t),δui(t))‖→0as t→∞.\|(e_i(t),δ u_i(t))\|→ 0\ as t→∞. Remark 7 (Interpretation of Proposition 1). Proposition 1 is the precise Lyapunov-type statement available without any additional assumption on the time evolution of the selected contingency equilibrium. It guarantees monotone decrease of the optimal contingency cost, summability of the stage cost, and asymptotic convergence of the closed-loop trajectory in the equilibrium-tracking coordinates (ei(t),δui(t))(e_i(t),δ u_i(t)). Corollary 2 (Convergence to a fixed equilibrium). Suppose that the assumptions of Proposition 1 hold and that there exists t¯∈ℤ+ t _+ such that, for all t≥t¯t≥ t, x¯ic,∗(t)=x¯ic,⋆ x_i^c, (t)= x_i^c, and u¯ic,∗(t)=u¯ic,⋆ u_i^c, (t)= u_i^c, . Then xi(t)→x¯ic,⋆x_i(t)→ x_i^c, and ui(t)→u¯ic,⋆u_i(t)→ u_i^c, as t→∞t→∞. 7 Simulation Study The simulation results presented in the following are illustrated in the supplementary video available at https://youtu.be/uBLV58GRvFw. 7.1 Setup The general framework developed in the previous sections is now instantiated for a specific agent model in order to assess the practical performance of the proposed decentralized contingency MPC scheme. For the simulation study, each agent is modeled by a discrete-time double integrator in a bounded planar workspace ⊂ℝ2,i.e.,np=2.W ^2,\ i.e.,\ n_p=2. For each agent i∈ℐi , the state is given by xi(t)=[pi(t)vi(t)]⊤∈ℝ4,pi(t)∈ℝ2,vi(t)∈ℝ2,x_i(t)=[p_i(t)\ \ v_i(t)] ^4,\ p_i(t) ^2,\ v_i(t) ^2, and the input is ui(t)∈ℝ2.u_i(t) ^2. The discrete-time dynamics are xi(t+)=f(xi(t),ui(t))=Axi(t)+Bui(t),x_i(t^+)=f(x_i(t),u_i(t))=Ax_i(t)+Bu_i(t), (28) with sampling time Ts=0.1sT_s=0.1\,s and system matrices A=[I2TsI202I2],B=[12Ts2I2TsI2],A= bmatrixI_2&T_sI_2\\ 0_2&I_2 bmatrix, B= bmatrix 12T_s^2I_2\\ T_sI_2 bmatrix, where I2∈ℝ2×2I_2 ^2× 2 denotes the identity matrix and 02∈ℝ2×20_2 ^2× 2 the zero matrix. The position output is pi(t)=Cixi(t),Ci=[I2 02].p_i(t)=C_ix_i(t),\ C_i=[I_2\ \ 0_2]. Each agent body is approximated by a disc of radius ri=0.2m.r_i=0.2\,m. State and input bounds are imposed through the velocity and acceleration limits ‖vi(t)‖≤3m/s,‖ui(t)‖≤3.5m/s2.\|v_i(t)\|≤ 3\,m/s,\ \|u_i(t)\|≤ 3.5\,m/s^2. The nominal prediction horizon is chosen as Nn=20N_n=20. For the double-integrator model, the contingency horizon NcN_c is chosen to allow one shared first input followed by admissible braking to a stopped equilibrium, x¯ic=[p¯ic 0]⊤,u¯ic=0. x_i^c=[ p_i^c\ \ 0] ,\ u_i^c=0. A sufficient horizon length is Nc≥1+⌈vmaxamaxTs⌉.N_c≥ 1+ v_ a_ T_s . (29) For the double-integrator model, the active safe-set center in (2) is chosen as the current position, ci(t)=pi(t)c_i(t)=p_i(t). The corresponding stopping radius is Ri(t)=12Ts2‖u‖+Ts‖v‖+‖v+Tsu‖22|amin|+ri.R_i(t)= 12T_s^2\|u\|+T_s\|v\|+ \|v+T_su\|^22|a_min|+r_i. The first two terms bound the displacement during the shared first input u∈u , while the third term bounds the subsequent braking distance. This particular radius is not essential; any choice satisfying Assumption 5 is admissible. 7.1.1 MPC Implementation All local optimal control problems are implemented in CasADi and solved using IPOPT [28]. Solver tolerances are set to 10−510^-5 for feasibility and optimality, and the maximum number of iterations is capped at 20002000. Warm-starting is used throughout. Tracking and equilibrium optimization The quadratic objective in the form of Ji(Xin(t),Uin(t),x¯ic(t),xiref)= J_i (X_i^n(t),U_i^n(t), x^c_i(t),x_i^ref )= ∑k=0Nn−1(‖pi,(k|t)n−piref‖Qp2+‖vi,(k|t)n‖Qv2+‖ui,(k|t)n‖Ru2) _k=0^N_n-1 (\|p^n_i,(k|t)-p_i^ref\|_Q_p^2+\|v^n_i,(k|t)\|_Q_v^2+\|u^n_i,(k|t)\|_R_u^2 ) +‖pi,(Nn|t)n−piref‖Qp2+γVic(x¯ic(t),xiref), \ +\|p^n_i,(N_n|t)-p_i^ref\|_Q_p^2+γ\,V_i^c\! ( x^c_i(t),x_i^ref ), with diagonal weights Qp=Qv=Ru=I2,Q_p=Q_v=R_u=I_2, and Vic(x¯ic(t),xiref)=‖x¯ic(t)−xiref‖Ps2,xiref=[piref0]⊤,V_i^c\! ( x^c_i(t),x_i^ref )=\| x_i^c(t)-x_i^ref\|_P_s^2,\ \ x^ref_i= bmatrixp_i^ref&0 bmatrix , where Ps=I4P_s=I_4 and γ=0.1γ=0.1 is used in the simulations. Contingency cost The Lyapunov bound uses the safe-cost functional Jic(t)=∑k=0Nc−1 J_i^c(t)= _k=0^N_c-1 (‖xi,(k|t)c−x¯ic(t)‖Qs2+‖ui,(k|t)c‖Rs2) (\|x^c_i,(k|t)- x_i^c(t)\|_Q_s^2+\|u^c_i,(k|t)\|_R_s^2 ) +‖x¯ic(t)−xiref‖Ps2, +\| x_i^c(t)-x_i^ref\|_P_s^2, implemented with Qs=0.1⋅I4Q_s=0.1· I_4, Rs=0.1⋅I2R_s=0.1· I_2, and PsP_s as before. Nominal soft collision-avoidance constraints For each other agent j≠ij≠ i and each nominal stage k∈ℤ0Nn−1k _0^N_n-1 we introduce nonnegative slacks sij,k≥0s_ij,k≥ 0, and impose the squared-distance constraint ‖pi,(k|t)n−cj(t)‖2+sij,k≥dij,k2,\|p^n_i,(k|t)-c_j(t)\|^2+s_ij,k\;≥\;d_ij,k^2, (30) where cj(t)c_j(t) and Rj(t)R_j(t) denote the currently reconstructed active safe-set center and radius of agent j, and dij,k:=Rs(xi,(k|t)n)+Rj(t).d_ij,k:=R_s (x^n_i,(k|t) )+R_j(t). The slack variables are penalized in the nominal objective by Ji←Ji+ρnom∑j∈ℐ∖i∑k=0Nn−1sij,k.J_i← J_i+ _nom _j \i\ _k=0^N_n-1s_ij,k. with ρnom=100 _nom=100. 7.1.2 Increasing agent density This scenario class evaluates scalability with respect to agent density. The increasing-density study uses M=5,10,20M=5,10,20 agents with randomly sampled initial and reference positions under a minimum separation. Fig. 3 shows collision-free closed-loop trajectories for all densities. The normalized contingency cost in Fig. 4 decreases as enforced by (15n); Higher densities mainly increase the transient phase due to stronger local interactions. Figure 3: Representative closed-loop trajectories in the increasing-density study: M=5M=5 (upper left), M=10M=10 (upper right), and M=20M=20 (bottom). Filled circles denote initial positions and star markers denote reference positions. The gray objects represent static obstacles. The trajectories remain collision-free in all cases. Figure 4: Normalized contingency-cost evolution Jic(t)/Jic(0)J_i^c(t)/J_i^c(0) for M=10M=10 agents (see Fig. 3). The trajectories satisfy the Lyapunov-decreasing behavior induced by the shifted-tail contingency-cost update (constraint (15n)). 7.1.3 Bottleneck The bottleneck scenario stresses conflict resolution in a narrow passage formed by two static obstacles. Fig. 5 shows that all agents pass the constriction without collisions. The distance signals and freeze count in Figs. 6–7 show that close encounters near the passage trigger temporary freeze events, which prevent unsafe safe-set updates while preserving closed-loop progress. Figure 5: Closed-loop trajectories in the bottleneck scenario. Filled circles denote initial positions and star markers denote target positions. The gray obstacles create a narrow passage that induces strong local interactions. Figure 6: Distance evolution in the bottleneck scenario. Top: pairwise distances between agents; the dashed line indicates the minimum admissible distance. Bottom: distances between agent safe sets; values close to zero indicate strong interaction and freeze-operator activation. Figure 7: Number of frozen agents over time in the bottleneck scenario. The freeze events are sparse and temporary. 7.1.4 PnP The PnP experiment evaluates the proposed scheme under online changes in the set of active agents. Starting from a feasible multi-agent configuration, three additional agents join the workspace during closed-loop operation and are initialized according to the join protocol in Section 5.1. Later, a different agent leaves the workspace and is removed from the locally reconstructed constraints of the remaining agents. Fig. 8 summarizes the experiment. The results illustrate that insertion and removal can be handled without trajectory communication and without modifying the local MPC problem structure of the remaining agents. In particular, the deterministic FoS update and the (history-free) reconstruction at the join time allow the scheme to preserve collision avoidance and feasibility despite the changing agent configuration. Figure 8: PnP scenario with online agent insertion and removal. Left: Closed-loop trajectories in a cluttered workspace (gray obstacles). Filled circles denote initial positions and stars denote final positions; colors correspond to individual agents. Right: Activity timeline indicating when each agent is active/inactive; vertical dashed lines mark join/leave events. The proposed scheme maintains safe, collision-free motion throughout despite the changing set of active agents. 8 Conclusions and outlook The proposed decentralized contingency MPC scheme provides a provably safe mechanism for local interaction in strongly coupled multi-agent systems without trajectory exchange or communication. Safety is ensured through local constraint reconstruction and the deterministic FoS update of the active safe sets. Recursive feasibility, collision-free closed-loop execution, and Lyapunov-type convergence follow from the shifted-tail construction and the associated decrease condition. The simulations indicate moderate conservatism even in dense and cluttered environments. The safe-set principle is also aligned with intuitive behavior in traffic: a driver maintains a safety margin such that an emergency maneuver remains feasible. Similarly, the local safe sets ensure that a feasible contingency action remains available during multi-agent interaction. Future work should address disturbances, model mismatch, sensing noise or delays in reconstructed neighbor safe sets, and heterogeneous agent dynamics and constraints. Another direction is a memoryless safe-set update, enabling active safe sets or tight outer approximations to be reconstructed from instantaneous information only. This would simplify decentralized implementation and reduce the conservatism of PnP operation. Appendix Appendix A Auxiliary shifted-tail lemmas The recursive-feasibility and Lyapunov-type arguments both rely on the same shifted contingency candidate. To avoid duplicate arguments and cross-references between proofs, the two key shifted-tail facts are collected first. Lemma 3 (Feasibility of the shifted candidate). Fix an agent i∈ℐi and a time t∈ℤ+t _+ at which the local FHOCP (4.4) is feasible. Let ( ( xi,(k|t)n,∗k=0Nn,ui,(k|t)n,∗k=0Nn−1,xi,(k|t)c,∗k=0Nc,ui,(k|t)c,∗k=0Nc−1, \x_i,(k|t)^n, \_k=0^N_n,\u_i,(k|t)^n, \_k=0^N_n-1,\x_i,(k|t)^c, \_k=0^N_c,\u_i,(k|t)^c, \_k=0^N_c-1, x¯ic,∗(t),u¯ic,∗(t)) x_i^c, (t), u_i^c, (t) ) be an optimal feasible solution. Define, at time t+t^+, x~i,(k|t+)c x_i,(k|t^+)^c :=xi,(k+1|t)c,∗,k=0,…,Nc−1, :=x_i,(k+1|t)^c, , k=0,…,N_c-1, (A.1) u~i,(k|t+)c u_i,(k|t^+)^c :=ui,(k+1|t)c,∗,k=0,…,Nc−2, :=u_i,(k+1|t)^c, , k=0,…,N_c-2, (A.2) u~i,(Nc−1|t+)c u_i,(N_c-1|t^+)^c :=u¯ic,∗(t), := u_i^c, (t), (A.3) x¯~ic(t+) x_i^c(t^+) :=x¯ic,∗(t),u¯~ic(t+):=u¯ic,∗(t). := x_i^c, (t), u_i^c(t^+):= u_i^c, (t). (A.4) Then the candidate (x~i,(k|t+)ck=0Nc,u~i,(k|t+)ck=0Nc−1,x¯~ic(t+),u¯~ic(t+)) (\ x_i,(k|t^+)^c\_k=0^N_c,\ u_i,(k|t^+)^c\_k=0^N_c-1, x_i^c(t^+), u_i^c(t^+) ) satisfies the contingency-part constraints (15b), (15e), (15g), (15h), (15i)–(15k), (15l), and (15m) at time t+t^+. Proof. By feasibility at time t, xi,(Nc|t)c,∗=x¯ic,∗(t),x¯ic,∗(t)=fi(x¯ic,∗(t),u¯ic,∗(t)).x_i,(N_c|t)^c, = x_i^c, (t),\ x_i^c, (t)=f_i\! ( x_i^c, (t), u_i^c, (t) ). (A.5) The applied input is ui(t)=ui,(0|t)n,∗=ui,(0|t)c,∗.u_i(t)=u_i,(0|t)^n, =u_i,(0|t)^c, . Hence, by Assumption 1, xi(t+)=fi(xi,(0|t)c,∗,ui,(0|t)c,∗)=xi,(1|t)c,∗.x_i(t^+)=f_i\! (x_i,(0|t)^c, ,u_i,(0|t)^c, )=x_i,(1|t)^c, . (A.6) We first define the terminal candidate state by x~i,(Nc|t+)c:=fi(x~i,(Nc−1|t+)c,u~i,(Nc−1|t+)c). x_i,(N_c|t^+)^c:=f_i\! ( x_i,(N_c-1|t^+)^c, u_i,(N_c-1|t^+)^c ). (A.7) Using (A.1), (A.3), and (A.5), x~i,(Nc|t+)c x_i,(N_c|t^+)^c =fi(xi,(Nc|t)c,∗,u¯ic,∗(t)) =f_i (x_i,(N_c|t)^c, , u_i^c, (t) ) (A.8) =fi(x¯ic,∗(t),u¯ic,∗(t)) =f_i ( x_i^c, (t), u_i^c, (t) ) =x¯ic,∗(t)=x¯~ic(t+). = x_i^c, (t)= x_i^c(t^+). Initialization and dynamics. By (A.6) and (A.1), x~i,(0|t+)c=xi,(1|t)c,∗=xi(t+), x_i,(0|t^+)^c=x_i,(1|t)^c, =x_i(t^+), so (15b) holds for the contingency part. For k=0,…,Nc−2k=0,…,N_c-2, feasibility at time t gives x~i,(k+1|t+)c=xi,(k+2|t)c,∗ x_i,(k+1|t^+)^c=x_i,(k+2|t)^c, =fi(xi,(k+1|t)c,∗,ui,(k+1|t)c,∗) =f_i\! (x_i,(k+1|t)^c, ,u_i,(k+1|t)^c, ) =fi(x~i,(k|t+)c,u~i,(k|t+)c), =f_i\! ( x_i,(k|t^+)^c, u_i,(k|t^+)^c ), Thus (15e) holds for k=0,…,Nc−2k=0,…,N_c-2, and the case k=Nc−1k=N_c-1 is given by (A.7). State, input, and static-obstacle constraints. For k=0,…,Nc−2k=0,…,N_c-2, x~i,(k|t+)c=xi,(k+1|t)c,∗∈i,u~i,(k|t+)c=ui,(k+1|t)c,∗∈i x_i,(k|t^+)^c=x_i,(k+1|t)^c, _i, u_i,(k|t^+)^c=u_i,(k+1|t)^c, _i by feasibility at time t. For the last stage, x~i,(Nc−1|t+)c=xi,(Nc|t)c,∗=x¯ic,∗(t)∈i, x_i,(N_c-1|t^+)^c=x_i,(N_c|t)^c, = x_i^c, (t) _i, and u~i,(Nc−1|t+)c=u¯ic,∗(t)∈i. u_i,(N_c-1|t^+)^c= u_i^c, (t) _i. The same index shift shows that h(p~i,(k|t+)c)≥0,∀k∈ℤ0Nc,h ( p_i,(k|t^+)^c )≥ 0, ∀ k _0^N_c, where p~i,(k|t+)c:=Cix~i,(k|t+)c p_i,(k|t^+)^c:=C_i x_i,(k|t^+)^c. Terminal constraints. Equation (A.8) yields x~i,(Nc|t+)c=x¯~ic(t+), x_i,(N_c|t^+)^c= x_i^c(t^+), which is (15i). Moreover, by (A.4) and (A.5), x¯~ic(t+)=fi(x¯~ic(t+),u¯~ic(t+)), x_i^c(t^+)=f_i\! ( x_i^c(t^+), u_i^c(t^+) ), so (15j) holds. Finally, feasibility at time t implies Cix¯ic,∗(t)∈Si∗(t).C_i x_i^c, (t)∈ S_i (t). If χi(t)=1 _i(t)=1, then Si∗(t+)=Si∗(t)S_i (t^+)=S_i (t) by (19), so Cix¯~ic(t+)∈Si∗(t+).C_i x_i^c(t^+)∈ S_i (t^+). If χi(t)=0 _i(t)=0, then Si∗(t+)=S~i(t+)=Γi(xi(t+))S_i (t^+)= S_i(t^+)= _i(x_i(t^+)), and the tail-containment argument below with k=1k=1 already implies Cix¯~ic(t+)∈Si∗(t+).C_i x_i^c(t^+)∈ S_i (t^+). Hence (15k) holds. Active safe-set containment. Active safe-set containment (15l). It remains to show that the shifted contingency candidate satisfies the active safe-set containment constraint at time t+t^+. We distinguish two cases. Case 1: χi(t)=1 _i(t)=1. Then, by the FoS update rule (19), the active safe set is frozen, i.e., Si∗(t+)=Si∗(t).S_i (t^+)=S_i (t). Since the contingency trajectory at time t was feasible and satisfied (15l) in Si∗(t)S_i (t), the shifted tail remains contained in the same set. Hence, (15l) holds at time t+t^+. Case 2: χi(t)=0 _i(t)=0. Then the active safe set is updated to the state-induced candidate set, Si∗(t+)=Γi(xi(t+)).S_i (t^+)= _i\! (x_i(t^+) ). By exact dynamics and the shared first input, xi(t+)=xi,(1|t)c,∗.x_i(t^+)=x_i,(1|t)^c, . Therefore, the new active safe set is exactly the one induced by the first predicted contingency successor state. Since the feasible solution at time t satisfies the tail-containment constraint (15m), the entire shifted contingency tail is contained in that induced safe set. Hence, (15l) also holds at time t+t^+. Tail-containment constraint (15m). Let arbitrary k∈ℤ0Nc,l∈ℤkNck _0^N_c,\ l _k^N_c be given for the candidate at time t+t^+. It must be shown that ‖p~i,(l|t+)c−ci(x~i,(k|t+)c)‖≤Ri(x~i,(k|t+)c)−ri. \| p^c_i,(l|t^+)-c_i\! ( x^c_i,(k|t^+) ) \|≤ R_i\! ( x^c_i,(k|t^+) )-r_i. For k≤Nc−1k≤ N_c-1 and l≤Nc−1l≤ N_c-1, the shifted candidate satisfies x~i,(l|t+)c=xi,(l+1|t)c,∗,x~i,(k|t+)c=xi,(k+1|t)c,∗. x^c_i,(l|t^+)=x^c, _i,(l+1|t), x^c_i,(k|t^+)=x^c, _i,(k+1|t). Since the safe-set generator is deterministic, this implies ci(x~i,(k|t+)c)=ci(xi,(k+1|t)c,∗),Ri(x~i,(k|t+)c)=Ri(xi,(k+1|t)c,∗).c_i\! ( x^c_i,(k|t^+) )=c_i\! (x^c, _i,(k+1|t) ),\ R_i\! ( x^c_i,(k|t^+) )=R_i\! (x^c, _i,(k+1|t) ). Moreover, l∈ℤkNc−1l _k^N_c-1 implies l+1∈ℤk+1Ncl+1 _k+1^N_c. Hence, feasibility of the solution at time t and constraint (15m) yield ‖pi,(l+1|t)c,∗−ci(xi,(k+1|t)c,∗)‖≤Ri(xi,(k+1|t)c,∗)−ri, \|p^c, _i,(l+1|t)-c_i\! (x^c, _i,(k+1|t) ) \|≤ R_i\! (x^c, _i,(k+1|t) )-r_i, which is exactly the desired inequality. For k≤Nc−1k≤ N_c-1 and l=Ncl=N_c, we have x~i,(Nc|t+)c=x¯~ic(t+)=x¯ic,∗(t)=xi,(Nc|t)c,∗. x^c_i,(N_c|t^+)= x^c_i(t^+)= x^c, _i(t)=x^c, _i,(N_c|t). Since now Nc∈ℤk+1NcN_c _k+1^N_c, feasibility at time t again gives ‖p~i,(Nc|t+)c−ci(x~i,(k|t+)c)‖≤Ri(x~i,(k|t+)c)−ri. \| p^c_i,(N_c|t^+)-c_i\! ( x^c_i,(k|t^+) ) \|≤ R_i\! ( x^c_i,(k|t^+) )-r_i. Finally, for k=Nck=N_c, necessarily l=Ncl=N_c, and the claim follows directly from x~i,(Nc|t+)c=xi,(Nc|t)c,∗ x^c_i,(N_c|t^+)=x^c, _i,(N_c|t) together with feasibility at time t for the index pair (k,l)=(Nc,Nc)(k,l)=(N_c,N_c). Therefore, the shifted candidate satisfies (15m) at time t+t^+. ∎ Lemma 4 (Shifted contingency-cost identity). Under the hypotheses of Lemma 3, the shifted contingency candidate defined in (A.1)–(A.4) satisfies J~ic(t+)=J^ic(t+), J_i^c(t^+)= J_i^c(t^+), (A.9) where J^ic(t+) J_i^c(t^+) is given by (14). Proof. By definition (12), J~ic(t+)=∑k=0Nc−1 J_i^c(t^+)= _k=0^N_c-1 ℓic(x~i,(k|t+)c−x¯~ic(t+),u~i,(k|t+)c−u¯~ic(t+)) _i^c\! ( x_i,(k|t^+)^c- x_i^c(t^+), u_i,(k|t^+)^c- u_i^c(t^+) ) (A.10) +Vic(x¯~ic(t+),xiref). \;+\;V_i^c\! ( x_i^c(t^+),x_i^ref ). For k=0,…,Nc−2k=0,…,N_c-2, x~i,(k|t+)c−x¯~ic(t+)=xi,(k+1|t)c,∗−x¯ic,∗(t), x_i,(k|t^+)^c- x_i^c(t^+)=x_i,(k+1|t)^c, - x_i^c, (t), u~i,(k|t+)c−u¯~ic(t+)=ui,(k+1|t)c,∗−u¯ic,∗(t). u_i,(k|t^+)^c- u_i^c(t^+)=u_i,(k+1|t)^c, - u_i^c, (t). For the last stage, (A.1), (A.3), and (A.5) imply x~i,(Nc−1|t+)c=xi,(Nc|t)c,∗=x¯ic,∗(t),u~i,(Nc−1|t+)c=u¯ic,∗(t), x_i,(N_c-1|t^+)^c=x_i,(N_c|t)^c, = x_i^c, (t),\ u_i,(N_c-1|t^+)^c= u_i^c, (t), so the last stage contributes ℓic(0,0)=0 _i^c(0,0)=0 by Assumption 9(3). Hence J~ic(t+)=∑k=1Nc−1 J_i^c(t^+)= _k=1^N_c-1 ℓic(xi,(k|t)c,∗−x¯ic,∗(t),ui,(k|t)c,∗−u¯ic,∗(t)) _i^c\! (x_i,(k|t)^c, - x_i^c, (t),u_i,(k|t)^c, - u_i^c, (t) ) (A.11) +Vic(x¯ic,∗(t),xiref). \;+\;V_i^c\! ( x_i^c, (t),x_i^ref ). Comparing (A.11) with the optimal contingency cost at time t, Jic,∗(t)=∑k=0Nc−1 J_i^c, (t)= _k=0^N_c-1 ℓic(xi,(k|t)c,∗−x¯ic,∗(t),ui,(k|t)c,∗−u¯ic,∗(t)) _i^c\! (x_i,(k|t)^c, - x_i^c, (t),u_i,(k|t)^c, - u_i^c, (t) ) (A.12) +Vic(x¯ic,∗(t),xiref), \;+\;V_i^c\! ( x_i^c, (t),x_i^ref ), we obtain J~ic(t+)=Jic,∗(t)−ℓic(xi(t)−x¯ic,∗(t),ui(t)−u¯ic,∗(t)), J_i^c(t^+)=J_i^c, (t)- _i^c\! (x_i(t)- x_i^c, (t),u_i(t)- u_i^c, (t) ), (A.13) because xi(t)=xi,(0|t)c,∗x_i(t)=x_i,(0|t)^c, and ui(t)=ui,(0|t)c,∗u_i(t)=u_i,(0|t)^c, . By (14), the right-hand side of (A.13) is exactly J^ic(t+) J_i^c(t^+), which proves Lemma 4. ∎ Appendix B Proof of Lemma 2 Proof. The claim is shown by induction. Pairwise disjointness at t=0t=0 holds by Assumption 7. Assume that Si∗(t)∩Sj∗(t)=∅,∀i≠j,S_i (t)∩ S_j (t)= , ∀ i≠ j, holds at some time t∈ℤ+t _+. Fix arbitrary i≠ji≠ j and consider the update to t+t^+. Case 1: χi(t)=1 _i(t)=1 and χj(t)=1 _j(t)=1. Then Si∗(t+)=Si∗(t),Sj∗(t+)=Sj∗(t),S_i (t^+)=S_i (t),\ S_j (t^+)=S_j (t), and hence Si∗(t+)∩Sj∗(t+)=∅.S_i (t^+)∩ S_j (t^+)= . Case 2: χi(t)=1 _i(t)=1 and χj(t)=0 _j(t)=0. Then Si∗(t+)=Si∗(t),Sj∗(t+)=S~j(t+).S_i (t^+)=S_i (t),\ S_j (t^+)= S_j(t^+). Since χj(t)=0 _j(t)=0, definition (17) implies S~j(t+)∩Si∗(t)=∅. S_j(t^+)∩ S_i (t)= . Therefore, Si∗(t+)∩Sj∗(t+)=∅.S_i (t^+)∩ S_j (t^+)= . Case 3: χi(t)=0 _i(t)=0 and χj(t)=1 _j(t)=1. Symmetric to Case 2. Case 4: χi(t)=0 _i(t)=0 and χj(t)=0 _j(t)=0. Then Si∗(t+)=S~i(t+),Sj∗(t+)=S~j(t+).S_i (t^+)= S_i(t^+),\ S_j (t^+)= S_j(t^+). Since χi(t)=0 _i(t)=0, definition (17) implies S~i(t+)∩S~j(t+)=∅. S_i(t^+)∩ S_j(t^+)= . Hence, Si∗(t+)∩Sj∗(t+)=∅.S_i (t^+)∩ S_j (t^+)= . Since the argument holds for every pair i≠ji≠ j, the family Sp∗(t+)p∈ℐ\S_p (t^+)\_p is pairwise disjoint. This completes the induction. ∎ Appendix C Proof of Theorem 1 Proof. We show that feasibility at time t implies feasibility at time t+t^+. Fix an arbitrary agent i∈ℐi and suppose that the local FHOCP (4.4) is feasible at time t. By Lemma 3, the shifted contingency candidate defined by (A.1)–(A.4) satisfies all contingency-part constraints of (4.4) at time t+t^+. By Lemma 4, its contingency cost satisfies J~ic(t+)=J^ic(t+), J_i^c(t^+)= J_i^c(t^+), so the Lyapunov-type constraint (15n) is also feasible at time t+t^+. Hence a feasible contingency candidate exists at time t+t^+. By Assumption 8, this feasible contingency candidate admits a feasible nominal completion satisfying the remaining constraints of the local FHOCP, including the shared-first-input constraint (15c). Therefore, the full local FHOCP (4.4) is feasible at time t+t^+. Since feasibility holds at t=0t=0 by Assumption 7, induction yields feasibility for all t∈ℤ+t _+. ∎ Appendix D Proof of Theorem 2 Proof. By Theorem 1, the local FHOCP remains feasible for every agent and every time. Therefore the safe-set containment constraint (15l) holds along the closed loop, and thus ℬi(t)⊆Si∗(t),∀i∈ℐ,∀t∈ℤ+.B_i(t) S_i (t),\ ∀ i ,\ ∀ t _+. By Lemma 2, the active safe sets remain pairwise disjoint: Si∗(t)∩Sj∗(t)=∅,∀i≠j,∀t∈ℤ+.S_i (t)∩ S_j (t)= , ∀ i≠ j,\ ∀ t _+. Hence, for any distinct agents i≠ji≠ j, ℬi(t)⊆Si∗(t),ℬj(t)⊆Sj∗(t),B_i(t) S_i (t), _j(t) S_j (t), it holds that ℬi(t)∩ℬj(t)=∅∀i≠j,∀t∈ℤ+.B_i(t) _j(t)= ∀ i≠ j,\ ∀ t _+. ∎ Appendix E Proof of Proposition 1 Proof. Fix an arbitrary agent i∈ℐi and time t∈ℤ+t _+. By recursive feasibility, the local FHOCP (4.4) is feasible at both t and t+t^+. By Lemma 3, the shifted contingency candidate is feasible at time t+t^+, and by Lemma 4, J~ic(t+)=J^ic(t+). J_i^c(t^+)= J_i^c(t^+). Therefore, optimality of the solution at time t+t^+ gives Jic,∗(t+)≤J~ic(t+)=J^ic(t+).J_i^c, (t^+)≤ J_i^c(t^+)= J_i^c(t^+). (E.1) Substituting the bound update (14) into (E.1) yields Jic,∗(t+)≤Jic,∗(t)−ℓic(ei(t),δui(t)),J_i^c, (t^+)≤ J_i^c, (t)- _i^c\! (e_i(t),δ u_i(t) ), which is exactly (26). Since ℓic≥0 _i^c≥ 0, the sequence Jic,∗(t)t∈ℤ+\J_i^c, (t)\_t _+ is monotonically nonincreasing. Moreover, Jic,∗(t)≥0J_i^c, (t)≥ 0 for all t, because (12) is the sum of the nonnegative stage cost and the nonnegative offset cost. Hence Jic,∗(t)\J_i^c, (t)\ is lower bounded and therefore convergent. Summing (26) from t=0t=0 to T−1T-1 gives ∑t=0T−1ℓic(ei(t),δui(t))≤Jic,∗(0)−Jic,∗(T)≤Jic,∗(0). _t=0^T-1 _i^c\! (e_i(t),δ u_i(t) )≤ J_i^c, (0)-J_i^c, (T)≤ J_i^c, (0). (E.2) Letting T→∞T→∞ yields (27). In particular, the nonnegative sequence ℓic(ei(t),δui(t)) _i^c\! (e_i(t),δ u_i(t) ) converges to zero. Finally, by Assumption 9(3), there exists α¯ℓ,i∈∞ α_ ,i _∞ such that α¯ℓ,i(‖(ei(t),δui(t))‖)≤ℓic(ei(t),δui(t)),∀t∈ℤ+. α_ ,i\! (\|(e_i(t),δ u_i(t))\| )≤ _i^c\! (e_i(t),δ u_i(t) ), ∀ t _+. Suppose, for contradiction, that ‖(ei(t),δui(t))‖↛0\|(e_i(t),δ u_i(t))\| → 0. Then there exist ε>0 >0 and an infinite subsequence tmm∈ℤ+\t_m\_m _+ such that ‖(ei(tm),δui(tm))‖≥ε,∀m∈ℤ+.\|(e_i(t_m),δ u_i(t_m))\|≥ , ∀ m _+. By strict monotonicity of α¯ℓ,i α_ ,i, ℓic(ei(tm),δui(tm))≥α¯ℓ,i(ε)>0,∀m∈ℤ+, _i^c\! (e_i(t_m),δ u_i(t_m) )≥ α_ ,i( )>0, ∀ m _+, which contradicts ℓic(ei(t),δui(t))→0. _i^c\! (e_i(t),δ u_i(t) )→ 0. Therefore, ‖(ei(t),δui(t))‖→0as t→∞.\|(e_i(t),δ u_i(t))\|→ 0 t→∞. ∎ Appendix F Proof of Corollary 2 Proof. By Proposition 1, ‖(ei(t),δui(t))‖→0.\|(e_i(t),δ u_i(t))\|→ 0. Assume that there exists t¯∈ℤ+ t _+ such that x¯ic,∗(t)=x¯ic,⋆,u¯ic,∗(t)=u¯ic,⋆,∀t≥t¯. x_i^c, (t)= x_i^c, , u_i^c, (t)= u_i^c, , ∀ t≥ t. Then, ∀t≥t¯∀ t≥ t, ei(t)=xi(t)−x¯ic,⋆,δui(t)=ui(t)−u¯ic,⋆.e_i(t)=x_i(t)- x_i^c, ,\ δ u_i(t)=u_i(t)- u_i^c, . Hence xi(t)→x¯ic,⋆,ui(t)→u¯ic,⋆as t→∞.x_i(t)→ x_i^c, , u_i(t)→ u_i^c, t→∞. ∎ Appendix G Proof of Corollary 1 Proof. We consider join and leave events separately. Join. Let inew∉ℐi_new request insertion at time tjoint_join. By Assumption 6, the joining agent can select an initial active safe set Sinew∗(tjoin)S_i_new (t_join) that is disjoint from all representations S^j(tjoin) S_j(t_join) of the currently active agents. If χj(tjoin)=0 _j(t_join)=0, this representation equals the true active safe set. If χj(tjoin)=1 _j(t_join)=1, Lemma 1 gives Sj∗(tjoin)⊆S^j(tjoin)S_j (t_join) S_j(t_join). Hence, Sinew∗(tjoin)∩Sj∗(tjoin)=∅,∀j∈ℐ.S_i_new (t_join)∩ S_j (t_join)= , ∀ j . Together with the feasibility of the joining agent and Theorem 1 for the previously active agents, the augmented system satisfies the initial feasibility and separation conditions at tjoint_join. Applying Theorems 1 and 2 from tjoint_join onward proves recursive feasibility and collision avoidance for the augmented system. Leave. If an agent leaves, it is removed from the locally reconstructed constraints of the remaining agents. This only deletes constraints and therefore cannot invalidate any previously feasible candidate solution. The active safe sets of the remaining agents remain pairwise disjoint, so recursive feasibility and collision avoidance follow again from Theorems 1 and 2. ∎ References [1] J. P. Alsterda, M. Brown, and J. C. Gerdes (2019) Contingency model predictive control for automated vehicles. In Proceedings of the American Control Conference, Cited by: §1.2. [2] A. D. Ames, S. Coogan, M. Egerstedt, G. Notomista, K. Sreenath, and P. Tabuada (2019) Control barrier functions: theory and applications. Note: arXiv preprint arXiv:1903.11199 Cited by: §1.1. [3] G. Belgioioso, D. Liao-McPherson, M. H. de Badyn, N. Pelzmann, J. Lygeros, and F. Dörfler (2023) Stability and robustness of distributed suboptimal model predictive control. IFAC-PapersOnLine 56 (2), p. 5115–5120. Note: 22nd IFAC World Congress External Links: ISSN 2405-8963, Document, Link Cited by: §1.1. [4] H. Chen and F. Allgöwer (1998) A quasi-infinite horizon nonlinear model predictive control scheme with guaranteed stability. Automatica 34 (10), p. 1205–1217. External Links: ISSN 0005-1098, Document, Link Cited by: §6, §6. [5] P. Fiorini and Z. Shiller (1998) Motion planning in dynamic environments using velocity obstacles. The International Journal of Robotics Research 17 (7), p. 760–772. External Links: Document Cited by: §1.1. [6] M. Hoy, A. S. Matveev, and A. V. Savkin (2012) Collision free cooperative navigation of multiple wheeled robots in unknown cluttered environments. Robotics and Autonomous Systems 60 (10), p. 1253–1266. External Links: Document Cited by: §1.1. [7] Y. Jiang, P. Sauerteig, B. Houska, and K. Worthmann (2021) Distributed optimization using aladin for mpc in smart grids. IEEE Transactions on Control Systems Technology 29 (5), p. 2142–2152. External Links: Document Cited by: §1.1. [8] J. Köhler, M. A. Müller, and F. Allgöwer (2019) Distributed model predictive control—recursive feasibility under inexact dual optimization. Automatica 102, p. 1–9. External Links: ISSN 0005-1098, Document, Link Cited by: §1.1. [9] A. S. Lafmejani and S. Berman (2021) Nonlinear MPC for collision-free and deadlock-free navigation of multiple nonholonomic mobile robots. Robotics and Autonomous Systems 141, p. 103774. External Links: Document Cited by: §1.1. [10] W. Lee, J. Sim, J. Kim, S. Jo, W. Luo, and C. Nam (2025) Merry-go-round: safe control of decentralized multi-robot systems with deadlock prevention. In 2025 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), Vol. , p. 4589–4595. External Links: Document Cited by: §1.1. [11] S. Lucia, M. Kögel, and R. Findeisen (2015) Contract-based predictive control of distributed systems with plug and play capabilities. IFAC-PapersOnLine 48 (23), p. 205–211. Note: 5th IFAC Conference on Nonlinear Model Predictive Control NMPC 2015 External Links: ISSN 2405-8963, Document, Link Cited by: §1.1, §1.1. [12] J. Lunze (2022) Networked control of multi-agent systems. 2 edition, Bookmundo Direct (Edition MoRa). External Links: ISBN 978-94-036-4847-7 Cited by: §1.1. [13] J.M. Maestre, D. Muñoz de la Peña, E.F. Camacho, and T. Alamo (2011) Distributed model predictive control based on agent negotiation. Journal of Process Control 21 (5), p. 685–697. Note: Special Issue on Hierarchical and Distributed Model Predictive Control External Links: ISSN 0959-1524, Document, Link Cited by: §1.1. [14] D. Q. Mayne, J. B. Rawlings, C. V. Rao, and P. O. M. Scokaert (2000) Constrained model predictive control: stability and optimality. Automatica 36 (6), p. 789–814. External Links: Document Cited by: §1, §6, §6. [15] R. R. Negenborn, B. D. Schutter, and J. Hellendoorn (2009) Multi-agent model predictive control: a survey. Note: arXiv preprint arXiv:0908.1076 Cited by: §1.1. [16] A. G. Richards, T. Schouwenaars, J. P. How, and E. Feron (2002) Spacecraft trajectory planning with avoidance constraints using mixed-integer linear programming. Journal of Guidance, Control, and Dynamics 25 (4), p. 755–764. Cited by: §1.1. [17] S. Riverso, M. Farina, and G. Ferrari-Trecate (2013) Plug-and-play decentralized model predictive control for linear systems. IEEE Transactions on Automatic Control 58 (10), p. 2608–2614. External Links: Document Cited by: §1.1. [18] D. Saccani, L. Fagiano, M. N. Zeilinger, and A. Carron (2023) Model predictive control for multi-agent systems under limited communication and time-varying network topology. Note: arXiv preprint arXiv:2304.01649 Cited by: §1.1, Remark 3. [19] R. Scattolini (2009) Architecture of distributed and hierarchical model predictive control—a review. Journal of Process Control 19 (5), p. 723–731. External Links: Document Cited by: §1.1. [20] G. Schildbach (2025) Contingency Model-based Control (CMC) for Communicationless Cooperative Collision Avoidance in Robot Swarms. Note: arXiv preprint arXiv:2512.20391 Cited by: §1.2. [21] T. Schouwenaars, B. D. Moor, E. Feron, and J. P. How (2001) Mixed integer programming for multi-vehicle path planning. In Proceedings of the European Control Conference (ECC), p. 2603–2608. External Links: Document Cited by: §1.1. [22] T. Schouwenaars, M. J. Valenti, E. Feron, and J. P. How (2005) Implementation and flight test results of MILP-based UAV guidance. 2005 IEEE Aerospace Conference, p. 1–13. External Links: Link Cited by: §1.1. [23] B. T. Stewart, A. N. Venkat, J. B. Rawlings, S. J. Wright, and G. Pannocchia (2010) Cooperative distributed model predictive control. Systems & Control Letters 59 (8), p. 460–469. External Links: Document Cited by: §1.1. [24] J. Stoustrup (2009) Plug & play control: control technology towards new challenges. European Journal of Control 15 (3–4), p. 311–330. Cited by: §1.1. [25] J. van den Berg, S. J. Guy, M. Lin, and D. Manocha (2011) Reciprocal n-body collision avoidance. The International Journal of Robotics Research 30 (4), p. 371–383. External Links: Document Cited by: §1.1. [26] A. N. Venkat, J. B. Rawlings, and S. J. Wright (2007) Distributed model predictive control of large-scale systems. In Assessment and Future Directions of Nonlinear Model Predictive Control, Lecture Notes in Control and Information Sciences, Vol. 358. External Links: Document Cited by: §1.1. [27] K. P. Wabersich and M. N. Zeilinger (2021) A predictive safety filter for learning-based control of constrained nonlinear dynamical systems. Automatica 129, p. 109597. External Links: Document Cited by: §1.1. [28] A. Wächter and L. T. Biegler (2006) On the implementation of an interior-point filter line-search algorithm for large-scale nonlinear programming. Mathematical Programming 106 (1), p. 25–57. External Links: Document Cited by: §7.1.1.