Quantitative Local Analysis of Nonlinear Systems NASA NRA

Quantitative Local Analysis of Nonlinear Systems NASA NRA Grant/Cooperative Agreement NNX 08 AC 80 A – “Analytical Validation Tools for Safety Critical Systems” – Dr. Christine Belcastro, Technical Monitor, 01/01/2008 -12/31/2010 AFOSR FA 9550 -05 -1 -0266 – “Analysis tools for Certification of Flight Control Laws” – 05/05/2005 -04/30/2008 Colleagues Univ of Minnesota: Pete Seiler, Abhijit Chakraborty, Gary Balas UC Berkeley: Ufuk Topcu, Erin Summers, Tim Wheeler, Andy Packard Barron Associates: Alec Bateman www. cds. caltech. edu/~utopcu/Langley. Workshop. html

www. cds. caltech. edu/~utopcu/Langley. Worksh op. html

Validation/Verification/Certification (VVC) Control Law VVC - Verification: assure that the flight control system fulfills the design requirements. - Validation: assure that the developed flight control system satisfies user needs under defined operating conditions. - Certification: applicant demonstrates compliance of the design to the certifying authority. Current practice: Partially guided by Mil. Spec – Linearized analyses • Closed-loop: Time domain • Open-loop: Frequency domain – Numerous nonlinear sims. – Strategies/Process to manage/distill all of this data into a actionable conclusion. “as much a psychological exercise as it is a mathematical analysis”, Anonymous, Senior systems engineer, large US corporation.

Why psychological? VV needs a conclusion about physical system using model -based analysis… leap-of-faith arises from Inadequacy in model – Known unknowns – Unknown unknowns – Gross simplification while addressing these Improve these Inadequacy in analysis to resolve issue – Inability to precisely answer question – Relevance of question to issue at hand Goal: – Make the leap smaller with quantitative nonlinear analysis

Role of linearized analysis Linear analysis: provides a quick answer to a related, but different question: Q: How much gain and time-delay variation can be accommodated without undue performance degradation? A: (answers a different question) Here’s a scatter plot of margins at 1000 equilbrium trim conditions throughout envelope Why does linear analysis have impact in nonlinear problems? – Domain-specific expertise exists to interpret linear analysis and assess relevance – Speed, scalable: Fast, defensible answers on high-dimensional systems Here’s a scatter plot of guaranteed region-of-attraction estimates, in the presence of 40% unmodeled dynamics at plant input, and 3 parametric variations, at 1000 trim conditions throughout the envelope Extend validity of the linearized analysis Infinitesimal → local (with certified estimates) Address uncertainty

Overview Numerical tools to quantify/certify dynamic behavior Locally, near equilibrium points Analysis considered Region-of-attraction, input/output gain, reachability, establishing local IQCs Methodology Enforce Lyapunov/Dissipation inequalities locally, on sublevel sets Set containments via S-procedure and SOS constraints Bilinear semidefinite programs “always” feasible Simulation aids nonconvex proof/certificate search Address model uncertainty Parametric Uncertainty – Parameter-independent Lyapunov/Storage Fcn – Branch-&-Bound Dynamic Uncertainty – Local small-gain theorems

Nonlinear Analysis Autonomous dynamics – equilibrium point – uncertain initial condition, – Question: do all solutions converge to Driven dynamics – equilibrium point – uncertain inputs, , – Question: how large can Uncertain dynamics – Unknown, constant parameters, – Unmodeled dynamics – Same questions… get?

Region-of-Attraction and Reachability Dynamics, equilibrium point By choice of positive-definite V, maximize so that: p: Analyst-defined function whose (well-understood) sublevel sets are to be in region-ofattraction Given a differential equation and a positive definite function p, how large can get, knowing Local DIE: Conditions on Conclusion on ODE

Solution Approach 1. S-procedure to (conservatively) enforce set containments in Rn i. Sum-of-squares to (conservatively) enforce nonnegativity of h: Rn → R ii. Easy (semidefinite program) to check if a given polynomial is SOS 2. Apply S-procedure/SOS to Analysis set-containment conditions. For (e. g. ) reachability, minimize β (R fixed, by choice of si and V) such that 3. SDP iteration: Initialize V, then a) Optimize objective by changing S-procedure multipliers b) Recenter V c) Iterate on (a) and (b) 4. Initialization of V is important (in a complicated fashion) for the iteration to work – Simulation of system dynamics yields convex constraints which contain all (if any) feasible Lyapunov function candidates

Quantitative improvement on linearized analysis Consider dynamics These SOS/S-procedure formulations are always feasible using quadratic V where matrix A is Hurwitz, and – function f 23 consists of 2 nd and 3 rd degree polynomials, f 23(0)=0 A nonempty region-of-attraction is certified Consider dynamics For some R>0, where matrix A is Hurwitz, and – f 2, g 2, h 2 quadratic, f 3 cubic – with f 2(0, 0)=f 3(0)=h 2(0)=0, and Consider dynamics For some R>0, where matrix A is Hurwitz, and –functions b bilinear, q quadratic

Common features of analysis These analysis all involve search over a nonconvex set of certifying Lyapunov functions, roughly The SOS relaxations are nonconvex as well, e. g. , Solution approaches: SOS conditions to verify containments – Parametrize V, parametrize multipliers, solve… • Ad-hoc iterative, based on linear SDPs • Bilinear SDP solvers Behavior: Initial point can have big effect on end result, e. g. , – Unable to reach a feasible point – Convergence to local optimum (or less)

ROA: Simulations constrain suitable V Consider a simpler question. Fix β, is Ad-hoc solution: – run N sims, starting from samples in • If any diverge, then “no” • If all converge, then maybe “yes”, and perhaps the Lyapunov analysis can prove it In this case, how can we use the simulation data? Necessary condition: If V exists to verify, it must be – ≤ 1 on all trajectories – ≥ 0 on all trajectories – Decreasing on all trajectories – Other constraints? ? ? …

Convex Outer bound on certifying Lyapunov functions After simulations – Collection of convergent trajectories starting in – divergent trajectories starting in Linearly parametrize V, namely Basis functions, eg. , all degree 4 Hermite polynomials The necessary conditions on V are convex constraints on V≤ 1 on convergent trajectories V≥ 0 on all trajectories V decreasing on convergent trajectories Quad(V) is a Lyapunov function for Linear(f) V≥ 1 on divergent trajectories Sample this set to get candidate V Hit&Run (Smith, 1984, Lovasz, 1999, Tempo, Calafiore, Dabbene If convex constraints yield empty set, then V parametrization cannot certify

Uncertain Systems: Parameter-Independent V Start with affine parameter uncertainty polytope in Rm Solve earlier conditions, but enforcing at the vertex values of f. Then is invariant, and in the Robust ROA of Advantages: a robust ROA, and . – V is only a function of x, δ appears only implicitly through the vertices – SOS analysis is only in x variables – Simulations are incorporated as before (vary initial condition and δ) Limitations – Conservative with regard to uncertainty Subdivide Δ Solve separately • Conclusions apply to time-varying parameters, hence… • often conclusions are too weak for time-invariant parameters Δ 2 Δ 1

Much better: B&B in Uncertainty Space Of course, growth is still exponential in parameters… but – kth local problem uses Vk(x) – Solve conservative problem over subdomain – Local problems are decoupled – Trivial parallelization δ 2 Computation yields a binary tree – decomposes parameter space – certificates at each leaf BTree(k). Analysis. Parameter. Domain Analysis. Vertex. Dynamics Analysis. Lyapunov. Certificate Analysis. SOSCertificates Analysis. Certified. Volume BTree(k). Children Nonconvex parameter-space, and/or coupled parameters – cover with union of polytopes, and refine… δ 1

4 -state aircraft example w/uncertainty Aircraft: Short period longitudinal model, pitch axis, with 1 -state linear controller Spherical shape factor: 9 -processor Branch-&-Bound – Divide worst region into 9, improve polytope cover Treat as 3 parameters − Affine dependence − 2 -dimensional manifold in R 3 − Cover with polytope in R 3 − Solve…

Unmodeled dynamics: Local small-gain theorem Local, gain constraint (≤ 1) on Δ M Implies: Starting from x(0)=0, for all Δ causal, globally stable, also satisfies DIE This gives: M

Unmodeled dynamics: Local small-gain theorem Local, gain constraint (≤ 1) on Δ M Local DIE for L 2 gain Δ causal, globally stable, Then: M

4 -state aircraft example w/uncertainty Δ . 75 C 1. 25 Results Nominal with δM, δCG Nominal 8. 6 (15. 3) 5. 1 (7. 5) with Δ 4. 2 (6. 7) 2. 4 (4. 1) Pδ

Adaptive System: reachability example analysis Model-reference adaptive systems r Reference model Adaptive control - plant e Quadratic vector field, marginally stable linearization Example: 2 -state P, 2 -state ref. model, 3 adaptive parameters –Insert additional disturbance (d) –Bound worst-case effect of external signals (r, d) on tracking error (e) • Initial conditions: Reachability analysis certifies that for all (r, d) with then for all t, There are particular r and d satisfying E 2 1 0 -1 -2 causing e to achieve at some time t. -1 0 E 1 1 2

F/A-18 Falling Leaf Mode The US Navy has lost many F/A-18 A/B/C/D Hornet aircraft due to an out-of-control flight departure phenomenon described as the “falling leaf” mode Can require 15, 000 -20, 000 ft to recover Administrative action by NAVAIR to prevent further losses Revised control law implemented, deployed in 2003/4, F/A-18 E/F − uses ailerons to damp sideslip Heller, David and Holmberg, “Falling Leaf Motion Suppression in the F/A-18 Hornet with Revised Flight Control Software, " AIAA-2004 -542, 42 nd AIAA Aerospace Sciences Meeting, Jan 2004, Reno, NV.

Baseline/Revised Control Architecture (simplified)

Baseline vs Revised: Analysis Is revised better? Yes, several years service confirm – but can this be ascertained with a model-based validation? Recall that Baseline underwent “validation”, yet had problems. Linearized Analysis: at equilibrium and several steady turn rates – Classical loop-at-a-time margins – Disk margin analysis (Nichols) – Multivariable input disk-margin – Diagonal input multiplicative uncertainty – “Full”-block input multiplicative uncertainty – Parametric stability margin (μ ) using physically motivated uncertainty in 8 aero coefficients Conclusion: Both designs have excellent (and nearly identical) linearized robustness margins trimmed across envelope… Chakraborty , Seiler and Balas, “Applications of Linear and Nonlinear Robustness Analysis Techniques to the F/A-18 Control Laws, ” AIAA Guidance, Navigation and Control Conference, Chicago IL, August 2009.

Baseline vs Revised: Beyond Linearized Analysis Perform region-of-attraction estimate as described – Unfortunately, closed-loop models too complex (high dynamic order) for direct approach, at this time. Model approximation: – reduced state dimension (domain-specific simplifications) – polynomial approximation of closed-loop dynamic models

ROA Results Ellipsoidal shape factor, aligned w/ states, appropriated scaled – 5 hours for quartic Lyapunov function certificate – 100 hours for divergent sims with “small” initial conditions Chakraborty , Seiler and Balas, “Applications of Linear and Nonlinear Robustness Analysis Techniques to the F/A-18 Control Laws, ” AIAA Guidance, Navigation and Control Conference, Chicago IL, August 2009.

Wrapup/Perspective Proofs of behavior with certificates Extensive simulation and linearized analysis Tools (Multipoly, SOSOPT, Se. Du. Mi) that handle (cubic, in x, vector field) • 15 states, 3 parameters, unmodeled dynamics, analyze with ∂(V)=2 • 7 states, 3 parameters, unmodeled dynamics, analyze with ∂(V)=4 • 4 states, 3 parameters, unmodeled dynamics, analyze with ∂(V)=6 -8 • Certified answers, however, not clear that these are appropriate for design choices Sproc/SOS/DIE more quantitative than linearization –Linearized analysis: quadratic storage functions, infinitesimal sublevel sets –SOS/S-procedure always works Work to scale up to large, complex systems analysis (e. g. , adaptive flight controls) where “certificates” are desired.

Decomposition for high-order Heterogeneous Systems Interconnection of locally stable systems (w/ Summers) – M is constant matrix – Associated with each Ni • (offset) Stable, linear Gi • (weight) Stable, linear, min-phase Wi – The system has local L 2 -gain ≤ 1, certified as presented. For low-order Ni, coupled with low-order G and W, this is done with high-degree V – (Linear) robustness analysis on an interconnection involving M, G, and W-1 yields conditions on d, under which gain from d to e is bounded – Hierarchical - easy to include WM, GM, and bound local gain of Poor-man’s IQC theory for locally-stable interconnections – Combinatorial number of ways to split original system – Infinite choices for G and W –… – Elements must be stable, so reject decompositions based on linearization – A possible route to answering some questions on medium-order systems

Uncertain Model Invalidation Analysis Given time-series data for a collection of experiments, with selected features and simple measurement uncertainty descriptions… Task: prove that regardless of the values chosen for the parameters, the model below cannot account for the observed data, where

Generalization of covering manifold Given: – polynomial p(δ) in many real variables, – Domain , typically a polytope Find a polytope that covers the manifold – Tradeoff between number of vertices, and – Excess “volume” in polytope One approach: – Find “tightest” affine upper and lower bounds over H linear function of c 0, c Enforce with S-procedure

Generalization of covering manifold Partition H, repeat For multivariable p, Bound, on H (above and below), each component of p with affine functions, c, d, (e. g, using S-procedure). Then, a covering polytope (Amato, Garofalo, Gliemo) is with 2 m+k easily computed vertices.