Quantitative Local Analysis of Nonlinear Systems

1. Quantitative Local Analysis of Nonlinear Systems NASA NRA Grant/Cooperative Agreement NNX08AC80A • “Analytical Validation Tools for Safety Critical Systems” • Dr. Christine Belcastro, Technical Monitor, 01/01/2008-12/31/2010 AFOSR FA9550-05-1-0266 • “Analysis tools for Certification of Flight Control Laws” • 05/05/2005-04/30/2008 Colleagues Univ of Minnesota: Pete Seiler, Abhijit Chakraborty, Gary Balas UC Berkeley: Ufuk Topcu, Erin Summers, Tim Wheeler, Andy Packard Barron Associates: Alec Bateman www.cds.caltech.edu/~utopcu/LangleyWorkshop.html

2. www.cds.caltech.edu/~utopcu/LangleyWorkshop.html

3. Validation/Verification/Certification (VVC) Control Law VVC - Verification: assure that the flight control system fulfills the design requirements. - Validation: assure that the developed flight control system satisfies user needs under defined operating conditions. - Certification: applicant demonstrates compliance of the design to the certifying authority. Current practice: Partially guided by MilSpec • Linearized analyses • Closed-loop: Time domain • Open-loop: Frequency domain • Numerous nonlinear sims. • Strategies/Process to manage/distill all of this data into a actionable conclusion. “as much a psychological exercise as it is a mathematical analysis”, Anonymous, Senior systems engineer, large US corporation.

4. Why psychological? VV needs a conclusion about physical system using model-based analysis… leap-of-faith arises from Inadequacy in model • Known unknowns • Unknown unknowns • Gross simplification Inadequacy in analysis to resolve issue • Inability to precisely answer question • Relevance of question to issue at hand Goal: • Make the leap smaller with quantitative nonlinear analysis while addressing these Improve these

5. Role of linearized analysis Linear analysis: provides a quick answer to a related, but different question: Q: How much gain and time-delay variation can be accommodated without undue performance degradation? A: (answers a different question) Here’s a scatter plot of margins at 1000 equilbrium trim conditions throughout envelope Why does linear analysis have impact in nonlinear problems? • Domain-specific expertise exists to interpret linear analysis and assess relevance • Speed, scalable: Fast, defensible answers on high-dimensional systems Extend validity of the linearized analysis Infinitesimal → local (with certified estimates) Address uncertainty Here’s a scatter plot of guaranteed region-of-attraction estimates, in the presence of 40% unmodeled dynamics at plant input, and 3 parametric variations, at 1000 trim conditions throughout the envelope

6. Overview Numerical tools to quantify/certify dynamic behavior Locally, near equilibrium points Analysis considered Region-of-attraction, input/output gain, reachability, establishing local IQCs Methodology Enforce Lyapunov/Dissipation inequalities locally, on sublevel sets Set containments via S-procedure and SOS constraints Bilinear semidefinite programs “always” feasible Simulation aids nonconvex proof/certificate search Address model uncertainty Parametric Uncertainty • Parameter-independent Lyapunov/Storage Fcn • Branch-&-Bound Dynamic Uncertainty • Local small-gain theorems

7. Nonlinear Analysis Autonomous dynamics • equilibrium point • uncertain initial condition, • Question: do all solutions converge to Driven dynamics • equilibrium point • uncertain inputs, , • Question: how large can get? Uncertain dynamics • Unknown, constant parameters, • Unmodeled dynamics • Same questions…

8. Region-of-Attraction and Reachability Dynamics, equilibrium point p: Analyst-defined function whose (well-understood) sub-level sets are to be in region-of-attraction By choice of positive-definite V, maximize  so that: Given a differential equation and a positive definite function p, how large can get, knowing Local DIE: Conditions on Conclusion on ODE

9. Solution Approach • S-procedure to (conservatively) enforce set containments in Rn • Sum-of-squares to (conservatively) enforce nonnegativity of h: Rn → R • Easy (semidefinite program) to check if a given polynomial is SOS • Apply S-procedure/SOS to Analysis set-containment conditions. For (e.g.) reachability, minimize β (R fixed, by choice of si and V) such that • SDP iteration: Initialize V, then • Optimize objective by changing S-procedure multipliers • Recenter V • Iterate on (a) and (b) • Initialization of V is important (in a complicated fashion) for the iteration to work • Simulation of system dynamics yields convex constraints which contain all (if any) feasible Lyapunov function candidates

10. Quantitative improvement on linearized analysis These SOS/S-procedure formulations are always feasible using quadratic V Consider dynamics where matrix A is Hurwitz, and • function f23 consists of 2nd and 3rd degree polynomials, f23(0)=0 A nonempty region-of-attraction is certified • Consider dynamics • where matrix A is Hurwitz, and • f2, g2, h2 quadratic, f3 cubic • with f2(0,0)=f3(0)=h2(0)=0, and For some R>0, • Consider dynamics • where matrix A is Hurwitz, and • functions b bilinear, q quadratic For some R>0,

11. Common features of analysis These analysis all involve search over a nonconvex set of certifying Lyapunov functions, roughly The SOS relaxations are nonconvex as well, e.g., Solution approaches: SOS conditions to verify containments • Parametrize V, parametrize multipliers, solve… • Ad-hoc iterative, based on linear SDPs • Bilinear SDP solvers Behavior: Initial point can have big effect on end result, e.g., • Unable to reach a feasible point • Convergence to local optimum (or less)

12. ROA: Simulations constrain suitable V Consider a simpler question. Fix β, is Ad-hoc solution: • run N sims, starting from samples in • If any diverge, then “no” • If all converge, then maybe “yes”, and perhaps the Lyapunov analysis can prove it In this case, how can we use the simulation data? Necessary condition: If V exists to verify, it must be • ≤1 on all trajectories • ≥0 on all trajectories • Decreasing on all trajectories • Other constraints???…

13. Convex Outer bound on certifying Lyapunov functions After simulations • Collection of convergent trajectories starting in • divergent trajectories starting in Linearly parametrize V, namely The necessary conditions on V are convex constraints on V≤1 on convergent trajectories V≥0 on all trajectories V decreasing on convergent trajectories Quad(V) is a Lyapunov function for Linear(f) V≥1 on divergent trajectories If convex constraints yield empty set, then V parametrization cannot certify Basis functions, eg., all degree 4 Hermite polynomials Sample this set to get candidate V Hit&Run (Smith, 1984, Lovasz, 1999, Tempo, Calafiore, Dabbene

14. Uncertain Systems: Parameter-Independent V Start with affine parameter uncertainty Solve earlier conditions, but enforcing at the vertex values of f. Then is invariant, and in the Robust ROA of . Advantages: a robust ROA, and • V is only a function of x, δ appears only implicitly through the vertices • SOS analysis is only in x variables • Simulations are incorporated as before (vary initial condition and δ) Limitations • Conservative with regard to uncertainty • Conclusions apply to time-varying parameters, hence… • often conclusions are too weak for time-invariant parameters polytope in Rm Subdivide Δ Solve separately Δ1 Δ2

15. δ2 δ1 Much better: B&B in Uncertainty Space Of course, growth is still exponential in parameters… but • kth local problem uses Vk(x) • Solve conservative problem over subdomain • Local problems are decoupled • Trivial parallelization Computation yields a binary tree • decomposes parameter space • certificates at each leaf BTree(k).Analysis Analysis.ParameterDomain Analysis.VertexDynamics Analysis.LyapunovCertificate Analysis.SOSCertificates Analysis.CertifiedVolume BTree(k).Children • Nonconvex parameter-space, and/or coupled parameters • cover with union of polytopes, and refine…

16. 4-state aircraft example w/uncertainty • Treat as 3 parameters • Affine dependence • 2-dimensional manifold in R3 • Cover with polytope in R3 • Solve… Aircraft: Short period longitudinal model, pitch axis, with 1-state linear controller Spherical shape factor: 9-processor Branch-&-Bound • Divide worst region into 9, improve polytope cover

17. Unmodeled dynamics: Local small-gain theorem M Local, gain constraint (≤1) on Δ M • Implies: Starting from x(0)=0, • for all Δ causal, globally stable, also satisfies DIE • This gives:

18. Unmodeled dynamics: Local small-gain theorem M Local, gain constraint (≤1) on Δ M Local DIE for L2 gain Δ causal, globally stable, • Then:

19. 4-state aircraft example w/uncertainty Δ .75 C Pδ 1.25

20. 1 0 E2 -1 -2 -1 0 1 2 E1 Adaptive System: reachability example analysis Model-reference adaptive systems Example: 2-state P, 2-state ref. model, 3 adaptive parameters • Insert additional disturbance (d) • Bound worst-case effect of external signals (r,d) on tracking error (e) • Initial conditions: r Reference model - Adaptive control plant e Quadratic vector field, marginally stable linearization Reachability analysis certifies that for all (r,d) with then for all t, There are particular r and d satisfying causing e to achieve at some time t.

21. F/A-18 Falling Leaf Mode The US Navy has lost many F/A-18 A/B/C/D Hornet aircraft due to an out-of-control flight departure phenomenon described as the “falling leaf” mode • Can require 15,000-20,000 ft to recover • Administrative action by NAVAIR to prevent further losses • Revised control law implemented, deployed in 2003/4, F/A-18E/F • uses ailerons to damp sideslip Heller, David and Holmberg, “Falling Leaf Motion Suppression in the F/A-18 Hornet with Revised Flight Control Software," AIAA-2004-542, 42nd AIAA Aerospace Sciences Meeting, Jan 2004, Reno, NV.

22. Baseline/Revised Control Architecture (simplified)

23. Baseline vs Revised: Analysis Is revised better? Yes, several years service confirm – but can this be ascertained with a model-based validation? Recall that Baseline underwent “validation”, yet had problems. Linearized Analysis: at equilibrium and several steady turn rates • Classical loop-at-a-time margins • Disk margin analysis (Nichols) • Multivariable input disk-margin • Diagonal input multiplicative uncertainty • “Full”-block input multiplicative uncertainty • Parametric stability margin (μ ) using physically motivated uncertainty in 8 aero coefficients Conclusion: Both designs have excellent (and nearly identical) linearized robustness margins trimmed across envelope… Chakraborty , Seiler and Balas, “Applications of Linear and Nonlinear Robustness Analysis Techniques to the F/A-18 Control Laws,” AIAA Guidance, Navigation and Control Conference, Chicago IL, August 2009.

24. Baseline vs Revised: Beyond Linearized Analysis Perform region-of-attraction estimate as described • Unfortunately, closed-loop models too complex (high dynamic order) for direct approach, at this time. Model approximation: • reduced state dimension (domain-specific simplifications) • polynomial approximation of closed-loop dynamic models

25. ROA Results Ellipsoidal shape factor, aligned w/ states, appropriated scaled • 5 hours for quartic Lyapunov function certificate • 100 hours for divergent sims with “small” initial conditions Chakraborty , Seiler and Balas, “Applications of Linear and Nonlinear Robustness Analysis Techniques to the F/A-18 Control Laws,” AIAA Guidance, Navigation and Control Conference, Chicago IL, August 2009.

26. Wrapup/Perspective Tools (Multipoly, SOSOPT, SeDuMi) that handle (cubic, in x, vector field) • 15 states, 3 parameters, unmodeled dynamics, analyze with ∂(V)=2 • 7 states, 3 parameters, unmodeled dynamics, analyze with ∂(V)=4 • 4 states, 3 parameters, unmodeled dynamics, analyze with ∂(V)=6-8 • Certified answers, however, not clear that these are appropriate for design choices Sproc/SOS/DIE more quantitative than linearization • Linearized analysis: quadratic storage functions, infinitesimal sublevel sets • SOS/S-procedure always works Work to scale up to large, complex systems analysis (e.g., adaptive flight controls) where “certificates” are desired. Extensive simulation Proofs of behavior with certificates and linearized analysis

27. Decomposition for high-order Heterogeneous Systems Interconnection of locally stable systems (w/ Summers) • M is constant matrix • Associated with each Ni • (offset) Stable, linear Gi • (weight) Stable, linear, min-phase Wi • The system has localL2-gain ≤1, certified as presented. For low-order Ni, coupled with low-order G and W, this is done with high-degree V • (Linear) robustness analysis on an interconnection involving M, G, and W-1 yields conditions on d, under which gain from d to e is bounded • Hierarchical - easy to include WM, GM, and bound local gain of • Poor-man’s IQC theory for locally-stable interconnections • Combinatorial number of ways to split original system • Infinite choices for G and W • … • Elements must be stable, so reject decompositions based on linearization • A possible route to answering some questions on medium-order systems

28. Uncertain Model Invalidation Analysis Given time-series data for a collection of experiments, with selected features and simple measurement uncertainty descriptions… Task: prove that regardless of the values chosen for the parameters, the model below cannot account for the observed data, where

29. Generalization of covering manifold Given: • polynomial p(δ) in many real variables, • Domain , typically a polytope Find a polytope that covers the manifold • Tradeoff between number of vertices, and • Excess “volume” in polytope One approach: • Find “tightest” affine upper and lower bounds over H Enforce with S-procedure linear function of c0, c

30. Generalization of covering manifold Partition H, repeat For multivariable p, Bound, on H (above and below), each component of p with affine functions, c, d, (e.g, using S-procedure). Then, a covering polytope (Amato, Garofalo, Gliemo) is with 2m+k easily computed vertices.