Analytical Validation Tools for Safety Critical Systems

Transcription

1 Analytical Validation Tools for Safety Critical Systems AerospaceControl Gary J. Balas and Peter Seiler Aerospace Engineering and Mechanics University of Minnesota Andrew Packard Department of Mechanical Engineering University of California, Berkeley Safe & Secure Systems & Software Symposium S5, June 2010

2 IEEE CSS International Workshop on The Future of Control in Transportation Systems May 27-29, 2010, Benevento Sorrento, Italy Workshop focused on transportation systems (railways, vehicle and road transportation, aircraft/infrastructure) to: Highlight future control challenges. Identify common control problems across the application areas. Identify control areas in need of support by academia, industries, private and government funding agencies. 30 attendees from 12 countries

3 IEEE International Workshop on The Future of Control in Transportation Systems Aerospace Working Group

4 Aerospace Working Group Members 3 Gary Balas, University of Minnesota Johann Bals, German Aerospace Center Richard Barhydt, NASA Federico Corraro, CIRA John Hansman, MIT Marco Lovera, Politecnico di Milano Andres Marcos, Deimos Space Roberto Palumbo, CIRA Peter Seiler, University of Minnesota Balint Vanek, Hungarian Academy of Sciences Shuguang Zhang, Beihang University Aerospace Working Group

5 Aerospace Challenges and Open Issues 4 High integrity control systems development (e.g., safety-critical systems) Certification challenges Design for Validation & Verification Life cycle management Process and tools (modeling, simulation, analysis, design, verification, validation) Theoretical understanding and validation of industrial practices Analytical redundancy (FDI, FTC, HM) Policy and legacy issues causing implementation issues Flexible operation design Multi-attribute optimization Adaptive systems Trajectory planning Environmental performance Aerospace Working Group

6 Aerospace Challenges and Open Issues 5 Complexity Handling complexity (model abstraction level) Boundary with related disciplines Distributed/centralized control and coordination Management of uncertainty Multi-vehicle network control Human-centered automation and control Aerospace Working Group

7 Aerospace Potential Actions 6 Cross-discipline benchmark problems Control, human factors, software, certification Formulated with industry IEEE Control System Society sponsored workshop Broadening control education Include the entire development process in education Education in related disciplines (e.g., computer science, human factors, application domains) Incorporate into existing curricula Encourage and support international collaboration High-integrity certification processes will require international cooperation Capture common industrial practices Encourage industry papers in special sessions and special issues Aerospace Working Group

8 Embedded Redundancy Management for Low-Cost, Safety-Critical Systems NSF Cyber-Physical Systems Program Pete Seiler, Gary Balas, Mats Heimdahl, Jaideep Srivastava, and Antonia Zhai Aerospace Engineering and Mechanics, Computer Science University of Minnesota June 14, 2010

9 Fault Detection for Safety Critical Systems Issue: Current safety critical systems rely mainly on physical redundancy but this increases system size, complexity and power consumption. Objective: Develop algorithms and computing architectures which enable fault detection without relying on physical redundancy. F/A-18 Hornet Aircraft

10 Embedded Fault Detection Fault Detection Approach 1. Model-based monitors to detect faults in physical domain 2. Monitors derived from software requirements to detect faults in cyber (hardware/software) domain 3. Data-driven anomaly detection to detect faults in both the cyber and physical domains Computing Architectures: Develop novel architectural enhancements to the multi-core architectures in order to implement the proposed faultdetection approach. Applications: UAVs, medical devices, road vehicles

11 Design & Development Space Software-Enabled Control mon_f ailure_report [status_a] status_a [status_b] status_b input_a [status_c] [prev_sel] status_c prev_sel f ailure_report input_b failreport f ailreport [A] [B] input_a input_b [C] input_c input_c Failure_Isolation trip_level pc persistence_cnt<pc> 2 persistence_cnt pc m persist_lim [trigger] tc 3 totalizer_cnt<tc> [A] totalizer_cnt MS [B] [C] triplex_input_monitor [DSTi] trigger input_a input_sel input_b input_c DST_index 4 input_sel triplex_input_selector CONCRETE Software V&V Research: Model-Based Formal Methods Structural Testing Run-time Monitoring ABSTRACT

12 Design & Development Space Software-Enabled Control mon_f ailure_report [status_a] status_a [status_b] status_b input_a [status_c] [prev_sel] status_c prev_sel f ailure_report input_b failreport f ailreport [A] [B] input_a input_b [C] input_c input_c Failure_Isolation trip_level pc persistence_cnt<pc> 2 persistence_cnt pc m persist_lim [trigger] tc 3 totalizer_cnt<tc> [A] totalizer_cnt MS [B] [C] triplex_input_monitor [DSTi] trigger input_a input_sel input_b input_c DST_index 4 input_sel triplex_input_selector CONCRETE ABSTRACT Aerospace Research: V&V of flight control system and vehicle health management; discrete and continuous-time dynamics

13 w theta <Velocity [m/s]> F_grav [N] F_drag [N] F_fric [N] Total Disturbance Force [N] Design & Development Space PHYSICAL 1 X Plant Description c_r m*g Constant2 Gain3 Sign Product1 u 2 1/2*rho*Cd*A_front Math Function Gain2 1 F_dist Environment si n m*g Trigonometric Function Gain1 Software-Enabled Control mon_failure_report [status_a] status_a [status_b] status_b input_a [status_c] [prev_sel] status_c prev_sel failure_report input_b failreport failreport [A] [B] input_a input_b [C] input_c input_c Failure_Isolation CYBER m trip_level persist_lim MS pc 2 persistence_cnt<pc> persistence_cnt [trigger] tc 3 totalizer_cnt<tc> [A] totalizer_cnt [B] pc trigger input_a input_sel input_b 4 input_sel triplex_input_monitor [C] input_c [DSTi] DST_index triplex_input_selector CONCRETE ABSTRACT

14 w theta <Velocity [m/s]> F_grav [N] F_drag [N] F_fric [N] Total Disturbance Force [N] Design & Development Space PHYSICAL 1 X Plant Description c_r m*g Constant2 Gain3 Sign Product1 u 2 1/2*rho*Cd*A_front Math Function Gain2 1 F_dist Environment si n m*g Trigonometric Function Gain1 NSF CPS Project Software-Enabled Control mon_failure_report [status_a] status_a [status_b] status_b input_a [status_c] [prev_sel] status_c prev_sel failure_report input_b failreport failreport [A] [B] input_a input_b [C] input_c input_c Failure_Isolation CYBER m trip_level persist_lim MS pc 2 persistence_cnt<pc> persistence_cnt [trigger] tc 3 totalizer_cnt<tc> [A] totalizer_cnt [B] pc trigger input_a input_sel input_b 4 input_sel triplex_input_monitor [C] input_c [DSTi] DST_index triplex_input_selector CONCRETE ABSTRACT

15 IGERT (Pending) Collaboration: Computer Science Aerospace Mechanical Civil Electrical Biomedical Human Factors Human Centered Automation Human Factors Cognitive Science Fluid and Aero Dynamics Sensors IGERT: Cyber Physical Systems A Confluence of Human, Machine, and Physical Environment Control Theory Software Engineering Validation & Verification

16 Acknowledgments Dr. Ufuk Topcu, Control and Dynamical Systems, Caltech Berkeley Center for Control and Identification Ryan Feeley, Evan Haas, George Hines, Zachary Jarvis-Wloszek, Erin Summers, Kunpeng Sun, Weehong Tan, and Timothy Wheeler University of Minnesota Aerospace Controls Group Abhijit Chakraborty, Rohit Pandita and Qian Zheng AFOSR FA , Development of Analysis Tools for Certification of Flight Control Laws, 05/01/05 04/30/08. NASA NRA NNX08AC80A, Analytical Validation Tools for Safety Critical Systems, Dr. Christine Belcastro Technical Monitor, 01/01/ /31/2010. NSF CPS CNS , Embedded Fault Detection for Low-Cost, Safety Critical Systems, 10/01/2009 9/30/2012. Software, Course Notes: AerospaceControl 2/24

17 Motivation: Flight Controls Validation of flight controls mainly relies on linear analysis tools and nonlinear (Monte Carlo) simulations. This approach generally works well but there are drawbacks: It is time consuming and requires many well-trained engineers. Linear analyses are valid over an infinitesimally small region of the state space. Linear analyses are not sufficient to understand truly nonlinear phenomenon, e.g. the falling leaf mode in the F/18 Hornet. Linear analyses are not applicable for adaptive control laws or systems with hard nonlinearities. There is a need for nonlinear analysis tools which provide quantitative performance/stability assessments over a provable region of the state space. 3/24

18 Our Perspective Linear analysis: provides a quick answer to a related, but different question: Q: How much gain and time-delay variation can be accommodated without undue performance degradation? A: (answers a different question) Here s a scatter plot of margins at 1000 trim conditions throughout envelope. Why does linear analysis have impact in nonlinear problems? Domain-specific expertise exists to interpret linear analysis and assess relevance. Speed, scalable: Fast, defensible answers on high-dimensional systems. Extend validity of the linearized analysis Infinitesimal local (with certified estimates) Address uncertainty 4/24

19 Overiew Numerical tools to quantify/certify dynamic behavior Locally, near equilibrium points Analysis considered Region-of-attraction, input/output gain, reachability, establishing local IQCs Methodology Enforce Lyapunov/Dissipation inequalities locally, on sublevel sets Set containments via S-procedure and SOS constraints Bilinear semi-definite programs Always feasible Simulation aids nonconvex proof/certificate search Address model uncertainty Parametric Uncertainty Parameter-independent Lyapunov/Storage functions Branch-&-Bound Dynamic Uncertainty Local small-gain theorems 5/24

20 Nonlinear Analysis Autonomous dynamics: ẋ = f(x), f( x) = 0 Equilibrium point Uncertain initial condition, x(0) = G Question: Do all solutions converge to x? Drive dynamics: ẋ = f(x, w), f( x, 0) = 0 Equilibrium point Uncertain inputs, w 2 R, w σ Question: How large can z = h(x) get? Uncertain dynamics: ẋ = f(x, δ), or ẋ = f(x, w, δ) Unknown, constant parameters, δ Unmodeled dynamics Same questions.... 6/24

21 Region-of-Attraction and Reachability Dynamics, equilibrium point ẋ = f(x), f( x) = 0 p : Analyst-defined function whose (well-understood) sub-level sets are to be in region-of-attraction. {x : p(x) β}, ROA N By choice of positive-definite V, maximize β so that {x : p(x) β} {x : V (x) 1} {x : V (x) 1} is bounded {x : x x, V (x) 1} { x : dv } dx f(x) < 0 Given a differential equation ẋ = f(x, w) and a positive definite function p, how large can e(t) get, knowing x(0) = 0, w 2 R? Conditions on R n+nw Conclusion on ODE ẋ = f(x, w), e = p(x) dv dx f(x, w) wt w on { x : V (x) R 2}, all w { x : V (x) R 2 } {x : p(x) β} x(0)0, w 2 R for allt, solution exists and e(t) β 7/24

22 Solution Approach 1. Sum-of-squares to (conservatively) enforce nonnegativity. f Σ if f = ΣG 2 i for some g i 2. Easy (semi-definite program) to check if a given polynomial is SOS 3. S-procedure to (conservatively) enforce set containment 4. Apply S-procedure to Analysis conditions. For (e.g.) reachability, minimize β (by choice of s i and V ) such that (β p) s 1 (R 2 V ) Σ x,w ( (R 2 V )s 2 + dv ) dx f(x, w) wt w Σ x,w 5. Semi-definite program iteration: Initialize V, then 5.1 Optimize objective by changing S-procedure multipliers 5.2 Optimize objective by changing V 5.3 Iterate on (5.1) and (5.2) 6. Initialization of V is important for the iteration to work 6.1 Simulation of system dynamics yields convex constraints which contain all feasible Lyapunov function candidates. This set can be sampled to initialize V. 8/24

23 Applications Region of attraction for F/A-18 falling leaf mode Reachability for GTM aircraft longitudinal axis dynamics 9/24

24 F/A-18 Falling Leaf Motion The US Navy has lost many F/A-18 A/B/C/D Hornet aircraft due to an out-of-control flight departure described as the falling leaf mode. F/A-18 : NASA Dryden Photo The falling leaf mode can require 4.5K-6K m to recover. F/A-18 : NASA Dryden Photo Administrative action by NAVAIR to prevent further losses. Revised control law implemented deployed in , F/A-18E/F Uses ailerons to damp sideslip 10/24

25 Baseline/Revised Control Architecture (simplified) 11/24

26 Baseline vs Revised: Analysis Is revised better? Yes, several years service confirm but can this be ascertained with a model-based validation? Recall that Baseline underwent validation, yet had problems. Linearized Analysis: at equilibrium and several steady turn rates Classical loop-at-a-time margins Disk margin analysis (Nichols) Multivariable input disk-margin Diagonal input multiplicative uncertainty Full -block input multiplicative uncertainty Parametric stability margin (µ) using physically motivated uncertainty in 8 aero coefficients. Conclusion: Both designs have excellent (and nearly identical) linearized robustness margins trimmed across envelope. 12/24

27 Baseline vs Revised: Beyond Linearized Analysis Perform region-of-attraction estimate as described. Unfortunately, closed-loop models too complex (high dynamic order) for direct approach, at this time. Model approximation: Reduced state dimension (domain-specific simplifications) α β p q r φ x c Polynomial approximation of closed-loop dynamic models. 13/24

28 ROA Results Ellipsoidal shape factor, aligned w/ states, appropriated scaled 5 hours for quartic Lyapunov function certificate 100 hours for divergent sims with small initial conditions Chakraborty, Seiler and Balas, Applications of Linear and Nonlinear Robustness Analysis Techniques to the F/A-18 Control Laws, AIAA Guidance, Navigation and Control Conference, Chicago IL, August /24

29 NASA Generic Transport Model (GTM) Aircraft NASA constructed the remote-controlled GTM aircraft for studying advanced safety technologies. The GTM is a 5.5 percent scale commercial aircraft. NASA created a high-fidelity 6DOF model of the GTM including look-up tables for the aerodynamic coefficients. References: Jordan, T., Foster, J.V., Bailey, R.M, and Belcastro, C.M., AirSTAR: A UAV platform for flight dynamics and control system testing. 25th AIAA Aerodynamic Measurement Technology and Ground Testing Conf., AIAA (2006). Cox, D., The GTM DesignSim v /24

30 Reachable Sets For a nonlinear system ẋ = f(x, u), the vector x f R n is unit energy reachable if there exists a final time T and an input u(t) defined on [0, T ] satisyfing u 2 1 and that drives the state from x(0) = 0 to x(t ) = x f. The unit energy reachable set R ue is the set of points that are reachable from the origin with a unit energy. For linear systems this set is an ellipsoid that can be computed from a semidefinite programming problem. The size of the ellipsoid scales with the magnitude of the input energy. For nonlinear systems the this set can be difficult to compute and its size does not, in general, scale linearly with the magnitude of the input energy. Our approach is to approximate nonlinear models with polynomials and then estimate the size of this set with polynomial optmization tools. Knowledge of the reachable set for an aircraft can be used for dynamic flight envelope assessment. 16/24

31 Aircraft Longitudinal Axis Dynamics The aircraft longitudinal axis dynamics are described by: V = D + mg sin (θ α) T cos α m α = L mv + mg cos (θ α) T sin α + q q = M I yy θ = q States: air speed V (ft/sec), angle of attack α (deg), pitch rate q (deg/sec) and pitch angle θ (deg). Controls: elevator deflection δ elev (deg) and engine thrust T (lbs). Forces/Moment: drag force D (lbs), lift force L (lbs), and pitching moment M (lbs-ft). 17/24

32 GTM Polynomial Modeling Aerodynamic look-up table data, engine data, trigonometric functions, and 1/V with low-order polynomials were fit. Resulting model is a 7th order polynomial. Two facts for obtaining accurate models: The raw aerodynamic data is provided in body-axes but better fits can be obtained in wind axes. Matching the trim characteristics requires very accurate fits at low angles of attack CLa 0.5 CDa Lookup Table Poly Fit 0.5 Lookup Table Poly Fit alpha (deg) alpha (deg) 18/24

33 Trim Conditions Computed the level-flight trim conditions for the nonlinear (look-up tables, etc.) and polynomial models. alpha (deg) TAS (ft/sec) throttle (percent) TAS (ft/sec) theta (deg) TAS (ft/sec) elev (deg) Full Nonlinear Polynomial TAS (ft/sec) 19/24

34 Computing Reachable Set Estimates We approximate the reachable set by an ellipsoid of the form ˆR β := {x : (x x trim ) T N(x x trim ) β} where N reflects a scaling of the coordinates. x := [V (ft/sec), α (rad), q (rad/sec), θ (rad) ] x trim := [ 150 ft/sec, rad, 0 rad/sec, rad ] N := diag([ 50 ft/sec, 0.35 rad, 0.87 rad/sec, 0.35 rad ]) 2 Upper bounds: β(γ) := min u 2 γ β subject to R ue ˆR β For polynomial systems this computation takes the form of an iteration involving polynomial (sum-of-squares) optimizations that are converted into semidefinte programs. Lower bounds: β(γ) := max u 2 γ(x x trim ) T N(x x trim ). One method is a power-method iteration [Tierno, et. al., 1997] Another method is to simulate the nonlinear system with the exact (scaled) worst-case input for the linearized system. The exact reachable set for the linearization can be computed and this can be used to compute the maximal value of (x x trim ) T N(x x trim ). 20/24

35 Reachability Results The size of the reachable set depends on the input energy. Upper bounds are shown in red, lower bounds in blue, and the linear approximation is in black. 0.7 β (reachable set ellipsoid bound) nonlinear(quadratic) linear 0.1 nonlinear (lowerbound) nonlinear(quartic) nonlinear(lower bound,wcinput) γ (input energy) 21/24

36 Reachability Results Tested the worse-case input signal for polynominal model (β = 0.48) on the full, nonlinear GTM model (β =.35). TAS (knots) time (sec) 5 alpha (deg) time (sec) 20 throttle (percent) q (deg/sec) time (sec) time (sec) theta (deg) elev (deg) time (sec) Poly 3.5 GTM time (sec) 22/24

37 Wrapup/Perspective Proofs of behavior Extensive simulation with certificate and linearized analysis Tools (Multipoly, SOSOPT, SeDuMi) that handle (cubic, in x, vector field) 15 states, 3 parameters, unmodeled dynamics, analyze with (V ) = 2 7 states, 3 parameters, unmodeled dynamics, analyze with (V ) = 4 4 states, 3 parameters, unmodeled dynamics, analyze with (V ) = 6 8 Certified answers, however, not clear that these are appropriate for design choices. S-procedure/SOS/DIE more quantitative than linearization Linearized analysis: quadratic storage functions, infinitesimal sublevel sets SOS/S-procedure always works 23/24