Quantitative Local Analysis of Nonlinear Systems NASA NRA Grant/Cooperative Agreement NNX08AC80A –“Analytical Validation Tools for Safety Critical Systems” –Dr. Christine Belcastro, Technical Monitor, 01/01/ /31/2010 AFOSR FA –“Analysis tools for Certification of Flight Control Laws” –05/05/ /30/2008 Colleagues Univ of Minnesota: Pete Seiler, Abhijit Chakraborty, Gary Balas UC Berkeley: Ufuk Topcu, Erin Summers, Tim Wheeler, Andy Packard Barron Associates: Alec Bateman

Validation/Verification/Certification (VVC) Control Law VVC - Verification: assure that the flight control system fulfills the design requirements. - Validation: assure that the developed flight control system satisfies user needs under defined operating conditions. - Certification: applicant demonstrates compliance of the design to the certifying authority. Current practice: Partially guided by MilSpec –Linearized analyses Closed-loop: Time domain Open-loop: Frequency domain –Numerous nonlinear sims. –Strategies/Process to manage/distill all of this data into a actionable conclusion. “as much a psychological exercise as it is a mathematical analysis”, Anonymous, Senior systems engineer, large US corporation.

Why psychological? VV needs a conclusion about physical system using model-based analysis… leap-of-faith arises from Inadequacy in model –Known unknowns –Unknown unknowns –Gross simplification Inadequacy in analysis to resolve issue –Inability to precisely answer question –Relevance of question to issue at hand Goal: –Make the leap smaller with quantitative nonlinear analysis Improve these while addressing these

Role of linearized analysis Linear analysis: provides a quick answer to a related, but different question: Q: How much gain and time-delay variation can be accommodated without undue performance degradation? A: (answers a different question) Here’s a scatter plot of margins at 1000 equilbrium trim conditions throughout envelope Why does linear analysis have impact in nonlinear problems? –Domain-specific expertise exists to interpret linear analysis and assess relevance –Speed, scalable: Fast, defensible answers on high-dimensional systems Extend validity of the linearized analysis Infinitesimal → local (with certified estimates) Address uncertainty Here’s a scatter plot of guaranteed region-of-attraction estimates, in the presence of 40% unmodeled dynamics at plant input, and 3 parametric variations, at 1000 trim conditions throughout the envelope

Overview Numerical tools to quantify/certify dynamic behavior Locally, near equilibrium points Analysis considered Region-of-attraction, input/output gain, reachability, establishing local IQCs Methodology Enforce Lyapunov/Dissipation inequalities locally, on sublevel sets Set containments via S-procedure and SOS constraints Bilinear semidefinite programs “always” feasible Simulation aids nonconvex proof/certificate search Address model uncertainty Parametric Uncertainty –Parameter-independent Lyapunov/Storage Fcn –Branch-&-Bound Dynamic Uncertainty –Local small-gain theorems

Nonlinear Analysis Autonomous dynamics –equilibrium point –uncertain initial condition, –Question: do all solutions converge to Driven dynamics –equilibrium point –uncertain inputs,, –Question: how large can get? Uncertain dynamics –Unknown, constant parameters, –Unmodeled dynamics –Same questions…

Region-of-Attraction and Reachability Dynamics, equilibrium point p: Analyst-defined function whose (well-understood) sub- level sets are to be in region-of- attraction By choice of positive-definite V, maximize  so that: Local DIE: Conditions on Conclusion on ODE Given a differential equation and a positive definite function p, how large can get, knowing

Solution Approach 1.S-procedure to (conservatively) enforce set containments in R n i.Sum-of-squares to (conservatively) enforce nonnegativity of h: R n → R ii.Easy (semidefinite program) to check if a given polynomial is SOS 2.Apply S-procedure/SOS to Analysis set-containment conditions. For (e.g.) reachability, minimize β (R fixed, by choice of s i and V) such that 3.SDP iteration: Initialize V, then a)Optimize objective by changing S-procedure multipliers b)Recenter V c)Iterate on (a) and (b) 4.Initialization of V is important (in a complicated fashion) for the iteration to work –Simulation of system dynamics yields convex constraints which contain all (if any) feasible Lyapunov function candidates

Quantitative improvement on linearized analysis Consider dynamics where matrix A is Hurwitz, and –function f 23 consists of 2 nd and 3 rd degree polynomials, f 23 (0)=0 Consider dynamics where matrix A is Hurwitz, and –f 2, g 2, h 2 quadratic, f 3 cubic –with f 2 (0,0)=f 3 (0)=h 2 (0)=0, and Consider dynamics where matrix A is Hurwitz, and –functions b bilinear, q quadratic These SOS/S-procedure formulations are always feasible using quadratic V A nonempty region-of-attraction is certified For some R>0,

Common features of analysis These analysis all involve search over a nonconvex set of certifying Lyapunov functions, roughly The SOS relaxations are nonconvex as well, e.g., Solution approaches: SOS conditions to verify containments –Parametrize V, parametrize multipliers, solve… Ad-hoc iterative, based on linear SDPs Bilinear SDP solvers Behavior: Initial point can have big effect on end result, e.g., –Unable to reach a feasible point –Convergence to local optimum (or less)

Consider a simpler question. Fix β, is Ad-hoc solution: –run N sims, starting from samples in If any diverge, then “no” If all converge, then maybe “yes”, and perhaps the Lyapunov analysis can prove it In this case, how can we use the simulation data? Necessary condition: If V exists to verify, it must be –≤1 on all trajectories –≥0 on all trajectories –Decreasing on all trajectories –Other constraints???… ROA: Simulations constrain suitable V

Convex Outer bound on certifying Lyapunov functions After simulations –Collection of convergent trajectories starting in –divergent trajectories starting in Linearly parametrize V, namely The necessary conditions on V are convex constraints on V≤1 on convergent trajectories V≥0 on all trajectories V decreasing on convergent trajectories Quad(V) is a Lyapunov function for Linear(f) V≥1 on divergent trajectories If convex constraints yield empty set, then V parametrization cannot certify Sample this set to get candidate V Basis functions, eg., all degree 4 Hermite polynomials Hit&Run (Smith, 1984, Lovasz, 1999, Tempo, Calafiore, Dabbene

Uncertain Systems: Parameter-Independent V Start with affine parameter uncertainty Solve earlier conditions, but enforcing at the vertex values of f. Then is invariant, and in the Robust ROA of. Advantages: a robust ROA, and –V is only a function of x, δ appears only implicitly through the vertices –SOS analysis is only in x variables –Simulations are incorporated as before (vary initial condition and δ) Limitations –Conservative with regard to uncertainty Conclusions apply to time-varying parameters, hence… often conclusions are too weak for time-invariant parameters polytope in R m Subdivide Δ Solve separately Δ1Δ1 Δ2Δ2

Much better: B&B in Uncertainty Space Of course, growth is still exponential in parameters… but –k th local problem uses V k (x) –Solve conservative problem over subdomain –Local problems are decoupled –Trivial parallelization Computation yields a binary tree –decomposes parameter space –certificates at each leaf BTree(k).Analysis Analysis.ParameterDomain Analysis.VertexDynamics Analysis.LyapunovCertificate Analysis.SOSCertificates Analysis.CertifiedVolume BTree(k).Children δ1δ1 δ2δ2 Nonconvex parameter-space, and/or coupled parameters –cover with union of polytopes, and refine…

4-state aircraft example w/uncertainty Aircraft: Short period longitudinal model, pitch axis, with 1-state linear controller Spherical shape factor: 9-processor Branch-&-Bound –Divide worst region into 9, improve polytope cover Treat as 3 parameters −Affine dependence −2-dimensional manifold in R 3 −Cover with polytope in R 3 −Solve…

Unmodeled dynamics: Local small-gain theorem Implies: Starting from x(0)=0, for all Δ causal, globally stable, also satisfies DIE Local, gain constraint (≤1) on This gives: M Δ M

Unmodeled dynamics: Local small-gain theorem Δ causal, globally stable, Local, gain constraint (≤1) on Then: M Δ M Local DIE for L 2 gain

4-state aircraft example w/uncertainty ResultsNominalwith δ M, δ CG Nominal8.6 (15.3)5.1 (7.5) with Δ4.2 (6.7)2.4 (4.1) PδPδ C Δ

Model-reference adaptive systems Example: 2-state P, 2-state ref. model, 3 adaptive parameters –Insert additional disturbance (d) –Bound worst-case effect of external signals (r,d) on tracking error (e) Initial conditions: Reachability analysis certifies that for all (r,d) with then for all t, There are particular r and d satisfying causing e to achieve at some time t. Adaptive System: reachability example analysis plant Reference model Adaptive control e - r E1 E2 Quadratic vector field, marginally stable linearization

F/A-18 Falling Leaf Mode The US Navy has lost many F/A-18 A/B/C/D Hornet aircraft due to an out-of-control flight departure phenomenon described as the “falling leaf” mode Heller, David and Holmberg, “Falling Leaf Motion Suppression in the F/A-18 Hornet with Revised Flight Control Software," AIAA , 42nd AIAA Aerospace Sciences Meeting, Jan 2004, Reno, NV. Can require 15,000-20,000 ft to recover Administrative action by NAVAIR to prevent further losses Revised control law implemented, deployed in 2003/4, F/A-18E/F −uses ailerons to damp sideslip

Baseline/Revised Control Architecture (simplified)

Is revised better? Yes, several years service confirm – but can this be ascertained with a model-based validation? Recall that Baseline underwent “validation”, yet had problems. Linearized Analysis: at equilibrium and several steady turn rates –Classical loop-at-a-time margins –Disk margin analysis (Nichols) –Multivariable input disk-margin –Diagonal input multiplicative uncertainty –“Full”-block input multiplicative uncertainty –Parametric stability margin (μ ) using physically motivated uncertainty in 8 aero coefficients Conclusion: Both designs have excellent (and nearly identical) linearized robustness margins trimmed across envelope… Baseline vs Revised: Analysis Chakraborty, Seiler and Balas, “Applications of Linear and Nonlinear Robustness Analysis Techniques to the F/A-18 Control Laws,” AIAA Guidance, Navigation and Control Conference, Chicago IL, August 2009.

Perform region-of-attraction estimate as described –Unfortunately, closed-loop models too complex (high dynamic order) for direct approach, at this time. Model approximation: –reduced state dimension (domain-specific simplifications) –polynomial approximation of closed-loop dynamic models Baseline vs Revised: Beyond Linearized Analysis

ROA Results Ellipsoidal shape factor, aligned w/ states, appropriated scaled –5 hours for quartic Lyapunov function certificate –100 hours for divergent sims with “small” initial conditions Chakraborty, Seiler and Balas, “Applications of Linear and Nonlinear Robustness Analysis Techniques to the F/A-18 Control Laws,” AIAA Guidance, Navigation and Control Conference, Chicago IL, August 2009.

Tools (Multipoly, SOSOPT, SeDuMi) that handle (cubic, in x, vector field) 15 states, 3 parameters, unmodeled dynamics, analyze with ∂(V)=2 7 states, 3 parameters, unmodeled dynamics, analyze with ∂(V)=4 4 states, 3 parameters, unmodeled dynamics, analyze with ∂(V)=6-8 Certified answers, however, not clear that these are appropriate for design choices Sproc/SOS/DIE more quantitative than linearization –Linearized analysis: quadratic storage functions, infinitesimal sublevel sets –SOS/S-procedure always works Work to scale up to large, complex systems analysis (e.g., adaptive flight controls) where “certificates” are desired. Wrapup/Perspective Proofs of behavior with certificates Extensive simulation and linearized analysis

Interconnection of locally stable systems (w/ Summers) –M is constant matrix –Associated with each N i (offset) Stable, linear G i (weight) Stable, linear, min-phase W i –The system has local L 2 -gain ≤1, certified as presented. For low-order N i, coupled with low-order G and W, this is done with high-degree V –(Linear) robustness analysis on an interconnection involving M, G, and W -1 yields conditions on d, under which gain from d to e is bounded –Hierarchical - easy to include W M, G M, and bound local gain of Decomposition for high-order Heterogeneous Systems Poor-man’s IQC theory for locally-stable interconnections –Combinatorial number of ways to split original system –Infinite choices for G and W –…–… –Elements must be stable, so reject decompositions based on linearization –A possible route to answering some questions on medium-order systems

Uncertain Model Invalidation Analysis Given time-series data for a collection of experiments, with selected features and simple measurement uncertainty descriptions… Task: prove that regardless of the values chosen for the parameters, the model below cannot account for the observed data, where

Generalization of covering manifold Given: –polynomial p(δ) in many real variables, –Domain, typically a polytope Find a polytope that covers the manifold –Tradeoff between number of vertices, and –Excess “volume” in polytope One approach: –Find “tightest” affine upper and lower bounds over H linear function of c 0, c Enforce with S-procedure

Generalization of covering manifold Partition H, repeat For multivariable p, Bound, on H (above and below), each component of p with affine functions, c, d, (e.g, using S-procedure). Then, a covering polytope (Amato, Garofalo, Gliemo) is with 2 m+k easily computed vertices.

Sum-of-Squares Sum-of-squares (SOS) decompositions (Parrilo) –certify nonnegativity, and –(with S-procedure) certify set containment conditions A polynomial f, in n real-variables is SOS if it can be expressed as a sum-of-squares of other polys, SDP decides SOS: For f with degree 2d Each M i is s×s, where

(s,q) dependence on n and 2d 2d n

(s,q) dependence on n and 2d 2d n

Region-of-attraction: 4-state aircraft example Aircraft: Short period longitudinal model, pitch axis, with 1-state linear controller Simple form for shape factor: Different Lyapunov function structures –Quadratic (β cert =8.6) –Fully quartic (quadratic + cubic + quartic) β cert =15.3 Other approaches have deficiencies –Directly use commercial BMI solver (PENBMI) β cert =15.2, but… 6 hours… 4000 simulations3 minutes Form LP/ConvexP0.5 minutes Get a feasable point1 minute Assess answer with V0.5 minutes SDP Iterate from V0.5 min/iteration, 10 iters TOTAL10 minutes discover divergent trajectories proving Divergent initial condition Certified set of convergent initial conditions Disk in 4-d state space, centered at equilibrium point Eliminate parameter uncertainty