B. Design a planning-and-feedback architecture

CAD.1 - Derive a Control Decomposition from the Whole Problem

Type: Method pattern Status: Stable

CAD.1:1 - Problem frame

Use this when a control problem seems to call for different planning and reaction times, but “add a strategic, tactical and operational layer” does not tell you which decisions belong where. You may also have an inherited hierarchy whose purpose is no longer clear.

Start by writing one consequential behavior that the entire closed loop must produce, together with the available observations, actuators and execution limits. Then identify the decision that prevents a direct solution. The first useful result is a candidate split and an account of what its parts must jointly preserve.

If one qualified controller already meets the task and implementation constraints, retain it. Layering needs an identified benefit; it is not a requirement for accuracy or sophistication.

CAD.1:2 - Problem

A hierarchy can divide a diagram while leaving the original difficulty untouched. A planner assumes commands can be realized, a tracker assumes commands change slowly, and neither assumption follows from the split. Conversely, trying to solve every decision at the fastest rate can make a good control formulation impossible to execute.

The design problem is to change the organization of decisions while retaining enough of their interactions to obtain the required behavior.

CAD.1:3 - Forces

CAD.1:4 - Solution

CAD.1:4.1 - Formulate the unsplit question

State the controlled quantities, objective or preference, hard constraints, operating domain, relevant disturbances, measurements and available actions. Distinguish three time quantities: the dynamics and disturbance times, the horizon over which a choice matters, and the time needed to obtain and execute that choice. A fast update is useful only if observations, computation and actuation support it.

Use a centralized mathematical formulation when it helps reveal coupling, even if that formulation is too expensive to run. It can be a finite-horizon objective with dynamics and constraints, a reach-and-avoid problem, or a reference-following requirement. It is the common comparison basis, not a promise that one optimizer must solve everything.

Retain a feasible simple controller as a baseline where available. State what it cannot achieve at acceptable effort: for example obstacle look-ahead, preview-dependent economy or long-horizon allocation. If the baseline’s actual limitation is unknown, test that uncertainty before adding layers.

When a qualified existing loop has adequate tracking and disturbance rejection but requested commands violate constraints, compare adding a reference or command governor before redesigning that loop. Use the joint plant-controller model, admissible initial conditions and qualified command-update rule described in CAD.Reference:4.5.1. Check whether the resulting command delay or distortion still meets the task. If it does, retain that candidate; if it does not, identify the unmet requirement that a different interface, planner or controller must address.

CAD.1:4.2 - Separate decisions because their information and effects differ

For each consequential decision, ask what it changes, which information it needs, how long its effect persists, how quickly a wrong choice becomes harmful, and what resources its computation consumes. Cluster decisions only when those answers support one useful calculation or law.

A slow planning decision might choose a route, reference segment or allocation. A faster decision might reject local disturbance or track that reference. This does not imply that the faster model is less detailed: a low-level model may retain actuator dynamics omitted by a planning model.

Generate materially different candidates. Compare a single loop, a planning-and-feedback split, or another separation motivated by the problem. Do not add a third layer merely because the source diagram contains three. A communication boundary can matter more than a time-scale boundary, and a faster processor can make a proposed split unnecessary.

CAD.1:4.3 - Expose what the split removes

A useful way to derive a candidate is to introduce separate variables for decisions that were coupled in the whole problem. Initially constrain them to agree. For example, let a planner choose a nominal trajectory z while the plant state is x; keep the relation that says what plant behavior z represents. Only then relax that relation to obtain separately solvable subproblems.

For each relaxation, recover its price. Replacing equality by tracking allows an error; removing full dynamics requires a realizability condition; replacing continuous interaction by periodic exchange introduces stale information and intersample evolution. Removing future disturbance information requires a prediction or uncertainty treatment. These are concrete missing relations, not a generic “integration risk”.

Use MMP.9 when reduction is involved: derive the retained evolution and identify terms depending on omitted state, past inputs or unresolved quantities. A term does not disappear because the upper model has fewer states. Decide whether it is retained through memory, bounded as mismatch, supplied by a lower closed loop, or left as an unresolved limitation.

The first candidate is complete enough to continue when every removed interaction has a proposed receiving treatment in CAD.2 or CAD.3. A treatment may fail; naming it does not establish it.

CAD.1:4.4 - Make the slow decision account for fast consequences

Do not optimize the slow part as if the faster part were free. Eliminate or approximate the fast response inside the slow objective when the model permits it.

For example, suppose a particular linear design starts at x = 0 and keeps x at zero by choosing a fast action f after observing w, while a slow action s remains fixed for a block. If the fast input matrix is invertible, the required correction is

f=-B_f^{-1}(B_s s+w).

Substitution gives a slow objective containing both the cost of s and the anticipated cost of these corrections. With a block of k forecast values, a possible norm-cost objective is

k\|s\|_s+\sum_{i=1}^{k}\|B_f^{-1}(B_s s+\widehat w_i)\|_f.

This is a derivation under a particular model, not a general recipe for plants with saturation or delay. When fast actions are limited, retain their feasibility condition as well as their cost. When an exact elimination is unavailable, use a qualified response model, a bound or joint optimization; label the remaining approximation and compare the actual combined result.

CAD.1:4.5 - Preserve the whole question through the next design move

Pass each candidate’s controlled behavior, separation reason and lost interactions to CAD.2. A command’s type alone is insufficient: a target position, a timed trajectory and a velocity segment imply different lower-level problems.

Keep candidates comparable under the same task, disturbance class and resource limits. A slower update with a smaller demanded reference change may look better only because the task was weakened. Retain a whole alternative until its decisive incompatibility or disadvantage is understood.

CAD.1:5 - Archetypal Grounding

A constructed actuator model is x_{k+1}=x_k+u_k, with |x|\leq1 and |u|\leq0.06. An existing fast law follows a reference. A planning calculation takes two fast sampling periods on a dedicated resource, so it cannot produce a new result every fast tick. Planning remains useful because it chooses future reference segments; the fast law supplies inexpensive execution.

One candidate sends a new held value every four ticks. Another sends a timed segment whose intermediate values the fast task can generate. They differ in the interaction removed by planning: the first assumes a jump can be tracked within the input limit; the second assumes a known continuous segment and a reliable clock. CAD.2 derives those consequences. Neither candidate has yet earned a safety claim.

As a non-use case, suppose the only task is stabilization around one fixed equilibrium and the existing fast law meets every limit. A slow planner adds no demonstrated decision benefit; keep the simpler controller.

CAD.1:6 - Bias-Annotation

Organizational hierarchies and biological analogies make layered pictures persuasive. They do not determine a control decomposition. The linear example favors a tractable model; nonlinear or partially observed plants can require a different split and different assurance.

CAD.1:7 - Conformance Checklist

• The unsplit behavior, constraints, information and resource conditions are recoverable.
• Each separation has a decision-specific reason and a serious alternative.
• Removed interactions have explicit receiving treatments or remain visible gaps.
• Slow choices include material fast consequences.
• The compared candidates serve the same demand.

CAD.1:8 - Common Anti-Patterns and How to Avoid Them

“Slow is accurate; fast is inaccurate” merges optimization quality, model fidelity and tracking error. State the quantity and comparison. “Three layers are necessary” replaces construction with a diagram; derive only the separations the problem needs. A planner that ignores actuator feasibility hands its original problem to the tracker; retain that interaction in the next construction.

CAD.1:9 - Consequences

The result is a smaller set of explainable architecture candidates. Some apparently attractive splits will be rejected before controller tuning. The cost is retaining the original problem long enough to compare whole behavior instead of judging each box independently.

CAD.1:10 - Architectural Rationale

The method starts from coupled behavior because a decomposition is a change to that coupling. Introducing agreement before relaxing it makes the lost condition recoverable. This gives later error and feasibility work a specific obligation rather than an open-ended request to integrate components.

CAD.1:11 - SoTA-Echoing

When should the decisions be separated? The selected line derives the split from the whole problem and keeps a qualified existing loop, with a governor if needed, and a single constrained controller as serious alternatives in :4.1–4.3. Separation earns its additional interface and assurance work when differences in information, prediction horizon or execution resources prevent those simpler arrangements from meeting the same demand. If a single MPC formulation can retain the relevant coupling and meet the deadline, decomposition still has to offer a gain that outweighs maintaining its interfaces.

The method adopts the problem-decomposition and coupling-relaxation move in Matni, Ames and Doyle, §2.2, while treating its particular layer arrangement as a choice. It adapts Goel, Chen and Wierman’s construction, §§II–IV in :4.4 to include fast consequences in the slow decision. That fixed two-rate, prediction-dependent cost result does not select a layer count or cover actuator limits. The corresponding price is explicit here: a split that saves computation still owes an error and feasibility construction.

A contemporary alternative is to keep the stabilized dynamics fixed and combine online optimization of references with a governor. Nonhoff, Al Torshan and Müller, 2026 preprint, §§II–IV construct this combination for disturbed linear systems under strong convexity of the steady-state costs, compact convex constraints and their bounded-disturbance and initialization assumptions. Their performance statement concerns regret against varying optimal steady states; it is not a solution for arbitrary trajectory or mission objectives. Retain that alternative when changing costs, rather than preview-dependent motion, create the upper decision. The governor comparison in CAD.Reference:4.5.1 explains when the existing loop can remain.

Reopen the split when measured computation, required preview, available observations or permitted command distortion changes. A newly feasible single-loop or governor solution can remove the reason for a larger architecture; a missed task requirement can justify developing it.

CAD.1:12 - Relations

C.39 supplies the general construction of a way to obtain a result; CAD.1 supplies the control-specific decomposition. MMP.9 supplies model reduction. CAD.2 consumes the selected candidate and makes its exchanges operational. CAD.4 compares whole candidates, including the unsplit alternative. SYSE.5 consumes the resulting functional organization when developing the engineered system.

CAD.1:End

CAD.2 - Construct the Planning and Feedback Interface

Type: Method pattern Status: Stable

CAD.2:1 - Problem frame

Use this when a planner and a lower controller have been chosen, but their combined behavior is not determined by their separate models. A reference jump, stale state estimate, model reset or held input may be the event that makes the connection fail.

Start with one command actually received by the lower computation: what quantity it represents, when it applies and how it becomes an actuator action. The first useful result is the connected evolution of plant, planning state and interface error, including the events between updates.

If a qualified interface already supplies this evolution under the current timing and command conditions, reuse it. A diagram or a matching data type is not that result.

CAD.2:2 - Problem

Models can agree at one exchange instant while diverging between exchanges. A planning state can be initialized from the plant without representing every relevant plant state. A controller can track a smooth signal yet fail when the implemented interface replaces it by steps.

The interface must therefore be designed as behavior over time, not just as a list of variables.

CAD.2:3 - Forces

CAD.2:4 - Solution

CAD.2:4.1 - Define the exchanged behavior

Use MMP.18 to establish meanings, units, coordinate frames, observation times, validity intervals and the operation performed between messages. A target, an input, an output trajectory and a constraint are different commands. State which one the lower computation receives.

Choose how the upper model represents the lower behavior. For a planning state z and plant state x, a reconstruction Pz can define an error e=x-Pz. A measured projection z=\Pi x is a different map. Even if \Pi P=I, initializing z=\Pi x leaves e=(I-P\Pi)x, which need not vanish.

If the controlled quantity is y=Cx and the planner predicts y_p=C_pz, then

y-y_p=Ce+(CP-C_p)z.

Output agreement requires the second term to vanish or be included in the bound. State reconstruction, output matching and physical identity are separate questions.

CAD.2:4.2 - Derive the error instead of assuming tracking

For a useful linear branch, express both models at the fast sampling instants:

x^+=Ax+Bu+w,\qquad z^+=A_pz+B_pv.

Here w is an admitted bounded mismatch or disturbance, not a name for all unknown behavior. Select an interface law

u=K(x-Pz)+Qz+Rv.

Substitute x=Pz+e before simplifying. The actual error equation is

e^+=Fe+Hz+Gv+w, \quad F=A+BK,\quad H=AP+BQ-PA_p,\quad G=BR-PB_p.

This calculation makes three design choices visible. K changes error correction; P and Q determine whether the nominal state evolution can match; R determines input matching. Solving H=0 is useful when possible but is not automatically possible or necessary. If it fails, retain Hz and bound or redesign it. A stable F does not remove forced error from H, G or w.

Use MMP.9 to construct and qualify a reduced model before relying on it here. A fitted upper model with unexamined hidden-state memory is not made adequate by a convenient matrix dimension.

CAD.2:4.3 - Add the clock, held values and reset events

Specify the fast interval, slow update interval, which variables evolve between slow updates, and the event order at a shared instant: observation, computation, command acceptance and actuation. Derive the state just before and just after each event.

For example, if z and v are held for N fast steps, first derive the held-z mode by setting A_p=I, B_p=0 in the residual equation. With F, H and G for that mode, repeated substitution gives

e_N=F^Ne_0+\sum_{i=0}^{N-1}F^i(Hz+Gv+w_{N-1-i}).

When the next planning state is z_{\mathrm{new}}, the same physical x gives

e_{\mathrm{new}}=e_N+P(z-z_{\mathrm{new}}).

A reset is thus an error input, even when the tracker is stable. If the planner instead propagates z every fast step, use that evolution in :4.2; do not also treat z as held.

Model a known delay through the state and commands actually available to the controller. Replacing x_k by x_{k-d} changes the law; augmenting the state with the necessary history is one way to derive its dynamics. If an estimator supplies x, include estimation error and its qualification. A full-state result cannot simply be relabeled output feedback.

A variable delay or missed update needs an explicit admissible timing set and an error model covering it. A bound for one fixed period does not establish a bound for arbitrary switching among periods.

CAD.2:4.4 - Return an interface that can be tested and changed

Give CAD.3 the combined evolution, initial-error condition, admissible command class, mismatch class and exact moments at which each required constraint must hold. Retain the meaning and time convention of every exchanged quantity. These are engineering design values; no special record format is required.

A failed error bound has several possible repairs: change the reconstruction, retain an omitted mode, alter feedforward, reduce command jumps, supply an interpolated segment, shorten latency or choose another split. The error equation identifies which change addresses the failure. Do not reflexively raise every update rate.

Test the actual exchange implementation with boundary events: simultaneous update, maximum permitted delay, reset, command reversal and missing command. These tests can falsify the model of the interface; they do not prove its physical assumptions.

CAD.2:5 - Archetypal Grounding

CAD.2:5.1 - A held reference

For the constructed plant x_{k+1}=x_k+u_k, choose

u_k=(1-a)(r_k-x_k),\qquad a=\tfrac12.

With a held reference r, e_{k+1}=ae_k. Let the reference change by \Delta r_j at the start of each N-step block. The error immediately after that change obeys

e_{j+1,0}=a^Ne_{j,0}-\Delta r_j.

For |\Delta r_j|\leq\delta, the interval |e|\leq E is invariant at block starts if

E\geq a^NE+\delta,\quad\text{hence}\quad E=\frac{\delta}{1-a^N}.

It also bounds intermediate fast instants because |a|\leq1. The initialization condition is |e_{0,0}|\leq E. With N=4,\delta=0.1, E=8/75. The reference jump, not instability of the fast law, determines this worst-case envelope.

CAD.2:5.2 - A continuous reference segment

Now let the fast computation generate r from a timed segment and let d_k=r_{k+1}-r_k, with |d_k|\leq v_{\max}. The same plant and gain give

e_{k+1}=ae_k-d_k,\qquad E=\frac{v_{\max}}{1-a}.

The planner can still update every four ticks. What changed is the command trajectory between updates. At v_{\max}=0.05, E=0.1. Segment endpoints must join continuously; an additional jump would add to d and invalidate the bound.

If a new segment is unavailable, holding the current reference gives d=0, which remains within this command class. This is an error-bound argument for that fallback, not evidence that holding position satisfies every mission requirement.

CAD.2:6 - Bias-Annotation

A common output makes unlike models appear interchangeable. Check the mapping and missing dynamics. The linear branch makes exact substitution easy; nonlinear models need the same semantic work but may require set propagation or different Lyapunov constructions.

CAD.2:7 - Conformance Checklist

• The command’s meaning, applicability time and between-update behavior are explicit.
• Projection, reconstruction and controlled-output comparison are distinguished.
• Combined error dynamics include mismatch and every update or reset mode.
• The stated initial set and timing class match the implementation being considered.
• Estimation or delay is represented wherever the law uses it.

CAD.2:8 - Common Anti-Patterns and How to Avoid Them

Matching array dimensions does not match quantities; recover their meanings and maps. Resetting the upper model does not reset the plant; derive the new error. Using a continuous reference in analysis and a held target in code changes the architecture; analyze the implemented exchange. Independent stability of two components does not establish stability of their connection.

CAD.2:9 - Consequences

The interface becomes a design object whose consequences can be calculated and tested. A small change to interpolation or initialization may replace an expensive change to controller bandwidth. The cost is modeling events and time conventions that a block diagram suppresses.

CAD.2:10 - Architectural Rationale

The reconstructed state is a reference for comparing behaviors, not a new physical level. Substitution exposes both the desired correspondence and the residual terms. Making update events part of the same evolution allows feasibility to be established for the connected system.

CAD.2:11 - SoTA-Echoing

Which relation between planning and realization is sufficient to use? For the stated linear branch, the selected construction is an explicit state reconstruction and tracking interface, followed by residual and event equations. It adopts the tracking-law form used by Stamouli, Tsiamis, Morari and Pappas, §3.2, Theorem 1: feedback on the reconstructed-state error with nominal and input feedforward terms. The serious matching-model alternative is a discrete-time simulation-function construction; its usable output-distance guarantee still needs a verified invariant sublevel set, not only decrease outside it. Section :4.2 adapts the law by retaining nonzero nominal mismatch H and bounded w; :4.1 also retains the output-matching residual. These substitutions do not inherit the source theorem: CAD.3 derives the bound for the resulting equation.

This choice makes a failed exact match actionable, at the cost of bounding more forcing and possibly shrinking the usable command domain. If the existing closed-loop model already supports a governor, use that whole model as explained in CAD.Reference:4.5.1; adding a reduced planning model and P is unnecessary unless it supplies a useful decision or computational gain. The held-value and continuous-segment cases in :5 are constructed applications of the residual equation, not interchangeable implementations of one reference.

For partial observations, Castroviejo-Fernandez and colleagues, §§3–6 provide a developed alternative: state and disturbance estimation with time-dependent error bounds for reference governing. Adopt their requirement to carry observer error into constraint predictions when choosing that branch; its extra observer and set computations replace the full-state premise, not merely the notation x. Section :4.3 therefore returns an estimator-based implementation to the connected-dynamics derivation. Reopen the interface when its measured quantities, reconstruction, hold, interpolation, reset or delay changes; compare bounds and computation under the same actual exchange before choosing between these constructions.

CAD.2:12 - Relations

CAD.1 supplies the decomposition and lost interactions. MMP.9 supplies a qualified reduction; MMP.18 supplies exchange and scale compatibility. CAD.3 consumes the derived error and timing modes. CAD.4 returns implementation changes that require this derivation to be reopened. C.30.LCA can then test whether a control-structure view exposes the relations that the construction actually uses.

CAD.5:4.7 supplies the estimate-based version of the interface when exact state is unavailable. It derives the additional forcing from estimation error; the observation model and timing must describe the same implemented loop.

CAD.2:End

CAD.3 - Construct a Jointly Admissible Command Domain

Type: Method pattern Status: Stable

CAD.3:1 - Problem frame

Use this when a connected controller must respect state, output or actuator limits while following commands from another computation. The upper plan may be feasible in its own model while leaving too little authority for correction below.

Start with the actual connected dynamics from CAD.2 and one limiting constraint. Derive the deviation that consumes its margin. The first useful result is a command domain with an invariant error bound and an admissible continuation, or a specific failure that returns the design for revision.

A simulation that stayed within bounds is useful evidence about that run. It is not the invariant command domain constructed here.

CAD.3:2 - Problem

The layers can make mutually inconsistent promises. The tracker guarantees a small error only for modest commands, while the planner assumes that error before restricting its commands. Tightening an upper constraint by an arbitrary tolerance conceals that circular dependence. A feasible first command can also lead to a state from which no later command is feasible.

The construction must close both the simultaneous compatibility question and the continuation question.

CAD.3:3 - Forces

CAD.3:4 - Solution

CAD.3:4.1 - Construct an invariant error set

For the linear interface of CAD.2, write

e^+=Fe+Hz+Gv+w.

Choose a proposed command set S of pairs (z,v), a bounded mismatch set W, and an error set E containing the admitted initial error. A sufficient one-step condition is

FE\ \oplus\ \{Hz+Gv:(z,v)\in S\}\ \oplus\ W\ \subseteq E.

Here \oplus is addition of sets. This is a property to establish, not a consequence of naming E an error tube. Substitution and induction then keep the error in E for every permitted command sequence. Preserve correlations between z and v when they materially reduce conservatism; replacing S by a Cartesian product can enlarge the forcing unnecessarily.

One usable construction takes a positive-definite M and the norm \|e\|_M=\sqrt{e^\mathsf{T}Me}. Verify

q=\|M^{1/2}FM^{-1/2}\|_2<1,\qquad d\geq\sup_{(z,v)\in S,\ w\in W}\|Hz+Gv+w\|_M.

The triangle inequality gives \|e^+\|_M\leq q\|e\|_M+d. Therefore

E=\{e:\|e\|_M\leq\varepsilon\},\qquad \varepsilon\geq\max\{\|e_0\|_M,d/(1-q)\}

is invariant. For a stable fixed F, a positive-definite solution of a discrete Lyapunov equation is a candidate M; verify the displayed norm inequality for the actual values used. Failure of this sufficient construction does not prove that no controller or invariant set exists.

For multiple timing modes, one sufficient condition for arbitrary admissible switching is a common set E containing the initial error and preserved by every admitted mode and reset map. This includes resets caused by a changed reference or error coordinate. Each step then starts in the same E, so induction covers any admitted sequence.

Separate invariant sets for the frozen modes are not sufficient by themselves. With mode-dependent or within-period phase sets E_i, prove that every allowed transition from mode or phase i to j, including its reset, sends the admitted part of E_i into E_j for all admitted commands and disturbances. Include initialization and the evolution within each phase. A boundary-map proof can use this construction, but a bound only at period boundaries leaves the intermediate phases uncovered.

CAD.3:4.2 - Translate error into planner and actuator constraints

With x=Pz+e and u=Qz+Rv+Ke, require

Pz+E\subseteq X,\qquad Qz+Rv+KE\subseteq U.

These constraints reserve physical room and actuator authority for correction. For an output constraint use the actual output map, including the mismatch term in CAD.2:4.1.

For example, if X=\{x:Lx\leq b\} and E is the ellipsoid above, each row must satisfy

L_iPz+\varepsilon\sqrt{L_iM^{-1}L_i^\mathsf{T}}\leq b_i.

If U=\{u:Du\leq f\}, the input row becomes

D_i(Qz+Rv)+ \varepsilon\sqrt{D_iKM^{-1}K^\mathsf{T}D_i^\mathsf{T}}\leq f_i.

Thus the amount of tightening comes from the connected dynamics and geometry. It is not a universal safety percentage.

Enforce these conditions at every instant covered by the claim. If z evolves between slow updates, an upper constraint checked only at those updates does not bound Qz at every fast instant. Propagate the nominal trajectory or bound its intermediate states. Continuous-time constraints require a continuous evolution argument, not denser-looking sampled plots.

CAD.3:4.3 - Close the dependence between commands and error

The proposed command domain determines d, while the resulting E restricts the command domain. Solve this compatibility deliberately. Start with a desired command envelope, construct a valid E, then test the actual state and input inclusions. If they fail, choose a smaller envelope or change the interface, gains, model or timing, and repeat the affected derivation.

A more direct formulation searches for S and E satisfying the error inclusion and the physical constraints together. For finite-dimensional parameterizations this can be an optimization or feasibility problem. No generic solver or convergence guarantee follows from writing that problem.

Do not treat repeated tightening as automatic convergence. A mapping that sends candidate planning sets to newly permitted sets can reverse inclusion: larger commands produce larger errors and smaller permitted commands. Alternating bounds may remain separated. Establish a nonempty self-consistent pair and its inclusions; do not use a numerically stationary iteration as the proof.

When a bound is conservative, try retaining command correlation, phase-dependent sets or a better model before weakening a hard constraint. For a fixed qualified loop, compare a joint state-command admissible set with the separate command and error envelopes used here; CAD.Reference:4.5.1 gives the governor entry, and :11 identifies a construction using time-dependent estimation bounds. Establish its successor conditions for the actual command rule before replacing this sufficient construction. If the required command is physically impossible, return that incompatibility to the system requirement or architecture decision.

CAD.3:4.4 - Construct a continuation, not only one permitted command

A permissible pair (z,v) must also lead somewhere from which work can continue. For the nominal update z^+=A_pz+B_pv, seek a set Z such that every admitted z has at least one permitted v with z^+\in Z.

One direct construction repeatedly removes states without such a successor:

Z_{n+1}= \{z\in Z_n:\exists v,\ (z,v)\in S,\ A_pz+B_pv\in Z_n\}.

An exact fixed point is controlled invariant under the stated model. A finite iteration gives an outer candidate, not automatically an invariant set; test the successor condition before relying on it. Gridding a continuous set needs an approximation-error argument.

An alternative is to exhibit a smaller terminal set T and an explicit admissible terminal law. A finite plan ending in T then has a feasible continuation by appending that law. For receding-horizon use, the standard shift argument also needs the actual next nominal state, retained feasible tail, modeled uncertainty and implementation to match the argument. A measurement-based reset must preserve the initialization and feasibility conditions or use an independently qualified recovery.

If a new optimization fails or misses its deadline, continuing a previously feasible tail can be legitimate only while its assumptions still hold. “Use the previous plan” is not a universal fallback.

CAD.3:4.5 - Use a continuous-time branch only with its stronger premises

Let D be the domain of the connected continuous state on which the model and the bounds below apply, including the reference and any controller state on which the argument depends. Start the trajectory in D and suppose a differentiable function V satisfies, throughout D under the admitted input law,

V\geq c_e\|x-Pz\|^2,\qquad \dot V\leq-\alpha V+\beta\|w\|^2,

with positive c_e,\alpha, nonnegative \beta, and \|w(t)\|\leq\bar w. Let \tau_D be the first exit time from D, with \tau_D=\infty if there is no exit. For every 0\leq t<\tau_D on which the solution exists, integration gives

V(t)\leq e^{-\alpha t}V(0) +\frac{\beta\bar w^2}{\alpha}(1-e^{-\alpha t}).

Consequently \|x-Pz\|\leq\varepsilon on that interval, where \varepsilon^2=\max\{V(0),\beta\bar w^2/\alpha\}/c_e. If h is Lipschitz with constant L_h on a state domain containing both x(t) and Pz(t), requiring h(Pz(t))\geq L_h\varepsilon implies h(x(t))\geq0 on the same interval.

To claim the conclusion for all future time, separately establish continued existence and containment of the connected trajectory in D under the allowed reference evolution and disturbances, for example through a forward-invariant subset of D containing the admitted initial states. A tracking-error bound alone does not prevent the reference and plant from leaving the region where the derivative or Lipschitz bound is valid.

This is a sufficient construction for a particular connected dynamics and admissible input law. Obtain V and verify its derivative, domain, actuator feasibility and treatment of the moving reference; their existence is not supplied by the formula. Sampling, estimation, saturation and delay must either occur in that dynamics or be covered by its perturbation bound.

CAD.3:4.6 - Separate recognition, mathematical assurance and physical reliance

A shrinking error trace or plausible margin recognizes a promising design. The invariance and continuation arguments establish conditional properties of a mathematical model. Model validation, parameter and disturbance bounds, execution timing and physical tests determine whether those properties support the intended engineering use.

A decrease condition that applies only outside a threshold does not, in discrete time, prevent a jump from inside to outside. Use an actual invariant-set inclusion or a one-step bound valid on the entire proposed set. Likewise, a small average error is not a worst-case constraint bound.

CAD.3:5 - Archetypal Grounding

For the held-reference case of CAD.2, a=1/2,N=4,\delta=0.1 give E=8/75. Since |u|=(1-a)|e|, a sufficient input bound is 4/75\approx0.05333<0.06. Requiring |r|\leq1-E=67/75 also suffices for |x|\leq1. This position tightening is conservative: the scalar convex update can support less restrictive position arguments. It is not claimed to be the maximal command domain.

Now double the requested average progression from 0.025 to 0.05 per fast tick while retaining four-tick held updates. Then \delta=0.2, E=16/75, and the sufficient input bound is 8/75\approx0.10667. More decisively, an initial jump from x=r=0 to r=0.2 commands u=0.1, directly violating the limit. Merely saturating u changes the error dynamics and requires a new analysis.

For continuous joined segments with |d_k|\leq0.05, E=0.1 and |u|\leq0.05. Choose |r_k|\leq0.9 and initialize |x_0-r_0|\leq0.1. Then the stated state and input limits hold at every fast sample. Generate the next reference by clipping r_k+d_k to the interval [-0.9,0.9], with |d_k|\leq0.05. The choice d=0 is always available, so the reference domain has an explicit continuation. This proves model feasibility even at a boundary; it does not promise arrival at every requested target or continuous physical safety between samples.

CAD.3:6 - Bias-Annotation

Robust envelopes can be unnecessarily restrictive, especially when correlations are discarded. Conversely, nominal examples can make the operating domain look larger than the evidence warrants. Keep sufficiency, necessity, conservatism and empirical observation distinct.

CAD.3:7 - Conformance Checklist

• The bound covers the actual initial condition, command class, mismatch and timing modes.
• Switching uses a common invariant set or proved transitions between the admitted mode or phase sets.
• A continuous-time claim ends at the first exit from its proof domain unless continued existence and containment in that domain are established.
• Every claimed constraint is tied to the instants or continuous intervals actually covered.
• Nominal commands leave justified correction authority.
• The command/error dependence closes without a circular assumption.
• There is a feasible continuation or an explicit limit on the duration of the claim.
• Physical reliance is no broader than the model and implementation evidence.

CAD.3:8 - Common Anti-Patterns and How to Avoid Them

A tolerance selected first and justified afterward can consume imaginary authority; derive it with the command domain. A nonempty feasible set can contain dead ends; test successors. A sampled safe plan is not a continuous safety argument. A stable controller plus actuator saturation is a different closed loop from the unsaturated proof.

CAD.3:9 - Consequences

The designer obtains commands that the whole architecture can support under stated conditions, or a precise reason to revise it. Some planning freedom is exchanged for dependable correction. The result may be conservative and computationally expensive; those costs belong in CAD.4.

CAD.3:10 - Architectural Rationale

The lower guarantee and upper assumption concern the same connected behavior. Error propagation and constraint propagation therefore form one coupled construction. Adding continuation prevents a one-step solution from being mistaken for an operating strategy.

CAD.3:11 - SoTA-Echoing

How can a command domain support continued constrained operation? The selected line is robust error containment, constraint tightening and a separate continuation argument in :4.1–4.4. It adapts Stamouli and colleagues’ constraint-propagation construction, §§4–5. Their reported output-constraint guarantee is at slow samples; the all-fast-sample input extension has an additional condition. Here each claimed time interval is explicit, and direct set inclusion establishes invariance without extending a decrease-only condition into a global bound. The price is a sufficient domain that may exclude useful commands.

A serious alternative for a fixed qualified loop is a governor’s joint state-command admissible set (CAD.Reference:4.5.1). It can retain relations discarded by one common error envelope. Castroviejo-Fernandez and colleagues, §§4–6, especially Proposition 2 further use observer-error bounds and a sequence of admissible sets with a proved successor relation. Adapt that idea when a worst-case constant disturbance envelope is unnecessarily restrictive; the extra assumptions on estimation and disturbance variation, and the set computation, must be worth the enlarged domain. This motivates the return in :4.3 rather than weakening a hard constraint.

A predictive safety filter is another alternative when the requested object is a plant input and a finite backup trajectory can be computed. Milios, Wabersich, Berkel and Schwenkel, §§II–IV distinguish recursive constraint satisfaction from additional stability guarantees and supply separate stabilizing conditions. Adopt that distinction in :4.4 and CAD.4:4.2. Such a filter needs its model, terminal ingredients and online computation; inserting it after the tracker changes the law analyzed in CAD.2.

For continuous dynamics, the Matni–Ames–Doyle treatment, §4.5 supplies a distinct safety-transfer line. Section :4.5 adapts the connection through an explicit error margin, conditional on remaining in the derivative and Lipschitz domains; it does not assume that every nonlinear controller supplies those premises. Reopen the selected containment construction when conservatism prevents the task, the admitted switching or disturbance changes, or the intended claim changes from constraint satisfaction to convergence or completion.

CAD.3:12 - Relations

CAD.2 supplies the exact connected dynamics. CAD.1 is the return when no useful command domain exists for the selected split. CAD.4 uses the size and cost of the feasible domain in whole-candidate comparison. MMP.18 supplies general compatibility reasoning; this pattern supplies the control-specific invariance, margin and continuation construction.

For feedback on an estimated state, CAD.5:4.7 supplies the extra forcing and input allowance. Use its run-wide error bound, including startup and allowed delivery modes, before qualifying the resulting command domain.

CAD.3:End

CAD.4 - Co-design and Realize the Whole Control Architecture

Type: Method pattern Status: Stable

CAD.4:1 - Problem frame

Use this when several control architectures appear feasible, or a change of model, hardware, rate or operating demand can invalidate an existing arrangement. Tuning each controller independently does not decide which complete arrangement should be built.

Start with the same required behavior and resource boundary for every candidate. The first useful result is a feasible whole configuration, its comparison with serious alternatives, and the conditions under which its implementation and later use remain justified.

For a fixed, qualified architecture requiring only a local parameter adjustment, use the relevant controller-design method directly and reopen the whole only if that adjustment changes a relied-on interface, resource or constraint.

CAD.4:2 - Problem

A detailed planning model may improve prediction but miss its deadline. A faster tracker can use more computation or amplify measurement noise. A longer planning interval can save resources while increasing command mismatch. A design assembled from individually preferred choices may have no feasible joint setting.

The problem is to choose and realize a configuration whose control, model and resource assumptions can hold together.

CAD.4:3 - Forces

CAD.4:4 - Solution

CAD.4:4.1 - Form complete candidates

Use C.39 to connect the required result to its supplying operations and C.32/SYSE.6 to retain whole alternatives. A candidate specifies the decomposition, model and its operating domain, exchanged command, timing and reset semantics, controller law, feasible command domain, planning continuation and implementation resources.

Keep architecture choices separate from tunable parameters without pretending that the separation is absolute. The number of layers, model order, kind of command, sampling periods, planning horizon and processor arrangement can change the problem being solved. Gains, weights and numeric tolerances tune a selected construction. Changing either group can reopen the other.

CAD.1–CAD.3 supply the positive construction, not merely a screening list. Existing qualified results can replace repeated design work. If the interface law changes, the old error bound is not a reusable result for that new law.

CAD.4:4.2 - Evaluate feasibility before ranking attractive scores

For each candidate, establish the connected error behavior, physical constraints and continuation under its own admitted conditions. Include initialization, transitions, planned modes and fallback behavior. A candidate with a missing load-bearing condition is unresolved, not numerically inferior.

Then evaluate the behavior the task actually values: tracking envelope, settling, progress, resource consumption, disturbance rejection or cost. Use the same demand and perturbation class across candidates. An average objective cannot compensate for violating a hard constraint.

Boundedness and convergence are distinct. For example, if the nominal law makes z_k\to z_* and v_k\to v_*, the linear error equation has forcing g_k=Hz_k+Gv_k+w_k. With a contractive F, g_k\to0 implies e_k\to0: the contribution of any fixed finite past decays, and the remaining tail is bounded by its shrinking forcing divided by 1-q. If Hz_*+Gv_*\neq0, even zero disturbance can leave a steady bias. A bounded command domain alone establishes neither nominal progress nor zero error.

When the performance claim requires optimality, robust stability or task completion beyond these arguments, supply the corresponding result for the actual connected model. Do not infer it from the presence of MPC, a Lyapunov function for one component, or an optimizer’s successful return.

CAD.4:4.3 - Include execution in the design equations

Use MMP.22 to turn the mathematical operation into a workable computation. Identify the data needed when the operation starts, the work that can be prepared ahead, the result required at its deadline, and what must happen if it is unavailable.

A necessary timing comparison is

C_{\mathrm{fast}}\leq T_{\mathrm{fast}},\qquad C_{\mathrm{plan}}\leq T_{\mathrm{plan}},

where C bounds execution under the selected implementation. These isolated inequalities are not sufficient on a shared processor: blocking, interference, communication and scheduling must fit the deadlines together. An operation count or mean runtime is not a worst-case execution bound.

If planning finishes one period after its observation, model that delay and the command that controls the intervening period. Preparing a future segment can make the delay harmless for a predetermined reference but not automatically for a newly observed obstacle. Increasing the processor speed changes the feasible architecture set; increasing the assumed speed in a spreadsheet does not.

Use the implementation to test unit conversions, numerical tolerances, update order, saturation and reset behavior. A numerical optimizer’s constraint tolerance belongs in the margin analysis if it can consume physical clearance. Verify that the lower law actually executed is the law used in CAD.2.

If an online solver returns only a partial iterate, separate the time spent solving from the test that permits applying its output. A qualified acceptance rule may allow a feasible inexact result and otherwise keep an admissible prior command or plan. Include the cost of that test and the conditions for progress; a timeout says nothing about admissibility, and feasibility alone does not establish progress. The command-governor alternative in :11 is one developed construction, not a fallback rule for every optimizer.

CAD.4:4.4 - Search jointly, with bounded conclusions

A practical first search can enumerate a small number of architecture choices and, within each, solve or tune the continuous parameters. Recompute the error and command domain for every material change. Reject a setting whose necessary constraints fail; retain unresolved settings separately from feasible ones.

Compare feasible candidates through task-relevant trade-offs and costs. Do not collapse incompatible obligations into an invented scalar score. A Pareto comparison can expose choices where one candidate is faster but more resource intensive. If the search covered only a grid, selected controller class or local optimizer, state that reach; it does not prove global architectural optimality.

Investigate the active limitation. If actuator reserve fails, altering the reference interface may help more than enlarging the processor. If timing fails, a reduced model or shorter horizon may help more than increasing gain. If a reduced model loses an important mode, a larger controller budget may be unavoidable. This is the constructive feedback from the whole evaluation to CAD.1–CAD.3.

CAD.4:4.5 - Qualify the realization and its revision conditions

Separate mathematical consequence, model qualification and implementation observation. Simulation can reveal an omitted mode or a bad reset. Tests on the target execution arrangement can expose deadline misses. Physical experiments can challenge the model, disturbance envelope and actuator assumptions. None automatically establishes every other claim.

Before relying on the design, identify the operating conditions that support it and the observations that can invalidate them. Examples are a larger reference jump, changed disturbance envelope, delayed sensor, actuator derating, altered model order or shared computing load. Reopen the specific equation, inclusion or comparison using the changed premise.

Choose detection and fallback behavior for the actual failure mode. A reference hold is justified in the running model because it lies within the admitted command class; in another plant it may be unsafe or mission-defeating. For an unexplained timing overrun or model residual beyond the admitted W, stop claiming the old bound and use only a separately qualified response.

The resulting control architecture returns to SYSE.6 with its feasible domain, performance, resource needs and unresolved constraints. That system decision can change sensors, actuators, plant structure or requirements rather than forcing every problem into controller tuning.

CAD.4:5 - Archetypal Grounding

CAD.4:5.1 - Compare rates at the same requested progression

For the discrete actuator example, assume a dedicated planner resource needs two fast ticks per result. The fast controller has a separate resource. Commands are prepared for their applicability interval; initialization supplies the first segment. This is a declared toy resource model, not measured processor performance.

At progression 0.025 per fast tick, a held reference changes by \delta=N/40. At progression 0.05 it changes by \delta=N/20. The sufficient error and input bounds are derived from CAD.2, with a=1/2.

At the original demand, two held-command arrangements pass this sufficient input test; their compute use and tracking behavior can be compared. At doubled demand, neither of the considered held arrangements that fits the planning time passes it. The N=4 case also has the direct violating first jump shown in CAD.3. For N=2, two successive positive changes of 0.1 from rest produce an input of 1/16 = 0.0625 at the second change, also above the limit.

The segment arrangement admits the higher demand under the stated sampled model and margins. It adds a clocked reference generator and continuity checks. It does not demonstrate that this arrangement dominates all possible controllers or that more than two layers would help.

CAD.4:5.2 - Carry the mathematical result into execution

The planner proposes a next endpoint and applicability time. The reference generator checks that the segment starts at the current reference, remains in [-0.9,0.9], and advances by at most 0.05 per fast tick. The fast law uses that generated reference, not the endpoint held for four ticks. An unavailable segment leaves the reference unchanged; the initialization error must already satisfy the bound.

A hardware test that reveals a one-tick delay in actuation changes x_{k+1}=x_k+u_k into a model with an input delay. The table is no longer sufficient evidence. Return to CAD.2 to derive the delayed dynamics and to CAD.3 for the resulting margins. Retain the comparison of command meanings and the source-independent arithmetic; do not retain the unqualified physical feasibility conclusion.

CAD.4:6 - Bias-Annotation

A convenient cost model can favor the hardware already at hand. A small parameter search can make its winner look universal. State the tested choices and preserve alternatives whose decisive conditions remain unknown. The running case demonstrates an interface repair, not an empirical prevalence claim.

CAD.4:7 - Conformance Checklist

• Complete candidates are compared under the same task and constraints.
• Connected feasibility and continuation are established before performance ranking.
• A convergence or optimality claim has its own applicable grounds.
• Execution, communication and scheduling assumptions fit the implemented arrangement.
• Search limits and unresolved candidates are visible.
• Changed-condition and fallback behavior return to the premise that actually changed.

CAD.4:8 - Common Anti-Patterns and How to Avoid Them

Optimizing each layer and connecting the winners can destroy feasibility; compare complete settings. Choosing rates from “fast” and “slow” labels hides dynamics and execution costs; derive their effects. A predicted runtime is not a deadline guarantee. A fallback that was never part of the model does not inherit its bound.

CAD.4:9 - Consequences

The choice can change model order, command representation, rates, controller parameters and hardware together. This broadens the search but can avoid tuning an infeasible arrangement. A declared bounded search yields a defensible local decision, not a universal optimum.

CAD.4:10 - Architectural Rationale

Control behavior and execution are coupled: computation changes latency, latency changes error, and error changes admissible commands. The whole design must therefore be the unit of comparison. Keeping each intermediate result explicit lets an implementation change reopen only the dependent reasoning.

CAD.4:11 - SoTA-Echoing

What should change when a complete control arrangement misses its demand or resource limit? The selected line compares coupled architecture and tuning choices, while retaining a qualified fixed loop with local command modification as a serious alternative. It adopts the joint-choice formulation in Verhoek, Stamouli, Pappas and Matni, 2026 preprint, §§3–7: model dimensions, sampling ratios, horizons and controller parameters affect the same feasibility problem. That construction fixes a two-layer LTI setting and specified delay and controller classes; efficient general optimization remains open. Sections :4.1–4.4 adapt the comparison to a bounded candidate search and require implementation timing rather than treating a computation-cost proxy as a deadline bound. The gain is avoiding incompatible local optima; the cost is a larger search and repeated qualification of coupled choices.

When the lower loop already has the required local performance, first compare changing its command admission or solver. Garone and Kolmanovsky, §§3–4 and Algorithm 1 develop command-governor logic permitting inexact optimization and a non-invariant inner admissible set, with stated feasibility and progress conditions. Adopt the separation between accepting a computed command and merely obtaining a solver output in :4.3; neither an arbitrary partial iterate nor an unqualified hold inherits that result. This can be preferable to buying faster computation or redesigning the tracker, but command progress and admissible-set computation remain costs to compare.

Switching among existing controllers is also a genuine architectural alternative. Wang, Di Cairano and Sanfelice, 2024, §§III–V combine mode-specific admissible sets with explicit switching and Lyapunov conditions. Adapt that comparison when a fast transient and a less oscillatory final approach favor different controllers; carry the guards and transitions into :4.2 and CAD.3:4.1. Separate stable modes alone do not supply the switched guarantee. Reopen the choice when task demand, computing interference or the cost of maintaining those mode conditions changes.

CAD.4:12 - Relations

CAD.1, CAD.2 and CAD.3 supply candidate decomposition, connected dynamics and admissible commands. Their results are dependencies of the whole comparison, not mandatory fresh work for every application. C.39 supplies general Method construction; MMP.22 supplies the mathematical-to-practical transformation. SYSE.6 receives the control result within the system architecture decision. C.30.LCA tests the resulting view’s coverage, not the control theorem.

CAD.5 supplies observation, internal-state and estimator alternatives with their error and execution conditions. Shared computation can change their observation age, so a different implementation can reopen that information result and the dependent CAD.3 margins.

CAD.4:End