Motivating applications

2. Motivating applications (Source: Boeing X45-A) (Source: Northrop Grumman-X47A) (Source: NASA Ames)

3. Hybrid systems • Continuous systems controlled by a discrete logic: embedded systems (autopilot logic) • Coordinating processes: multi-vehicle systems interfacing continuous control with coordination protocols • Continuous systems with a phased operation: (biological cell growth and division) discrete systems (computer science) continuous systems (control)

4. Verification and Controller Synthesis Verification: a mathematical proof that the system satisfies a property Controller synthesis: the design of control laws to guarantee that the system satisfies the property • Methods give definitive answers, unlike simulation • Often give surprising answers, trajectories which one might not think to simulate • Reduces development time, cost of certification initial unsafe

5. Verification and Controller Synthesis Verification: a mathematical proof that the system satisfies a property Controller synthesis: the design of control laws to guarantee that the system satisfies the property • Methods give definitive answers, unlike simulation • Often give surprising answers, trajectories which one might not think to simulate • Reduces development time, cost of certification initial unsafe

6. Verification and Controller Synthesis Verification: a mathematical proof that the system satisfies a property Controller synthesis: the design of control laws to guarantee that the system satisfies the property • Methods give definitive answers, unlike simulation • Often give surprising answers, trajectories which one might not think to simulate • Reduces development time, cost of certification initial unsafe

7. Verification and Controller Synthesis Verification: a mathematical proof that the system satisfies a property Controller synthesis: the design of control laws to guarantee that the system satisfies the property Safety Property can be encoded as a condition on the system’s reachable set of states initial unsafe unsafe unsafe initialization safe, under appropriate control

8. ‘evader’ (control) ‘pursuer’ (disturbance) Example: Aircraft Collision Avoidance Two identical aircraft at fixed altitude & speed: y v y u x v d

9. y x y Continuous Reachable Set Solve: Display:

10. safety filter’s input modification evader’s actual input unsafe set collision set pursuer evader evader’s desired input pursuer’s input Collision Avoidance Filter Simple demonstration • Pursuer: turn to head toward evader • Evader: turn to head right Movies …

11. Blunder Zones for Closely Spaced Approaches EEM Maneuver 1: accelerate EEM Maneuver 2: turn 45 deg, accelerate EEM Maneuver 3: turn 60 deg evader

12. Implementation: Display design courtesy of Chad Jennings, Andy Barrows, David Powell Blunder Zone is shown by the yellow contour Red Zone in the green tunnel is the intersection of the BZ with approach path. The Red Zone corresponds to an assumed 2 second pilot delay. The Yellow Zone corresponds to an 8 second pilot delay

13. Map View showing a blunder The BZ calculations are performed in real time (40Hz) so that the contour is updated with each video frame.

14. Verified Mode Switching in Autopilots

15. TOGA TOGA flaps retracted maximum thrust flaps retracted maximum thrust flare flare flaps extended minimum thrust flaps extended minimum thrust rollout rollout flaps extended reverse thrust flaps extended reverse thrust slow TOGA flaps extended maximum thrust Use in Cockpit Interface Verification • Controllable flight envelopes for landing and Take Off / Go Around (TOGA) maneuvers may not be the same • Pilot’s cockpit display may not contain sufficient information to distinguish whether TOGA can be initiated existing interface controllable TOGA envelope intersection revised interface controllable flare envelope

16. V1 V2 V3 V4 V1 V2 V3 V4 A More General Problem Structure Communication Zone Safety Assurance Zone

17. (Decomposed) Centralized Optimization Neighborhood of ith vehicle

18. fixed time horizon Bargaining start Fixed time horizon – complete global map

19. Flight Plans published by aircraft 1

20. Another Example

21. Flight Plans published by aircraft 1

22. moving time horizon Bargaining start Receding horizon – incomplete global map

23. Local Optimization with Constraints • Constraints embed: local dynamics: coordinated turn and straight flight [hdi] input constraints: limited turn rate and velocity [gei] global coordination constraints: minimum safety assurance [gsij] for all j within neighborhood of i

24. Decomposition I Centralized Optimization Decomposed Centralized Optimization Pareto optimality Nash equilibrium

25. Nash Equilibrium for Centralized Problem Define Hamiltonian for each subsystem: is a Nash equilibrium for the centralized optimization problem if: where Thus, none of the subsystems can improve its solution, with all other subsystems’ solutions remaining fixed.

26. Decomposition II Decomposed Centralized Optimization Decentralized Optimization Nash equilibrium Local optimal solutions

27. Nash Equilibrium for Decentralized Problem Define Hamiltonian for each subsystem: is a Nash equilibrium for the decentralized optimization problem if: Optimal solutions by each of the subsystems Proposition: is a Nash equilibrium of the centralized problem if and only if it is a Nash equilibrium of the decentralized problem

28. Example: Nash Equilibrium at (0,0)

29. Using Penalty function methods • Global contraction function from the local optimization structures • For a particular solution, local optimization of the ith vehicle only affects the portion of F tied to its own local optimization

30. Cooperation Assumptions • Eliminates cases in which a subsystem is artificially acting against a constraint dictated by another group • Eliminates cases in which two subsystems act against each other with non-identical constraints

31. Nash Bargaining with Multiple Threads • Multiple solutions, or “threads”, exist within the system: Vehicle #1 Vehicle #2 Vehicle #4 Vehicle #3 Iteration #1 Iteration #2 Iteration #3 Iteration #4 Iteration #4

32. Convergence Results • Global convergence to a (not necessarily feasible) Nash ‘solution’ • If the gradients of the constraint functions are linearly independent (Linear Constraint Qualification Condition, LICQ), then global convergence to a feasible Nash solution • Pareto optimality for convex problems [Inalhan, Stipanovic, Tomlin. Decentralized Optimization, with Application to Multiple Aircraft Coordination. CDC 2002, Submitted to JOTA]

33. V1 V2 V3 V4 4-Vehicle Example

34. 4-Vehicle Example

35. Flight Plans published by aircraft 1

37. Applied to other problems of interest… • Decentralized Initialization Procedure Heuristics • Multiple-Depots (Vehicles), Time-windows for access, Priority on objectives and the vehicles • Iterative selection process carried at each vehicle • Best solution in the fleet is then selected from each vehicle’s solution set

38. Spectrum of Approaches Lack of information  Bounded Irrationality Cooperative incomplete information Non-cooperative No information Non-cooperative Full information Cooperative Full information

39. Research Goals • Design of provably correct and safe decentralized control protocols • Adapt to coordination • Allow for dynamic reconfiguration • Treatment of information • Multi-scale provisioning of data based on inputs from various sensing modalities • Urgency of the need for sensed data • Available bandwidth • Verification algorithms • Used during design phase, to reduce the time spent during the validation phase

40. Stanford DragonFly UAV 10 ft wingspan 12 ft wingspan [Jang, Teo, Inalhan, and Tomlin, DASC 2001], [Jang and Tomlin, AIAA GNC 2002]