Sensor-fault Tolerance using Robust MPC with Set-based State Estimation and Active Fault Isolation

Transcription

1 Sensor-ault Tolerance using Robust MPC with Set-based State Estimation and Active Fault Isolation Feng Xu, Sorin Olaru, Senior Member IEEE, Vicenç Puig, Carlos Ocampo-Martinez, Senior Member IEEE and Silviu-Iulian Niculescu Abstract In this paper, a sensor ault-tolerant control (FTC) scheme using robust model predictive control (MPC) and settheoretic ault detection and isolation (FDI) is proposed. The MPC controller is used to both robustly control the plant and actively guarantee ault isolation (FI). In this scheme, ault detection (FD) is passive by interval observers, while ault isolation (FI) is active by MPC. The advantage o the proposed approach consists in using MPC to actively decouple the eect o sensor aults on the outputs such that one output component only corresponds to one sensor ault in terms o FI, which can utilize the eature o sensor aults or FI. A numerical example is used to illustrate the eectiveness o the proposed scheme. I. INTRODUCTION The control systems consist o a series o dierent components that play dierent roles in global operation. Among those components, the sensors are commonly used, which are tools to acquire the real-time system-operating inormation. Thus, it is important to monitor the situation o sensors and tolerate the eect o sensor aults in order to provide the control systems with saety properties. In the literature, there exist two types o FTC strategies, i.e., passive FTC (PFTC) and active FTC (AFTC) []. Generally, PFTC, based on controller robustness, has restrictive FTC ability in terms o perormance. AFTC uses a so-called FDI module to obtain ault inormation and then aults can be tolerated with the ault inormation. In the proposed scheme, MPC is used as the control strategy, whose advantage consists in handling system constraints [], []. Besides, or FDI robustness, set-based FDI is used in the scheme. In [8], a multi-sensor ault-tolerant MPC (FTMPC) scheme based invariant sets is proposed, where FDI is passively implemented. But, generally, passive ault diagnosis is more conservative. The objective o this paper is to propose a new sensor FTMPC scheme, which can deal with system constraints and tolerate sensor aults with less conservative FI conditions. The proposed scheme has three contributions. First, it proposes a novel and simple active FI technique based on MPC, which can reduce FI conservatism. Second, it proposes a robust state estimation approach or F. Xu, V. Puig and C. Ocampo-Martinez are with the Institut de Robòtica i Inormàtica Industrial (CSIC-UPC), Technical University o Catalonia (UPC), Llorens i Artigas, -6, 88 Barcelona, Spain, {xu, vpuig, cocampo}@iri.upc.edu. S. Olaru is with the ES (SUPELEC Systems Sciences), Automatic Control Department, Gi sur Yvette, France, sorin.olaru@supelec.r. S. Niculescu is with LS, CNRS-Supelec, Gi sur Yvette, France, silviu.niculescu@lss.supelec.r. This wor has been partially supported by the EU project i-sense (FP7-ICT ), China Scholarship Council, CNRS-Supélec and Automatic Control Department, Supélec, France. the MPC controller with easibility guarantee. Third, it can detect, isolate and tolerate unnown but bounded sensor aults with no need o physical redundancy o sensors. The remainder o the paper is as ollows. Section II introduces the scheme. Section III presents the FDI strategy. Section IV proposes the FTC strategy. In Section V, a numerical example illustrates the eectiveness o the proposed scheme. In Section VI, some conclusions are draw. In this paper, the inequalities are understood element-wise, the bold matrices denote interval matrices, mid( ) obtains the center o interval matrices, diag[ ] denotes the diagonal matrix, center( ) denotes the center o a centered set, O and I denote the zero and identity matrices with suitable dimensions, respectively, B r is a box composed o r unitary intervals and denotes the Minowsi sum. A. Plant Model II. PROBLEM FORMULATION The linear discrete time-invariant plant is modelled as x + = Ax + Bu + ω, y = GCx + η, (a) (b) where A R n n, B R n p and C R q n are constant matrices, x R n, u R p and y R q are state, input and output vectors at time instant, respectively, and ω and η model unnown disturbances and noises, respectively. In (), G taes a value G i (i I = {,,..., q}) to model the i-th sensor mode, where G is the identity matrix denoting the healthy mode and G i (i ) is a diagonal interval matrix modelling the i-th sensor ault with G i = diag[... i i... ], where the ault-modelling interval i satisies i [, ). Additionally, a diagonal interval matrix to describe all the considered sensor aults is deined as G = diag[... i... q ], where each diagonal element o G corresponds to the considered magnitude interval o one sensor ault. Besides, the system state and input constraints are given as X ={x R n : x x c x, x c R n, x R n }, U ={u R p : u u c ū, u c R p, ū R p }, (a) (b) respectively, where the vectors x c, u c, x and ū are constant.

2 Assumption.: ω and η are bounded by nown sets W ={ω R n : ω ω c ω, ω c R n, ω R n }, V ={η R q : η η c η, η c R q, η R q }, (a) (b) respectively, where the vectors ω c, η c, ω and η are constant. Assumption.: The matrix A is a Schur matrix and the pairs (A, G i C) are detectable or all i I. Remar.: For brevity, only single ault is considered in the paper. But, theoretically, the proposed approach can also be extended or multiple aults with G modelling multiple aults important/critical to system perormance/saety. Assumption.: The considered aults should persist suiciently long time such that the FDI module has enough responsive time to cope with them. B. Set-point Tracing In the i-th mode, the control objective is to trac an output set-point, i.e., in the absence o uncertainties and/or aults, lim (y yi ), where yi denotes the output set-point o the i-th mode. Remar.: Sensor aults imply the loss o available system inormation. Thus, there perhaps exist situations, where one has to degrade the expected perormance. In the proposed scheme, the tracing reerences or the i-th sensor mode are generated by the i-th nominal model x re + = Axre + Bu re, (a) y re = mid(g i )Cx re, (b) where u re, x re and y re are the reerence input, state and output at time instant. Using (), at steady state, one has A I B x i O =. (5) mid(g i )C O where (x i,u i ) is the state-input set-point pair corresponding to yi. But, the solution o (5) may not be unique. Thus, or q + modes, q + set-point pairs should be obtained. Assumption.: Under the constraints (), the equation (5) is solvable or all i I. Remar.: i needed, ω c and η c can be added into (). u i III. FAULT DETECTION AND ISOLATION A. Fault Detection A ban o interval observers are designed to monitor the plant, each o which matches one mode. The j-th (j I) interval observer matching the j-th mode is designed as ˆX j + =(A L jg j C) ˆX j {Bu } {L j y } ( L j )V W, Ŷ j =G jc ˆX j V, y i (6a) (6b) where ˆX j and Ŷ j and L j is the observer gain that assures A L j G j C is a Schur matrix. are the estimated state and output sets, Assumption.: The initial state x belongs to an initial set ˆX or all interval observers. As deined in (), W and V can be rewritten as zonotopes. By deining ˆX as a zonotope, ˆXj + and Ŷ j are zonotopes as well. Using zonotope operations, interval observers (6) can be propagated on-line with preserving zonotopic structure and guaranteeing containment. I the j-th interval observer matches the current mode, at steady state, one has x ˆX j and y Ŷ j. In the i-th mode, G taes the value G i (i I) and the i-th interval observer monitors the plant. To detect aults, the residual (in terms o zonotopes) is deined as R ii =y Ŷ i. (8) Remar.: Although a ban o interval observers operate concomitantly, only residual zonotopes o the interval observer matching the current mode is used or FD. Thus, when the system is in the i-th mode, the FD tas is implemented by testing whether or not R ii (9) is violated in real time. I a violation is detected, it means that the system has become aulty. Otherwise, it is considered that the system is still in the i-th mode. The satisaction o (9) does not always imply the system is healthy because the FD strategy cannot be sensitive to all aults. For the aults undetectable by (9), only potential PFTC ability o the proposed scheme can tolerate them to some extent. B. Fault Isolation ) Fault Isolation Conditions: To explain the proposed FI approach, it is assumed that the inputs are bounded by a set U = {u R p : u u c ū, u c R p, ū R p }, where U satisies the input constraint o the plant. i.e., U U. () Additionally, the output equation (a) can be rewritten as x + = Ax + [ B I ] [ ] u. () ω By considering u U and ω W, a robust positively invariant (RPI) set o () can be computed (see [], [5], [6] or the notion o RPI sets and constructive algorithms), which is denoted as X centered at x c = (I A) (Bu c + ω c ). () Furthermore, according to (b), in the i-th mode, the corresponding output set can be obtained as Y i = G i CX V, Please see [7] or the notion o zonotopes and all relevant properties o zonotopes used to implement interval observers in this paper. For analysis, R ii is used to denote residual zonotopes o the i-th interval observer in the i-th mode at time instant. But, realistically, one should only use R i to denote residual zonotopes rom the i-th interval. In this paper, become aulty generally denotes mode switching including ault occurrence and system recovery.

3 where Y i is centered at yc,i = mid(g i )Cx c + ηc. I G i taes the value G, the corresponding healthy output set is Y = CX V, where Y is centered at y c, = Cx c + ηc. The output set has q components, each o which is an interval that can be obtained by projecting the output set towards the corresponding dimension. In terms o u U, only the i-th component o Y i is dierent rom that o Y because o the eect o the i-th ault, while all the other components are the same. Furthermore, in contrast to Y, one deines a set Y = G CX V, where Y is centered at y c = mid(g )Cx c + ηc. By comparing Y and Y i with Y, one nows: All the interval components o Y are dierent rom those o Y, respectively. Only the i-th interval component o Y i (i ) is the same with that o Y, while all the others are dierent. For brevity, the i-th interval components o Y, Y i and Y are denoted as Y (i), Y i(i) and Y (i), which are centered at y c, (i), yc,i (i) and yc (i) (the i-th components o yc,, yc,i and y c ), respectively. Proposition.: For the plant () under the constraints (), i there exists a set U that satisies () such that Y (i) Y (i) = Ø, or all i I \ {}, () all the considered sensor modes are isolable ater detection. Proo : I the inputs are bounded by U, because o the separation o the i-th interval component, i.e, Y (i) Y (i) = Ø, ater the i-th ault occurs, the i-th output component inally enters into the i-th interval o Y instead o Y, while all the other output components enter into the corresponding components o Y instead o Y, respectively, which indicates the i-th ault. Thus, i all the interval components o Y and Y are separate rom each other, it implies that all the considered sensor modes are isolable ater their detection. Assumption.: There exists a set U U such that all the considered sensor aults satisy (). ) Fault Isolation Strategy: I a sensor ault is detected at time instant d, the state is still inside X M (the maximal robust control invariant (MRCI) set o (a) under the constraints ()) at this time instant because sensor aults do not aect the system dynamics, i.e., x d X M, () where X M is the terminal state constraint set o the MPC controller in the proposed scheme. At time instant d, the proposed FI approach switches the input constraint o the MPC controller rom U to U to start active FI. Ater constraint switching, i the MPC controller is still easible, the generated control action satisies u d U. (5) To isolate the ault during the transition induced by aults, at time instant d, one initializes a set-based dynamics X + = AX Bu W, Y = G CX V, (6a) (6b) with X d = X M and u U ( d ). Aterwards, the state and output set sequences can be generated by (6). Moreover, by using ˇX d = X M at time instant d to initialize the other set-based dynamics ˇX + = A ˇX BU W, ˇY = G C ˇX V, (7a) (7b) the other state and output set sequences can be obtained. As per [5], the state set sequence generated by (7a) will converge to the minimal robust positively invariant (mrpi) set o system states with respect to u U, enter into and stay inside X, and the output set sequence generated by (7b) will enter into and stay inside Y. Proposition.: At time instant d, by using X M to initialize (6) and (7), or all d, X ˇX and Y ˇY will always hold. Proposition.: Given the plant (), the state and output set sequences generated by (6), starting rom time instant d, x X can hold or all d. I the plant is healthy, no components o y and Y can persistently satisy y (i) Y (i) (i I \ {}) or all d, while i the i-th ault occurs, the i-th components o y and Y can persistently satisy y (i) Y (i) or all d but all the other components o y and Y cannot. Proo : First, because o (), (5) and u U or all > d, comparing () and (6), x X will hold or all d. Second, under Proposition., comparing (7) with (6), X and Y inally enter into X and Y and stay inside, respectively. Considering Y, i, or the i- th mode, i.e., G in (b) taes a value inside G i (i ), under Proposition., starting rom time instant d, only y (i) Y (i) will hold or all d with the initialization X d = X M, while all the other components o y do not have the same conclusion. For the healthy mode, since all the components o Y are separate rom the corresponding components o Y, no components o y can be contained by the corresponding interval o Y or all d. Thus, under Proposition.,. and Assumption., i a considered sensor ault is detected, by using the output set sequence generated by (6), the ault can be isolated by real-time testing whether or not y (i) Y (i), d (8) is violated or all i I \ {}. With the real-time testing o (8) or all the components, one has the FI conclusions: I the plant recovers to the health rom a aulty mode, or d, by testing (8), at a time instant, i all the output components violate (8), it implies that the healthy mode is isolated at this time instant. I the plant changes into another ault rom a aulty mode or the healthy mode, only the output component

4 corresponding to the current mode can always respect (8) while all the others will inally diverge rom their corresponding interval components o Y, respectively. Thus, the proposed FI approach consists in searching this unique component that indicates the ault and the corresponding time instant indicates the FI time. IV. FAULT-TOLERANT CONTROL A. Robust MPC Controller In this proposed scheme, the robust MPC controller is implemented by using min-max MPC. In the steady-state operation o the i-th mode, the i-th state-input set-point pair and the i-th interval observer are used and the corresponding robust MPC controller is designed as J = min u N max w j= (x +j x i ) Q + (u +j u i ) R + (x +N x i ) P subject to x +j X, u +j U, x +N X M, ω +j W, (9) x = ˆx, where N is the prediction horizon, ˆx is the system state estimation, u = [u, u +,, u +N ], Q, R and P are positive-deinite weighting matrices, w = [ω, ω +,, ω +N ] and the internal model o the MPC controller is given as x +j+ = Ax +j + Bu +j + ω +j. In the i-th mode, i no ault is detected, the MPC controller (9) is used to robustly control the system to trac the i-th output set-point yi. I a ault is detected, at the FD time, active FI is started by switching the input and terminal state constraints o (9) rom U and X M to U and X M (X M is the MRCI set o (a) under x X and u U ), respectively. By using active FI, the ault can be isolated and the controller can be reconigured with the state-input set-point pair and interval observer corresponding to the new mode. Simultaneously, the input and terminal state constraints o the MPC controller must be switched bac to U and X M in the operation o the new mode, respectively. B. Robust State Estimation Under the constraints (), one can compute the MRCI set X M or the dynamics (a). Since X M is used as the terminal state constraint o the MPC controller (9), ideally, i the initial state is inside X M and the real states are available or the MPC controller updating, the states can always be conined inside X M and the MPC controller can be always easible (see [] or min-max MPC). Unortunately, it is impossible to obtain the real states. Instead, one has to estimate the states or the MPC controller. ) State Estimation: For easibility and stability o the MPC controller with state estimation, one still uses X M as the terminal state constraint in the steady-state operation. Remar.: In the steady-state operation, as long as the MPC controller (9) is always updated by a point inside X M at each time instant, i.e., ˆx X M, it can eep easible such that the generated control actions always satisy u U. For constraint satisaction during the transition induced by aults, one maes the ollowing assumption. Assumption.: The mrpi set (denoted as X m ) corresponding to u U and ω W or the dynamics () is contained in the state constraint set X. Assumption.: There exists α such that the initial state x o (a) satisies x X = αx m and X X M. Under Assumption. and., X is an RPI set corresponding to u U and ω W or the dynamics (). Thus, i u U, the states always stay inside X. Furthermore, i the system is in the steady-state operation o the i-th mode, the i-th interval observer can real-time estimate sets to contain the current states, i.e., x ˆX i. Thus, based on X and ˆX i, one has x X ˆX i. () In the i-th mode, the ollowing method is proposed to obtain state estimation, i.e., ˆx = center( X ˆX i ), () where ˆx is used to update the MPC controller (9). Proposition.: Under Assumption. and., the MPC controller (9) with the state estimation () is recursively easible in the steady-state operation. Moreover, the real states x are always conined inside X. Proo : Under Assumption. and., X is contained inside X M, which implies ˆx X M. Thus, at each step, by using (), the MPC controller (9) is always easible. As long as the MPC controller is easible, u U always holds, which always implies x X X. ) Stability with State Estimation: When using the state estimation () to update the MPC controller, there always exist state estimation errors deined as x = x ˆx, () Since both x and ˆx are conined in the intersection X ˆX i, x should be bounded. In the worst case, i.e., X coincides with ˆX i, the bound o x can be obtained as x X ( X). () Note that because the coincidence o X and ˆXi is a low probability event, the real-time bound o x should be less conservative than (). Since the plant is stable as in Assumption., the bounding o x implies stability o the system with the state estimation (). C. Fault-tolerant Control Approach ) Active Fault Isolation: Once a ault (indexed by j i) is detected at time instant d, the proposed FI approach relies on switching the constraints o the MPC controller rom U and X M to U and X M to start active FI. Proposition.: Under Assumption.,. and., the mrpi set (denoted as X m ) or the dynamics () corresponding to u U is contained in X m. Moreover, X M is a robust control invariant (RCI) set or the dynamics () corresponding to u U.

5 Proo : Because o U U, the mrpi set or the dynamics () corresponding to u U is contained in that corresponding to u U. Because o X X, both mrpi sets are contained in X. For U U, X M can satisy the deinition as an RCI set o the dynamics () under u U, which indicates X M X M (See [] or the RCI sets). During active FI, x ˆX i cannot always hold, which implies that () cannot guarantee easibility o the MPC controller. Thus, it is necessary to propose a new strategy to update the MPC controller to guarantee both active FI and transient-state easibility ater aults. To avoid ineasibility during active FI, or each step d, one uses ˆx = center(x M ) () to update the MPC controller or generating control actions. By (), during active FI, the easibility o the MPC controller can always be guaranteed such that u U, which implies that the satisaction o the FI conditions in Proposition. on-line. Furthermore, FI can be implemented by using the FI approach (8). Then, at time instant i when the ault is isolated, the constraints o the MPC controller are switched to U and X M rom U and X M or perormance. Proposition.: At the FI time i, x i X (i.e., x i X M ). Furthermore, as long as the MPC controller is easible, x X M or all i. Proo : Under Assumption., x X X M in the steady-state operation. At time instant d, although the constraints U and X M are switched into U and X M, one still has u U U with (), which implies that the states still stay inside X. At time instant i when the constraints are switched bac to U and X M, x i X still holds and the easibility o (9) assures x X M or all i. Remar.: It is assumed that the j-th mode (j i) is isolated. Under Proposition., or i, i the intersection X ˆX j is not empty, ˆx = center( X ˆX j ) is used or the MPC controller. Otherwise, () continues to be used. Ater reconiguration, it is guaranteed that, several steps later, X ˆX j Ø can persistently hold. D. Fault-tolerant Control Algorithm An FTC algorithm is summarized or the FTC scheme. ) It is assumed that the system is in the i-th mode, i.e., the i-th state-input set-point pair and the i-th interval observer are used or the system. ) When a ault is detected at time instant d, the constraints o the MPC controller are simultaneously switched rom U and X M to U and X M to start active FI. () is used to guarantee active FI and MPC easibility during active FI stage, (6) is initialized by X M to generate the output set sequence or FI and the FI strategy (8) is used to isolate the ault. ) Once the ault is isolated (it is assumed that the index is j i), the system is reconigured and the strategy proposed in Remar. is specially used or the initial stage o the new mode. Aterwards, the whole algorithm is repeated to monitor this new mode. V. ILLUSTRATIVE NUMERICAL EXAMPLE A numerical example is used to show the eectiveness o the proposed scheme, whose parameters are given as Parameter matrices: A = [.6.7 ], B = [ ].5., C =.. [ ]. Process disturbances: w = [.. ] T, w c = [ ] T. Measurements noises: η = [.. ] T, η c = [ ] T. Observer [ gains : ] [ ] [ ].. L =, L. =, L. =. Considered [ sensor aults: ] [ ] [,.] G =, G =, [,.] [ ] [,.] G =. [,.] [ ] [ ] Fault magnitudes 5. : G =, G =.. Output set-points: y.5 =, y.5 =, y.5 =..5 State-input set-point pairs: u.5 =, u =, u.76.9 =,.759 x.5 =, x 5 =, x.5 =. 5 Initial [ conditions: [ [ ]. x =, ˆX = B ] ].. System constraints: U = {u : [ ] T [ ] T u }, X = {x : [ ] T [ ] T x }. Input set or active FI: U = {u : [ ] T [ ] T u }. Sampling time: T =.s. Prediction horizon: N =. MPC controller parameters:. Q =, R =, P =.. For the three modes (healthy and aulty), three corresponding interval observers are designed as in (6). Furthermore, using u U and ω W, the output sets corresponding to the three mode can be presented in Figure. Fig.. Output sets or active FI In Figure, all the interval components o Y are disjoint rom those o Y, respectively, and both o Y and Y have L and L are obtained using mid(g ) and mid(g ), respectively. 5 G and G denote actual ault magnitudes, i.e., G G and G G. Note that ault occurrence o any magnitude inside G and G can be isolated i they can be detected.

6 an interval component that is the same with Y. The scenarios or both aults are: rom time instants to, the system is healthy, while rom time instants to, a ault occurs. R () R () R () Fig.. Y() y() Fig.. R () R () R () FD o the irst ault Y() y() FI o the irst ault The FD and FI results o the irst ault are shown in Figure and, respectively. In Figure, a ault is detected at =, i.e., R (note that R () and R () respectively coincides with R () and R () in Figure ). Thus, active FI is started at =, i.e., (6) is initialized and (8) is tested in real time or FI. In Figure, at = 7, the irst component o y respects its bound Y (), i.e., y 7 () Y 7 (), while the second component violates its bound, i.e., y 7 () Y 7 (), which indicates the irst sensor ault is isolated. Thus, the irst state-input set-point pair is used to reconigure the system at = 7. The output o the system is shown in Figure as the red stars. Beore the irst ault, the expected output y is well traced, while ater the irst ault, the tracing perormance becomes poor until the time instant = 7 when the system is reconigured. Ater = 7, the expected y can be well traced again. 8 6 u() u() Fig.. Control inputs or the irst ault 8 6 x() ˆx() Fig x() ˆx() Comparison o states and state estimations During active FI, because o the strategy (), the generated inputs are constant, which satisy the constraint set U. Ater system reconiguration, the control inputs to tolerate the irst ault are generated, which also satisy the constraint U. Besides, to show the eectiveness o the state estimation (), a comparison between the real states and their estimations is shown in Figure 5. It can be observed that () can give satisactory state estimations in steady state. Remar 5.: Although two sensor aults are considered in this example, due to the length o this paper, only the results related to the irst sensor ault are presented here. VI. CONCLUSIONS The paper propose a sensor FTC scheme using MPC, interval observer-based FD and set-based active FI. By combining MPC with set-based FDI approaches it is shown that sensor FDI and the corresponding FI conditions can be simpliied. For the MPC easibility guarantees, the FTC scheme rely on relationships between invariant sets characterizing the autonomous dynamics and resumed by.. I alternative on-line state-estimation schemes can be implemented by exploiting plant inormation, the FTC scheme proposed in the present paper can be used with possible relaxed assumptions. REFERENCES [] M. Blane, M. Kinnaert, J. Lunze, and M. Staroswieci. Diagnosis and Fault-Tolerant Control. Springer-Verlag, Berlin, Germany, 6. [] F. Borrelli, A. Bemporad, and M. Morari. Predictive Control or Linear and Hybrid Systems. Model Predictive Control Lab, UC-Bereley, USA,. [] E. Koman, H. Haimovich, and M.M. Seron. A systematic method to obtain ultimate bounds or perturbed systems. International Journal o Control, 8():67 78, 7. [] Johan Löberg. Min-max Approaches to Robust Model Predictive Control. PhD thesis, Department o Electrical Engineering, Linöping University, Sweden,. [5] S. Olaru, J.A. De Doná, M.M. Seron, and F. Stoican. Positive invariant sets or ault tolerant multisensor control schemes. International Journal o Control, 8():6 6,. [6] F. Stoican and S. Olaru. Set-theoretic Fault-tolerant Control in Multisensor Systems. John Wiley & Sons, Inc.,. [7] F. Xu, V. Puig, C. Ocampo-Martinez, F. Stoican, and S. Olaru. Actuatorault detection and isolation based on set-theoretic approaches. Journal o Process Control, ():97 956,. [8] A. Yetendje, M. M. Seron, and J. A. De Doná. Robust MPC design or ault tolerance o constrained multisensor linear systems. In Proceedings o the International Conerence on Control and Fault- Tolerant Systems, Nice, France, October 6-8. The control actions are presented in Figure, where beore ault occurrence, the control inputs satisy their constraints.