Computing Viable Sets and Reachable Sets to Design Feedback Linearizing Control Laws Under Saturation

Transcription

1 Computing Viable Sets and Reachable Sets to Design Feedback Linearizing Control Laws Under Saturation Meeko Oishi, Ian Mitchell, Claire Tomlin, Patrick Saint-Pierre Abstract We consider eedback linearizable systems subject to bounded control input and nonlinear state constraints. In a single computation, we synthesize 1) parameterized nonlinear controllers based on eedback linearization, and 2) the set o states over which this controller is valid. This is accomplished through a reachability calculation, in which the state is extended to incorporate input parameters. While we use a Hamilton- Jacobi ormulation, a viability approach is also easible. The result provides a mathematical guarantee that or all states within the computed set, there exists a control law that will simultaneously satisy two separate goals: envelope protection no violation o state constraints), and stabilization despite saturation. We apply this technique to two real-world systems: the longitudinal dynamics o a civil jet aircrat, and a twoaircrat, planar collision avoidance scenario. The result, in both cases, is a easible range o input parameters or the nonlinear control law, and a corresponding controlled invariant set. I. INTRODUCTION Aircrat light management systems blend a pilot s or autopilot s control input with a variety o state and input constraints, in order to achieve goals such as management o control saturation, trajectory generation and tracking, and envelope protection. In complex systems such as aircrat, many o these control goals must be achieved simultaneously. Blindly implementing control schemes or multiple goals e.g. envelope protection and stabilization) can result in chattering, instability, and other counterintuitive phenomenon, when the controller switches between multiple, independently designed control laws. Existing light management systems are designed mostly through ad-hoc rules to avoid these types o problems. While the resultant systems are This work was supported by M. Oishi s Harry S. Truman Postdoctoral Fellowship in National Security Science and Engineering at Sandia National Laboratories operated by Sandia Corporation, a Lockheed Martin Company, or the US DoE s NNSA under Contract DE-AC4-94-AL85), C. Tomlin s NSF Career Award, by the Deense Advanced Research Projects Agency DARPA) under the Sotware Enabled Control Program AFRL Contract F C-314), and by the DoD Multidisciplinary University Research Initiative MURI) program administered by the Oice o Naval Research under Grant N M. Oishi is an Assitant Proessor with the Department o Electrical and Computer Engineering, Vancouver, BC, Canada moishi@ece.ubc.ca I. Mitchell is an Assistant Proessor with the Department o Computer Science, University o British Columbia, Vancouver, BC, Canada mitchell@cs.ubc.ca C. Tomlin is an Associate Proessor with the Department o Aeronautics and Astronautics, Stanord University, Stanord, CA, USA, and an Associate Proessor with the Department o Electrical Engineering and Computer Science, University o Caliornia, Berkeley, CA, USA tomlin@stanord.edu P. Saint-Pierre is a Proessor with Universite Paris IX-Dauphine, France saint-pierre@viab.dauphine.r extensively tested through costly simulations to help identiy unanticipated problems, it is physically impossible to test all possible initial conditions. Problems which go undetected through this design and simulation process can result in automation surprises [1] and other problematic behaviors in actual aircrat operation. As an example, consider an incident in Paris-Orly, France, in which the pilot unknowingly activated envelope protection control laws during the aircrat s inal approach to landing. Upon reaching a speed excessive or the aircrat s aerodynamic coniguration, the autopilot initiated an altitudechange maneuver, in order to avoid structural damage to the wing. This initially caused the aircrat to climb steeply. The autothrottles increased thrust, and the pilots attempted to use the aircrat s control suraces to make the aircrat descend. However, the envelope protection control laws overrode the pilot s actions, commanding a high angle o attack, and eventually reaching a stall. The light crew managed to regain control o the aircrat, then successully completed a manual landing [2], [3]. New methods and tools in reachability analysis can provide an alternative ramework or control design in saetycritical systems such as civil jet aircrat. These methods provide a mathematical guarantee o the modeled system s behavior, in the presence o state and input constraints. Physical constraints arising rom aerodynamic envelope protection, such as the speed at which an aircrat can stall, can be incorporated as constraints on the continuous statespace. Actuator saturation can be incorporated as an input constraint resulting in bounded control authority. When other goals, such as trajectory tracking, are incorporated into this analysis, multiple objectives can be simultaneously served through a single computational synthesis. We show how to synthesize, in a single computation, controllers which simultaneously satisy two separate objectives: 1) envelope protection, and 2) stabilization under input saturation. To address the problem o envelope protection, we deine saety as the ability to remain within a set o constraints in the continuous state-space, despite bounded control authority. We seek to determine the controlled invariant set: the subset o sae states in which we can guarantee the state o the system can always remain. We ind this set by computing its converse: the set o states which are themselves unsae or which give rise to trajectories which become unsae [4]. This converse is simply the backwards reachable set o the unsae states, and we can compute backwards reachable

2 sets using existing techniques based on Hamilton-Jacobi partial dierential equations HJ PDEs). In addition to the backwards reachable set, these techniques also provide setvalued control laws, so by taking set complements we can ind both the controlled invariant set and the control signals which make it invariant. We draw on the Hamilton- Jacobi techniques here because o their sub-grid accuracy and success in previous aircrat applications [5], [6], [7], however viability techniques could also be used. Viability theory [8] and numerical algorithms [9] have been developed to compute viability kernels and capture basins or continuous systems, and also extended to hybrid systems [1], [11]. These are computationally based on a minimum-timeto-reach ormulation [12]. To address stabilization under saturation, we parameterize eedback linearizing control laws subject to bounded control input, such that the parameters relect system perormance goals e.g. damping, overshoot). We ormulate constraints that input saturation and stability place on the input parameters. Feedback linearization is a popular technique or dierentially lat systems [13], [14], but can generate inputs with high-magnitude. Synthesizing non-saturating eedback linearizing control laws is a non-trivial problem [15], [16], [17] or stabilization [18] as well as or tracking [19]. Trajectory generation or dierentially lat systems oten involves saturation and rate constraints [2], [21]. Other common techniques to incorporate state and input constraints are model predictive control [22], [23], [24], and control Lyapunov unctions [25], [26], however inding such unctions is oten diicult and done heuristically. For linear systems, quadratic Lyapunov unctions can be synthesized [27], [28]. A variety o techniques have been investigated to control linear systems with constraints [29], [3], [31], [32]. Our method is novel in its use o reachability analysis to perorm multiobjective controller synthesis which assures stabilization, envelope protection, and input non-saturation. While a standard reachability analysis guarantees envelope protection and input non-saturation, the resultant control law would not guarantee stability and may not be implementable it could be bang-bang or cause chattering. Thereore, our approach uses a reachability calculation with additional constraints to ensure that the resultant control law meets all the desired objectives and is implementable, as well. By extending the state to include the input parameters, we can include constraints or stability, saturation, and envelope protection in a single reachability analysis. Hence in a single step, we ind non-saturating eedback linearizing controllers through application o reachability techniques which guarantee envelope protection. The paper is organized as ollows: We irst ormulate the problem we wish to solve and provide a brie description o the reachability computation and the resultant invariant set. We demonstrate this method on three examples: a double integrator, a nonlinear model o a two-input, twostate system representing the longitudinal dynamics o a civil jet aircrat, and a two-aircrat, three-dimensional cooperative collision avoidance model. For each example, we design a parameterized eedback linearizing controller designed to stabilize despite input saturation. We ormulate the initial cost unction or an extended-state reachability computation, and discuss the computed results: 1) controllers which are guaranteed to stabilize the system without violating state constraints or saturating the input, and 2) the set o states rom which any given controller can be applied. Our current eorts involve synthesis o switched controllers by choosing rom a set o the computed controllers to minimize the time to reach the origin. We end with conclusions and directions or uture work. II. PROBLEM FORMULATION We begin with the simplest case. Consider the input-output ull-state eedback linearizable system ẋ = x) + gx)u, x X R n, u R y = hx), y R with bounded input u U, and constraint set C R n which encodes the set o states which satisy the constraints on the system e.g., speeds above the aircrat s stall speed). We express the state constraints through the inequality 1) C = {x cx) }. 2) The eedback linearizing control law to stabilize 1) around the equilibrium x = is ) ux, β) = 1 L h β i x i) 3) L g h i= with Lie derivatives L h = h x x), L2 h = x L h),, L h = x Ln 2 h), and x i) the ith time derivative o x. Constant coeicients β = [β, β 1,, β ] are chosen such that the polynomial in s s n + β i s i 4) i= is Hurwitz. With this control law, the resultant closed-loop system will be linear and stable. However, in order to prevent saturation, the control ux, β) must remain within its allowable bounds U or a constant β or x X. u min ux, β) u max 5) Deine the reachable set as the set o states in C or which all values o a measurable unction u ) in U drive the system state out o the constraint set C. We presume that the equilibrium x = C is contained in the constraint set. We compute the reachable set and its complement, known as the invariant set, through Hamilton-Jacobi techniques. We wish to satisy two goals with a single controller: 1) envelope protection, and 2) stabilization under saturation. Further, we wish to determine the largest set o states rom which this controller is guaranteed to ulill these goals. Statement o Problem 1: Given the dynamical system 1), with state constraints 2), and with a eedback linearizing control law ux, β) 3) parameterized by a constant vector β R n, determine 1) the invariant set W, which is the

3 largest set o states x or a given non-saturating controller ux, β) that will reach the origin without violating the state constraints x C, 2) β such that the eedback linearizing control law is both non-saturating 5) and stable 4). III. METHOD We irst append the parameter vector β to the state such that x = [x, β] R 2n. The extended dynamics ẋ = x) + gx) L h 1 ) L gh i= β ix i) β = 6) ensure that β remains a constant in the reachability computation. For irst and second-order systems, the requirements or stability 4) simpliy to β i > 7) while or higher-order systems, 4) can be represented as a set o inequalities in β i. Through reachability analysis and controller synthesis we can determine the backwards reachable set Wt) and its complement, the controlled invariant set Wt). Given a dynamically evolving system 6) and a constraint set C, we deine the backwards reachable set as the set o all states which will exit the constraint set C in the time [, t]. The controlled invariant set is simply the complement o this result. To calculate the backwards reachable set, deine a continuous unction J : X R n R such that C = {x X, β R n J x, β) }. 8) The backwards reachable set Wt) can be ound by solving the terminal value Hamilton-Jacobi HJ) partial dierential equation PDE) [33], [4], [6] J x, t) t + min [, H x, J x, t) x )] = or t < ; J x, ) = J x) or t = ; 9) As shown in [6], the implicit representation o the backwards reachable set is Wt) = {x X, β R n J x, t) }. I 9) converges as t, then J x, t) J x) and the reachable set converges to a ixed point Wt) W. In order to solve Problem 1, we incorporate the state bounds, non-saturation constraints, and stability constraints into the initial cost unction J x, β) = min { J state x, β), J sat max x, β), } J sat min x, β), J stability x, β) 1) or which we deine the unctions J state J sat max x, β) = cx) x, β) = u max ux, β) J sat min x, β) = ux, β) u min J stability x, β) = β i 11) such that they are positive in those regions where the constraints are satisied. We then deine the Hamiltonian as ) J H x, x = J ) T x x) + gx) L h )) ) T 12) i= β ix i) +, 1 L gh J β as opposed to the standard ormulation in which H x, J ) ) T J = max x) + gx)u). 13) x u U x The control law which results rom 13) will provide envelope protection and prevent input saturation, however it may be bang-bang, and because it is a measurable unction, may not be implementable. However, by construction, the control law used in 12) will be smooth, stabilize 1), ensure envelope protection, and will not saturate. The invariant set computed using 13) will contain the invariant set computed using 12). By appending β to the state and prescribing zero dynamics to it, we have assured that β is constant. This is required to guarantee stability. The result o the reachability computation is the largest set o states x or a given input parameter β or which trajectories that begin in this set and are controlled through 3) will reach the origin without violating any state constraints 2) or saturating the input 5). Remark: We have solved Problem 1 through the above ormulation o constraints into the reachability calculation with initial conditions 1),11) and Hamilton-Jacobi PDE 12). The eedback linearizable system 1) with control input 3) parameterized by a constant β which satisies 5) and 4), will result in a system locally stable around x =. This control law will not saturate or states in the invariant set x W. The advantage o this ramework is that the computed result inherently meets the required constraints or both stability and non-saturation, while maintaining invariance within the constraint set. For a given value o β, the computed result in x is the region o the state-space or which the speciied controller will stabilize, will not saturate, and will not violate any o the state bounds. As there are generally no analytic ways to synthesize such β, this computation provides an alternative to simply picking various β and checking whether they ulill the conditions or stability and nonsaturation. While we have presented our method or the simplest case, a SISO system with ull-state eedback, this method also generalizes to MIMO systems which are ull-state eedback linearizable or which can be transormed into ull-state eedback linearizable orm. At irst glance, solving 9), 12) involves a reachability calculation in 2n dimensions no small eat due to the complexity o the calculation, Od 2n ) with d grid points in 2n dimensions. However, by exploiting structure in the pole placement, we can reduce the computation to Od n+1 ), with d grid points in n + 1 dimensions. Consider a simple double integrator, β R 2 +. I we collocate poles on the real line with β 1 = η 2, β 2 = 2η, the computation is reduced rom 4 to 3

4 Maximum area with η =.42 Maximum area with η = x 2 x Fig. 1. Invariant set W β plotted in [x 1, x 2, η] or η =.35, corresponding to two real poles at.35. Fig. 2. Invariant set W β plotted in [x 1, x 2, η] or η =.3, corresponding to a complex pair at.15 ±.5268i. dimensions. In addition, because β does not depend on x, the reachable set can be computed or various β independently, e.g. on parallel computers to sweep through β-space. This parallelization is generally not possible or reachable sets with coupled dynamics. A. Double Integrator IV. EXAMPLES To demonstrate this method, consider the system ẍ = u, with state x = [x 1, x 2 ] C = X = [x 1, x 1 ] [x 2, x 2 ], input u U = [u min, u max ], and output h = x 2. We design a eedback linearizing control law, ux, β) = β 1 x 1 β 2 x 2, with β 1, β 2 R +, such that the resultant closed-loop system is stable. [ ] 1 ẋ = x 14) β 1 β 2 As state dimensionality is at a premium in the reachability calculation, we consider two cases: 1) two real poles when β 1 = η 2, β 2 = η, and 2) two complex poles when β 1 = β 2 = η. For these two cases, the reachability computation will proceed in 3, as opposed to 4, dimensions. The constraint set C X R + incorporates both the state constraint x C as well as the input constraint ux, β) U. The saturation constraints 5), state constraints, and stability constraints are ormulated as J sat x, β) = min{u max β 1 x 1 β 2 x 2, β 1 x 1 β 2 x 2 u min } J state x) = min{x 1 x 1, x 1 x 1, x 2 x 2, x 2 x 2 } J stability β) = η. 15) For the reachability computation, we combine the above three unctions into one initial cost unction J x, β) = min{j sat state x, β), J x), J stability β)} 16) Each horizontal slice in Figures 1 and 2 represents the invariant set in [x 1, x 2 ] or a given control parameter η. It is the set o initial conditions or which the state will be driven to the equilibrium without saturating the input or violating the state constraints. While or this trivial system, non-saturating, stabilizing controllers can be calculated by hand, or general nonlinear systems, this is not possible. Figures 3 and 4 show the largest invariant sets, maximized over β through a simple post-processing calculation. By contrast, while the controlled invariant set calculated or x 1 Fig. 3. Largest invariant set with two real poles, plotted in x 1, x 2 ) or η =.42. The region contained the dotted lines is the initial constraint set or which J x, β) x 1 Fig. 4. Largest invariant set with an imaginary pair o poles, plotted in x 1, x 2 ) or η =.46. The region contained by the dotted lines is the initial constraint set or which J x, β). ẍ = u, measurable u U without a eedback linearizing control law speciied) will contain both o these invariant sets, the input signal required may not be implementable and will not stabilize the system. B. Aerodynamic Envelope Protection We model the longitudinal dynamics o a conventional aircrat as a nonlinear system m V = T Dα, V ) mg sin γ mv γ = Lα, V ) mg cos γ 17) with state x = [V, γ] X = R + R corresponding to speed V and light path angle γ) and input u = [T, α] U = [T min, T max ] [α min, α max ] corresponding to thrust T and angle o attack α). The state constraints are given by x C = [V min, V max ] [γ min, γ max ] X. Physical constants are mass m = 2 kg, gravitational constant g = 9.81m/s 2, and the sets X = [63.79, 97.74] [ 6, 6], U = [, 6867] [ 5, 17] are determined by standard aircrat operating conditions. Drag and lit are given by Dα, V ) = V 2 a + bc L α) 2 ) Lα, V ) = cv 2 c L α) 18) with coeicient o lit c L α) = c L + c Lα α, and positive constants a = 6.516, b = , c = , c L =.4225, and c Lα = 5.15 as in the Flaps-2 coniguration o the large civil jet aircrat with its landing gear up [5]. The aircrat should track a reerence speed V r = 9 m/s and a reerence light path angle γ r =. We rewrite 17) in eedback linearizable orm as [ ] [ ] [ ] [ ] m V mg sin γ av 2 1 u1 = + mv γ mg cos γ cv 2 u 2 19) by deining a new input through an invertible transormation [ ] u = bv φu) = 2 c L α) 2 + T. 2) c L α) With outputs y = [V, γ], equation 19) has relative degree 1 or each output. In order to track a desired reerence state x r = [V r, γ r ], deine an auxiliary input v = [ β 1 V

5 η =.5 η =.25 η = γ [rad] η =.75 η =.1 η = γ [rad] γ [rad] η = η = η =.22.5 Fig. 6. Invariant set in [V, γ, η]. For a given η, states inside the shaded region will reach V r, γ r) without saturating the input or violating the aerodynamic envelope. Fig. 7. Invariant set in [x r, y r, θ r] or β = or the collision avoidance scenario V [m/s] V [m/s] V [m/s] Fig. 5. Horizontal slices o Figure 6 show the invariant set in V, γ) at various η which correspond to stabilizing and non-saturating control laws. V r ), β 2 γ γ r )], with β 1, β 2 R +. The control law [ ]) ux, β) = φ 1 mg sin γ + av 2 mβ 1 V V r ) 1 cv mg cos γ mv β 2 2 γ γ r )) 21) results in linear dynamics, stable around x r. Assuming that β 1 = β 2 = η, we incorporate the state constraints, input constraints, and stability constraints into the initial cost unction: J x, β) = min{j sat env x, β), J x), β} 22) with J satx, β) = min{u max ux, β), ux, β) u min }, J state x, β) = min{v max V, V V min, γ max γ, γ γ min }. The result o the reachability calculation is shown in Figure 6 or combinations o [V, γ, η]. For clarity, crosssections o [V, γ] or various η are shown in Figure 5. As the control parameter increases, less o the aerodynamic light envelope V, γ) is controllable, due mainly to input saturation. The uncontrollable portions o the V, γ) envelope at all η in the lower right quadrant correspond to descent at high speeds this is a well-known issue or landing aircrat, in which the aircrat is very close to a stall condition. As with the double integrator example, we numerically evaluate the computational result to determine the control parameter η which generates the largest invariant set. For each η, we count the number o grid points which have a positive value. For this scenario, the maximum number o positive-valued grid points occurs at η =.45. This result could be useul or maximizing the controllable portion o the aircrat s aerodynamic envelope. The envelope with the largest area in V, γ)-space will allow or operation in more combinations o speed and light path angle than any other envelope in the computed set W. In situations in which it is imperative to have a larger controllable set in regions o high speed and high descent rate, unstable controllers might be useul. An unstable controller in this region o the aerodynamic light envelope would need to be combined with stabilizing controllers in other regions o the aerodynamic light envelope in a careully deined switching scheme. While the practicalities o aircrat certiication and pilot training would likely prevent unstable controllers rom implementation onboard civil jet aircrat, other platorms which require agility in all areas o the aerodynamic envelope such as ighter aircrat or helicopters) might beneit rom such a strategy. C. Cooperative Collision Avoidance We model the relative dynamics o two aircrat traveling at a constant speed V =.125 nmi/s, ẋ r ẏ r = V cosθ r θ R ) 1 sinθ r θ R ) V y r x r u g θ r ) with relative position x r, y r, relative heading θ r, turn rates u 1, u 2 [ tan2π/9), tan2π/9)], and constant g = nmi/s 2. As opposed to the competitive model presented in [34], we assume cooperative, centralized control over both aircrat. For ease o notation, we write 23) as ẋ = F x) + Gx)u, with F x) R 3 and Gx) R 3 2. The aircrat must remain at least R = 5 nmi apart at all times, so the state is constrained by J radius x) = x 2 r + y 2 r R 2 24) Assuming cooperation between the two aircrat and ull-state output y = [x r, y r, θ r ], the eedback linearizing control ux, β) = G T G ) β 1 x r 1 G T β 2 y r F x) β 3 θ r θ R ) 25) tracks a desired relative heading θ R, subject to saturation constraints J max x, β) = u max ux, β), J min x, β) = ux, β) u max. The resultant dynamics are ẋ = px)v x 2 r + y r x r + V cosθ r θ R ) 1) V sinθ r θ R ) 26) y2 r β 3 θ θ R )

6 with px) = y r cosθ r θ R ) 1) + x r sinθ r θ R ). We parameterize β by β 1 = β 2 =.1β 3 = η, resulting in the additional constraint J η = η. The initial cost unction or the reachability calculation is J x, β) = min{j radius x), J max x, β), J min x, β), J η β)} 27) Figure 7 shows the the resultant reachable set or η = As opposed to the two previous examples, the sae region lies outside o the shaded region. For clarity, the invariant set calculated with dynamics 23) and initial cost unction 24) is also displayed in Figure 7, and contains the invariant set calculated with the prescribed controller 26) and initial cost unction 27). V. SWITCHED CONTROL LAWS We are currently exploring synthesis o stable, switched control laws that will not saturate and will not violate state constraints, in order to increase the controllable range o the state-space. We present the initial results o this work. The result o the reachability calculation demonstrated in the previous three examples is 1) a discrete set o input parameters β, and 2) the invariant sets in x corresponding to a given input ux, β). An immediate question arises: How can we determine which β is best? In the double integrator and in the aircrat example, we chose a single value or β, which corresponded to the largest invariant set. However, there is no reason to be restricted to a single value o β: a reasonable alternative is to choose a set o β, and to optimally switch between them. This might be particularly useul in systems or which the invariant sets are drastically dierent or various β, since enabling switching results in a larger invariant set than any o that o the individual systems alone. Statement o Problem 2: Find the optimal state-based switching control law required to minimize the time to reach a small-radius B n around the desired equilibrium point, given a inite set o p non-saturating eedback linearizing controllers parameterized by β 1,..., β p. For this computation, while either Hamilton-Jacobi or viability techniques could be implemented, we apply viability techniques that are well-tested in switched systems to compute the minimum-time-to-reach unction [12]. For an impulse dynamical system described by the dierential inclusion x F xt)), F x) = {x) + gx)ux, β), u U} 28) with no state reset map, deine the target set T C as a subset o the constraint set C. Consider the problem o reaching T without leaving C. The viability kernel with target Viab F C, T ) C is the largest set o initial conditions in C rom which at least one trajectory governed by 28) will remain in the constraint set C until it reaches the target T, which we assume here is a small-radius ball B n around the equilibrium point. Consider the minimum-time-to-reach value unction V x ) = in T C T x )) 29) x S F x ) Fig. 8. In the lightest red) regions, β 1 = [.1225,.7] is invoked. In the darkest black) regions, β 2 = [.3,.3] is invoked; and in the medium-shade green) regions, β 3 = [, ] is invoked. Fig. 9. Level sets o the minimum-time-to-reach computation or a switched system with dynamics corresponding to β 1 = [.1225,.7], β 2 = [.3,.3], and β 3 = [, ]. or initial state x in the solution map S F x ), in which the time cost T T C x )) = { in{t : xt) T and s < t, xs) C} + i the constraint condition ails 3) is the irst time the system reaches the target when ollowing the trajectory x ). We know that the epigraph o V, deined as EpiV ) := {x, y) C R + : V x) y}, coincides with a viability kernel with target associated with an extended dynamical system EpiV ) = Viab F K R +, T R + ) 31) in which F x, y) = F x) { 1} and the state x has been augmented to include a dimension or time [35]. The viable set is the domain o the unction V x). For the double integrator problem, we choose three parameters to represent three qualitatively dierent closed-loop systems 14). The parameter β 1 = [.1225,.7] generates non-oscillatory trajectories that asymptotically approach the origin; β 2 = [.3,.3] results in damped oscillatory trajectories, and β 3 = [, ] results stationary trajectories. Figure 9 shows level sets o the minimum-time-to-reach unction. The resulting control law, shown in Figure 8 demarcates regions in W in which the dierent β should be used in order to reach B n in minimal time. VI. CONCLUSION We presented a method to determine, through a Hamilton- Jacobi reachability computation, the set o states in saetycritical systems which will reach the desired equilibrium without saturating the input or violating the state constraints. Thus both envelope protection and stabilization under saturation are simultaneously achieved. This involves a reachability analysis on an extended state space which incorporates a parameter rom the eedback linearizing input. By incorporating the input saturation, stability, and state constraints simultaneously in the initial cost unction, the resultant invariant set will be the largest set o states, given bounded input, which will stabilize the system and always

7 remain within a given constraint set. We presented two real-world examples to illustrate the method. We synthesized non-saturating eedback linearizing controllers, and determined where in the state-space these controllers could be used to guarantee not only stability and non-saturation o the input, but also invariance with respect to state constraints. The method and three examples presented contribute to the diicult problem o determining stabilizing controllers or saety-critical systems under nonlinear state and input constraints. Many uture directions o work are possible, including 1) minimization o the number o switched, nonsaturating controllers when multiple solutions to the control parameterization problem are possible, 2) alternative, less computationally exhaustive ormulations to sample the parameter space β and 3) one-step synthesis o a minimal number and optimal selection o input parameters β or switched, non-saturating, eedback linearizing controllers. REFERENCES [1] E. Palmer, Oops, it didn t arm - a case study o two automation surprises, in 8th International Symposium on Aviation Psychology, Columbus, Ohio, [2] K. Abbott, S. Slotte, and D. Stimson, The interaces between lightcrews and modern light deck systems, Federal Aviation Administration, Human Factors Team Report, June [3] C. Billings, Aviation Automation: The Search or a Human-Centered Approach. Hillsdale, NJ: Erlbaum, [4] C. Tomlin, J. Lygeros, and S. Sastry, A game theoretic approach to controller design or hybrid systems, Proceedings o the IEEE, vol. 88, no. 7, pp , 2. [5] M. Oishi, I. Mitchell, A. Bayen, C. Tomlin, and A. Degani, Hybrid veriication o an interace or an automatic landing, in Proceedings o the IEEE Conerence on Decision and Control, Las Vegas, NV, December 22, pp [6] I. Mitchell, A. M. Bayen, and C. J. Tomlin, A time-dependent Hamilton-Jacobi ormulation o reachable sets or continuous dynamic games, IEEE Transactions on Automatic Control, vol. 5, no. 7, pp , July 25. [7] I. Mitchell, A Toolbox o Level Set Methods, Department o Computer Science, University o British Columbia, June 24, mitchell/toolboxls. [8] J. Aubin, Viability Theory. Birkhauser, [9] P. Saint-Pierre, Approximation o the viability kernel, Applied Mathematics and Optimisation, vol. 29, pp , [1] J. Aubin, J. Lygeros, M. Quincampoix, S. Sastry, and N. Seube, Impulse dierential inclusions: a viability approach to hybrid systems, IEEE Transactions on Automatic Control, vol. 47, no. 1, pp. 2 2, 22. [11] P. Saint-Pierre, Approximation o viability kernels and capture basin or hybrid systems, in European Control Conerence, J. Martins de Carvalho, Ed., 21, pp [12] E. Cruck and P. Saint-Pierre, Nonlinear impulse target problems under state constraint: A numerical analysis based on viability theory, Set- Valued Analysis, vol. 12, no. 4, pp , December 24. [13] M. Fliess, J. Levin, P. Martin, and P. Rouchon, A Lie-Backlund approch to equivalence and latness o nonlinear systems, IEEE Transactions on Automatic Control, vol. 44, no. 5, pp , [14] R. Hirschorn and J. Davis, Global output tracking or nonlinear systems, SIAM Journal o Control and Optimization, vol. 26, no. 6, pp , [15] A. Bemporad, Reerence governor or constrained nonlinear systems, IEEE Transactions on Automatic Control, vol. 43, no. 3, pp , [16] G. Pappas, J. Lygeros, and D. Godbole, Stabilization and tracking o eedback linearizable systems under input constraints, in Proceedings o the IEEE Conerence on Decision and Control, New Orleans, LA, December 1995, pp [17] N. Kapoor and P. Daoutidis, Stabilization o unstable systems with input constraints, in Proceedings o the American Control Conerence, Seattle, WA, June 1995, pp [18] F. Doyle, An anti-windup input-output linearization scheme or SISO systems, Journal o Process Control, vol. 9, pp , [19] P. Lu, Tracking control o nonlinear systems with bounded controls and control rates, Automatica, vol. 33, no. 6, pp , [2] N. Faiz, S. Agrawal, and R. Murray, Dierentially lat systems with inequality constraints: An approach to real-time easible trajectory generation, Journal o Guidance, Control, and Dynamics, vol. 24, no. 2, pp , 21. [21] P. Martin, R. Murray, and P. Rouchon, Flat systems, equivalence, and trajectory generation, Caltech Technical Report, Caliornia Institute o Technology, Pasadena, CA, Tech. Rep., 23. [22] W. Liao, M. Cannon, and B. Kouvaritakis, Constrained MPC using eedback linearization or systems with unstable inverse dynamics, in Proceedings o the American Control Conerence, Portland, OR, June 25, pp [23] M. Bacic, M. Cannon, and B. Kouvaritakis, Invariant sets or eedback linearisation based on nonlinear predictive control, IEE Proceedings in Control Theory Applications, vol. 152, no. 3, pp , 25. [24] V. Nevistic and J. Primbs, Model predictive control: Breaking through constraints, in Proceedings o the IEEE Conerence on Decision and Control, December 1996, pp [25] N. El-Farra and P. Cristoides, Switching and eedback laws or control o constrained switched nonlinear systems, in Hybrid Systems: Computation and Control, ser. LNCS 2289, C. Tomlin and M. Greenstreet, Eds. Springer-Verlag, March 22, pp [26] Y. Lin and E. Sontag, A universal ormula or stabilization with bounded controls, Systems and Control Letters, vol. 16, pp , [27] M. S. Branicky, Multiple Lyapunov unctions and other tools or switched and hybrid systems, IEEE Transactions on Automatic Control, vol. 43, no. 4, pp , [28] T. Hu and Z. Lin, Composite quadratic Lyapunov unctions or constrained control systems, IEEE Transactions on Automatic Control, vol. 48, no. 3, pp , 23. [29] A. Glattelder and W. Schauelberger, Control systems with input and output constraints. Springer, 23. [3] A. Stoorvogel and A. Saberi, Editorial: The challenge o constraints, International Journal o Robust and Nonlinear Control, vol. 14, p. 185, 24. [31] G. Grimm, A. Teel, and L. Zaccarian, Robust linear anti-windup synthesis or recovery o unconstrained perormance, International Journal o Robust and Nonlinear Control, vol. 14, pp , 24. [32] M. Turner and I. Postelthwaite, Multivariable override control or systems with output and state constraints, International Journal o Robust and Nonlinear Control, vol. 14, pp , 24. [33] C. Tomlin, I. Mitchell, A. Bayen, and M. Oishi, Computational techniques or the veriication o hybrid systems, Proceedings o the IEEE, vol. 91, no. 7, pp , 23. [34] I. Mitchell and C. Tomlin, Level set methods or computation in hybrid systems, in Hybrid Systems: Computation and Control, ser. LNCS 179, B. Krogh and N. Lynch, Eds. Springer Verlag, March 2. [35] P. Cardaliaguet, M. Quincampoix, and P. Saint-Pierre, Optimal times or constrained non-linear control problems without local controllability, Applied Mathematics and Optimisation, vol. 35, pp. 1 22, 1997.