Graph-Based Controller Synthesis for Safety-Constrained, Resilient Systems

Abstract

Resilience to damage, component degradation, and adversarial action is a critical consideration in design of autonomous systems. In addition to designing strategies that seek to prevent such negative events, it is vital that an autonomous system remains able to achieve its control objective even if the system partially loses control authority. While loss of authority limits the system's control capabilities, it may be possible to use the remaining authority in such a way that the system's control objectives remain achievable. In this paper, we consider the problem of optimal design for an autonomous system with discrete-time linear dynamics where the available control actions depend on adversarial input produced as a result of loss of authority. The central question is how to partition the set of control inputs that the system can apply in such a way that the system state remains within a safe set regardless of an adversarial input limiting the available control inputs to a single partition elements. We interpret such a problem first as a variant of a safety game, and then as a problem of existence of an appropriate edge labeling on a graph. We obtain conditions for existence and a computationally efficient algorithm for determining a system design and a control policy that preserve system safety. We illustrate our results on two examples: a damaged autonomous vehicle and a method of communication over a channel that ensures a minimal running digital sum.M. Bucić is with ETH Zürich. M. Ornik and U. Topcu are with the University of Texas at Austin.

Designing Resilient Linear Driftless Systems

“…If max j C j 2 < n m , then it contradicts (7). From [18] we also know that the maximum singular value of a column vector is its norm.…”

“…Proof: Since the columns C of matrix V have the same norm, equation (7) implies C 2 = n m . The maximal singular value of a column vector is its norm [18], so…”

“…Among the types of system malfunction, we specifically consider the loss of control authority over actuators. This setting has been introduced in [7] and refers to actuators becoming unmanageable and producing undesirable, uncontrolled outputs. For instance, a damaged rudder flapping in the wind produces undesirable outputs and it cannot be turned off like a defective engine.…”