CAD.4:4 - Solution
CAD.4:4.1 - Form complete candidates
Use C.39 to connect the required result to its supplying operations and C.32/SYSE.6 to retain whole alternatives. A candidate specifies the decomposition, model and its operating domain, exchanged command, timing and reset semantics, controller law, feasible command domain, planning continuation and implementation resources.
Keep architecture choices separate from tunable parameters without pretending that the separation is absolute. The number of layers, model order, kind of command, sampling periods, planning horizon and processor arrangement can change the problem being solved. Gains, weights and numeric tolerances tune a selected construction. Changing either group can reopen the other.
CAD.1–CAD.3 supply the positive construction, not merely a screening list. Existing qualified results can replace repeated design work. If the interface law changes, the old error bound is not a reusable result for that new law.
CAD.4:4.2 - Evaluate feasibility before ranking attractive scores
For each candidate, establish the connected error behavior, physical constraints and continuation under its own admitted conditions. Include initialization, transitions, planned modes and fallback behavior. A candidate with a missing load-bearing condition is unresolved, not numerically inferior.
Then evaluate the behavior the task actually values: tracking envelope, settling, progress, resource consumption, disturbance rejection or cost. Use the same demand and perturbation class across candidates. An average objective cannot compensate for violating a hard constraint.
Boundedness and convergence are distinct. For example, if the nominal law makes z_k\to z_* and v_k\to v_*, the linear error equation has forcing g_k=Hz_k+Gv_k+w_k. With a contractive F, g_k\to0 implies e_k\to0: the contribution of any fixed finite past decays, and the remaining tail is bounded by its shrinking forcing divided by 1-q. If Hz_*+Gv_*\neq0, even zero disturbance can leave a steady bias. A bounded command domain alone establishes neither nominal progress nor zero error.
When the performance claim requires optimality, robust stability or task completion beyond these arguments, supply the corresponding result for the actual connected model. Do not infer it from the presence of MPC, a Lyapunov function for one component, or an optimizer’s successful return.
CAD.4:4.3 - Include execution in the design equations
Use MMP.22 to turn the mathematical operation into a workable computation. Identify the data needed when the operation starts, the work that can be prepared ahead, the result required at its deadline, and what must happen if it is unavailable.
A necessary timing comparison is
C_{\mathrm{fast}}\leq T_{\mathrm{fast}},\qquad C_{\mathrm{plan}}\leq T_{\mathrm{plan}},
where C bounds execution under the selected implementation. These isolated inequalities are not sufficient on a shared processor: blocking, interference, communication and scheduling must fit the deadlines together. An operation count or mean runtime is not a worst-case execution bound.
If planning finishes one period after its observation, model that delay and the command that controls the intervening period. Preparing a future segment can make the delay harmless for a predetermined reference but not automatically for a newly observed obstacle. Increasing the processor speed changes the feasible architecture set; increasing the assumed speed in a spreadsheet does not.
Use the implementation to test unit conversions, numerical tolerances, update order, saturation and reset behavior. A numerical optimizer’s constraint tolerance belongs in the margin analysis if it can consume physical clearance. Verify that the lower law actually executed is the law used in CAD.2.
If an online solver returns only a partial iterate, separate the time spent solving from the test that permits applying its output. A qualified acceptance rule may allow a feasible inexact result and otherwise keep an admissible prior command or plan. Include the cost of that test and the conditions for progress; a timeout says nothing about admissibility, and feasibility alone does not establish progress. The command-governor alternative in :11 is one developed construction, not a fallback rule for every optimizer.
CAD.4:4.4 - Search jointly, with bounded conclusions
A practical first search can enumerate a small number of architecture choices and, within each, solve or tune the continuous parameters. Recompute the error and command domain for every material change. Reject a setting whose necessary constraints fail; retain unresolved settings separately from feasible ones.
Compare feasible candidates through task-relevant trade-offs and costs. Do not collapse incompatible obligations into an invented scalar score. A Pareto comparison can expose choices where one candidate is faster but more resource intensive. If the search covered only a grid, selected controller class or local optimizer, state that reach; it does not prove global architectural optimality.
Investigate the active limitation. If actuator reserve fails, altering the reference interface may help more than enlarging the processor. If timing fails, a reduced model or shorter horizon may help more than increasing gain. If a reduced model loses an important mode, a larger controller budget may be unavoidable. This is the constructive feedback from the whole evaluation to CAD.1–CAD.3.
CAD.4:4.5 - Qualify the realization and its revision conditions
Separate mathematical consequence, model qualification and implementation observation. Simulation can reveal an omitted mode or a bad reset. Tests on the target execution arrangement can expose deadline misses. Physical experiments can challenge the model, disturbance envelope and actuator assumptions. None automatically establishes every other claim.
Before relying on the design, identify the operating conditions that support it and the observations that can invalidate them. Examples are a larger reference jump, changed disturbance envelope, delayed sensor, actuator derating, altered model order or shared computing load. Reopen the specific equation, inclusion or comparison using the changed premise.
Choose detection and fallback behavior for the actual failure mode. A reference hold is justified in the running model because it lies within the admitted command class; in another plant it may be unsafe or mission-defeating. For an unexplained timing overrun or model residual beyond the admitted W, stop claiming the old bound and use only a separately qualified response.
The resulting control architecture returns to SYSE.6 with its feasible domain, performance, resource needs and unresolved constraints. That system decision can change sensors, actuators, plant structure or requirements rather than forcing every problem into controller tuning.