Hybrid Systems Controller Synthesis Examples

EE291E Tomlin/Sastry

Example 1: Aircraft Collision AvoidanceTwo identical aircraft at fixed altitude & speed:

‘evader’ (control) ‘pursuer’ (disturbance)

x

y

uv

d

v

Continuous Reachable Set

x

y

Collision Avoidance Filter

Simple demonstration– Pursuer: turn to head toward evader– Evader: turn to head right

pursuer

safety filter’s input modification

pursuer’s inputevader’s desired input

evader

evader’s actual input

unsafe setcollision set

Movies…

Collision Avoidance Control

http://www.cs.ubc.ca/~mitchell/ToolboxLS/

Overapproximating Reachable Sets

[Khrustalev, Varaiya, Kurzhanski]

Overapproximative reachable set:

Exact:

Approximate:

~1 sec on 700MHz Pentium III (vs 4 minutes for exact)

• Polytopic overapproximations for nonlinear games• Subsystem level set functions• “Norm-like” functions with identical strategies to exact

[Hwang, Stipanović, Tomlin]

Can separation assurance be automated?

Requires provably safe protocols for aircraft interactionMust take into account:• Uncertainties in sensed information, in actions of the other vehicle• Potential loss of communication• Intent, or non-intent

unsafe set with choiceto maneuver or not?

Example 2: Protocol design

unsafe set with maneuver

unsafe set without maneuver

?

unsafe

safe

Protocol Safety Analysis• Ability to choose maneuver start time further reduces unsafe set

safe without switchunsafe to switch

safe with switch

unsafe with or without switch

Implementation: a finite automaton• It can be easier to analyze discrete systems than continuous:

use reachable set information to abstract away continuous details

q1safe at present

will become unsafeunsafe to 1

q5safe at present

always safesafe to 1

q3safe at present

will become unsafesafe to 1

q4safe at present

always safeunsafe to 1

q2unsafe at present

will become unsafeunsafe to 1

qs

SAFE

qu

UNSAFE

forced transitioncontrolled transition (1)

q1

q5

q3

qu

q4 q2

Example 3: Closely Spaced Approaches

Photo courtesy of Sharon Houck

Example 3: Closely Spaced Approaches

evader

EEM Maneuver 1: accelerateEEM Maneuver 2: turn 45 deg, accelerate

EEM Maneuver 3: turn 60 deg

[Rodney Teo]

Sample Trajectories

Segment 1

Segment 2

Segment 3

Dragonfly 3Dragonfly 2

Ground Station

Tested on the Stanford DragonFly UAVs

EEM alert

Sep

arat

ion

dist

ance

(m)

Nor

th (m

)

East (m)

time (s)

Above threshold

Accelerate and turn EEM

Put video here

Tested at Moffett Federal Airfield

EEM alert

Sep

arat

ion

dist

ance

(m)

Nor

th (m

)

East (m)

time (s)

Above threshold

Put video here

Coast and turn EEM

Tested at Moffett Federal Airfield

Tested at Edwards Air Force Base

T-33 Cockpit

[DARPA/Boeing SEC Final Demonstration:F-15 (blunderer), T-33 (evader)]

Photo courtesy of Sharon Houck;Tests conducted with Chad Jennings

Implementation: Display design courtesy of

Chad Jennings, Andy Barrows, David Powell

R. Teo’s Blunder Zone is shown by the yellow contour

Red Zone in the green tunnel is the intersection of the BZ with approach path.

The Red Zone corresponds to an assumed 2 second pilot delay. The Yellow Zone corresponds to an 8 second pilot delay

R. Teo’s Blunder Zone is shown by the yellow contour

Red Zone in the green tunnel is the intersection of the BZ with approach path.

The Red Zone corresponds to an assumed 2 second pilot delay. The Yellow Zone corresponds to an 8 second pilot delay

Map View showing a blunder

The BZ calculations are performed in real time (40Hz) so that the contour is updated with each video frame.

Map View with Color Strips

The pilots only need to know which portion of their tunnel is off limits. The color strips are more efficient method of communicating the relevant extent of the Blunder zone

Aircraft must stay within safe flight envelope during landing:– Bounds on velocity ( ), flight path angle (), height ( )– Control over engine thrust ( ), angle of attack (), flap settings– Model flap settings as discrete modes – Terms in continuous dynamics depend on flap setting

Example 4: Aircraft Autolander

inertial frame

wind frame

body frame

Autolander: Synthesizing Control

For states at the boundary of the safe set, results of reach-avoid computation determine– What continuous inputs (if any) maintain safety– What discrete jumps (if any) are safe to perform– Level set values and gradients provide all relevant data

Application to Autoland Interface• Controllable flight envelopes for landing and Take Off / Go

Around (TOGA) maneuvers may not be the same• Pilot’s cockpit display may not contain sufficient information to

distinguish whether TOGA can be initiated

flareflaps extendedminimum thrust

rolloutflaps extendedreverse thrust

slow TOGAflaps extended

maximum thrust

TOGAflaps retracted

maximum thrust

flareflaps extendedminimum thrust

rolloutflaps extendedreverse thrust

TOGAflaps retracted

maximum thrust

revised interface

existing interface

controllable flare envelope

controllable TOGA envelopeintersection