Auto sync: 2026-01-22 20:20:39 (1 files changed)

M  Writing/THESIS_PROPOSAL/3-research-approach/v2.tex

Writing/THESIS_PROPOSAL/3-research-approach/v2.tex

@@ -111,8 +111,8 @@ So, what's the solution?
 
     There is no outstanding way to build HAHACS. This methodology provides a
     basis for systems engineers to think about the components of a HAHACS as
-    interlocking pieces whos verification interlinks into a broader system. This
-    will also motivate the adoption of temporal logic to define autonomous
+    interlocking pieces whos verification interlinks into a broader system.
+    This will also motivate the adoption of temporal logic to define autonomous
     control systems, by allowing a close connection and tracability between
     requirements from regulations to system specifications.
 
@@ -120,6 +120,107 @@ So, what's the solution?
 
 }
 
+Some thoughts on invariants, and how they fit here: There are several types of
+safety invariants that HAHACS might have. 
+
+1. Conditions that initiate a switch between control modes (reactiive synthesis
+relevant) 
+
+2. Invariants about the stability of discrete states (barrier certificates) 
+
+3. Invariants ensuring the transition between discrete states (reachability) 
+
+4. Invariants about the timeliness of discrete transitions (??? Reachability?)
+
+How do we reason about all of these invariants. Well, fundamentally they can
+all be reasoned about with temporal logic statements. Using next and eventually
+operators, we can get to the fundamental behavior of all of these modes. What's
+challenging is the fact that we ensure that all of these specifications are
+validated differs between the type of invariant. This is really the beauty of
+this approach, and the intellectual merit. This proposal provides a way for
+hybrid control systems to be verified for autonomous control systems by
+diversifying the way that the invariants are checked. 
+
+Reactive synthesis helps us build discrete controllers using specifications
+that have conditons that don't depend on time. These invariants generally are
+strategic decisions, such as changing between operating modes, initiating power
+level changes, or perhaps doing a refueling or shutdown routine. These
+specifications are able to be nearly directly drawn from operating procedures,
+and should be closely tied to instructions that would be used for human
+operators. They have checkpoints for the continuous system in between different
+control implements. An example is, raise power at a certain rate while ensure
+temperature remains between certain bounds. These conditions are physical
+states, but they are a binary result. The condition is really binary, desipite
+perhaps having units of celsius or %power. When we build discrete controllers
+from these specifications, we get the validation of the controller of these
+specs for free by nature of reactive synthesis tools. We get direct
+traceability from the operating procedure to the discrete controller
+implementation with minimal human effort.
+
+That being said, there are no free lunches here. Ultimately, we're controlling
+physical systems, and while we can automate the controller building between
+stratgic objectives, it is not trivial to do so for the controller of the
+physical process. These controllers are going to have to be built manually,
+with the continuous dynamics of the system in mind. Helpfully, if
+specifications are complete first, one can obtain discrete controller before
+building physical controllers. The result of this is a simplification of
+controller design, becuase the operational goals of each continuous controller
+is clearly outlined by the invariants that define the goal of each discrete
+mode. While for reactive synthesis purposes conditions such as a certain
+temperature being reached or power level attained are binary variables, the
+continuous physical meaning becomes important in the design and analysis of the
+physical controllers. The continuous value of these conditions becomes the goal
+of the continuous controller design, while also providing a basis to check
+controller performance.
+
+To check continuous controllers are valid, we can split continuous controller
+objectives into two types. First, we have continuous controllers that are
+designed to move the plant between two different discrete modes. These will be
+called 'transitory' controllers, because their entire purpose is to transition
+the plant betweeen between discrete control modes. Because of the specification
+of the hybrid control system a priori, we will have defined what the invariants
+of these transitions are in continuous state space. Then, once a continuosu
+controller design is developed, it can be validated using reachability
+analysis. The input set for the analysis is the possible states that enter this
+transitory mode, while the reachable states must be entirely contained within
+the exit invariant for the controller to pass. At the time of writing this
+proposal, it is not clear what the most efficient way to obetain this
+continuous controller is, but is generally beyond the scope of this work. It is
+assumed that they generally won't be so difficult to find for most systems, as
+the refinement of the discrete controller should simplify the control
+objectives of the physical controllers significantly.
+
+The second type of continuous controller that may be utilized in a HAHAHCS is a
+controller that tries to maintaine a continuous steady state, such that no
+discrete transitions are triggered. Reachability on these systems may not prove
+a prudent approach to validating this behavior for a candidate continuous
+controller, and instead, barrier certificates must be used. Barrier
+certificates analyze the dynamics of the system to say whether or not flux
+across a given boudnary exists. That is to say that they evaluate whether or
+not there is a trajectory or not that leaves a given boundary. This definition
+is exactly what defines the validity of a stabilizing continuous control mode.
+Once again, because the design of the discrete controller defines careful
+boundaries in continuous state space, the barrier is known a priori of which we
+must satisfy this condition. This will eliminate the search for such a barrier,
+and minimze complicatoin in validating stabilizing continuous control modes.
+
+Finally, consideration must be paid for when errors occur. The validation of
+these continuous control modes hinges upon having an assumption ofcorrect
+model, which in the case of a mechanical failure will almsot certainly be
+invalidated. Special continuous controllers for these conditions must be
+created, called 'explusory' control modes. These controllers will be
+responsible for ensuring safety in case of failure, and will be designed with
+reachability, but in this case, additional allocation for the allowing of
+physical parameters will be allowed in the analysis. Traditional safety
+analysis will also be used to identify potential failure modes, and the
+modelling of their worst case dynamics. The HAHCS will be able to idenfity why
+such a fault occors because an discrte boundary condition will be violated by
+the continuous physical controller. That is to say, since we will have
+validated the continuous control modes using reachability and barrier
+certificates a priori, we will know with certainty that the only room for
+dynamics to change is a shift in the plant dynamics, not that of the proven
+controller.
+
 \fi