Compositional Safety Analysis using Barrier Certificates

Size: px

Start display at page:

Download "Compositional Safety Analysis using Barrier Certificates"

Sheila Palmer
6 years ago
Views:

1 Compositional Safety Analysis using Barrier Certificates Department of Electronic Systems Aalborg University Denmark November 29, 2011

2 Objective: To verify that a continuous dynamical system is safe. Definition We say that a system Γ = (f, X, X 0, X u, D) is safe if there are no unsafe trajectories.

3 Objective: To verify that a continuous dynamical system is safe. Definition We say that a system Γ = (f, X, X 0, X u, D) is safe if there are no unsafe trajectories. X 0 X u

4 Objective: To verify that a continuous dynamical system is safe. Definition We say that a system Γ = (f, X, X 0, X u, D) is safe if there are no unsafe trajectories. X 0 X u

5 Objective: To verify that a continuous dynamical system is safe. Definition We say that a system Γ = (f, X, X 0, X u, D) is safe if there are no unsafe trajectories. X 0 X u

6 Objective: To verify that a continuous dynamical system is safe. Definition We say that a system Γ = (f, X, X 0, X u, D) is safe if there are no unsafe trajectories. X X 0 X u

7 Example: Ensure that the rotor speed stays within some specified bounds. ω r t

8 Example: Ensure that the rotor speed stays within some specified bounds. ω r t For the wind turbine the wind is a unknown but bounded disturbance. v w Wind Turbine Model ω r

9 Example: Ensure that the rotor speed stays within some specified bounds. ω r t For the wind turbine the wind is a unknown but bounded disturbance. ṽ w v w Wind Turbine Model ω r

10 Proposition (Strict barrier certificate) Let Γ = (f, X, X 0, X u, D) be given. If there exists a differentiable function B : R n R satisfying B(x) 0 x X 0, B(x) > 0 x X u, and B x (x)f (x, d) < 0 (x, d) X b D, where X b {x X B(x) = 0}. Then the system Γ is safe. (1a) (1b) (1c) X 0 B(x) 0 X X b X u B(x) > 0

11 Proposition (Strict barrier certificate) Let Γ = (f, X, X 0, X u, D) be given. If there exists a differentiable function B : R n R satisfying B(x) 0 x X 0, B(x) > 0 x X u, and B x (x)f (x, d) < 0 (x, d) X b D, where X b {x X B(x) = 0}. Then the system Γ is safe. (1a) (1b) (1c) X 0 B(x) 0 X X b X u B(x) > 0

12 Corollary (Weak barrier certificate) Let Γ = (f, X, X 0, X u, D) be given. If there exists a differentiable function B : R n R satisfying Then the system Γ is safe. B(x) 0 x X 0, B(x) > 0 x X u, and B (x)f (x, d) 0 (x, d) X D. x (2c) (2a) (2b) X 0 B(x) 0 X X u B(x) > 0

13 Suppose the following inequalities are satisfied (to be understood coordinatewise): X {x R n g X (x) 0}, X 0 {x R n g X0 (x) 0}, X u {x R n g Xu (x) 0}, D {d R m g D (d) 0}, (3a) (3b) (3c) (3d) where g X, g X0, g Xu, g D are polynomial maps

14 A polynomial p P n,d is called sum of squares (SOS) if p = k pi 2 (4) i=1 for some polynomials p i P n with i = 1,..., k.

15 A polynomial p P n,d is called sum of squares (SOS) if p = k pi 2 (4) i=1 for some polynomials p i P n with i = 1,..., k. Let α i,j P n,d and w j R. An SOS programming problem is minimize (c 1,...,c k ) R k k w j c j (5) j=1 subject to (6) J α i,0 + α i,j c j is SOS i = 1,..., l. (7) j=1

16 Weak barrier certificate can be solved directly, via the following SOS programming problem. Corollary Let the system Γ = (f, X, X 0, X u, D) and polynomials g be given, and let ɛ 1 > 0. If there exist B P n, λ X0 (Pn S ) k X 0, λ Xu (Pn S ) k Xu, λ X (Pn+m) S k X, and λ D (Pn+m) S k D such that B λ T X 0 g X0, B ɛ 1 λ T X u g Xu, and B x f λt X g X λ T Dg D are sum of squares. Then the system Γ is safe. (8a) (8b) (8c)

17 w 1 d 2 Σ 1 Σ 2 d 1 w 2 w 3 w 4 Σ 3 d 3 Aim: Solve independent optimization problems for each subsystem. Combine the results of the subproblems in a master problem to prove the safety of the interconnected system.

18 w 1 d 2 Σ 1 Σ 2 d 1 w 2 w 3 w 4 Σ 3 d 3 Aim: Solve independent optimization problems for each subsystem. Combine the results of the subproblems in a master problem to prove the safety of the interconnected system. Outlook: It is possible to decouple some optimization problems via dual decomposition. Problem: The subsystems are coupled by signals w i : R 0 R q i.

19 Corollary Let Γ = ({f i }, {X i }, {X 0,i }, {X u,i }, {D i }) be given. If there exist differentiable functions B i : R n i R for i = 1,..., I such that B i (x i ) 0 x i X 0,i, (9a) i B i (x i ) > 0 x i X u,i, i Then the system Γ is safe. i B i x i (x i )f i (x i, d i, w in,i ) < 0 w in,i W in,i, x i X b,i, d i D i. (9b) (9c)

20 Proposition Let Γ = ({f i }, {X i }, {X 0,i }, {X u,i }, {D i }) be given. If there exist differentiable functions B i : R n i R and functions γ 0,i : R n i R, γ u,i : R n i R, and γ w,i : R q i + m i R for i = 1,..., I such that B i (x i ) + γ 0,i 0 x i X 0,i, B i (x i ) γ u,i > 0 x i X u,i, B i (x i )f i (x i, d i, w in,i ) < γ w,i (w in,i, h i (x i )) x i for all w in,i W in,i, x i X b,i, d i D i, (10a) (10b) and for all w in,i W in,i, x i X i γ 0,i 0, γ u,i 0, i i i γ w,i (w in,i, h i (x i )) 0. Then the system Γ is safe.

21 minimize f (x, y) = f 1 (x 1, y) + f 2 (x 2, y) subject to x 1 C 1, x 2 C 2, h 1 (x 1, y) + h 2 (x 2, y) 0. (11)

22 minimize f (x, y) = f 1 (x 1, y) + f 2 (x 2, y) subject to x 1 C 1, x 2 C 2, h 1 (x 1, y) + h 2 (x 2, y) 0. (11) Replace y with either y 1 or y 2 and add the constraint y 1 = y 2 minimize f (x, y) = f 1 (x 1, y 1 ) + f 2 (x 2, y 2 ) subject to x 1 C 1, x 2 C 2, y 1 = y 2, h 1 (x 1, y 1 ) + h 2 (x 2, y 2 ) 0.

23 minimize f (x, y) = f 1 (x 1, y) + f 2 (x 2, y) subject to x 1 C 1, x 2 C 2, h 1 (x 1, y) + h 2 (x 2, y) 0. (11) Replace y with either y 1 or y 2 and add the constraint y 1 = y 2 minimize f (x, y) = f 1 (x 1, y 1 ) + f 2 (x 2, y 2 ) subject to x 1 C 1, x 2 C 2, y 1 = y 2, h 1 (x 1, y 1 ) + h 2 (x 2, y 2 ) 0. Notice that f 1 and f 2 have no shared variables. The Lagrangian becomes L(x 1, y 1, x 2, y 2, λ 1, λ 2 ) = f 1 (x 1, y 1 ) + f 2 (x 2, y 2 ) + λ T 1 (y 1 y 2 ) + λ 2 (h 1 (x 1, y 1 ) + h 2 (x 2, y 2 )). (12)

24 Lagrangian: L(x 1, y 1, x 2, y 2, λ 1, λ 2 ) = f 1 (x 1, y 1 ) + f 2 (x 2, y 2 ) + λ T 1 (y 1 y 2 ) + λ 2 (h 1 (x 1, y 1 ) + h 2 (x 2, y 2 )). (13)

25 Lagrangian: L(x 1, y 1, x 2, y 2, λ 1, λ 2 ) = f 1 (x 1, y 1 ) + f 2 (x 2, y 2 ) + λ T 1 (y 1 y 2 ) The dual function becomes where ( ϕ 1 (λ) = inf x 1,y 1 + λ 2 (h 1 (x 1, y 1 ) + h 2 (x 2, y 2 )). (13) ϕ(λ 1, λ 2 ) = ϕ 1 (λ 1, λ 2 ) + ϕ 2 (λ 1, λ 2 ), (14) ) f 1 (x 1, y 1 ) + λ T 1 y 1 + λ 2 h 1 (x 1, y 1 ) ) ( ϕ 2 (λ) = inf f 2 (x 2, y 2 ) λ T x 2,y 1 y 2 + λ 2 h 2 (x 2, y 2 ) 2 ϕ 1 and ϕ 2 can be solved independently., (15a). (15b)

26 Lagrangian: L(x 1, y 1, x 2, y 2, λ 1, λ 2 ) = f 1 (x 1, y 1 ) + f 2 (x 2, y 2 ) + λ T 1 (y 1 y 2 ) The dual function becomes where ( ϕ 1 (λ) = inf x 1,y 1 + λ 2 (h 1 (x 1, y 1 ) + h 2 (x 2, y 2 )). (13) ϕ(λ 1, λ 2 ) = ϕ 1 (λ 1, λ 2 ) + ϕ 2 (λ 1, λ 2 ), (14) ) f 1 (x 1, y 1 ) + λ T 1 y 1 + λ 2 h 1 (x 1, y 1 ) ) ( ϕ 2 (λ) = inf f 2 (x 2, y 2 ) λ T x 2,y 1 y 2 + λ 2 h 2 (x 2, y 2 ) 2 ϕ 1 and ϕ 2 can be solved independently. The dual problem is, (15a). (15b) maximize ϕ 1 (λ 1, λ 2 ) + ϕ 2 (λ 1, λ 2 ), (16)

27 Algorithm 1 Initialization: Let k = 0, define the step size α k, and choose some λ (0) 1, λ(0) 2, ɛ > 0. 2 Solve subproblems: Solve ϕ 1 (λ) to find x (k) 1 and ȳ (k) 1, solve ϕ 2 (λ) to find x (k) 2 and ȳ (k) 2. 3 Update dual variables: λ (k+1) 1 := λ (k) 1 α k (ȳ (k) 2 ȳ (k) 1 ), λ (k+1) 2 := λ (k) 2 + α k (h 1 ( x (k) 1, ȳ (k) 1 ) + h 2 ( x (k) 2, ȳ (k) 2 )), k := k + 1. If λ (k+1) 1 λ (k) 1 > ɛ, then go to step 2. Otherwise, terminate the algorithm.

28 v w β v t Aerodynamics Tower T r F t T g Drive train ω r shaft is decele to sway too m accepted by th this does not h are modeled as explanation. [ vr ω r,f ] = [ [ ] [ vr cvr v = r + (v w v t ) ω r,f ] [ ] Figure 3: Wind turbine modeled Tr as an interconnection of three subsystems., h c ωr,f ω r,f + ω 1 =, r F t [ ] [ 1 ] vt = M t (F t B t v t k t x t ) ẋ t The function to be maximized is ϕ(λ) = i ϕi(λ), which has a gradient g(λ (k) ) =, h 2 = v t v t i gi(λ(k) ). The vector of multipliers is updated according to (43), and is 1 ω ( r J r (T r k r θ B r (ω r 1 λ (k+1) = λ (k) α kg T N g ω g )) λ (k)). (51) θ = ω r 1 N g ω g ( ), h 3 = ω r, ω 1 g J g N g (k r θ + B r (ω r 1 N g ω g )) T g 1 It is seen that if i γ1,i 0 is violated, then λ(k+1) 1 > λ (k) 1, as the first element of g(λ (k) ) is negative. This puts a larger penalty on the violation of the constraint through the dual variable λ 1. T r = ( c 11 + c 12 ω r,f + c 13 v r + c 14 ω 2 r,f + c 15v 2 r + c 16 ω r,f v r ) v 3 r 5. EXAMPLE [ vt [ p1 h 1 = ẋ t ] = p 2 [ 1 M h 2 = v t ω r θ = ω g where F t = (c 21 + c 22 ω r,f + c 23 v r + c 24 v 2 r + c 25 ω r,f v r )v 2 r + c 26 + c 27 ω 2 r,f h 3 = ω r 1 J p 1 = ( c 1 +c p 2 = (c 2 + c

29 Objective: Show that an emergency shutdown of the wind turbine does not cause the tower to deflect too much and does not make the drive train twist too much.

30 Objective: Show that an emergency shutdown of the wind turbine does not cause the tower to deflect too much and does not make the drive train twist too much. We prove via the compositional weak barrier certificate method that the polynomial B(x) = ω 2 r θ ω2 r θ ω 2 r ω r ω g ω 2 g ω g θ θ v 2 t x t 0.256v 2 t v t x 2 t 2.15v t x t v t 0.755x 2 t x t v 2 r v r ω r,f 0.107v r ω 2 r,f ω r,f is nonpositive on the initial set and positive on the unsafe set. Hence, the system is safe.

Safe Operation and Emergency Shutdown of Wind Turbines

Safe Operation and Emergency Shutdown of Wind Turbines Andreas Søndergaard Pedersen Christian Sigge Steiniche Intelligent Autonomous Systems, Master Thesis May 212 Department of Electronic Systems Aalborg