Model-free Learning for Safety-critical Control Systems: A Reference Governor Approach

This paper proposes a new formulation for the Reference Governor (RG) applied to linear systems affected by exogenous disturbances, specifically those large enough to cause constraint violation. This formulation is based on a set-theoretic approach which includes external disturbances within a new RG, that we call Recovery RG (RRG). The idea is to update the Maximal Output Admissible Set (MAS) and compute a constraint-admissible input that recovers the system from constraint violation at steady-state. The proposed RRG overcomes some of the limitations of standard RG schemes, and maintains their desirable features such as formulation simplicity and finite time determination of the MAS. We validate this new scheme by simulating a linearized turbocharged gasoline engine affected by additive disturbances.

Reference governors enforce pointwise-in-time state and control constraints by temporarily modifying the reference command to a nominal closed-loop system whenever the danger of constraint violation exists. In this paper we propose a reference governor with the added capability of resetting internal closed-loop system states as necessary to avoid constraint violation. With this approach the constrained domain of attraction, i.e., the set of states recoverable without constraint violation, is enlarged. This scheme is referred to as the controller state and reference governor. The paper describes this scheme, analyzes its stability and convergence properties, and presents examples of applying it to aircraft flight control and gas turbine engine control examples.

The reference governor is an add-on scheme to a pre-stabilized system that enforces pointwise-in-time state and control constraints. It does so by monitoring and minimally adjusting the reference command to ensure system response to the adjusted reference satisfies prescribed constraints. Conventional approaches to reference governor design rely on explicit models of the system. In this paper, we propose a reference governor approach for systems that admit only implicit models and are subject to set-bounded disturbance inputs. To ensure constraint satisfaction in the presence of uncertain but set-bounded disturbances, the proposed reference governor exploits metric regularity, a tool from variational analysis. We illustrate the effectiveness and online feasibility of the proposed reference governor approach through a power system example.

Proposes an approach to reference governor design. As in the prior literature, the governor accepts input commands and modifies their evolution so that specified pointwise-in-time constraints on state and control variables are satisfied. The new approach has several important advantages: it applies to continuous-time nonlinear systems, the design process is based on families of Lyapunov functions, the governor has a relatively simple implementation, the underlying theory is simple and self-contained. Key issues related to reference governor implementation are discussed in a general way, including the description of hybrid reference governors that allow the set of command inputs to be nonconvex.

Basically, aircraft engines can be divided into a control embedded system and a controlled system with its environment. The behaviour of the controlled system is given a priori, while the control system still needs to be designed in a way guaranteeing the correct overall behaviour under all operational conditions depending on the flight domain. A large quantity of functions in control systems can be described by a formal system expressed in block diagrams and state-based representations. These representations can be translated to formal based tools relying on the synchronous languages Signal and Statecharts. SACRES is a tool set supporting the design of safety-critical embedded control systems. It integrates the tools and specification techniques Statemate, Sildex, and Timing Diagrams with tool components for automatic code generation, formal verification based on model checking techniques, and an innovative approach for automatic code validation for target code generated from DC+. Technical achievements are The main benefits of the SACRES approach are reduced risks for design errors and decreased design times and costs for the development of dependable (safety critical) embedded systems. SACRES is an attempt to avoid unpredictability (particularly that arising from late feedback from testing) associated with development of safety critical systems, through the use of the maximum degree of automation, especially in respect of code generation and verification. An outstanding property of SACRES is the combination of specification styles and specification tools being applied in practice with automatic tools to establish provable correctness with respect to required properties. Both dependability and productivity are increased by automatic code generation from high-level specifications such that the generated code can be validated against higher levels by rigorous proofs. These techniques allow traditional tests by sampling to be replaced by rigorous checking techniques which correspond to 100% coverage of test cases. In order to address a global innovative approach in the near future which match the whole software configuration, the SACRES tool set should be interfaced with asynchronous techniques matching the operating system development. This raises an open question in the software development future new process.

In turbocharged gasoline engines, the violation of the compressor surge constraint can be prevented by exploiting predictive control techniques based on the reference governor (RG). In this paper, two RG designs are considered: an inner-and an outer-loop RG. The inner-loop design governs the throttle command, and the outer-loop governs the requested air charge command. Numerical simulations and the experimental vehicle results are presented, showing that both designs enforce the surge constraint without the use of a compressor bypass valve, but that the inner-loop design requires scheduling in order to do so.

In this paper we present an approach for designing of reference tracking controllers for constrained, discrete-time piecewise affine systems. The approach follows the idea of reference governor techniques where the desired set-point is filtered by a system called the “reference governor”. Based on the system current state, set-point, and prescribed constraints, the reference governor computes a new set-point for a low-level controller so that the state and input constraints are satisfied and convergence to the original set-point is guaranteed.

This paper provides a novel and practical approach, to check the correctness and completeness of functional specifications (the completeness means complete for one specified function), especially for complex safety critical systems. This approach combines Artificial Intelligence (AI) planning technique, together with formal functional specification, to assist further cybersecurity vulnerability analysis on safety critical Industrial Control System (ICS). The effectiveness of this combination is represented by examples, which are based on a safety critical ICS-Refueling Machine (RM). RMs are widely used in Nuclear Power Plants (NPPs). The outcome of this idea is a correct and complete functional specification of specific functions, which is the key foundation for our further safety and security vulnerability analysis, especially for performing analysis based on model checking. This practical checking approach is applicable to further Instrumentation & Control (I&C) systems and platforms.

Control Barrier Functions (CBFs) have become a popular tool for enforcing set invariance in safety-critical control systems. While guaranteeing safety, most CBF approaches are myopic in the sense that they solve an optimization problem at each time step rather than over a long time horizon. This approach may allow a system to get too close to the unsafe set where the optimization problem can become infeasible. Some of these issues can be mitigated by introducing relaxation variables into the optimization problem; however, this compromises convergence to the desired equilibrium point. To address these challenges, we develop an approximate optimal approach to the safety-critical control problem in which the cost of violating safety constraints is directly embedded within the value function. We show that our method is capable of guaranteeing both safety and convergence to a desired equilibrium. Finally, we compare the performance of our method with that of the traditional quadratic programming approach through numerical examples .

Exposing inconsistencies can uncover many defects in software specifications. One approach to exposing inconsistencies analyzes two redundant specifications, one operational and the other property-based, and reports discrepancies. This paper describes a formal method, based on this approach and the SCR (software cost reduction) tabular notation, that can expose inconsistencies in software requirements specifications. Because users of the method do not need advanced mathematical training or theorem-proving skills, most software developers should be able to apply the method without extraordinary effort. This paper also describes an application of the method which exposed a safety violation in the contractor-produced software requirements specification of a sizable, safety-critical control system. Because the enormous state space of specifications of practical software usually renders direct analysis impractical, a common approach is to apply abstraction to the specification. To reduce the state space of the control system specification, two pushbutton abstraction methods were applied, one which automatically removes irrelevant variables and a second which replaces the large, possibly infinite, type sets of certain variables with smaller type sets. Analyzing the reduced specification with the model checker Spin uncovered a possible safety violation. Simulation demonstrated that the safety violation was not spurious but an actual defect in the original specification.

Spacecraft automated rendezvous, proximity maneuvering, and docking (ARPOD) play significant roles in many space missions, including on-orbit servicing and active debris removal. Precise modeling and prediction of spacecraft dynamics can be challenging due to the uncertainties and perturbation forces in the spacecraft operating environment and due to the multilayered structure of its nominal control system. Despite this complication, spacecraft maneuvers need to satisfy required constraints (thrust limits, line-of-sight cone constraints, relative velocity of approach constraints, etc.) to ensure safety and achieve ARPOD objectives. This paper considers an application of a learning-based reference governor (LRG) to spacecraft ARPOD operations to enforce constraints without relying on a dynamic model of the spacecraft during the mission. Similar to the conventional reference governor (RG), the LRG is an add-on supervisor to a closed-loop control system, serving as a prefilter on the command generated by the ARPOD planner. The LRG modifies, if it becomes necessary, the reference command to a constraint-admissible value to enforce specified constraints. The LRG is distinguished, however, by the ability to rely on learning instead of an explicit model of the system; and it guarantees constraints’ satisfaction during and after the learning. In this paper, the LRG is applied to the control of combined translational and rotational motions of a chaser spacecraft, and three case studies with different sets of safety constraints and thruster assumptions are used to demonstrate the benefits of the LRG in ARPOD missions.

This special interest group consisted of 16 delegates at the ASI and met on four occasions to debate the specific issues raised by safety critical real time control systems. In order to protect both human life and the environment of the Earth, certain classes of automated control systems in industries such as nuclear power, aviation and railway signalling are subject to independent analysis and certification, before operational use is permitted. There is universal agreement that such independent checks are essential when human life is at stake. The papers by Cullyer and McDermid in these Proceedings give more details.

A formal framework for the safe design of the Autonomous Driving supervision

The vehicle industry is quickly becoming more connected and growing. This growth is due to advancements in cyber physical systems (CPSs) that enhance the safety and automation in vehicle. The modern automobile consists of more than 70 electronic control units (ECUs) that communicate and interact with each other over automotive bus systems. Passenger comforts, infotainment features, and connectivity continue to progress through the growth and integration of Internet-of-Things (IoT) technologies. Common networks include the Controller Area Network (CAN), Local Interconnect Network (LIN), and FlexRay. However, the benefits of increased connectivity and features comes with the penalty of increased vulnerabilities. Security is lacking in preventing attacks on safety-critical control systems. I will explore the state of the art methods and approaches researchers have taken to identify threats and how to address them with intrusion detection. I discuss the development of a hybrid based intrusion detection approach that combines anomaly and signature based detection methods. Machine learning is a hot topic in security as it is a method of learning and classifying system behavior and can detect intrusions that alter normal behavior. In this paper, we discuss utilizing machine learning algorithms to assist in classifying CAN messages. I present work that focuses on the reverse engineering and classification of CAN messages. The problem is that even though CAN is standardized, the implementation may vary for different manufacturers and vehicle models. These implementations are kept secret, therefore CAN messages for every vehicle needs to be analyzed and reverse engineered in order to get information. Due to the lack of publicly available CAN specifications, attackers and researchers need to reverse engineer messages to pinpoint which messages will have the desired impact. The reverse engineering process is needed by researchers and hackers for all manufacturers and their respective vehicles to understand what the vehicle is doing and what each CAN message means. The knowledge of the specifications of CAN messages can improve the effectiveness of security mechanisms applied to CAN.

This paper describes an experiment informal specification and validation performed in the context of an industrial joint project. The project involved an Italian company working in the field of railway engineering, Ansaldobreda Segnalamento Ferroviario, and the CNR Institutes IEI and CNUCE of Pisa, Within the project two formal models have been developed describing different aspects of a safety-critical system used in the management of medium-large railway networks. Validation of safety and liveness properties has been performed on both models. Safety properties have been checked primarily in presence of Byzantine faults as well as of silent faults embedded in the models themselves. Liveness properties have been more focused on a communication protocol used within the system. Properties have been specified by means of assertions or temporal logical formulae. We used PROMELA as specification language, while the verification was performed using the verification tool suite SPIN.