Correct-by-construction control synthesis for buck converters with event-triggered state measurement

TL;DR

This paper presents a novel correct-by-construction switching controller for buck converters using event-triggered measurements, addressing challenges of outdated state information with a belief space abstraction and demonstrating effectiveness through simulation.

Contribution

Introduces a new control synthesis method that accounts for out-of-date measurements via belief space abstraction for power converters.

Findings

Controller effectively manages outdated measurements.

Belief space abstraction preserves key properties.

Simulation confirms improved control performance.

Abstract

In this paper, we illustrate a new correct-by-construction switching controller for a power converter with event-triggered measurements. The event-triggered measurement scheme is beneficial for high frequency power converters because it requires relatively low-speed sampling hardware and is immune to unmodeled switching transients. While providing guarantees on the closed-loop system behavior is crucial in this application, off-the-shelf abstraction-based techniques cannot be directly employed to synthesize a controller in this setting because controller cannot always get instantaneous access to the current state. As a result, the switching action has to be based on slightly out-of-date measurements. To tackle this challenge, we introduce the out-of-date measurement as an extra state variable and project out the inaccessible real state to construct a belief space abstraction. The properties preserved by this belief space abstraction are analyzed. Finally, an abstraction-based synthesis method is applied to this abstraction. We demonstrate the controller on a constant on-time buck voltage regulator plant with an event-triggered sampler. The simulation verifies the effectiveness of our controller.

Tables

Table 1. TABLE I: Parameter & Variables

Notation	Physical meaning	Value
$I$	inductor current	-
$V$	capacitor voltage	-
$C$	output capacitor	$2.5\times {10}^{-3}$ (F)
$L$	output inductor	$2\times {10}^{-4}$ (H)
$R$	load resistor	0.5 ($\Omega$)
$V_{\mathrm{in}}$	input voltage	100 (V)

Equations

$$\displaystyle\tfrac{d}{dt}\left[\begin{array}[]{c}I\\ V\\ \end{array}\right]=\left[\begin{array}[]{cc}0&-\tfrac{1}{L}\\ \tfrac{1}{C}&-\tfrac{1}{RC}\\ \end{array}\right]\left[\begin{array}[]{c}I\\ V\\ \end{array}\right]+\left[\begin{array}[]{c}\tfrac{V_{\rm in}}{L}\\ 0\\ \end{array}\right],$$

$$x(k+1)=A_{s}x(k)+K_s+d$$

$$\phi ::=\pi \mid \neg \phi \mid {\phi }_1\vee {\phi }_2\mid ◯\phi \mid {\phi }_1\mathcal{U}{\phi }_2$$

$$\Phi =(\square \text{safe})\wedge (\neg \text{target}\mathcal{U}\square \text{target}).$$

$${\text{Reach}}^1(R_q^x,s)$$

$${\text{Reach}}^{k+1}(R_q^x,s)$$

$$\displaystyle\big{(}(X_{\rm inter}^{q}\cap X_{\rm target}\neq\emptyset)\wedge(X_{\rm final}^{q}\not\subseteq X_{\rm target})\big{)}$$

$$\vee (X_{\mathrm{inter}}^q⊈X),$$

$$\displaystyle X_{\rm inter}^{q}\doteq\Bigg{(}\bigcup_{k=1}^{N_{\rm dwell}}\textbf{Reach}^{k}(R_{q}^{x},\text{on})\Bigg{)}$$

$$\displaystyle\cup\Bigg{(}\bigcup_{k=1}^{N_{\rm grace}}\textbf{Reach}^{k}\Big{(}\textbf{Reach}^{N_{\rm dwell}}(R_{q}^{x},\text{on}),\text{off}\Big{)}\Bigg{)},$$

$$\displaystyle X_{\rm final}^{q}\doteq\textbf{Reach}^{N_{\rm grace}}\Big{(}\textbf{Reach}^{N_{\rm dwell}}(R_{q}^{x},\text{on}),\text{off}\Big{)}.$$

$$X_{\mathrm{inter}}^q\cap R_{q^{\prime }}^x\ne \varnothing ,$$

$$\displaystyle\Big{(}\textbf{Reach}^{N_{\rm grace}}(R_{q}^{x},\text{on})\Big{)}^{x_{2}}\cap R^{\hat{x}_{2}}_{q^{\prime}}\neq\emptyset,$$

$$R_q^{{\hat{x}}_1}=R_{q^{\prime }}^{{\hat{x}}_1}.$$

$${\text{Reach}}^1(R_q^x,\text{off})⊈X;$$

$${\text{Reach}}^1(R_q^x,\text{off})\cap R_{q^{\prime }}^x\ne \varnothing ,$$

$$\displaystyle\Big{(}\textbf{Reach}^{1}(R_{q}^{x},\text{off})\Big{)}^{x_{1}}\cap R_{q^{\prime}}^{\hat{x}_{1}}\neq\emptyset,$$

$$R_q^{{\hat{x}}_2}=R_{q^{\prime }}^{{\hat{x}}_2}.$$

$$\text{BPref}(\text{w})=\{\begin{array}{ll}w(1)w(2)\dots w(k_{\text{w}}^{\ast })& \text{ if }{k}_{\text{w}}^{\ast }<\infty \\ \text{w}& \text{ otherwise }\end{array}.$$

$$k_{\text{w}}^{\ast }\doteq \min \{k\mid \text{safe}\notin w(k)\text{, or }$$

$$\text{target}\in w(k-1)\text{ and }\text{target}\notin w(k)\}.$$

$$\underset{{\Phi }_{\mathrm{safety}}}{\underbrace{(\square \text{safe})\wedge (\neg \text{target}\mathcal{W}\square \text{target})}}\wedge \underset{{\Phi }_{\mathrm{liveness}}}{\underbrace{(◊\text{target})}}.$$

$$\displaystyle\underbrace{\left[\begin{array}[]{c}x(1+N_{\rm p})\\ x(2+N_{\rm p})\\ \vdots\\ x(2N_{\rm p})\end{array}\right]}_{\xi^{+}}=\underbrace{\textbf{diag}(\overline{A}_{k})}_{\textbf{A}}\underbrace{\left[\begin{array}[]{c}x(1)\\ x(2)\\ \vdots\\ x(N_{\rm p})\end{array}\right]}_{\xi}+\underbrace{\left[\begin{array}[]{c}\overline{K}_{1}\\ \overline{K}_{2}\\ \vdots\\ \overline{K}_{N_{\rm p}}\end{array}\right]}_{\textbf{K}},$$

$$A_{i_k}=A_{\mathrm{on}},K_{i_k}=K_{\mathrm{on}},$$

$$A_{i_k}=A_{\mathrm{off}},K_{i_k}=K_{\mathrm{off}},$$

Full text

I Introduction

There is an increasing demand for higher performance power converters; digital controllers with the promise of higher speed and lower price thanks to Moore’s law look to fulfill this challenge. Compared to its analog counterpart, a digital controller is more flexible in accommodating different high performance applications. Besides, more complicated control algorithms can be more easily realized by digital [17].

Traditional digital controllers for power converters require a fixed-rate digital sampler for measurements, with a sampling rate much higher than the actuation frequency.111In power converters, actuation is typically via controlling switches in the system; and sampler (or sampling hardware) refers to the measurement mechanisms. This is because the digital control algorithms employed usually require high-fidelity estimates of system states. Hence, with the increasing demand on dynamic response and switching frequency of power converters, sampling hardware complexity increases dramatically [7]. In addition, for variable switching-frequency power converters, sampling measurements at a fixed-rate is susceptible to distortion in measurement quality due to unmodeled switching transients. As an alternative, event-driven control is starting to draw attention in power electronics as it can alleviate the requirement for high complexity sampling hardware without sacrificing the performance significantly [9, 18].

In this work, we consider controller design for a specific power converter called constant on-time buck converter. Such converters are widely used in voltage regulator modules and point-of-load converter applications [4]. The converter usually has two switches as actuators, denoted as $S_{1}$ and $S_{2}$ respectively, and the term “constant on-time” indicates that the turn-on time of the switch $S_{1}$ is kept constant. Constant on-time is shown to provide robustness to the circuit parameter variations [11] and avoid chattering in hysteresis control [3]. A notable feature of the constant on-time buck converter considered in this work is that its states are measured in an event-triggered manner. By imposing certain physical constraints on when the voltages and currents are measured, the burden on sampling hardware can largely be reduced. However, this non-uniform sampling mechanism necessitates new control algorithms that can work with limited and possibly out-of-date measurements.

In order to address this challenge, we formulate the constant on-time buck converter control problem as a temporal logic game of switched affine systems and solve the game for an abstraction of the system [6, 16]. The solution of the game leads to a correct-by-construction switching controller that assures a desired closed-loop behavior specified using temporal logics [2], making it possible to strictly regulate the systems’ behavior. Moreover, this set of approaches is particularly good at handling switched systems like the buck converter considered in this paper. However, standard approaches for abstraction-based synthesis usually assume a uniform sampling rate and immediate access to the system states, assumptions that do not hold for the buck converter system. Controller design for systems like this can be handled under the framework of sampled-data systems, with extra analysis to guarantee the time robustness, e.g., [14]. In particular, abstraction-based synthesis of such system with incremental stability assumption are studied under the framework of sampled-data systems in recent works like [13], where one can tolerate nonuniform but bounded sampling rates, while still enjoying the approximate-bisimulation property thank to the incremental stability of the system.

The main difference of our approach from [13] is that we solve the problem as a temporal logic game with imperfect (particularly, delayed) information [8, 10]. With this approach, we do not need to assume an incrementally stable system or finite sampling period (the case with infinitely long sampling period may be rare in practice but there can be potential situations where further measurement is not helpful for the decision making). The main challenge with the imperfect information game solving is that it usually involves the construction of a belief space that grows exponentially [8]. In this paper, we provide belief space reduction schemes tailored to the specific features in the buck converter problem.

II System Model, Requirements and Problem Statement

In this section, we define the control problem by giving the buck converter model and the requirements of the system. We consider two types of requirements: physical requirements and functional requirements. Physical requirements refer to the extra restrictions on the measurement mechanism in order to improve the system performance and reduce the hardware implementation cost, as discussed in the introduction, whereas functional requirements specify the desired closed-loop system behavior.

II-A Physical Requirements and Buck Converter Model

We first develop a hybrid automaton model that integrates the buck converter circuit model with the measurement scheme derived from the physical requirements. While hybrid automata are used to model power converters for reachability-based verification purposes in the past [5, 15], to the best of our knowledge, no prior work exists that considers event-triggered measurements.

The buck converter has two switches as actuators, denoted as $S_{1}$ and $S_{2}$ respectively. We describe the converter’s model by a switched affine system with two modes, and we refer the two modes as the “on-mode” and the “off-mode”. The “on-mode” corresponds to the case when $S_{1}$ is on and $S_{2}$ is off, while the “off-mode” corresponds to the case when $S_{1}$ is off and $S_{2}$ is on222The both-on combination leads to a voltage source being short circuited and the both-off combination leads to an open circuit current source. Hence these two configurations are never used.. The continuous-time circuit dynamics under the on-mode is given by

[TABLE]

where the variables and parameters are given in TABLE I.

The dynamics under the off-mode can be defined by replacing the rightmost constant offset term in Eq. (9) by $[0,0]^{T}$. With a sampling time of $250$ ns, the discrete-time switched dynamics are given by:

[TABLE]

where $x=[x_{1},x_{2}]=[I,V]\in\mathbb{R}^{2}$ is the state, $s\in\{\text{on, off}\}$ is the mode, $d\in D\subseteq\mathbb{R}^{2}$ is the bounded disturbance.

As alluded to in the introduction, for some performance and cost considerations, the following physical requirements are imposed on the mode switching and state measurements:

• •

The dwell time of the on-mode is fixed as $T_{\rm dwell}$ as per constant-on time converter scheme. For the specific voltage regulator in this paper, we set $T_{\rm dwell}=12\ \mu\text{s}$ (i.e., $N_{\rm dwell}=48$ samples) for illustration.

• •

The state $V$ is measured only once per cycle after the system has stayed in the on-mode for exactly $T_{\rm grace}$. Although $V$ can be accessed by more than once per switching cycle, voltage measurement is very costly [1]. Therefore, one of the aims of this paper is to do as few voltage measurements as possible.

• •

The dwell time of the off-mode is lower bounded by $T_{\rm grace}$ for allowing states to settle from the switching transient. We set $T_{\rm grace}=1\ \mu\text{s}$ (i.e., $N_{\rm grace}=4$ samples) in this paper. The state $I$ can be measured at any time after $T_{\rm grace}$ during off-mode. It is much easier to measure the current during the off-mode rather than the on-mode because during on-time, the inductor current has to be measured by a differential voltage sensor which is harder to implement. One difference from voltage measurements is that the current measurement can be done for more than once during off-time because the cost of current measurement is not as high as voltage measurement.

• •

After staying in the on-mode for $T_{\rm dwell}$, the system is forced to switch to off-mode so that the inductor current information can be updated during every cycle.

To capture the dynamics of the buck converter system with the above switching and measurement restrictions, we introduce two extra variables: 1) $\hat{x}=[\hat{x}_{1},\hat{x}_{2}]$ that represents the measurement of the actual state $x=[x_{1},x_{2}]$ , and 2) $t_{\rm d}$ that represents the time spent in the on- or off-mode. With the extra variables, the model can be represeted with the hybrid automaton, denoted by $\mathcal{H}$, shown in Fig. 1.

Note that the discrete state of hybrid automaton $\mathcal{H}$ can be further simplified, by combining the three discrete states in the dashed line box. We do this because all the transitions within the dashed line box are autonomous, while the only non-autonomous transition is between the states marked as “off-mode (post-measurement)” and “on-mode (pre-measurement)”. From now on, we will refer to the combined state (i.e., the three discrete states in dashed line box) as mode 1, and the other discrete state as mode 2. To distinguish these two modes from the on/off-mode of the buck converter, we use $a\in A=\{1,2\}$ to denote the above simplified modes, and $s\in\{\text{on, off}\}$ for the on/off-mode. We say a mode sequence $\textbf{a}=a(1)a(2)a(3)\dots$ is admissible for the hybrid automaton $\mathcal{H}$ if it evolves according to the following rules:

• •

$a(k)=2\Rightarrow a(k+1)=1\text{ or }2$. This means when $a(k)=2$, one can either continue with $a(k+1)=2$ or switch to $a(k+1)=1$.

• •

For any maximal 1-fragment $a(k)\dots a(K)$ consisting of only consecutive 1’s, $(K-k+1)\text{ mod }(N_{\rm dwell}+N_{\rm grace})=0$ must hold. The term “maximal” means that one of the following three conditions holds: (i) $a(k-1)=a(K+1)=2$, or (ii) $k=1$ and $a(K+1)=2$, or (iii) $a(k-1)=2$ and $K=\infty$. This means that once the mode is set to 1, it will remain there for $N_{\rm dwell}+N_{\rm grace}$ steps. Note that the system will then automatically switch to mode 2 according to Fig. 1, but we allow controller to decide to skip “off-mode (post-measurement)” state with the reset $\hat{x}_{1}=x_{1}$. Hence there can be multiple consecutive 1-fragments, each containing $N_{\rm dwell}+N_{\rm grace}$ terms.

Under an admissible mode sequence a, the converter state $x$ and its measurement $\hat{x}$ update accordingly:

• •

if $a(k)=2$, the converter state $x$ will update with the off-mode dynamics; the measurement $\hat{x}_{1}$ updates at every step while $\hat{x}_{2}$ is always fixed;

• •

if $a(k)=1$, the converter state will evolve according to the on-mode dynamics whenever $t_{\rm d}\leq N_{\rm dwell}$, and then evolves with the off-mode dynamics whenever $t_{\rm d}>N_{\rm dwell}$; the measurement $\hat{x}_{1}$ is always fixed, and $\hat{x}_{2}$ gets updated only when $t_{\rm d}=T_{\rm grace}$.

We define \textbf{x}^{\textbf{a},\textbf{d}}=\big{(}x(1),\hat{x}(1)\big{)}\big{(}x(2),\hat{x}(2)\big{)}\dots to be the unique execution of hybrid automaton $\mathcal{H}$ under action sequence a and disturbance profile $\textbf{d}=d(1)d(2)d(3)\dots$. Note that $t_{\rm d}$ is not included as a state in the execution because it will be redundant if a is given. However, we will need $t_{\rm d}$ when control action $a$ is to be determined. In the reset of the paper, we call state feedback333At this point, it does not make much sense to assume both $x$ and $\hat{x}$ to be accessible to the controller. However, as will be seen later in the paper, such controller is useful for stating the relation between the closed-loop hybrid automaton and its raw abstraction. controller $C:X\times\hat{X}\times\{0,\dots,N_{\rm dwell}+N_{\rm grace}\}\rightarrow 2^{A}$ to be admissible by $\mathcal{H}$ if $C(x,\hat{x},t_{\rm d})=1$ for $t_{\rm d}<N_{\rm dwell}+N_{\rm grace}$, in which case the system stays at mode 1 according to Fig. 1.

II-B Functional Requirements

We use Linear Temporal Logic (LTL) to specify the functional requirements of the buck converter system, i.e., the desired closed-loop system behavior of the hybrid system $\mathcal{H}$. In what follows we briefly introduce the syntax and the semantics of LTL, and refer the reader to [2] for more details.

II-B1 LTL Syntax

Let $AP$ be a set of atomic propositions, the syntax of LTL formulas over $AP$ is given by

[TABLE]

where $\pi\in AP$. With the grammar given in Eq. (11), we define the other propositional and temporal logic operators as follows: $\varphi_{1}\wedge\varphi_{2}\doteq\neg(\neg\varphi_{1}\vee\neg\varphi_{2})$, $\varphi_{1}\rightarrow\varphi_{2}\doteq\neg\varphi_{1}\vee\varphi_{2}$, $\lozenge\varphi\doteq True\ \mathcal{U}\ \varphi$, $\Box\varphi\doteq\neg\lozenge\neg\varphi$, $\varphi\ \mathcal{W}\ \psi\doteq(\varphi\ \mathcal{U}\ \psi)\vee(\Box\neg\psi)$.

II-B2 LTL Semantics

We define a word $\textbf{w}=w(1)w(2)w(3)\dots$ to be an infinite sequence of subsets of atomic propositions (i.e., $w(k)\subseteq AP$), and interpret an LTL formula over the set of words as follows:

• •

$\textbf{w}\models\pi$ if and only if (iff) $\pi\in w(1)$,

• •

$\textbf{w}\models\neg\varphi$ iff $\textbf{w}\nvDash\varphi$,

• •

$\textbf{w}\models\varphi_{1}\vee\varphi_{2}$ iff $\textbf{w}\models\varphi_{1}$ or $\textbf{w}\models\varphi_{2}$,

• •

$\textbf{w}\models\bigcirc\varphi$ iff $\textbf{w}_{2}\models\varphi$,

• •

$\textbf{w}\models\varphi_{1}\ \mathcal{U}\ \varphi_{2}$ iff $\exists s\geq 0:\textbf{w}_{s}\models\varphi_{2}$ and $\forall t<s:\textbf{w}_{t}\models\varphi_{1}$,

where $\textbf{w}_{k}=w(k)w(k+1)w(k+2)\dots$ is the suffix of word w starting from its $k^{\rm th}$ element. Given an infinite word w and an LTL formula $\varphi$, we say $\varphi$ holds for w (or w satisfies $\varphi$) iff $\textbf{w}\models\varphi$.

II-B3 Buck Converter Specification in LTL

The objective of the controller is to steer the buck converter state $x$ into a given target region $X_{\rm target}$, and let it stay in $X_{\rm target}$ forever once arrived. In the meantime, the state should never go outside the given domain $X$. Let $AP=\{\texttt{safe},\texttt{target}\}$, the above specification can be written as the following LTL formula:

[TABLE]

Let a be a mode sequence that is admissible for hybrid automaton $\mathcal{H}$ and d be the disturbance profile, and let \textbf{x}^{\textbf{a},\textbf{d}}=\big{(}x(1),\hat{x}(1)\big{)}\big{(}x(2),\hat{x}(2)\big{)}\dots be the associated execution, we say that execution $\textbf{x}^{\textbf{a},\textbf{d}}$ satisfies LTL formula $\Phi$ if \textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})\doteq\ell\big{(}x(1)\big{)}\ell\big{(}x(2)\big{)}\dots\models\Phi, where $\ell:X\rightarrow 2^{AP}$ is an observation map such that $\texttt{safe}\in\ell(x)\Leftrightarrow x\in X$ and $\texttt{target}\in\ell(x)\Leftrightarrow X_{\rm target}$. Note that the labeling is only with respect to the true state $x$ and we are not interested in labeling the measurement state $\hat{x}$.

II-C Problem Statement

Given the hybrid automaton $\mathcal{H}$, the LTL specification $\Phi$ defined in Eq. (12), and an initial state $x_{\rm init}$ (or a set of initial states $X_{\rm init}$)444We assume that the actual state $x$ is accessible at the initial time. This assumption is reasonable as there will be no unmodeled switching dynamics that spoil the measurement at the very beginning. As a result, the measurement state $\hat{x}$ of hybrid automaton $\mathcal{H}$ is such that $\hat{x}=x$ at the initial time., the goal is to find a switching controller under which all the executions of $\mathcal{H}$ starting from $X_{\rm init}$ and $t_{\rm d}=N_{\rm dwell}+N_{\rm grace}$ (i.e., starting from mode 2) satisfy LTL formula $\Phi$. In particular, the control action needs to be determined based on the history of $\hat{x}$, but not $x$.

III Solution approach

To synthesize a correct-by-construction controller for the buck converter with the described event-triggered measurement mechanism, we use abstraction-based synthesis. We first construct a finite transition system that over approximates the behavior of the buck converter and the measurement state $\hat{x}_{2}$, then we project out state $x_{2}$ that is not directly accessible and this leads to an abstraction in the belief space. The control problem is then solved as a reach-avoid-stay game on the belief space abstraction. Finally, several techniques are presented to reduce the belief space abstraction size.

III-A Raw Abstraction

The buck converter system will be abstracted by a finite transition system $TS$, a five-tuple $(Q,A,AP,\lambda,\tau)$, where $Q$ is a finite set of states, $A$ is a finite set of actions, $AP$ is a set of atomic propositions, $\lambda:Q\rightarrow 2^{AP}$ is the labeling function and $\tau:Q\times A\rightarrow 2^{Q}$ is the nondeterministic transition map. With a slight abuse of notation, we define $\tau(Q_{1},A_{1})=\bigcup_{q\in Q_{1},a\in A_{1}}\tau(q,a)$ for $Q_{1}\subseteq Q$ and $A_{1}\subseteq A$. Given an action sequence $\textbf{a}=a(1)a(2)a(3)\dots$, an execution of the transition system is a sequence $\textbf{q}^{\textbf{a}}=q(1)q(2)q(3)\dots$ such that q(k+1)\in\tau\big{(}q(k),a(k)\big{)}, and the word associated with this execution is \textbf{w}(\textbf{q}^{\textbf{a}})=\lambda\big{(}q(1)\big{)}\lambda\big{(}q(2)\big{)}\lambda\big{(}q(3)\big{)}\dots.

We first compute an abstraction of the system with the extended state $[x,\hat{x}]^{T}\in X\times\hat{X}$, where $\hat{X}$ is the domain of $\hat{x}$, the out-of-date measurement of $x$. This abstraction is called the “raw abstraction”. The raw abstraction should over-approximate the behavior of the hybrid automaton $\mathcal{H}$ presented in Section II-A so that if a controller is synthesized for the raw abstraction, it can be applied to the hybrid automaton and the correctness is preserved. However, nondeterministic abstractions based on one-step reachability relations typically lead to spurious behaviors (especially, in the absence of bisimulation relations) since the nondeterminism accumulates [6, 16]. Our key insight to mitigate this problem for the buck converter system is to leverage the constant duration of mode 1 and do long-term reachable set computation to avoid spurious transitions. This also eliminates the need for extra states to track the dwell time in mode 1. The constructed abstraction is in a sense “multi-rate” where different transitions correspond to different durations on the actual system. This requires extra care in labeling the abstraction in general, for which we exploit the special structure in specification $\Phi$ to simplify the process. These constructions lead to a raw abstraction that approximates the behaviors of $\mathcal{H}$ in a weaker sense but is enough to preserve the correctness as long as achieving specification $\Phi$ is considered. In what follows, we denote this raw abstraction by $TS^{\rm R}=(Q,A,AP,\lambda,\tau)$ and define each component in the five-tuple according to the idea mentioned above. Then we will formally state the system relation between the hybrid automaton $\mathcal{H}$ and this raw abstraction $TS^{\rm R}$.

III-A1 Raw Abstraction Construction

First, the action set $A=\{1,2\}$ is the set of the simplified modes defined at the end of Section II-A. The atomic proposition set $AP=\{\texttt{safe},\texttt{target}\}$.

Secondly, to define the state set $Q$, we partition the true two-dimensional state domain $X$ and the two-dimensional measurement domain $\hat{X}$ in the same way using a grid. Each point in the grid is denoted by $x^{i}$ (or $\hat{x}^{i}$, respectively) when it is used to abstract $X$ (or $\hat{X}$, respectively), and corresponds to a closed rectangular region $R^{x^{i}}$ (or $R^{\hat{x}_{j}}$, respectively). Now, we can express the discrete state set $Q$ by \big{(}\{x^{1},x^{2},\dots,x^{N}\}\times\{\hat{x}^{1},\hat{x}^{2},\dots,\hat{x}^{N}\}\big{)}\cup\{q_{\rm out}\}, where $q_{\rm out}$ is an extra state that represents the region outside the domain. Now that each discrete state $q\in Q\setminus\{q_{\rm out}\}$ corresponds to a tuple $(x^{i},\hat{x}^{j})$, it naturally corresponds to a four-dimensional rectangular region $R_{q}=R^{x^{i}}\times R^{\hat{x}^{j}}$ in the continuous state space $X\times\hat{X}$. We also use $R_{q}^{x}$ ($R_{q}^{\hat{x}}$ respectively) to denote the projection of $R_{q}$ onto $X$ ($\hat{X}$ respectively) space, that is, $R_{q}^{x}=R^{x^{i}}$ and $R_{q}^{\hat{x}}=R^{\hat{x}^{j}}$ for $q=(x^{i},\hat{x}^{j})$. Similarly, $R_{q}^{x_{1}}$, $R_{q}^{x_{2}}$, $R_{q}^{\hat{x}_{1}}$, $R_{q}^{\hat{x}_{2}}$ correspond to the one-dimensional projections of the four-dimensional rectangle $R_{q}$. We define the labeling function $\lambda$ to be such that $\texttt{safe}\in\lambda(q)\Leftrightarrow q\neq q_{\rm out}$, and $\texttt{target}\in\lambda(q)\Leftrightarrow R_{q}^{x}\subseteq X_{\rm target}$. In particular, we assume the grid partition of $X$ to be proposition preserving, i.e., for all $q\in Q\setminus\{q_{\rm out}\}$, either $\text{int}(R_{q}^{x})\cap X_{\rm target}=\emptyset$ or $\text{int}(R_{q}^{x})\subseteq X_{\rm target}$, where $\text{int}(R_{q}^{x})$ is the interior of rectangle $R_{q}^{x}$. We also define target state set $Q_{\rm target}\doteq\{q\in Q\mid\texttt{target}\in\lambda(q)\}$ and the initial state set $Q_{\rm init}\doteq\{q\in Q\mid R_{q}^{x}\cap X_{\rm init}\neq\emptyset\}$.

Next, we define the transition relation $\tau$ of the raw abstraction $TS^{\rm R}$. To this end, we first recursively define the $k$-step reachable set $\textbf{Reach}^{k}(R_{q}^{x},s)$ of the system’s true state $x\in R_{q}^{x}$, under control action $s\in\{\text{on},\text{off}\}$:

[TABLE]

Particularly, $\textbf{Reach}^{1}(R_{q}^{x},s)$ (and hence $\textbf{Reach}^{k+1}(R_{q}^{x},s)$ by induction) can be easily computed as a zonotope given that $R_{q}^{x}$ and disturbance set $D$ are zonotopes [12]. In our case, $R_{q}^{x}$ is a rectangle and $D$ is chosen to be a 1-norm ball and hence both are zonotopes.

Given the above definitions for the reachable sets, for any $q,q^{\prime}\in Q$ and $a\in A=\{1,2\}$, the transition map $\tau$ is defined as follows:

• •

For $q\notin Q_{\rm target}$, $q_{\rm out}\in\tau(q,1)$ iff

[TABLE]

where

[TABLE]

• •

For $q\in Q_{\rm target}$, $q_{\rm out}\in\tau(q,1)$ iff $X^{q}_{\rm inter}\not\subseteq X_{\rm target}$.

• •

$q^{\prime}\in\tau(q,1)$ for $q^{\prime}\in Q\setminus\{q_{\rm out}\}$ iff

[TABLE]

• •

$q_{\rm out}\in\tau(q,2)$ iff

[TABLE]

• •

$q^{\prime}\in\tau(q,2)$ for $q^{\prime}\in Q\setminus\{q_{\rm out}\}$ iff

[TABLE]

• •

$\tau(q_{\rm out},1)=\tau(q_{\rm out},2)=\{q_{\rm out}\}$

III-A2 Relation between Raw Abstraction $TS^{\rm R}$ and Hybrid Automaton $\mathcal{H}$

Through the above construction, we obtain a finite transition system $TS^{\rm R}$ that “captures” the behaviors of hybrid automaton $\mathcal{H}$, with some intermediate behaviors being reasonably omitted for reducing spurious behaviors. Such omission leads to a relation between $\mathcal{H}$ and $TS^{\rm R}$ that is different from the usual behavior over approximation, but will not harm the correctness of the controller obtained through synthesis on the raw abstraction. In particular, this relation is specific to solving reach-avoid-stay game with specification $\Phi$ defined in Eq. (12). In what follows, we formally state this relation. To this end, several definitions are needed.

Definition 1

An admissible controller $C:\mathcal{X}_{\rm win}\times\{0,\dots,N_{\rm dwell}+N_{\rm grace}\}$ for hybrid automaton $\mathcal{H}$, where $\mathcal{X}_{\rm win}\subseteq X\times\hat{X}$, is “induced” from a controller $\overline{C}:Q_{\rm win}\subseteq Q\rightarrow 2^{A}$ defined on the raw abstraction $TS^{\rm R}$ if $\mathcal{X}_{\rm win}=\bigcup_{q\in Q_{\rm win}}R_{q}$ and $C(x,\hat{x},t_{\rm d})=\overline{C}(q)$ when $t_{\rm d}=N_{\rm dwell}+N_{\rm grace}$, where $q$ is such that $[x,\hat{x}]^{T}\in R_{q}$. In particular, $\mathcal{X}_{\rm win}$ and $Q_{\rm win}$ are called “winning sets”, which only consist good initial conditions starting from where achieving the specification is possible555For general LTL specifications, the controller needs memory and the winning set may be different from the domain of the controller. However, the reach-stay-avoid specification $\Phi$ in Eq. (12) can be achieved by a state feedback controller whose domain is the same as the winning set..

Definition 2

Mapping $\textbf{BPref}:(2^{AP})^{\omega}\rightarrow(2^{AP})^{\omega}\cup(2^{AP})^{\ast}$ maps a word w to its “bad prefix” for the LTL formula $\Phi$ defined in Eq. (12), i.e.,

[TABLE]

where

[TABLE]

To understand Defn. 2, note that $\Phi$ can be rewritten as

[TABLE]

Given a word $\textbf{w}=w(1)w(2)\dots\in(2^{AP})^{\omega}$ that violates $\Phi_{\rm safety}$, the violation can be localized to a prefix of w satisfying either $\texttt{safe}\notin w(k)$ or $\texttt{target}\in w(k-1)$ while $\texttt{target}\notin w(k)$. With this observation, one can talk about “the first violation” of $\Phi_{\rm safety}$ that occurs at $k^{\ast}_{\textbf{w}}$ defined in Eq. (26). An easy implication of Defn. 2 is that $\textbf{w}\models\Phi_{\rm safety}\Leftrightarrow\textbf{BPref}(\textbf{w})$ being infinite.

Definition 3

*The “intermediate action projection” $\textbf{Proj}:A^{\omega}\rightarrow A^{\omega}$ is a partial mapping defined for any action sequence $\textbf{a}=a(1)a(2)a(3)\dots$ that is admissible to $\mathcal{H}$. $\textbf{Proj}(\textbf{a})$ replaces any maximal 1-fragment666See Section II-A for definition. Since a is admissible to $\mathcal{H}$, we know that such maximal 1-fragments of a must consist of $l$ smaller fragments of length $N_{1}$, where $l$ is arbitrary natural number. of a, e.g. $a(k)a(k+1)\dots a(k+lN_{1}-1)$, by the first elements in each $N_{1}$ sub-fragment, i.e., by $a(k)a(k+N_{1})\dots a(k+(l-1)N_{1})$. Let $\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})=w(1)w(2)w(3)\dots$ be one word associated admissible a. With a slight abuse of notation, we use \textbf{Proj}\big{(}\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})\big{)} to denote the sequence obtained by replacing $w(k)w(k+1)\dots w(k+lN_{1}-1)$ (i.e., any fragment associated with a maximal 1-fragments in a) by $w(k)w(k+N_{1})\dots w(k+(l-1)N_{1})$. *

Observe that \textbf{Proj}(\textbf{w})\models\Phi_{\rm liveness}\Rightarrow\textbf{w}\models$$\Phi_{\rm liveness}.

With the definitions above, the relation between hybrid automaton $\mathcal{H}$ and its raw abstraction $TS^{\rm R}$ can be formally stated by the following proposition.

Proposition 1

Given any controller $\overline{C}:Q\rightarrow 2^{A}$ defined on $TS^{\rm R}$, let $C$ be the admissible controller induced by $\overline{C}$. For any execution \textbf{x}^{\textbf{a},\textbf{d}}=\big{(}x(1),\hat{x}(1)\big{)}\big{(}x(2),\hat{x}(2)\big{)}\big{(}x(3),\hat{x}(3)\big{)}\dots generated by $\mathcal{H}$ starting from $t_{\rm d}=N_{1}$ under controller $C$, there exists an execution $\textbf{q}^{\overline{\textbf{a}}}=q(1)q(2)q(3)\dots$, generated by $TS^{\rm R}$ under controller $\overline{C}$, such that

1. (i)

$[x(1),\hat{x}(1)]^{T}\in R_{q(1)}$*, * 2. (ii)

\textbf{Proj}\Big{(}\textbf{BPref}\big{(}\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})\big{)}\Big{)}=\textbf{BPref}\big{(}\textbf{w}(\textbf{q}^{\overline{\textbf{a}}})\big{)}.

By Proposition 1, we have the following useful result, which guarantees that the controller synthesized for raw abstraction $TS^{\rm R}$ will lead to correct behavior when its induced admissible controller is applied to the hybrid automaton $\mathcal{H}$.

Theorem 1

Suppose a winning set $Q_{\rm win}\subseteq Q$ and a controller $\overline{C}:Q_{\rm win}\rightarrow 2^{AP}$ is found for $TS^{\rm R}$, so that any execution $\textbf{q}^{\overline{\textbf{a}}}=q(1)q(2)q(3)\dots$ with $q(1)\in Q_{\rm win}$, which is generated under action sequence $\overline{\textbf{a}}=\overline{a}(1)\overline{a}(2)\overline{a}(3)\dots$ satisfying \overline{a}(k)\in\overline{C}\big{(}q(k)\big{)}, satisfies $\Phi$. Then any execution \textbf{x}^{\textbf{a},\textbf{d}}=\big{(}x(1),\hat{x}(1)\big{)}\big{(}x(2),\hat{x}(2)\big{)}\big{(}x(3),\hat{x}(3)\big{)}\dots of $\mathcal{H}$ starting from $[x(1),\hat{x}(1)]^{T}\in\bigcup_{q\in Q_{\rm win}}R_{q}$ satisfies $\Phi$ under control sequence $\textbf{a}=a(1)a(2)a(3)\dots$ with a(k)\in C\big{(}x(k),\hat{x}(k),t_{\rm d}\big{)}, where $C$ is induced from $\overline{C}$.

The proofs of Proposition 1 and Theorem 1 are given in the Appendix.

III-B Belief Space Abstraction Construction

We cannot directly synthesize the controller on the raw abstraction obtained above. The reason is: since the abstraction (i.e., the finite transition system) is nondeterministic, we cannot locate the actual discrete state on this raw abstraction due to lack of immediate information of the true state $x$. As a result, should a controller $\overline{C}$ be found on the raw abstraction, we would not be able to follow the action suggested by this controller at the current state, as the precise current state on the raw abstraction is not known. Instead, we construct a belief space abstraction, each of whose states may contain multiple raw abstraction states, but can be distinguished from others using the current value of the measured state $\hat{x}$. Suppose a controller can be found on the belief space abstraction, we can achieve the control objective with $\hat{x}$.

In what follows we will focus on constructing the belief space abstraction $TS^{\rm B}$ from the raw abstraction $TS^{\rm R}$. The belief space abstraction construction relies on a key function $\beta$ that maps a set of raw states to a set of belief states. Recall that the set of raw states $Q$ (except for $q_{\rm out}$) can be expressed as a set of tuples $(x^{i},\hat{x}^{j})$ from the product grid $\{x^{1},x^{2},\dots,x^{N}\}\times\{\hat{x}^{1},\hat{x}^{2},\dots,\hat{x}^{N}\}$. Since $x$ is not accessible, the state of the belief space abstraction should be in form of $(S,\hat{x}^{j})$, where $S\subseteq\{x^{1},x^{2},\dots,x^{N}\}$. Formally, let $P$ be the set of states of the belief space abstraction, the state mapping $\beta:2^{Q}\rightarrow 2^{P}$ is defined as follows:

• •

$\beta(\emptyset)=\emptyset$, $\beta(\{q_{\rm out}\})=\{p_{\rm out}\}$,

• •

\beta\Big{(}\big{\{}(x,\hat{x})\mid x\in S,\hat{x}=\hat{x}^{j}\big{\}}\Big{)}=\big{\{}(S,\hat{x}^{j})\big{\}},

• •

\beta(\mathcal{S})=\bigcup_{\hat{x}^{j}}\beta\Big{(}\big{\{}(x,\hat{x})\in\mathcal{S}\mid\hat{x}=\hat{x}^{j}\big{\}}\Big{)}.

Informally, map $\beta$ collects the raw states indistinguishable from each other with $\hat{x}$ and collapse them into one belief state.

On the other hand, if two raw states are with different $\hat{x}$, they will be collapsed into different belief states. Fig. 2 shows an example to understand the definition of mapping $\beta$. For ease of illustration, we only use an example where $X$ and $\hat{X}$ are one-dimensional. The heavily shaded region covers a set $\mathcal{S}$ of raw abstraction states. In this example, \beta(\mathcal{S})=\Big{\{}\big{(}\{x^{3},x^{4}\},\hat{x}^{2}\big{)},\big{(}\{x^{3}\},\hat{x}^{3}\big{)},\big{(}\{x^{2},x^{3},x^{4}\},\hat{x}^{4}\big{)}\Big{\}}.

With the state map $\beta$ defined above, we present the belief space abstraction construction with Algorithm 1.

We start with initial raw state set $Q_{\rm init}$ that corresponds to the continuous state regions containing the given initial continuous state from $X_{\rm init}$. We then map $Q_{\rm init}$ to its corresponding set of belief state $\beta(Q_{\rm init})$ and expand this set with its forward reachable states $P_{ij}$. Note that by definition of $\beta$, each expanded state from $P_{ij}$ are distinguishable from the rest as they have different values of $\hat{x}$. This procedure will be repeated until no other new states are added in. We know the procedure will terminate because there are only finitely many states in the belief space abstraction.

The buck converter control problem is then solved as a reach-stay-avoid game on the belief space abstraction with the same specification $\Phi$. Details about the control synthesis algorithm can be found in [16]. The synthesis algorithm will return 1) a wining set $P_{\rm win}\subset P\setminus\{p_{\rm out}\}$ , and 2) a controller $\overline{\overline{C}}:P_{\rm win}\rightarrow 2^{A}$ under which $\Phi$ is satisfied for execution starting from $P_{\rm win}$. If $\beta(Q_{\rm init})\subseteq P_{\rm win}$, we claim the control problem of hybrid automaton $\mathcal{H}$ is solved. Next we give a definition and formally state this result.

Definition 4

Let $\overline{\overline{C}}:P\rightarrow 2^{A}$ be a state feedback controller defined for $TS^{\rm B}$, we call a controller $\overline{C}:Q\rightarrow 2^{A}$ defined for $TS^{\rm R}$ to be “induced” from $\overline{\overline{C}}$ if \overline{C}(q)=\bigcup_{p\in P:q\in\beta^{-1}\big{(}\{p\}\big{)}}\overline{\overline{C}}(p).

Proposition 2

Given any controller $\overline{\overline{C}}:P\rightarrow 2^{A}$ defined on $TS^{\rm R}$, let $\overline{C}$ be the controller induced by $\overline{\overline{C}}$. For any execution $\textbf{q}^{\overline{\textbf{a}}}=q(1)q(2)q(3)\dots$ generated by $TS^{\rm R}$ under controller $\overline{C}$, there exists an execution $\textbf{p}^{\overline{\overline{\textbf{a}}}}=p(1)p(2)p(3)\dots$, generated by $TS^{\rm B}$ under controller $\overline{\overline{C}}$, such that

1. (i)

q(1)\in\beta^{-1}\big{(}\{p(1)\}\big{)}*, * 2. (ii)

\big{|}\textbf{Pref}\big{(}\textbf{w}(\textbf{q}^{\overline{\textbf{a}}})\big{)}\big{|}=\big{|}\textbf{Pref}\big{(}\textbf{w}(\textbf{p}^{\overline{\overline{\textbf{a}}}})\big{)}\big{|}, where $|\textbf{w}|$ is the length of sequence w. 3. (iii)

\forall k:\texttt{target}\notin\lambda\big{(}q(k)\big{)}\Rightarrow\forall k:\texttt{target}\notin\mu\big{(}p(k)\big{)}.

Theorem 2

Suppose a winning set $P_{\rm win}\subseteq P$ and a controller $\overline{\overline{C}}:P_{\rm win}\rightarrow 2^{AP}$ is found for $TS^{\rm B}$, so that any execution $\textbf{p}^{\overline{\overline{\textbf{a}}}}=p(1)p(2)p(3)\dots$ with $p(1)\in P_{\rm win}$, which is generated under action sequence $\overline{\overline{\textbf{a}}}=\overline{\overline{a}}(1)\overline{\overline{a}}(2)\overline{\overline{a}}(3)\dots$ satisfying \overline{\overline{a}}(k)\in\overline{\overline{C}}\big{(}p(k-1)\big{)}, satisfies $\Phi$. Then any execution $\textbf{q}^{\textbf{a}}=q(1)q(2)q(3)\dots$ of $TS^{\rm R}$ started from $q(1)\in Q_{\rm win}\doteq\beta^{-1}(P_{\rm win})$ will satisfy $\Phi$ under control sequence $\overline{\textbf{a}}=\overline{a}(1)\overline{a}(2)\overline{a}(3)\dots$ with \overline{a}(k)\in\overline{C}\big{(}q(k-1)\big{)}.

The proof of Proposition 2 is quite similar to that of Proposition 1 except that 1) we do not need Proj to remove intermediate states during mode 1, and 2) we do not have exact similar prefix in bullet (ii) because \beta^{-1}\big{(}\{p\}\big{)} may contain $q$’s labeled with and without target, in which case $\texttt{target}\notin\mu(p)$ by Algorithm 1. However, bullets (ii) and (iii) still enable a proof of Theorem 2.

In what follows, several remarks are provided.

The first remark is regarding the implementation of the controller $\overline{\overline{C}}$ on the continuous state system in real time. Although controllers $\overline{C}$ and $C$ can be induced from $\overline{\overline{C}}$, the obtained controller $C$ can not be applied to the hybrid system directly because $C$ still requires both $x$ and $\hat{x}$ to make the decision. However, we can use the control structure defined in Fig. 3, which only uses the current value of $\hat{x}$. Let $p(k)$ be the belief state at time $k$, we set $q(1)=q_{\rm init}\in Q_{\rm init}$ where p_{\rm init}=\beta\big{(}\{q_{\rm init}\}\big{)}, and $q_{\rm init}$ is such that the given fully measured continuous state $x_{\rm init}\in R_{q_{\rm init}}$. We then proceed as follows:

first, we apply action $a(1)$, which can be any element in \overline{\overline{C}}\big{(}p(1)\big{)}, to the continuous state system; 2. 2)

meanwhile, we need to compute the set \sigma\big{(}p(1),a(1)\big{)} of possible next states on the belief space abstraction; 3. 3)

since the states in \sigma\big{(}p(1),a(1)\big{)} are distinguishable with $\hat{x}$, we can determine the actual next state $p(2)$ using the current value of $\hat{x}$; 4. 4)

then we arbitrarily pick control action $a(2)$ from set \overline{\overline{C}}\big{(}p(2)\big{)}, and proceed by repeating steps 2) and 3).

In other words, we need not only the measurement $\hat{x}$, but also \sigma\big{(}p(k),a(k)\big{)} to determine control action $a(k+1)$. Hence the controller requires memory. The correctness of the control structure presented in Fig. 3 can be proved by Theorem 1 and 2, noticing that the control actions at any $[x,\hat{x}]^{T}$ and $t_{\rm d}$ given by this structure is a subset of $C(x,\hat{x},t_{\rm d})$, where $C$ is induced from $\overline{C}$ and $\overline{C}$ is induced from $\overline{\overline{C}}$.

The second remark is about winning set $P_{\rm win}$. Although the belief space abstraction is specific to initial condition $q_{\rm init}$, the obtained controller also works if the system starts from any state $q\in\beta^{-1}(P_{\rm win})$, as a result of the suffix-closedness of $\Phi$ (i.e., $\textbf{w}\models\Phi\Rightarrow\textbf{w}_{k}\models\Phi$ for all $k$).

III-C Belief Space Size Reduction

First, in line 10 of Algorithm 1, if $p_{\rm out}\in P_{ij}$, then we can simply set $P_{ij}=\{p_{\rm out}\}$. Such replacement is valid because going outside of the continuous state domain is considered unacceptable. If $p_{\rm out}\in P_{ij}$, the other states from $P_{ij}\setminus\{p_{\rm out}\}$ will not help solving the synthesis problem but only lead to belief space blow up.

Secondly, note that the reachable set $\textbf{Reach}(R_{q}^{x},a)$ is always a convex set (in fact, it is always a polytope), this suggests that we will not have any belief state $p=(S,\hat{x})$ with a “disjoint” $S$. Also note that $S$ can be overapproximated by $\{x_{1}^{i}\mid\underline{i}\leq i\leq\overline{i}\}\times\{x_{2}^{j}\mid\underline{j}\leq j\leq\overline{j}\}$. Therefore, instead considering P\subseteq\big{(}\{x^{1},x^{2},\dots,x^{N}\}\times\{\hat{x}^{1},\hat{x}^{2},\dots,\hat{x}^{N}\}\big{)}\cup\{p_{\rm out}\}, we only need to consider P\subseteq\big{(}\{x^{1},x^{2},\dots,x^{N}\}\times\{\hat{x}^{1},\hat{x}^{2},\dots,\hat{x}^{N}\}^{2}\big{)}\cup\{p_{\rm out}\}. Moreover, $\hat{x}_{1}$ can be omitted as it only mismatches $x_{1}$ during mode 1, within which all transitions are autonomous and no control decision is taken. Thus the belief space can be further reduced to P\subseteq\big{(}\{x^{1},x^{2},\dots,x^{N}\}\times\{\hat{x}_{2}^{1},\hat{x}_{2}^{2},\dots,\hat{x}_{2}^{M}\}^{2}\big{)}\cup\{p_{\rm out}\}, where $\{\hat{x}_{2}^{1},\hat{x}_{2}^{2},\dots,\hat{x}_{2}^{M}\}$ is the grid along $\hat{x}_{2}$ axis.

IV Simulation Results

We apply the developed approach to the buck converter problems. An alternative design based on a simple open-loop periodic switching rule is used for comparison. The desired range of system states are picked as follows: $X=[0,80]\times[0,25]$, with target $X_{\rm target}=[0,80]\times[24,25]$. The specified initial condition is $x_{1}=0,x_{2}=0$.

IV-A Baseline Approach

We first present a simpler baseline solution approach which only leads to a periodic switching rule that steers the converter voltage into the target range. Since the on-off duration of the switching rule is fixed, this is an open-loop control strategy which does not require any state measurements. As will be shown later, however, such open-loop periodic switching leads to undesired transient behavior before the state stabilizes around the target.

Let $N_{\rm on}=N_{\rm dwell}$ be the fixed on-mode duration and $N_{\rm off}$ be the off-mode duration to be determined. Also let $N_{\rm p}=N_{\rm on}+N_{\rm off}$ be the number of steps of one on-off period. The dynamics of the converter’s “periodic behavior” under such switching rule can be captured by the following higher-dimensional system:

[TABLE]

where $\overline{A}_{k}=\prod_{i_{k}=1}^{N_{\rm p}}A_{i_{k}}$, $\overline{K}_{k}=\sum_{j_{k}=1}^{N_{\rm p}-1}\prod_{i_{k}=1}^{N_{\rm p}}A_{i_{k}}K_{j_{k}}+K_{N_{\rm p}}$, and

[TABLE]

Since $N_{\rm on}=10$ is fixed, the objective is to determine $N_{\rm off}$ so that the system in Eq. (40) is asymptotically stable around its equilibrium $\xi_{\rm eq}$ (i.e., $(I-\textbf{A})\xi_{\rm eq}=\textbf{K}$), and all the $x$ fragment in $\xi_{\rm eq}$ fall in the corresponding target range. To achieve this, we do a line search on $N_{\rm off}$ and pick $N_{\rm off}=35$.

Fig. 4 shows the resulting behavior under the open-loop periodic switching rule. It can be seen that the true state $x$ eventually converges into the desired range $X_{\rm target}$, but it experiences a large overshot before stabilizing around the periodic steady state behavior. Such large overshot is undesirable and can risk safety. This also suggests the necessity of specifying the desired system behavior with temporal logic (e.g., staying within the target once arrived, never going into unsafe region, etc), rather than just requiring stability.

IV-B Proposed Approach

We apply the proposed solution approach to the buck converter control problem and obtained a controller. Fig. 5 shows the simulation result of the closed loop system. The top plot shows the current $x_{1}$ and its measurement $\hat{x}_{1}$. The two variables have very close values and can be hardly distinguished from the plot. The middle plot shows the voltage $x_{2}$ and its measurement $\hat{x}_{2}$. It can be seen that $x_{2}$ converges to the target interval in finite time and stays within the interval once there. The bottom plot shows the switching signal. The update of $\hat{x}_{2}$ is consistent with the switching signal. We also observe that the switching sequence has a periodic behavior at the steady state (i.e., after settling down in the target interval). This is the result of fixed on-mode dwell time, and some control action selection heuristic, i.e., we select the control actions that are more likely to maintain the previous on-off switching pattern whenever there are multiple actions suggested by the controller.

Next we report the result of belief space size reduction. Without any reduction, the total number of belief space abstraction contains $3.43\times 10^{15}$ states. After omitting the measurement $\hat{x}_{1}$, as explained in Section III-C, the number of states reduces to $3.19\times 10^{6}$. The number is further reduced to $6.59\times 10^{4}$ after replacing the arbitrary subset construction by the disjoint subset construction (see Section III-C).

V Conclusions

The contributions of this paper are twofold. First, we developed a hybrid automaton model for constant-on time buck converter that integrates the circuit model with physical requirements. Second, we proposed a belief space abstraction-based control synthesis scheme for the buck converter with event-triggered measurements that guarantees satisfaction of functional requirements. The correctness of the control synthesis scheme is analyzed and the resulting controller is shown to outperform a baseline design on a simulation example. Ideas exploiting the problem structure to reduce complexity and conservatism are presented, which we believe can be relevant in other application domains as well.

Although the abstraction (hence the controller) size is modest compared to the abstractions in other real applications, the practical implementation still requires to further simplify the control law. We will consider extracting a simplified switching rule from the obtained correct-by-construction controller and testing it on hardware as part of our future work.

Appendix

V-A Proof of Proposition 1

Proof:

Let $C,\overline{C},\textbf{x}^{\textbf{a},\textbf{d}}$ be defined as in Proposition 1, we now construct $\overline{\textbf{a}}$ and $\textbf{q}^{\overline{\textbf{a}}}$ that satisfy bullets (i) and (ii). To this point, we set $q(1)$ to be such that $[x(1),\hat{x}(1)]^{T}\in R_{q(1)}$. With $t_{\rm d}=N_{1}$, this implies C\big{(}x(1),\hat{x}(1),t_{\rm d}\big{)}=\overline{C}\big{(}q(1)\big{)}. Then we evolve $TS^{\rm R}$ under $\overline{C}$ starting from $q(1)$, and show that this can lead to $\overline{\textbf{a}}$ and $\textbf{q}^{\overline{\textbf{a}}}$ that satisfy bullet (ii) by induction. As the induction step, we assume that $[x(k),\hat{x}(k)]^{T}\in R_{q(k^{\prime})}$, $t_{\rm d}=N_{1}$ and C\big{(}x(k),\hat{x}(k),t_{\rm d}\big{)}=\overline{C}\big{(}q(k^{\prime})\big{)}. If a=2\in C\big{(}x(k),\hat{x}(k),t_{\rm d}\big{)} and $a(k)=2$ is used, by Eq. (22)-(24), we know that there exists q(k^{\prime}+1)\in\tau\big{(}q(k^{\prime}),2\big{)} s.t. $[x(k+1),\hat{x}(k+1)]^{T}\in R_{q(k^{\prime}+1)}$ and $t_{\rm d}$ remains to be $N_{1}$. If a=1\in C\big{(}x(k),\hat{x}(k),t_{\rm d}\big{)} and $a(k)=1$ is used, by Eq. (18)-(20), there exists q(k^{\prime}+1)\in\tau\big{(}q(k^{\prime}),2\big{)} s.t. $[x(k+N_{1}),\hat{x}(k+N_{1})]^{T}\in R_{q(k^{\prime}+1)}$ and \lambda\big{(}q(k^{\prime}+1)\big{)}=\ell\big{(}x(k+N_{1})\big{)} due to the proposition preserving property of the partition. During time steps from $k$ to $k+N_{1}$, $t_{\rm d}$ will be reset to zero and recount to $N_{1}$. Since $C$ is admissible to $\mathcal{H}$, we know that $a(k+1),\dots,a(k+N-1)=1$ will be removed by Proj. Hence \ell\big{(}x(k+1))\dots\ell\big{(}x(k+N-1)\big{)} will also be removed, and we have \textbf{Proj}\big{(}\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})\big{)}=\textbf{w}(\textbf{q}^{\overline{\textbf{a}}}). In the case that $\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})\models\Phi_{\rm safety}$, this concludes the induction step because in this case, we have $q(k)\neq q_{\rm out}$ for all $k$ and BPref is just identity mapping for both $\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})$ and $\textbf{w}(\textbf{q}^{\overline{\textbf{a}}})$. In the case that $\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})\not\models\Phi_{\rm safety}$, the above induction can last until the first violation of $\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})\not\models\Phi_{\rm safety}$ (see Definition 2) that occurs at $k=k^{\ast}$. In this case $q((k^{\ast})^{\prime})=q_{\rm out}$ by Eq. (15) and (21), where $(k^{\ast})^{\prime}$ is defined similar to that in the above induction. Recall that $\texttt{safe}\notin\lambda(q_{\rm out})$, \textbf{Pref}\big{(}\textbf{w}(\textbf{q}^{\overline{\textbf{a}}})\big{)} is the prefix of $\textbf{w}(\textbf{q}^{\overline{\textbf{a}}})$ until $(k^{\ast})^{\prime}-1$ position. Hence \textbf{Proj}\Big{(}\textbf{BPref}\big{(}\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})\big{)}\Big{)}=\textbf{BPref}\big{(}\textbf{w}(\textbf{q}^{\overline{\textbf{a}}})\big{)}. ∎

V-B Proof of Theorem 1

Proof:

Let $C,\overline{C},Q_{\rm win},\textbf{a},\textbf{x}^{\textbf{a},\textbf{d}}$ be defined as in Theorem 1. By Proposition 1, there exists $\overline{\textbf{a}}$ and $\textbf{q}^{\overline{\textbf{a}}}$ satisfy the two bullets. By bullet (i), we know that $q(1)\in Q_{\rm win}$. Moreover, by definition $\overline{\textbf{a}}$ and $\textbf{q}^{\overline{\textbf{a}}}$ is such that \overline{a}(k)\in\overline{C}\big{(}q(k)\big{)}. This implies that $\textbf{w}(\textbf{q}^{\overline{\textbf{a}}})\models\Phi$, that is, $\textbf{w}(\textbf{q}^{\overline{\textbf{a}}})\models\Phi_{\rm safety}$ and $\textbf{w}(\textbf{q}^{\overline{\textbf{a}}})\models\Phi_{\rm liveness}$.

First, $\textbf{w}(\textbf{q}^{\overline{\textbf{a}}})\models\Phi_{\rm safety}$ means that \textbf{BPref}\big{(}\textbf{w}(\textbf{q}^{\overline{\textbf{a}}})\big{)}=\textbf{w}(\textbf{q}^{\overline{\textbf{a}}}) is an infinite sequence. Then we know by bullet (ii) that \textbf{BPref}\big{(}\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})\big{)} must also be infinite and hence $\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})\models\Phi_{\rm safety}$. This also gives \textbf{BPref}\big{(}\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})\big{)}=\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}}). 2. 2)

With $\textbf{w}(\textbf{q}^{\overline{\textbf{a}}})\models\Phi_{\rm liveness}$ and \textbf{BPref}\big{(}\textbf{w}(\textbf{q}^{\overline{\textbf{a}}})\big{)}=\textbf{w}(\textbf{q}^{\overline{\textbf{a}}}) from 1), we have \textbf{BPref}\big{(}\textbf{w}(\textbf{q}^{\overline{\textbf{a}}})\big{)}\models\Phi_{\rm liveness}\Rightarrow\textbf{Proj}\Big{(}\textbf{BPref}\big{(}\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})\big{)}\Big{)}\models\Phi_{\rm liveness} by bullet (ii). This further implies $\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})\models\Phi_{\rm liveness}$ because \textbf{BPref}\big{(}\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})\big{)}=\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}}) and $\textbf{Proj}(\textbf{w})\models\Phi_{\rm liveness}\Rightarrow\textbf{w}\models\Phi_{\rm liveness}$.

Finally we have $\textbf{w}(\textbf{x}^{\textbf{a},\textbf{d}})\models\Phi_{\rm safety}\wedge\Phi_{\rm liveness}=\Phi$. ∎