A Hybrid Bounding Method for Computing an Over ... - CiteSeerX

2352

IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 54, NO. 10, OCTOBER 2009

A Hybrid Bounding Method for Computing an Over-Approximation for the Reachable Set of Uncertain Nonlinear Systems Nacim Ramdani, Member, IEEE, Nacim Meslem, and Yves Candau Abstract—In this paper, we show how to compute an over-approximation for the reachable set of uncertain nonlinear continuous dynamical systems by using guaranteed set integration. We introduce two ways to do so. The first one is a full interval method which handles whole domains for set computation and relies on state-of-the-art validated numerical integration methods. The second one relies on comparison theorems for differential inequalities in order to bracket the uncertain dynamics between two dynamical systems where there is no uncertainty. Since the -differentiable funcderived bracketing systems are piecewise tions, validated numerical integration methods cannot be used directly. Hence, our contribution resides in the use of hybrid automata to model the bounding systems. We give a rule for building these automata and we show how to run them and address mode switching in a guaranteed way in order to compute the over approximation for the reachable set. The computational cost of our method is also analyzed and shown to be smaller that the one of classical interval techniques. Sufficient conditions are given which ensure the -practical stability of the enclosures given by our hybrid bounding method. Two examples are also given which show that the performance of our method is very promising. Index Terms—Hybrid systems, interval analysis, reachability analysis, uncertain systems.

I. INTRODUCTION OMPUTING reachable sets for hybrid systems is an important step when one addresses verification or synthesis tasks. A key issue then lays in the calculation of the reachable set for continuous dynamics with nonlinear models, even more when uncertainty is present in either parameters, control or disturbance inputs. Consider an uncertain dynamical system described by nonautonomous differential equations with the following form:

C

(1) Manuscript received September 09, 2008; revised January 12, 2009, January 26, 2009, and February 05, 2009. First published September 22, 2009; current version published October 07, 2009. This paper was presented in part at the 11th International Workshop, Hybrid Systems: Computation and Control, St. Louis, MO, April 2008. Recommended by Associate Editor H. Ito. N. Ramdani is with the Constraints Solving, Optimization, Robust Interval Analysis (COPRIN) Project, Institut National de Recherche en Informatique et en Automatique (INRIA) Sophia-Antipolis, Nice FR-06902, France (e-mail: [email protected]). N. Meslem was with the CERTES, Université Paris Est, Créteil, France. He is now with MIG, Mathematics, Computing Science and Genome, INRA, Jouy-enJosas FR-78350, France (e-mail: [email protected]). Y. Candau is with the CERTES, Université Paris Est, Créteil FR-94010, France (e-mail: [email protected]). Color versions of one or more of the figures in this paper are available online at http://ieeexplore.ieee.org. Digital Object Identifier 10.1109/TAC.2009.2028974

is possibly nonlinear, where the function , is the initial domain for state vector at time and is an uncertainty domain for parameter vector . In this work, because of the methods used we will assume that the uncertainty sets are axis-aligned boxes. the set of solutions of (1) at time origiLet us denote and for each parameter nating from each initial condition in vector in . The forward reachable set of system (1) over a time interval is then defined as follows:

(2) Several methods have been developed recently for the explicit computation of the reachable set. Let us classify them in two classes as proposed in [1]. The first class of methods compute over-approximations of the reachable sets. When the continuous dynamics are linear they combine time discretization, numerical integration and computational geometry. They use various representations for the reachable sets such as polytopes [2]–[5], zonotopes [6] or ellipsoids [7], [8]. Numerical tools arealso availablewhichimplement the above techniques. Some other methods proceed with hybrid abstractions: the continuous state space is divided into a finite number of cells defined by linear inequalities and then compute reachable set using discrete reachability tools [9]–[12]. In [13], a method is given for constructing such hybrid abstractions for polynomial hybrid systems. The case of uncertainty in model parameters has been addressed recently in [14] where a discrete abstraction is used for the analysis of multi-affine uncertain differential equations. When the continuous dynamics are modelled with a nonlinear differential equation, the computation of the reachable set becomes much harder which forms one of the main obstacles in safety verification of hybrid systems [11]. Most computational methods rely then on ahybridizationof the continuous-time models, i.e. the use of piecewise simpler, possibly affine or polynomial conservative approximations of the analysed system on cells defined on the state space [13], [15]. Although these reachability computation methods scale polynomially with the continuous state dimension, they are quite ineffective when used with truly nonlinear systems mainly because of the conservatism induced by linearization. The second class of methods compute convergent approximations of the reachable set since they aim at computing as closely as possible the true reachable set. In these methods, backward reachablesetsarecomputedbyusinglevelsetmethodsandviscosityso-

0018-9286/$26.00 © 2009 IEEE Authorized licensed use limited to: UR Sophia Antipolis. Downloaded on October 13, 2009 at 05:22 from IEEE Xplore. Restrictions apply.

RAMDANI et al.: HYBRID BOUNDING METHOD

lutions to Hamilton–Jacobi–Isaacs (HJI) partial differential equation [1], [16]. In [17] aminimum time to reachfunction is alsoused in the context of both HJI equations and viability theory. Compared to over-approximations based methods, HJI based methods are very effective since they can represent non-convex reachable sets and can naturally handle uncertain time-varying nonlinear dynamics. However they scale exponentially with the continuous state dimension and hence are practical only for problems with continuous state variable of small dimension. In this paper, we investigate the use of guaranteed numerical set integration for the computation of conservative over-approximations for the reachable set of uncertain nonlinear dynamics. Such an approach has been investigated only by few authors. Set integration via interval Taylor models [18] was used for the verification of hybrid systems, but no parameter uncertainty was considered[19].Itwasalsousedforthesimulationofuncertainhybrid systems where the dimension of the continuous state vector was small [20]. Nevertheless, it is well-known that in general the size of the reachable set derived with interval Taylor models diverges after few computation steps when the size of either initial state domain or parameter uncertainty domain is large. This shortcoming is mainly caused by the wrapping effect, i.e., the overestimation of the solution due to the bracketing of any set by an axis-aligned box. Hence, the contribution of this paper is to show how one can address nonlinear continuous reachability computation in presence of model uncertainty, in a more efficient way by using the classical Müller’s theorem [21]–[23] allied with interval Taylor models. We will recall the classical Müller’s existence theorem and we will indicate how it can be used for guaranteed set integration and hence reachability computation. The core idea developed in the sequel is to no longer perform set integration with whole domains but to only compute guaranteed bounds for the reachable sets. To do so, we will first show how the Müller’s theorem makes it possible to derive two dynamical systems which enclose the original uncertain dynamical system and thus bound the flow pipe between a minimal solution, i.e. a flow that is always lower than the solution flow pipe, and a maximal solution, i.e., a flow that is always larger. Since the two bounding systems involve no more uncertainty, interval Taylor models can be used for the guaranteed computation of the minimal and maximal solutions. We will show how to build the bracketing systems by analyzing the sign of partial derivatives of . Since the so-obtained bounding systems are in general defined by continuous but -differentiable functions, we will show how only piecewise to use hybrid automata to model them and how to address mode switching. In summary, we will show that the computation of the reachable set for an uncertain nonlinear continuous dynamical system boils down to running two (coupled) hybrid dynamical systems involving no uncertainty in either model parameters or initial state. The derived hybrid dynamical systems are nonlinear, that is, the guards on discrete transition and the continuous flows in all modes can be specified using arbitrary nonlinear expressions over both the continuous state and parameter variables. This paper is structured as follows. Section II recalls set integration via interval Taylor models and shows how to use them for computing over-approximation for reachable sets. Section III introduces the classical Müller’s existence theorem and shows how to use it for reachability computation. Section IV contains the

2353

main contribution of the paper, i.e. our hybrid bounding method for computing over-approximation for reachable sets. Section V addresses the stability and complexity issues for our new method. Section VI contains two illustrative examples. II. COMPUTING REACHABLE SETS USING INTERVAL TAYLOR MODELS In this section, we will recall how to compute an over-approximation for the reachable set using guaranteed set integration via interval Taylor models. A. Interval Analysis Interval analysis was initially developed to account for the quantification errors introduced by the floating point representation of real numbers with computers and was extended to validated numerics ([24] and the references therein). A real interval is a connected and closed subset of . We have . The midpoint of an interval and is defined by . The set of all real intervals of is denoted by . Real arithmetic operations are exand tended to intervals. Consider an operator and two intervals. Then: . An interval vector is the Cartesian product of n intervals. The . For set of n-dimensional real interval vectors is denoted by and n-dimensional real an n-dimensional real vector interval vectors , we have and . ; the range of this function over an Consider is given by: . The interval vector interval function is an inclusion function for if . An inclusion function for can be obtained by replacing each occurrence of a real variable by the corresponding interval and each standard function by its interval counterpart. The resulting function is called the natural inclusion function. The performances of this inclusion function depend on the formal expression for . Given a bounded set of complex shape, one usually defines an axis-aligned box or a paving, i.e. a union of non-overlapping boxes, which contains the set : this is known as an outer approximation of it. Likewise, one also defines an inner approximation which is contained in the set . Hence, we have the following property . B. Interval Taylor Models Consider

now

the

differential and

equation

(1) where . Define a which is not necessarily time grid equally spaced. The objective is to compute interval vectors , that are guaranteed to contain the set of solutions of (1) at time . Definition 1 (A Priori Enclosure): A vector interval which satisfies the property (3) is an a priori enclosure for the solutions of (1) over the time interval .

Authorized licensed use limited to: UR Sophia Antipolis. Downloaded on October 13, 2009 at 05:22 from IEEE Xplore. Restrictions apply.

2354

IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 54, NO. 10, OCTOBER 2009

The computation of the set of solutions can be solved efficiently by using interval Taylor expansions. These full interval methods are usually one-step methods which proceed in two phases: 1) They first verify existence and uniqueness of the solution using the fixed point theorem and the Picard-Lindelöf opwhich satisfies erator, compute an a priori enclosure (3) and adapt integration time step size if and hence the necessary in order to keep the width of global truncation error smaller than a given threshold. A simple method for obtaining the a priori enclosure uses as initial guess, is widened and/or the time step is then the set reduced until the following inclusion is satisfied [25]:

(4) There are more efficient techniques which are detailed in [18], [26]. of the set of 2) Then they compute a tighter enclosure solutions of (1) at , i.e.

open source softwares available which implement most of the above techniques. Remark 1: When the size of the initial domain or the parameter vector box is too large, guaranteed numerical integration is often doomed to diverge. In such cases, pessimism might be controlled by bisection, i.e. performing a partition of the initial state vector or parameter vector domains. Nevertheless, such a procedure scales exponentially with the dimension of the state and parameter vectors and hence increases computation times very significantly. Consequently, the method introduced in this paper investigates the possibility to achieve numerical integration without employing bisection. C. The Reachable Set Let us see now how one can compute an over-approximation for the reachable set. By using interval Taylor models one can obtain guaranteed enclosures for the set of solutions of (1) at . It remains to enclose the set of grid points , solution between two grid points. We will show now how to derive explicit formulas which characterize the boundaries of the reachable set for any t. and define For

(6) (5) Proposition 1: which corresponds to a Taylor expansion of order where is used to compute the remainder term. The coefficients are the Taylor coefficients of the solution which can be computed either numerically by automatic differentiation or analytically via formal methods. The enclosures thus obtained are said validated which is in contrast with conventional numerical integration techniques which derive approximations with unknown global error and where the accumulation of both truncation and round-off errors may cause the computed solution to deviate widely from the real one. Unfortunately, the wrapping effect makes the explicit scheme (5) width-increasing and thus not suitable for numerical implementation. To solve such a drawback, one can use mean value forms, matrices preconditioning and linear transforms (see the review in [18]). For instance, a popular method by Lohner uses at each time step a point vector , a point matrix and an interval vector such that . Then it tunes the algorithm such that wrapping effect impacts only . In this Lohner’s are obtained via factorization [27]. method, matrices In [28], [29], a Taylor series expansion with respect to initial state has also been used in order to curb the pessimism introduced by wrapping effect. A more general scheme has been developed in [30] where the interval method is founded on the Hermite-Obreshkoff expansion series where the sought enclosure appears both implicitly and explicitly. In [31], an alternative technique has been introduced where constraint propagation techniques are used in connection with a guaranteed relaxation of the ODE in order to build a pruning step. Finally, there are

(7) Proof: It suffices to write a Taylor series expansion at time and use for evaluating the remainder term (see [18]). Remark 2: To use (6) in practice, it suffices to choose for the a priori enclosure of (1) as given by (4). Define as an over-approximation of a reachable set , as follows: (8) Proposition 2:

(9) and satisfies

(10) Proof: Obvious from (7). Define . Proposition 3: An over-approximation of the reachable set (2) is given by

Authorized licensed use limited to: UR Sophia Antipolis. Downloaded on October 13, 2009 at 05:22 from IEEE Xplore. Restrictions apply.

(11)

RAMDANI et al.: HYBRID BOUNDING METHOD

2355

and satisfies

(12) Proof: Obvious from (7) and proposition (2). As a conclusion, it is clear that thanks to (6) and (11), one can derive explicit formulas which characterize the boundaries of the reachable set. In practice however, one can use instead of (11) the over-approximation (12) obtained by using the a priori only. solutions

at . If, in addition, for all and takes the value , function is Lipschitz continuous with respect to over then this solution is unique for any given . B. The Reachable Set Using the Müller’s theorem, one obtains an enclosure for the solution of (1) as follows: (19)

III. COMPUTING A REACHABLE SET USING MÜLLER’S EXISTENCE THEOREM In this section, we will show how to compute an over-approximation for the reachable set via guaranteed set integration by using the classical Müller existence theorem [21], [22] as reported in [23]. A. Müller’s Existence Theorem Theorem 1 ([22], [23]): Consider the dynamical system (1), where function is continuous over a domain defined by (13) where means for all i. Assume that functions and are continuous over for all and satisfy the following properties and 1) 2) the lower Dini derivatives and and the and of and upper Dini derivatives are such that (14) (15) where

is the subset of

defined by

(16)

and where

is the subset of

defined by

In addition, it is easy to prove that the a priori enclosures for , as defined by (3) can also be obtained as follows: (20) where and are a priori enclosures obtained for and . We will show how to obtain these enclosures later on. obtained via (19) in Finally, one can use the enclosures (6), (11) or (12) in order to compute an over-approximation for the reachable set. The main difficulty is now to obtain suitable and in the general case. In this bracketing functions paper, we will show that by analysing the signs of the partial it will be possible to build these brackderivatives of eting functions. C. The Bracketing Functions Define as the set containing all the true solutions of (1) is taken in and in . Of obtained at time , when course, the set is the sought reachable set . It is not available yet but we will need it to state the rule for building the bracketing functions. Recall however that one can still obtain a conservative over-approximation for it by using interval Taylor models. Assume that the sign of the partial derivatives and is constant when is taken in the reachable set, i.e. , and . Note that these signs need not be constant over the whole state space but only over the reachable set space. Rule 1: [Analysis of the partial derivatives signs] Here we adapt the ideas introduced in [23], [32]. The inequalities below , and . Define are meant as follows: if

(17)

Then for all a solution

, , system (1) admits that stays in the domain

if and

(21)

. In a similar way, define as follows: if

(18)

Authorized licensed use limited to: UR Sophia Antipolis. Downloaded on October 13, 2009 at 05:22 from IEEE Xplore. Restrictions apply.

if

(22)

2356

IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 54, NO. 10, OCTOBER 2009

and follows:

. Now define if if

as

(23)

if . In a similar way, define

and as follows: if if

(24)

if and . Now the components of the differential equations which make it possible to compute the upper and lower solutions are obtained as follows:

IV. COMPUTING A REACHABLE SET BY USING HYBRID AUTOMATA AS BOUNDING SYSTEMS In this section, we introduce a new approach for enclosing the reachable set of uncertain dynamical systems, for which and the signs of the partial derivatives are not constant over , . In such a case, the Müller’s theorem and rule 1 make it possible to build system (28) only over each time interval where these signs can be ascertained. When the bounding systems are , they behave as analysed over the whole time interval the subsystems of a hybrid system, denoted , which switches from one subsystem to another each time a partial derivative changes sign. A. Hybrid Bounding Denote the finite set of modes of over which one subsystem is active and the set of mode transitions. Denote a switching time instant and the collection of switching time instants

(25) (29) Denote and

where , (26) (27) then obviously and are in general, solutions of a system of coupled differential equations, i.e., (28) which involves no uncertain quantity. Therefore interval Taylor models such as the one introduced in the previous section can be used for efficiently solving (28) in a guaranteed way. Indeed when these methods are used for solving differential equations with no uncertainty, they are usually able to curb the pessimism induced by the wrapping effect, even over long integration time. Remark 3: According to their definition, the functions and may lead to different results for different and hence there might be a non unique choice of which minimizes or for all . This fact may lead to enclosures maximizes (28) too conservative. This shortcoming will be addressed in a further work. Remark 4: Although interval Taylor models can be used for solving in an efficient way the system (28), there is no guaranty will not diverge. Secthat the size of the enclosure tion V-B will address this issue and give some ideas about the behaviour of the enclosures. In fact, rule 1 can only be used over time intervals where the signs of the partial derivatives are constant. In the sequel, we will show how we can address the cases where this condition is not satisfied by using hybrid automata as bracketing systems.

with ,

. The switching time instants are not known a priori, which constitutes an issue for this bounding approach method. We will show now how to solve this problem and how to build the automaton which governs the dynamics of the bounding systems. into a sucLet us split the experiment time period where cession of integration time intervals and where integration time steps are either chosen a priori or adapted on-line as in the preceding sections. over which no Denote , the set of time intervals switching occurs, i.e. (30) Similarly, define the set i.e.

of intervals where a switch occurs,

(31) , an inner approximation for Denote , an outer approximation for . We have

and

(32) and hence . Next proposition shows how to obtain ): An inner apProposition 4 (Inner Approximation of proximation is given by

Authorized licensed use limited to: UR Sophia Antipolis. Downloaded on October 13, 2009 at 05:22 from IEEE Xplore. Restrictions apply.

(33)

RAMDANI et al.: HYBRID BOUNDING METHOD

2357

where (resp. ) is an inclusion function for (resp. ). of (1) as given by (4) Proof: Since the a priori solution or (20) encloses the whole state trajectory over , we can write (34) Consequently

(35) . This ends the proof. We have similar results for function Now, according to proposition 4, we can use rule 1 over each and to in order to derive time interval bracket all the possible solutions of the uncertain system (1). an a priori enclosure of solution over the time Denote interval , we have

Fig. 1. Time history for the partial derivative [g ] of example (37). Here q des]. ignates the automaton mode which is used during the time interval [t ; t

(36) It remains to deal with time intervals , i.e. time interas defined by (29). Since Rule 1 and vals which contain hence the bounding method cannot be used, we use instead a full interval method. By doing so, we keep the guaranty property for the enclosures without having to derive the actual time instant where the commutation occurs. In addition, if a time interval contains several , i.e. multiple zero-crossing, we have the guaranty that this time interval will be selected to be in ; thus the usual problem of detecting multiple zero-crossing does not arise in our method. The hybrid bounding approach is now illustrated in the following example. Example 1 (Illustrative Example): Let us consider the scalar dynamical system with two uncertain parameters and (37) Fig. 1 depicts a possible time history for the inclusion functions . There are 4 cases where the signs of both partial derivatives can be determined with no ambiguity: these time , during which periods correspond to time intervals the bounding systems are, as time goes forward: ; • • ; • ; • . To the contrary, there are time intervals where the signs of the partial derivatives cannot be ascertained. They correspond during which we will handle the unto time intervals certain system (37) via interval Taylor models, i.e. we will perform numerical integration with intervals of significant widths. As a conclusion, the hybrid automaton which characterizes the bounding systems will contain 1 4 modes: mode 0 refers to the use of interval Taylor models, modes 1 to 4 refer to the 4 cases

Fig. 2. Automaton used for the guaranteed numerical integration of system ~] ; [p]; [t ; t ]). q designates the automaton g ] denotes [g ] ([x (37). Here [~ mode.

where bounding systems can be tuned for (37). The automaton is depicted in Fig. 2 where are given both modes and switching conditions. Let us use in the sequel mode 0 to denote the original uncertain dynamical system and modes to denote coupled bounding systems. The following propositions will make it possible to detect on-the-fly the switching between modes, i.e. and and to instantiate the new mode. ): Proposition 5 (Switching

Authorized licensed use limited to: UR Sophia Antipolis. Downloaded on October 13, 2009 at 05:22 from IEEE Xplore. Restrictions apply.

(38)

2358

IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 54, NO. 10, OCTOBER 2009

Proof: When mode and one of the inclusion functions in (38) contains 0, then a transition occurs and the new . Note that test (38) is conservative, mode is necessarily i.e. if one of the partial derivatives or changes sign at then its inclusion function contains 0; to the contrary if the inclusion function of one partial derivative contains 0 it does not mean that the partial derivative actually changes sign. This is not an issue, since we just need to detect zero-crossing in a guaranteed way. Indeed in this case, the sign of the par, rule tial derivative cannot be ascertained for all in 1 cannot be used and we have decided to use instead a full in. Now, recall that is terval integration method, i.e. and computed computed via (20). But, since solutions with the bounding systems derived for mode are valid only , does not contain for . over must be re-computed with the original uncertain system. ): Proposition 6 (Switching

(39) and it becomes possible to ascerProof: When mode tain the sign of all the partial derivatives and for all in which is done by using the inclusion functions, then a . is transition occurs and the new mode is necessarily computed with interval Taylor models and is always valid. Nu. merical integration can then be taken forward from Remark 5: When switching from to , , (for in ), can be recomputed via (20) and hence using the bracketing systems derived for mode . Although this is obviously not necessary, it may improve the quality of the approximation. In summary, the computation of an over-approximation of the reachable set (2) is obtained by running the following hybrid automaton: (40) where is a finite set of modes. . 1) reverts to the original uncertain system (1) Mode and is active over time intervals . Denote . To in this case the active continuous state vector as correspond to the use of the the contrary, modes bounding systems (28) obtained via rule 1 over time inter. Denote in this case the active continvals . uous state vector as is the set of the transitions. According to 2) propositions 5 and 6, the elements of are either of type or of type . is the collection of switching time in3) stants. According to (32) and proposition 4 we have . 4) is the collection of reset functions. For -type transitions, the discontinuous state jump is and for -type given by transitions, the discontinuous state jump is and .

5)

is the collection of the

field vectors obtained with rule 1. is the state space of (1). represents the uncertainty domain for model parameters for (1). Finally, we can build the Hybrid-Bounding algorithm for computing the reachable set of (1) by running automaton (1). It relies on algorithm Integrate-one-step-ahead which computes the one-step ahead solution for an uncertain differential equation. Algorithm Hybrid-Bounding initializes the initial mode, i.e. , the algoat time . While integration time is smaller that , then checks rithm integrates one step ahead from to . if a mode switching occurs during the time interval This is done by checking if the signs of the partial derivatives and have changed. If there is a switching, then action will depend on the current mode. If the current mode is then it suffices to switch to the new mode and carry on integration according to proposition 6. To the contrary, if current mode is not 0, then algorithm has to re-do computation for current time step with the uncertain model in order to cross the switching condition in a guaranteed way according to proposition 5. In algorithm Integrate-one-step-ahead, numerical integration is done via interval Taylor models with the original uncer. When , algorithm selects the tain system when and . bounding systems and set bounding solutions Then numerical integration is performed over . In order to have guaranteed results, we have chosen to use the same interval Taylor model method as with mode 0 for solving the coupled system (28), but with intervals of zero width. Finally, if for any reason, a given partial derivative keeps time period, changing sign in a continuum of time over and automaton then the active mode remains locked on . Next section will propose a simple (40) never jumps to method which addresses this issue and prevent the automaton . from being locked on mode 6) 7)

B. Hybrid Bounding Allied With a Partitioning Algorithm The ability of algorithm Hybrid-Bounding to yield effective results in the general case is driven by the ability to ascertain and . Obviously, when the signs of the partial derivatives the size of the domains taken for initial state vector or parameter vector are large, one expects the algorithm to get trapped in and thus to never activate the the full interval mode, i.e. modes which use the bounding systems approach. A simple idea to circumvent such a drawback consists in allowing the domains to be partitioned in a way that renders easier the determination of the signs of the partial derivatives. This idea will be used both during the initialization step, i.e. when algorithm initiates and for dealing with the mode switching. In order to facilitate the partition of both parameter or state vectors, let us define an ex. Hence . tended state vector Moreover, in order to deal with the sub-boxes obtained via partition, the new algorithms will use lists. During the initialization step, algorithm Hybrid-Boundingwith-Partition uses a partitioning algorithm, algorithm Partiinto a left part and tion which splits an interval vector

Authorized licensed use limited to: UR Sophia Antipolis. Downloaded on October 13, 2009 at 05:22 from IEEE Xplore. Restrictions apply.

RAMDANI et al.: HYBRID BOUNDING METHOD

2359

a right part in order to furnish a list of -vector sub-boxes over which the signs of the partial derivatives can be ascertained. The list contains also boxes of width smaller than a prescribed will be used. threshold for which the mode Algorithm Hybrid-Bounding-with-Partition differs from algorithm Hybrid-Bounding only by the introduction of the partitioning algorithm Partition and by the use of lists of couples (mode, solution enclosure): For each , one list gathers the state vectors enclosures at time and another one which contain the flow pipe gathers the a priori solutions and which can be used for computing an for over-approximation of the reachable set according to (12). Furthermore, a regularization procedure is used which aims at controlling computation complexity by reducing the size of the lists. In this paper, this is done by merging all the list elements, i.e. the solution enclosures, when they all belong to a . This is motivated by the fact that -vector same mode partition is done only for crossing the switching time instants and as far as possible, the computation of reachable sets is done via existence theorems. This algorithm can also be tuned by the user according to the problem under study.

such that number of integration steps should be smaller, i.e. will satisfy . and are In summary, when the size of the initial domains small, computing the reachable set can be done either via the full interval method or the hybrid bounding method. In this case, the whole computational cost for our method shall be smaller than the full interval one. Now when the size of the domains are large, the full interval method cannot be used unless domains are partitioned. This procedure scales exponentially with the dimension of state and parameter spaces and makes the full interval method not practical. However, our hybrid bounding approach is capable of dealing with sets of large size but may need partitioning for mode switching. Finally, our hybrid method shall always cost less than a full interval one. B. Stability Analysis In this subsection, we will address the stability issue for the size of the enclosures as obtained by the hybrid automaton (40). To do so, we will analyze the differential equation which . When active mode is governs the dynamics of the size of , the enclosure’s size is given by

V. MORE ON THE HYBRID BOUNDING METHOD

(42)

A. Complexity Analysis

and we have

In this subsection, we will compare the amount of computation needed to produce the reachable set when using our hybrid method with the case where a full interval method is used. Before discussing this fact, let us first recall the complexity of set integration via interval Taylor models. When the Taylor coefficients in (5) are obtained via automatic differentiation [33] and the following recursive relationships: (41) the computational cost needed for obtaining them is times the cost of evaluating function [34]. When integration , i.e. in (5), are adapted on-line, then time steps the whole computational cost is roughly equal to times the cost of evaluating function , where is the number of integration time steps actually needed to achieve numerical integration over the whole time period, i.e. such . When the reachable set is that computed using a full interval method as in Section II-C with large domains for either initial state vector or parameter uncertainty, and if the enclosures do not diverge, then the adapted integration time steps are usually small and hence number quite large. Now, when the reachable set is computed by using our hybrid method (Section IV), the computational cost is the same . To the as the full interval method when active mode is , the dimension of the contrary, when the active mode is continuous state vector is twice the dimension of the original system, hence the computational cost of a single integration step. But recall that the twice dimensional handled system involves no more uncertain quantity. Consequently, the adapted integration time steps can be far larger and hence the whole

(43) To the contrary, when active mode is , the compuis done by using interval Taylor models with tation of the original uncertain system. In such cases, it is not easy to write a dynamical equation which describes the behaviour of this size. We will let aside this mode in the further analysis but quantify its impact via a modified jump function. Hence, if the actual switching sequence is for instance , where , it will become . Finally, when analyzed over the whole time period, the behavior is modelled by a hybrid automaton which uses the of of automaton (40) with collection of modes discontinuous state jumps, obtained by putting in cascade an -type jump with an -type one. Consequently, the dynamics of are modelled by (43) with and a jump function given by (44) and where time is also reset accordingly. Now, analyzing the stability property for can be addressed by using methods available for the stability analysis of hybrid systems. In our case, we will use methods published in [35] which give sufficient conditions for -practical stability trajectories of hybrid systems, i.e. conditions which keep within given bounds. In the sequel we will recall these results and show how to use them to address the issue at hand. Hereor . after the time interval denotes either Definition 2 (Switching Law Over ): Given a time interval , a switching law over is a mapping: which

Authorized licensed use limited to: UR Sophia Antipolis. Downloaded on October 13, 2009 at 05:22 from IEEE Xplore. Restrictions apply.

2360

IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 54, NO. 10, OCTOBER 2009

specifies a nonZeno switching sequence for any initial . state Definition 3 ( -Practical Stability Over ): Assume a time interval and a switching law over are given. Given an , the hybrid system (43) is said to be -practically stable over under if there exists a such that whenever . Definition 4 ( -Practical Lyapunov-Like Function): Given and a switching law over , a contina time interval satisuously differentiable real-valued function is a -practical Lyapunov-like fying function over under if there exists a Lebesgue in, positive constants and tegrable function , such that for any trajectory generated by that and its corresponding switching sequence starts from , , the following holds , a.e. ; a) at any b) switching instant ; , c) . Here, denotes the number of switching during the time . interval Note that is not a Lyapunov function in the usual sense, since no definiteness condition is imposed on it or its derivatives. Theorem 2 ([35]: Given a time interval and a switching law over , hybrid system (43) is -practically stable over under , if there exists an -practical Lyapunov-like function over under . We will now apply the above results to the problem under -differentiable over , we can find study. Since function is and write without loss of generality regular matrices

constant w.r.t , denote the maximum eigenvalue of . System (43) is -practically stable over if

and under

(48) , i.e. if which can be satisfied if there exist some there exist some modes for which system (43) describing the dynamics of is stable. In addition, the lower bound on such that system (43) is -practically stable over under is given by

(49) Proof: Let us consider (47) we have

. From (46) and

(50) Now, we can define piecewise continuous functions and . For any satisfying , (50) leads to . and let quantifies Let us choose the ratio of the values after and prior to the switching where automaton (43) uses the compositional jump function (44). According to c) of definition 4, system (43) is -practically stable over under if the following inequality holds:

(45) Remark 6: Matrices in (45) can for instance be taken as where is the point solution of the gradient and . system (1) when From equations (26), (27), (42) and (45), we can write the as follows: dynamics of

(51) which, according to the definition of

and

, leads to

(46) where

(52) (47)

Let us choose

, then we only need to have

and where is built from by using Rule 1 according to the signs of the partial derivatives of . Note that (46) and (47) now involve the over-approximation of the reachable set. Proposition 7: Assume that is Lipschitz continuous, thus is also Lipschitz continuous. For all , denote the Lispchitz constant of w.r.t and its Lispchitz Authorized licensed use limited to: UR Sophia Antipolis. Downloaded on October 13, 2009 at 05:22 from IEEE Xplore. Restrictions apply.

(53)

RAMDANI et al.: HYBRID BOUNDING METHOD

2361

which is equivalent to the requirement (49) which also implies (48). Remark 7: A connection between the practical stability properties for the enclosure’s size, i.e. system (43) and the dynamics is also the of the original system (1) can be established if , which is true if matrices maximum eigenvalue of and share the same eigenvalues. If matrices as defined in (45) are obtained by linearization according to remark and share the same eigenvalues if matrices 6, then satisfy, possibly after an appropriate change of coordinates, one of the two conditions: are Metzler matrices for all in , i.e. matrix i) for all ; elements are—upper or lower—triangular matrices. ii) In both cases, it is important to note that rule 1 must be applied in the new set of coordinates. VI. EXAMPLES A. Uncertain Nonlinear System This example is taken from molecular system biology. Consider a non-linear dynamical model which describes MitogenActivated Protein Kinase cascades [36]

Fig. 3. Time history of the x component of the reachable set of (54) with no parametric uncertainty. The curve labelled 3% corresponds to 3% uncertainty on initial state vector, whereas the one labelled 4% corresponds to 4% uncertainty on initial state vector. Both curves are obtained with a full interval method (3%: CPU time = 22:44s PIV 2 GHz). Without parametric uncertainty, full interval method diverges at soon as the size of the domain for initial state vector is larger than 3%.

(54)

Here the parameters are assumed perfectly known , , , , , , , , , , and a positive feedback is taken, i.e., . Nom, inal values for initial state vector are as follows , , , . The components of the reachable set as given by a full interval method, i.e., interval Hermite–Obreschkoff series with variable step control as implemented in the VNODE software [37] are plotted in Fig. 3 for 3% and 4% relative uncertainty on initial state vector. Note that with relative uncertainty larger than 3%, the full interval method diverges rapidly. In addition, the method diverges also when parametric uncertainty is set, even of very small magnitude (0.01%). Consider again the system (54) but this time with fairly large uncertainty on parameter and initial state vectors: , , , , , , , , , , , , , , , . Rule 1 is used in order to build the coupled differential equations for the minimal and maximal solutions of (54). Interval Hermite Obreschkoff models with variable time step as implemented in the open source VNODE software [37]

Fig. 4. Time history of the x component of the reachable set of (54) as obtained with the bounding method based on the Müller theorem with an initial domain for state vector of size 100%. The curve labelled ‘no uncertainty’ corresponds to no uncertainty in the parameter vector (CPU time = 38:26s PIV 2 GHz) and the one labelled ‘with uncertainty’ corresponds to the presence of uncertainty in the parameter vector (CPU time = 38:58s PIV 2 GHz).

are used for solving the new differential system. Fig. 4 plots component of the reachable set as the time history of the obtained in both cases where parametric uncertainty is taken or not taken into account. It is clear that the bounding approach based on the Müller’s theorem successfully computes the over approximation for the reachable set. In fact, the superior performance of our method in this case can be further analysed. It is easy to see that since all system variables are positive data, then by changing orthants and according to the signs of the partial derivatives w.r.t model parameters, one can obtain decoupled differential equations for upper and lower bounding systems which are also feasible. That is to say that the bounding systems are obtained by instantiating both state and parameter variables to feasible values. Since

Authorized licensed use limited to: UR Sophia Antipolis. Downloaded on October 13, 2009 at 05:22 from IEEE Xplore. Restrictions apply.

2362

IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 54, NO. 10, OCTOBER 2009

the bounding systems are feasible then the enclosures obtained using our method are tight (up to the precision of the guaranteed numerical integration method used). B. Another Uncertain Nonlinear System From Bio-Reactors: Non Monotone With Inputs We consider the Haldane model to simulate the biotechnological process in a stirred reactor. The model is taken from [38] but addresses the existence of one specie on a chemostat with a single substrate. Consider the following equations: (55) where designates the biomass density, the substrate conthe concentration, the dilution rate of the chemostat, and centration of input substrate. The coefficients , , are positive constants which are defined as follows , , and . and . The coefficients and are with relative uncertainty 1% assumed uncertain: with relative uncertainty 1.5%. Initial state and is taken uncertain and is defined as follows . It easy to check that the signs of the partial derivatives needed to apply rule 1 are as follows:

Fig. 5. Time history of the x component of the reachable set of (55) as obtained with the hybrid bounding method (CPU time = 7:95s PIV 2 GHz). The reachable set computed via a full interval method diverges after few steps only.

(56) and

(57) Hence, the automaton (40) which must be used with algorithm Hybrid-Bounding contains only three modes: corresponds to the original system (55); • mode is active when , i.e. • mode and system (28) writes

(58)

• mode writes

is active when

Fig. 6. Time history of the s component of the reachable set of (55) as obtained with the hybrid bounding method (CPU time = 7:95s PIV 2 GHz). The reachable set computed via a full interval method diverges after few steps only.

Before using our hybrid bounding method let us check if inequalities (49) and (48) are satisfied, i.e. if proposition 7 holds. For system (55), we use

and system (28)

(59)

Algorithm Interval-Integrate is implemented with the extended mean value algorithm [18] with a constant integration . time step Note that a full interval Taylor models method diverges after few computation steps even without parameter uncertainty.

, for , , . For , (48) yields . Hence it exists a set such that the size of the enclosures given by our hybrid bounding method remains bounded. The components of the reachable set as obtained by algorithm Hybrid-Bounding for the integration time interval are plotted in Figs. 5 and 6. The pessimism introduced by the full interval Taylor method when crossing the switching condition can be further controlled by using algorithm Hybrid-Bounding-with-Partition. The computed reachable sets are plotted in Figs. 7 and 8. Note also the switching depicted in Figs. 6 and 8. hyperplane defined by

Authorized licensed use limited to: UR Sophia Antipolis. Downloaded on October 13, 2009 at 05:22 from IEEE Xplore. Restrictions apply.

RAMDANI et al.: HYBRID BOUNDING METHOD

Fig. 7. Time history of the x component of the reachable set of (55), as obtained with the hybrid bounding method and with a partition allowed only on s component and a threshold  : .

= 1 (CPU time = 27 6s PIV 2 GHz)

2363

validated methods. Our contribution resides then in the use of non linear hybrid automata to model the bounding systems; the so-obtained method is denoted as the hybrid bounding method. We give a rule for building the bracketing systems automata and show how to run them and how to address mode switching in a guaranteed way in order to compute the over approximation for the reachable set. We have shown that the hybrid bounding method introduced in this paper exhibits better performance than full interval methods since it requires a smaller computational cost and is capable of computing over approximations for the reachable set of non-linear systems with fairly large uncertainty in both parameter and state vectors. Finally, we used the concept of -practical stability for hybrid systems in order to study the stability of the enclosures obtain by our new method. We gave sufficient conditions for the stability of the enclosures’ size. Then, we discussed the connection between these conditions and the original system for two classes of dynamical systems. Used with state-of-the-art hybrid system verification tools, it should make it easier to solve hybrid reachability issues when the continuous dynamical systems are described via nonlinear differential equations. Future work will study how to optimize the performance of the algorithms introduced when using a partitioning strategy for crossing switching hyperplanes. The potential of constraint propagation may then be investigated. Finally, the reachability analysis of hybrid dynamical systems with nonlinear continuous dynamics will be addressed by using this new method. ACKNOWLEDGMENT

Fig. 8. Time history of the s component of the reachable set of (55), as obtained with the hybrid bounding method and with a partition allowed only on s component and a threshold  : .

= 1 (CPU time = 27 6s PIV 2 GHz)

All algorithms are developed in C++ and use the Profil/BIAS C++1 class library for interval computations. Taylor coefficients are computed using the FADBAB++ package.2 VNODE software is developed by Ned Nedialkov.3 The authors would like to thank the anonymous reviewers for their comments and suggestions which helped improving paper quality. REFERENCES

Here again, the hybrid bounding method has better performance than full interval methods since it successfully computes the over approximation for the reachable set. VII. CONCLUSION In this paper we have addressed the issue of computing an over approximation for the reachable set of uncertain nonlinear continuous dynamical systems. We have shown that reachable sets can be computed via guaranteed set integration and we have introduced two different ways to do so. The first one, the full interval one, performs the integration by computing directly with the sets or boxes which characterize the uncertainty. The second one relies on comparison theorems for differential inequalities in order to bracket the uncertain dynamical system between two dynamical systems where there is no uncertainty in either state or parameter vectors and thus enclose the flow pipe between a minimal and a maximal solution. In both methods the numerical set integration is performed by using state-of-the-art

[1] C. J. Tomlin, I. M. Mitchell, A. M. Bayen, and M. Oishi, “Computational techniques for the verification of hybrid systems,” Proc. IEEE, vol. 91, no. 7, pp. 986–1001, Jul. 2003. [2] R. Alur, C. Courcoubetis, N. Halbwachs, T. Henzinger, P.-H. Ho, X. Nicollin, A. Olivero, J. Sifakis, and S. Yovine, “The algorithmic analysis of hybrid systems,” Theor. Comput. Sci., vol. 138, pp. 3–34, 1995. [3] E. Asarin, O. Maler, and A. Pnueli, “Reachability analysis of dynamical systems having piecewise-constant derivatives,” Theor. Comput. Sci., vol. 138, pp. 35–65, 1995. [4] E. Asarin, O. Bournez, T. Dang, and O. Maler, “Approximate reachability analysis of piecewise-linear dynamical systems,” in Proc. HSCC’00, 2000, pp. 20–31. [5] A. Chutinan and B. H. Krogh, “Computational techniques for hybrid systems verification,” IEEE Trans. Autom. Control, vol. 48, no. 1, pp. 64–75, Jan. 2003. [6] A. Girard, “Reachability of uncertain linear systems using zonotopes,” in Proc. HSCC, 2005, pp. 291–305. [7] O. Botchkarev and S. Tripakis, “Verification of hybrid systems with linear differential inclusions using ellipsoidal approximations,” in Proc. HSCC, 2000, pp. 73–88. 1www.ti3.tu-harburg.de/Software/PROFILEnglisch.html. 2www2.imm.dtu.dk/~km/FADBAD/. 3www.cas.mcmaster.ca/~nedialk/Software/VNODE/VNODE.shtml.

Authorized licensed use limited to: UR Sophia Antipolis. Downloaded on October 13, 2009 at 05:22 from IEEE Xplore. Restrictions apply.

2364

IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 54, NO. 10, OCTOBER 2009

[8] A. B. Kurzhanski and P. Varaiya, “Ellipsoidal techniques for hybrid dynamics: The reachability problem,” in New Directions and Applications in Control Theory, Lecture Notes in Control and Information Sciences, W. Dayawansa, A. Lindquist, and Y. Zhou, Eds. New York: Springer-Verlag, 2005, vol. 321, pp. 193–205. [9] H. Guéguen and J. Zaytoon, “On the formal verification of hybrid systems,” Control Eng. Prac., vol. 12, pp. 1253–1267, 2004. [10] L. Doyen, T. Henzinger, and J. Raskin, “Automatic rectangular refinement of affine hybrid systems,” in Proc. FORMATS’05, 2005, pp. 144–161. [11] M.-A. Lefebvre and H. Guéguen, “Hybrid abstractions of affine systems,” Nonlin. Anal., vol. 65, no. 6, pp. 1150–1167, 2006. [12] M. Kloetzer and C. Belta, “Reachability analysis of multi-affine systems,” in Proc. HSCC, 2006, pp. 348–362. [13] A. Tiwari and G. Khanna, “Series abstractions for hybrid automata,” in Proc. HSCC, 2002, pp. 465–478. [14] G. Batt, C. Belta, and R. Weiss, “Model checking genetic regulatory networks with parameter uncertainty,” in Proc. HSCC, 2007, pp. 61–75. [15] E. Asarin, T. Dang, and A. Girard, “Hybridization methods for the analysis of non-linear systems,” Acta Informatica, vol. 43, pp. 451–476, 2007. [16] I. M. Mitchell, A. M. Bayen, and C. J. Tomlin, “A time-dependant hamilton-jacobi formulation of reachable sets for continuous dynamics games,” IEEE Trans. Autom. Control, vol. 50, no. 7, pp. 947–957, Jul. 2005. [17] A. M. Bayen, E. Crück, and C. J. Tomlin, “Guaranteed overapproximations of unsafe sets for continuous and hybrid systems: Solving the hamilton-jacobi equation using viability techniques,” in Proc. HSCC, 2002, pp. 90–104. [18] N. Nedialkov, K. Jackson, and G. Corliss, “Validated solutions of initial value problems for ordinary differential equations,” Appl. Math. Computat., vol. 105, pp. 21–68, 1999. [19] T. Henzinger, B. Horowitz, R. Majumdar, and H. Wong-Toi, “Beyond HyTech: Hybrid systems analysis using interval numerical methods,” in Proc. HSCC, 2000, pp. 130–144. [20] A. Rauh, M. Kletting, H. Aschemann, and E. Hofer, “Interval methods for simulation of dynamical systems with state-dependent switching characteristics,” in Proc. IEEE Int. Conf. Control Appl., Munich, Germany, 2006, pp. 355–360. [21] M. Müller, “Uber das fundamentaltheorem in der theorie der gewöhnlichen differentialgleichungen,” Mathematische Zeitschrift, vol. 26, pp. 619–645, 1927. [22] W. Walter, “Differential inequalities and maximum principles: Theory, new methods and applications,” Nonlin. Anal., Theory, Methods Appl., vol. 30, no. 8, pp. 4695–4711, 1997. [23] M. Kieffer, E. Walter, and I. Simeonov, “Guaranteed nonlinear parameter estimation for continuous-time dynamical models,” in Proc. 14th IFAC Symp. Syst. Ident., Newcastle, Australia, 2006, pp. 843–848. [24] L. Jaulin, M. Kieffer, O. Didrit, and E. Walter, Applied Interval Analysis: With Examples in Parameter and State Estimation, Robust Control and Robotics. London, U.K.: Springer-Verlag, 2001. [25] R. Moore, Interval Analysis. Englewood Cliffs, NJ: Prentice-Hall, 1966. [26] N. Nedialkov, K. Jackson, and J. Pryce, “An effective high-order interval method for validating existence and uniqueness of the solution of an ivp for an ode,” Reliable Comput., vol. 7, no. 6, pp. 449–465, 2001. [27] R. J. Lohner, “Enclosing the solutions of ordinary initial and boundary value problems,” in Computer Arithmetic: Scientific Computation and Programming Languages. Stuttgart, Germany: Wiley, 1987, pp. 255–286. [28] M. Berz and K. Makino, “Verified integration of odes and flows using differential algebraic methods on high-order taylor models,” Reliable Comput., vol. 4, pp. 361–369, 1998. [29] J. Hoefkens, M. Berz, and K. Makino, “Controlling the wrapping effect in the solution of odes for asteroids,” Reliable Comput., vol. 8, pp. 21–41, 2003. [30] N. S. Nedialkov and K. R. Jackson, “An interval hermite-obreschkoff method for computing rigorous bounds on the solution of an initial value problem for an ordinary differential equation,” Reliable Comput., vol. 5, pp. 289–310, 1999. [31] M. Janssen, P. Hentenryck, and Y. Deville, “A constraint satisfaction approach for enclosing solutions to parametric ordinary differential equations,” SIAM J. Numer. Anal., vol. 40, pp. 1896–1939, 2002.

[32] N. Ramdani, N. Meslem, T. Raïssi, and Y. Candau, “Set-membership identification of continuous-time systems,” in Proc. 14th IFAC Symp. System Ident., Newcastle, Australia, 2006, pp. 446–451. [33] L. Rall and G. F. Corliss, “Introduction to automatic differentiation,” in In Computational Differentiation: Techniques, Applications, and Tools. Philadelphia, PA: SIAM, 1996, pp. 1–18. [34] N. Nedialkov, “Computing Rigorous Bounds on the Solution of an Initial Value Problem for an Ordinary Differential Equation,” Ph.D. dissertation, Univ. Toronto, Toronto, ON, Canada, 1999. [35] X. Xu and G. Zhai, “Practical stability and stabilization of hybrid and switched systems,” IEEE Trans. Autom. Control, vol. 50, no. 11, pp. 1897–1903, Nov. 2005. [36] E. Sontag, “Molecular systems biology and control,” Eur. J. Control, vol. 11, pp. 396–435, 2005. [37] N. Nedialkov and K. Jackson, The Design and Implementation of a Validated Object-Oriented Solver for ivps for Odes Software Quality Research Laboratory, Department of computing and Software, McMaster University, Hamilton, ON, Canada, Tech. Rep. 6, 2002, . [38] O. Bernard and J.-L. Gouzé, “Closed loop observers bundle for uncertain biotechnological models,” J. Process Control, vol. 14, pp. 765–774, 2004.

Nacim Ramdani (M’08) received the Engineer degree from Ecole Centrale de Paris, France, in 1990, and the Ph.D. and Habilitation degrees from the University of Paris XII, France, in 1994 and 2005, respectively. He joined the French National Research Institute in Computer Science and Control (INRIA, Institut National de Recherche en Informatique et en Automatique) in 2007, and is currently a Research Scientist with the Constraints Solving, Optimization, Robust Interval Analysis (COPRIN) group at INRIA Sophia-Antipolis, France. From 2005 to 2007, he was on sabbatical at the Montpellier Laboratory of Computer Science, Robotics, and Microelectronics (LIRMM CNRS University of Montpellier 2), France. From 1996 to 2005, he was Maitre de Conférences at the University of Paris Est, France, and member of the Thermal Sciences Research Laboratory (CERTES, Centre d’Etudes et Recherche Thermique et Systèmes). His current research interests include modelling and analysis of continuous and hybrid systems in presence of uncertainty, and set membership estimation, with applications to robotics and human movement science.

Nacim Meslem received the M.S. degree in automatic and applied computer science from Ecole Centrale de Nantes, Nantes, France, in 2004 and the Ph.D. degree from the University Paris Est, Créteil, France, in 2008. Since 2008, he has been with Institut National de la Recherche Agronomique (INRA), Jouy-en-Josas, France, where he is presently a Post Doctoral Fellow. His research interests include set-membership state and parameter estimation, hybrid modelling, stability analysis, and biological systems.

Yves Candau received the M.E. degree and the Ph.D. in energetics sciences from Ecole Polytechnique, Paris, France, in 1980. He became the Head of the Thermal Sciences Research Laboratory, Centre d’Etudes et Recherche Thermique et Systèmes (CERTES), University Paris Est, Créteil, France. His research interests include signal processing and inverse methods applied to thermal measurements engineering.

Authorized licensed use limited to: UR Sophia Antipolis. Downloaded on October 13, 2009 at 05:22 from IEEE Xplore. Restrictions apply.