CAD.3:4 - Solution

CAD.3:4.1 - Construct an invariant error set

For the linear interface of CAD.2, write

e^+=Fe+Hz+Gv+w.

Choose a proposed command set S of pairs (z,v), a bounded mismatch set W, and an error set E containing the admitted initial error. A sufficient one-step condition is

FE\ \oplus\ \{Hz+Gv:(z,v)\in S\}\ \oplus\ W\ \subseteq E.

Here \oplus is addition of sets. This is a property to establish, not a consequence of naming E an error tube. Substitution and induction then keep the error in E for every permitted command sequence. Preserve correlations between z and v when they materially reduce conservatism; replacing S by a Cartesian product can enlarge the forcing unnecessarily.

One usable construction takes a positive-definite M and the norm \|e\|_M=\sqrt{e^\mathsf{T}Me}. Verify

q=\|M^{1/2}FM^{-1/2}\|_2<1,\qquad d\geq\sup_{(z,v)\in S,\ w\in W}\|Hz+Gv+w\|_M.

The triangle inequality gives \|e^+\|_M\leq q\|e\|_M+d. Therefore

E=\{e:\|e\|_M\leq\varepsilon\},\qquad \varepsilon\geq\max\{\|e_0\|_M,d/(1-q)\}

is invariant. For a stable fixed F, a positive-definite solution of a discrete Lyapunov equation is a candidate M; verify the displayed norm inequality for the actual values used. Failure of this sufficient construction does not prove that no controller or invariant set exists.

For multiple timing modes, one sufficient condition for arbitrary admissible switching is a common set E containing the initial error and preserved by every admitted mode and reset map. This includes resets caused by a changed reference or error coordinate. Each step then starts in the same E, so induction covers any admitted sequence.

Separate invariant sets for the frozen modes are not sufficient by themselves. With mode-dependent or within-period phase sets E_i, prove that every allowed transition from mode or phase i to j, including its reset, sends the admitted part of E_i into E_j for all admitted commands and disturbances. Include initialization and the evolution within each phase. A boundary-map proof can use this construction, but a bound only at period boundaries leaves the intermediate phases uncovered.

CAD.3:4.2 - Translate error into planner and actuator constraints

With x=Pz+e and u=Qz+Rv+Ke, require

Pz+E\subseteq X,\qquad Qz+Rv+KE\subseteq U.

These constraints reserve physical room and actuator authority for correction. For an output constraint use the actual output map, including the mismatch term in CAD.2:4.1.

For example, if X=\{x:Lx\leq b\} and E is the ellipsoid above, each row must satisfy

L_iPz+\varepsilon\sqrt{L_iM^{-1}L_i^\mathsf{T}}\leq b_i.

If U=\{u:Du\leq f\}, the input row becomes

D_i(Qz+Rv)+ \varepsilon\sqrt{D_iKM^{-1}K^\mathsf{T}D_i^\mathsf{T}}\leq f_i.

Thus the amount of tightening comes from the connected dynamics and geometry. It is not a universal safety percentage.

Enforce these conditions at every instant covered by the claim. If z evolves between slow updates, an upper constraint checked only at those updates does not bound Qz at every fast instant. Propagate the nominal trajectory or bound its intermediate states. Continuous-time constraints require a continuous evolution argument, not denser-looking sampled plots.

CAD.3:4.3 - Close the dependence between commands and error

The proposed command domain determines d, while the resulting E restricts the command domain. Solve this compatibility deliberately. Start with a desired command envelope, construct a valid E, then test the actual state and input inclusions. If they fail, choose a smaller envelope or change the interface, gains, model or timing, and repeat the affected derivation.

A more direct formulation searches for S and E satisfying the error inclusion and the physical constraints together. For finite-dimensional parameterizations this can be an optimization or feasibility problem. No generic solver or convergence guarantee follows from writing that problem.

Do not treat repeated tightening as automatic convergence. A mapping that sends candidate planning sets to newly permitted sets can reverse inclusion: larger commands produce larger errors and smaller permitted commands. Alternating bounds may remain separated. Establish a nonempty self-consistent pair and its inclusions; do not use a numerically stationary iteration as the proof.

When a bound is conservative, try retaining command correlation, phase-dependent sets or a better model before weakening a hard constraint. For a fixed qualified loop, compare a joint state-command admissible set with the separate command and error envelopes used here; CAD.Reference:4.5.1 gives the governor entry, and :11 identifies a construction using time-dependent estimation bounds. Establish its successor conditions for the actual command rule before replacing this sufficient construction. If the required command is physically impossible, return that incompatibility to the system requirement or architecture decision.

CAD.3:4.4 - Construct a continuation, not only one permitted command

A permissible pair (z,v) must also lead somewhere from which work can continue. For the nominal update z^+=A_pz+B_pv, seek a set Z such that every admitted z has at least one permitted v with z^+\in Z.

One direct construction repeatedly removes states without such a successor:

Z_{n+1}= \{z\in Z_n:\exists v,\ (z,v)\in S,\ A_pz+B_pv\in Z_n\}.

An exact fixed point is controlled invariant under the stated model. A finite iteration gives an outer candidate, not automatically an invariant set; test the successor condition before relying on it. Gridding a continuous set needs an approximation-error argument.

An alternative is to exhibit a smaller terminal set T and an explicit admissible terminal law. A finite plan ending in T then has a feasible continuation by appending that law. For receding-horizon use, the standard shift argument also needs the actual next nominal state, retained feasible tail, modeled uncertainty and implementation to match the argument. A measurement-based reset must preserve the initialization and feasibility conditions or use an independently qualified recovery.

If a new optimization fails or misses its deadline, continuing a previously feasible tail can be legitimate only while its assumptions still hold. “Use the previous plan” is not a universal fallback.

CAD.3:4.5 - Use a continuous-time branch only with its stronger premises

Let D be the domain of the connected continuous state on which the model and the bounds below apply, including the reference and any controller state on which the argument depends. Start the trajectory in D and suppose a differentiable function V satisfies, throughout D under the admitted input law,

V\geq c_e\|x-Pz\|^2,\qquad \dot V\leq-\alpha V+\beta\|w\|^2,

with positive c_e,\alpha, nonnegative \beta, and \|w(t)\|\leq\bar w. Let \tau_D be the first exit time from D, with \tau_D=\infty if there is no exit. For every 0\leq t<\tau_D on which the solution exists, integration gives

V(t)\leq e^{-\alpha t}V(0) +\frac{\beta\bar w^2}{\alpha}(1-e^{-\alpha t}).

Consequently \|x-Pz\|\leq\varepsilon on that interval, where \varepsilon^2=\max\{V(0),\beta\bar w^2/\alpha\}/c_e. If h is Lipschitz with constant L_h on a state domain containing both x(t) and Pz(t), requiring h(Pz(t))\geq L_h\varepsilon implies h(x(t))\geq0 on the same interval.

To claim the conclusion for all future time, separately establish continued existence and containment of the connected trajectory in D under the allowed reference evolution and disturbances, for example through a forward-invariant subset of D containing the admitted initial states. A tracking-error bound alone does not prevent the reference and plant from leaving the region where the derivative or Lipschitz bound is valid.

This is a sufficient construction for a particular connected dynamics and admissible input law. Obtain V and verify its derivative, domain, actuator feasibility and treatment of the moving reference; their existence is not supplied by the formula. Sampling, estimation, saturation and delay must either occur in that dynamics or be covered by its perturbation bound.

CAD.3:4.6 - Separate recognition, mathematical assurance and physical reliance

A shrinking error trace or plausible margin recognizes a promising design. The invariance and continuation arguments establish conditional properties of a mathematical model. Model validation, parameter and disturbance bounds, execution timing and physical tests determine whether those properties support the intended engineering use.

A decrease condition that applies only outside a threshold does not, in discrete time, prevent a jump from inside to outside. Use an actual invariant-set inclusion or a one-step bound valid on the entire proposed set. Likewise, a small average error is not a worst-case constraint bound.