Safety-critical Control Research Articles

Hybrid Wiener model: An on-board approach using post-flight data for gas turbine aero-engines modelling

On-board modelling of gas turbine aero-engines over the life cycle is a promising solution for engine performance improvement and future aero-propulsion requirements. In this paper, an on-board modelling approach named Hybrid Wiener model (HWM) is proposed for gas turbine aero-engines using post-flight engine monitoring data, which aims at estimating the unmeasured safety-critical control parameters (i.e. thrust, surge margin, and turbine entry temperature) by monitoring the engine degradation effects. Common on-board models for nominal engines, i.e. piecewise linear model, novel generalized describing function, and Wiener model, are systematically tested on a validated turbofan engine aero-thermal model. Simulations demonstrate that Wiener model is the best candidate for nominal engines. HWM is therefore constructed with the integration of on-line Wiener models and an off-line adaptation approach. The on-line part computes the unmeasured safety-critical parameters in a real-time manner. Meanwhile, the off-line adaptation part serves to periodically update the nonlinear static blocks of on-line Wiener models using the post-flight data in order to match the particular degraded engine. Idle to full-power rapid transient simulations of HWM are carried on the turbofan engine aero-thermal model for degradation simulations using publicly available data. Results from the studied turbofan engine at different flight cycles demonstrate that HWM is not only able to guarantee the steady accuracy for thrust, surge margin, and turbine entry temperature, but also ensures that the maximum transient errors for these safety-critical parameters are less than 4.66% during rapid acceleration states. Moreover, the percent errors of peak values for surge margin and turbine entry temperature between HWM and the engine are within 0.50%. The performance of the proposed HWM over the engine life cycle is therefore confirmed.

Safety-Critical Control Synthesis for Network Systems With Control Barrier Functions and Assume-Guarantee Contracts

This article aims at the safety-critical control synthesis of network systems such that the satisfaction of the safety constraints can be guaranteed. To handle the large state dimension of such systems, an assume-guarantee contract is used to break the large synthesis problem into smaller subproblems. Parameterized signal temporal logic (pSTL) is used to formally describe the behaviors of the subsystems which we use as the template for the contract. We show that robust control invariant sets (RCIs) for the subsystems can be composed to form a robust control invariant set (RCI) for the whole network system under a valid assume-guarantee contract. An epigraph algorithm is proposed to solve for a contract that is valid, an approach that has linear complexity for sparse networks, which leads to a RCI for the whole network system. Implemented with control barrier function (CBF), the state of each subsystem is guaranteed to stay within the safe set. Furthermore, we propose a contingency tube model predictive control approach based on the RCI, which is capable of handling severe contingencies, including topology changes of the network. A power grid example is used to demonstrate the proposed method. The simulation result includes both set point control and contingency recovery, and the safety constraint is always satisfied.

Adaptive step size numerical integration for stochastic differential equations with discontinuous drift and diffusion

Stochastic hybrid systems (SHSs) are a modelling framework for a cyber-physical system (CPS), used to simulate, validate, and verify safety critical controllers under uncertainty. Popular simulation tools can miss detecting discontinuities when simulating SHS, thereby producing incorrect outputs during simulation. We propose a novel adaptive step size simulation/integration technique for a subset of SHS—stochastic differential equations (SDEs) with discontinuous drift and diffusion coefficients. Each integration step, of the Euler-Maruyama numerical solution of the SDEs, is made dependent upon the values of the continuous variables inducing the discontinuity. This in turn guarantees convergence of the system trajectory towards the discontinuity without missing it. A thorough analysis and extensive benchmarking of the proposed integration technique shows the efficacy of the approach when simulating complex SHSs.

Safety-Critical Event Triggered Control via Input-to-State Safe Barrier Functions

The efficient utilization of available resources while simultaneously achieving control objectives is a primary motivation in the event-triggered control paradigm. In many modern control applications, one such objective is enforcing the safety of a system. The goal of this paper is to carry out this vision by combining event-triggered and safety-critical control design. We discuss how a direct transcription, in the context of safety, of event-triggered methods for stabilization may result in designs that are not implementable on real hardware due to the lack of a minimum interevent time. We provide a counterexample showing this phenomena and, building on the insight gained, propose an event-triggered control approach via Input to State Safe Barrier Functions that achieves safety while ensuring that interevent times are uniformly lower bounded. We illustrate our results in simulation.

Applying Safety Concepts and Principles in Vital Controller Design

A vital controller is safety critical and its failures, if not mitigated in time, can contribute to hazards in the application system. With electronics advancing and automation increasing, the expanding complexity of a vital controller creates challenges in designing it and assessing its safety integrity level. Typically, traditional safety engineering approaches are not effective for providing systematic guidance to design vital controllers and also not cost efficient for justifying their safety integrity. Through practice on developing multiple Communications-Based Train Control systems, we have identified an approach to using a set of safety concepts as guidance for both safety critical controller design and its safety integrity assessment. These safety concepts are categorized as intrinsic fail-safe, reactive fail-safe, and composite fail-safe. An effective combination of them is applying the composite fail-safe concept in checked redundancy techniques for designing the architecture of a controller, the reactive safety concept for identifying self-testing and monitoring mechanisms in each checked redundant channel, and the intrinsic fail-safe concept for ensuring safe interfaces to other controllers and controlled devices. This paper presents the approach for using these safety concepts and discusses their application principles and verification factors for achieving high safety integrity level of a controller.

Testing and verification of neural-network-based safety-critical control software: A systematic literature review

Context: Neural Network (NN) algorithms have been successfully adopted in a number of Safety-Critical Cyber-Physical Systems (SCCPSs). Testing and Verification (T&V) of NN-based control software in safety-critical domains are gaining interest and attention from both software engineering and safety engineering researchers and practitioners. Objective: With the increase in studies on the T&V of NN-based control software in safety-critical domains, it is important to systematically review the state-of-the-art T&V methodologies, to classify approaches and tools that are invented, and to identify challenges and gaps for future studies. Method: We retrieved 950 papers on the T&V of NN-based Safety-Critical Control Software (SCCS). To reach our result, we filtered 83 primary papers published between 2001 and 2018, applied the thematic analysis approach for analyzing the data extracted from the selected papers, presented the classification of approaches, and identified challenges. Conclusion: The approaches were categorized into five high-order themes: assuring robustness of NNs, assuring safety properties of NN-based control software, improving the failure resilience of NNs, measuring and ensuring test completeness, and improving the interpretability of NNs. From the industry perspective, improving the interpretability of NNs is a crucial need in safety-critical applications. We also investigated nine safety integrity properties within four major safety lifecycle phases to investigate the achievement level of T&V goals in IEC 61508-3. Results show that correctness, completeness, freedom from intrinsic faults, and fault tolerance have drawn most attention from the research community. However, little effort has been invested in achieving repeatability; no reviewed study focused on precisely defined testing configuration or on defense against common cause failure.

Gas turbine aero-engines real time on-board modelling: A review, research challenges, and exploring the future

On-board real time modelling for gas turbine aero-engines has been extensively used for engine performance improvement and reliability. This has been achieved by the utilization of on-board model for the engine's control and health management. This paper offers a historical review of on-board modelling applied on gas turbine engines and it also establishes its limitations, and consequently the challenges, which should be addressed to apply the on-board real time model to new and the next generation gas turbine aero-engines. For both applications, i.e. engine control and health management, claims and limitations are analysed via numerical simulation and publicly available data. Regarding the former, the methods for modelling clean and degraded engines are comprehensively covered. For the latter, the techniques for the component performance tracking and sensor/actuator diagnosis are critically reviewed. As an outcome of this systematic examination, two remaining research challenges have been identified: firstly, the requirement of a high-fidelity on-board modelling over the engine life cycle, especially for safety-critical control parameters during rapid transients; secondly, the dependability and reliability of on-board model, which is critical for the engine protection in case of on-board model failure. Multiple model-based on-board modelling and runtime assurance are proposed as potential solutions for the identified challenges and their potential and effectiveness are discussed in detail.

Sum-of-Squares methods for controlled invariant sets with applications to model-predictive control

We develop a method for computing controlled invariant sets of discrete-time affine systems using Sum-of-Squares programming. We apply our method to the controller design problem for switching affine systems with polytopic safe sets but our work also improves the state of the art for the particular case of LTI systems. The task is reduced to a semidefinite programming problem by enforcing an invariance relation in the dual space of the geometric problem. The paper ends with an application to safety critical model predictive control.

Safety-Critical Control of Active Interventions for COVID-19 Mitigation.

The world has recently undergone the most ambitious mitigation effort in a century, consisting of wide-spread quarantines aimed at preventing the spread of COVID-19. The use of influential epidemiological models of COVID-19 helped to encourage decision makers to take drastic non-pharmaceutical interventions. Yet, inherent in these models are often assumptions that the active interventions are static, e.g., that social distancing is enforced until infections are minimized, which can lead to inaccurate predictions that are ever evolving as new data is assimilated. We present a methodology to dynamically guide the active intervention by shifting the focus from viewing epidemiological models as systems that evolve in autonomous fashion to control systems with an “input” that can be varied in time in order to change the evolution of the system. We show that a safety-critical control approach to COVID-19 mitigation gives active intervention policies that formally guarantee the safe evolution of compartmental epidemiological models. This perspective is applied to current US data on cases while taking into account reduction of mobility, and we find that it accurately describes the current trends when time delays associated with incubation and testing are incorporated. Optimal active intervention policies are synthesized to determine future mitigations necessary to bound infections, hospitalizations, and death, both at national and state levels. We therefore provide means in which to model and modulate active interventions with a view toward the phased reopenings that are currently beginning across the US and the world in a decentralized fashion. This framework can be converted into public policies, accounting for the fractured landscape of COVID-19 mitigation in a safety-critical fashion.

A Scalable Safety Critical Control Framework for Nonlinear Systems

There are two main approaches to safety-critical control. The first one relies on computation of control invariant sets and is presented in the first part of this work. The second approach draws from the topic of optimal control and relies on the ability to realize Model-Predictive-Controllers online to guarantee the safety of a system. In the second approach, safety is ensured at a planning stage by solving the control problem subject for some explicitly defined constraints on the state and control input. Both approaches have distinct advantages but also major drawbacks that hinder their practical effectiveness, namely scalability for the first one and computational complexity for the second. We therefore present an approach that draws from the advantages of both approaches to deliver efficient and scalable methods of ensuring safety for nonlinear dynamical systems. In particular, we show that identifying a backup control law that stabilizes the system is in fact sufficient to exploit some of the set-invariance conditions presented in the first part of this work. Indeed, one only needs to be able to numerically integrate the closed-loop dynamics of the system over a finite horizon under this backup law to compute all the information necessary for evaluating the regulation map and enforcing safety. The effect of relaxing the stabilization requirements of the backup law is also studied, and weaker but more practical safety guarantees are brought forward. We then explore the relationship between the optimality of the backup law and how conservative the resulting safety filter is. Finally, methods of selecting a safe input with varying levels of trade-off between conservatism and computational complexity are proposed and illustrated on multiple robotic systems, namely: a two-wheeled inverted pendulum (Segway), an industrial manipulator, a quadrotor, and a lower body exoskeleton.

Towards Variable Assistance for Lower Body Exoskeletons

This paper presents and experimentally demonstrates a novel framework for variable assistance on lower body exoskeletons, based upon safety-critical control methods. Existing work has shown that providing some freedom of movement around a nominal gait, instead of rigidly following it, accelerates the spinal learning process of people with a walking impediment when using a lower body exoskeleton. With this as motivation, we present a method to accurately control how much a subject is allowed to deviate from a given gait while ensuring robustness to patient perturbation. This method leverages control barrier functions to force certain joints to remain inside predefined trajectory tubes in a minimally invasive way. The effectiveness of the method is demonstrated experimentally with able-bodied subjects and the Atalante lower body exoskeleton.

Methodology for Integrating Computational Tree Logic Model Checking in Unified Modelling Language Artefacts A Case Study of an Embedded Controller


 
 
 A unified modelling language (UML) based formal verification methodology that can be easily integrated into an embedded system software development life cycle is suggested. The approach augments UML diagrams with formal models through an interfacing domain and adds semantics to these diagrams. The suggested methodology; commences from functional specification and use case modelling, selects the most critical behaviour where formal verification can add value to the development cycle, analyses the selected behaviour using UML state transition diagram, derives a state chart matrix from the same, and a high level language software translates the state chart matrix to a labelled transition system. Safety properties are derived from system specifications and are expressed as computation tree logic (CTL) formulae. CTL model-checking algorithm from the literature is used for model- checking. The applicability of the suggested approach is established using a safety critical embedded controller used for deployment and recovery of sensor structures from an airborne platform.
 
 

A Deductive Method for Diagnostic Analysis of Digital Instrumentation and Control Systems

Reliability and safety assurance are of supreme importance in the implementation of digital safety-critical control systems. A deductive method integrated with simulation-based fault injection and testing is presented for out-of-range permanent software fault localization. For fault modeling, an input–output mapping scheme is proposed to characterize the behavior of software modules and represent failure modes in an analogous manner to hardware state definitions. The Markov/cell-to-cell-mapping scheme is used for diagnostics. The diagnostic process is illustrated by several case studies for a boiling water reactor feedwater control system. The case study results show that the diagnostic algorithm is capable of software fault localization in the presence of both single and multiple faults.

A formal framework for the safe design of the Autonomous Driving supervision

The autonomous vehicle is meant to drive by itself, without any driver intervention (for the levels 4 and 5 of automated driving, according to the National Highway Traffic Safety Administration(NHTSA)). This car includes a new function, called Autonomous Driving (AD) function, in charge of driving the vehicle when it is authorized. This function may be in different states (basically active or inactive), that shall be managed by a sub-function, named supervision. The main focus of this work is to ensure that the supervision of a function, performed by a safety critical embedded automotive control system (controlled systems are not considered), respects functional and safety requirements. Usually two processes are involved in the system design: the systems engineering process and the safety one. The first process defines the functional requirements on the function while the safety one specifies redundant sub-functions (realizing together the function) allowing to ensure a continuous service under failure. Since two different aspects of the system are specified, it is a major challenge to make all requirements consistent, from the outset of the design process. In this paper, a method is precisely proposed to address this issue. A progressive reinforcement of the treated requirements is achieved by means of formal state models. In fact, the proposed approach permits to build state models from requirements initially expressed in natural language. Potential ambiguities, incompletenesses or undertones in requirements are in this way gradually deleted. The enrichment of conventional formal verification of control properties with safety requirements constitutes the main originality of the deployed method and contributes to solve inconsistencies between functional and safety verification processes. In addition, the application of the method to the design of AD function supervision highlights its efficiency in an industrial context.

Teaching Safety Critical Control System: A Success Story of Industry Academia Relation

At times, safety critical control systems have failed in their missions. However, the world is moving towards complete autonomy with autonomous driverless cars likely to ply to ferry people in near future. Emerging young engineers will face the world inadequately equipped to address these challenges. Safety Critical Algorithms, Formal Methods and Testing are the need of the hour. The only way to solve this demand for competence that is maturing and needs to be brought up rapidly is to have industry academia collaboration. This paper presents a few safety critical control failure cases and highlights the gap between the student, academia and the industry. A brief description of what has been done as part of the industry academia partnership with MAHE, Manipal, a deemed private University in specific is brought out.

Computing controlled invariant sets for hybrid systems with applications to model-predictive control

In this paper, we develop a method for computing controlled invariant sets using Semidefinite Programming. We apply our method to the controller design problem for switching affine systems with polytopic safe sets. The task is reduced to a semidefinite programming problem by enforcing an invariance relation in the dual space of the geometric problem. The paper ends with an application to safety critical model predictive control.

Co-Scheduling Persistent Periodic and Dynamic Aperiodic Real-Time Tasks on Reconfigurable Platforms

As task preemption/relocation with acceptably low overheads become a reality in today's reconfigurable FPGAs, they are starting to show bright prospects as platforms for executing performance critical task sets while allowing high resource utilization. Many performance sensitive real-time systems including those in automotive and avionics systems, chemical reactors, etc., often execute a set of persistent periodic safety critical control tasks along with dynamic event driven aperiodic tasks. This work presents a co-scheduling framework for the combined execution of such periodic and aperiodic real-time tasks on fully and run-time partially reconfigurable platforms. Specifically, we present an admission control strategy and preemptive scheduling methodology for dynamic aperiodic tasks in the presence of a set of persistent periodic tasks such that aperiodic task rejections may be minimized, thus resulting in high resource utilization. We used the 2D slotted area model where the floor of the FPGA is assumed to be statically equipartitioned into a set of tiles in which any arbitrary task may be feasibly mapped. The experimental results reveal that the proposed scheduling strategies are able to achieve high resource utilization with low task rejection rates over various simulation scenarios.

Safety-Critical Support Vector Regressor Controller for Nonlinear Systems

In this study, a novel safety-critical online support vector regressor (SVR) controller based on the system model estimated by a separate online SVR is proposed. The parameters of the controller are optimized using closed-loop margin notion proposed in Ucak and Gunel (Soft Comput 20(7):2531–2556, 2016). The stability analysis of the closed-loop system has been actualised to design an architecture where operation is interrupted and safety is assured in case of instability. The SVR controller proposed in Ucak and Gunel (2016) has been improved to a safety-critical structure by the addition of a failure diagnosis block which carries out Lyapunov stability analysis and detects failures when the overall system becomes unstable. The performance of the proposed method has been evaluated by simulations carried out on a process control system. The results show that the proposed safety-critical SVR controller attains good modelling and control performances and failures arising from instability can be successfully detected.

EFT Fault Impact Analysis on Performance of Critical Tasks in Intravehicular Networks

Electrical fast transients (EFT) represent an important problem to intravehicular networks. Concerning this problem, this paper reports a study about the impact of EFT to the performance of communication protocols used in intravehicular networks. A method of fast transient injection has been applied to an experimental CAN network with the objective of verifying the EFT impact on jitter and how it influences the communication process. An experiment with a simulated control system distributed over a real CAN network was carried out. For this experiment, an active suspension system was chosen as a case study and a sequence of EFT injections was performed. As a result, it was verified that injected EFT bursts increase jitter of safety-critical control messages and may effectively influence and produce faults during the communication process.

A Technique for the Retrospective and Predictive Analysis of Cognitive Errors for the Oil and Gas Industry (TRACEr-OGI)

Human error remains a major cause of several accidents in the oil and gas (O&G) industry. While human error has been analysed in several industries and has been at the centre of many debates and commentaries, a detailed, systematic and comprehensive analysis of human error in the O&G industry has not yet been conducted. Hence, this report aims to use the Technique for Retrospective and Predictive Analysis of Cognitive Errors (TRACEr) to analyse historical accidents in the O&G industry. The study has reviewed 163 major and/or fatal O&G industry accidents that occurred between 2000 and 2014. The results obtained have shown that the predominant context for errors was internal communication, mostly influenced by factors of perception. Major accident events were crane accidents and falling objects, relating to the most dominant accident type: ‘Struck by’. The main actors in these events were drillers and operators. Generally, TRACEr proved very useful in identifying major task errors. However, the taxonomy was less useful in identifying both equipment errors and errors due to failures in safety critical control barriers and recovery measures. Therefore, a modified version of the tool named Technique for the Retrospective and Predictive Analysis of Cognitive Errors for the Oil and Gas Industry (TRACEr-OGI) was proposed and used. This modified analytical tool was consequently found to be more effective for accident analysis in the O&G industry.