Verification and Validation of Adaptive Control Systems for Safety Critical Systems

Sorn Simatrang (sorn@case.edu)

Introduction
One of the applications of adaptive control systems are an aircraft control with providing safety and robustness such as UAVs. Besides aircraft, space missions are also good instances for the usage of adaptive controller since most of space missions are long and almost completely autonomous. The environmental changes could be, for instance, a stuck stabilator, broken aileron and/or rudder and sensor failure. Hence, such systems should be able to handle with unexpected situation by itself while the traditional controllers cannot provide this ability. Intelligent adaptive controllers are the most promising method for those problems. Nevertheless, to be implementable in such safety critical applications, the adaptive controller is required to be verified and validated to guarantee the safety and predetermined specifications. Unfortunately, the major obstacles to apply adaptive flight control systems into safety critical applications like aerospace are nonlinearity in adaptive close loop systems and unpredictable phenomena. These difficulties are impervious us to analyze the transient behavior of adaptive systems.

Flight Controllers
In modern flight control systems, there are three kinds of controller used for aircraft as follow Cockpit Control Almost modern flight control systems still need cockpit controls, flight control surfaces linkage between cockpit control and flight control surfaces and the actual mechanisms to control the aircraft. A basic cockpit control consists of three mechanisms as follow. Control yoke for roll by moving the ailerons. Control column for pitch angle by moving elevators. Rudder pedals for yaw by moving the rudder.

Figure 1: Showing the control axis of aircraft and the actuator on aircraft [24] Classical Controller The Proportional-Integral-Derivative Controller (PID) is the most popular classical controller. Simply, a PID controller consists of 3 components: the proportional component, Integral component, and Derivative component. Error signal is determined by the difference of the reference and pervious output. Then, in each control loop, error is sent to PID controller which consists of three parameters, , . Continuously, this procedure is so on till the errors reach zero value. Adaptive systems are systems whose function evolves over time, as they improve their performance through learning. And If learning and adaptation are allowed to occur after the control systems are deployed, the system is called online adaptive system. [3] Thus, an adaptive flight controller is a flight controller which is able to learn about changes in aircraft systems, and evolve those changes in the manner of maintaining stability and performance of the systems. There are common three algorithms which have been used for aircraft control systems, indirect adaptive control, direct adaptive control and neural network base controller. In direct adaptive control, the control parameters are adapted based on some performance error. Direct adaptive control are expounded in [5, 6, 7, 8]. Indirect adaptive control architecture used a plant model updated by system identification techniques to create a controller. Finally, neural network based controllers are adapted online by using learning data. One of the instances of flight control systems implementing neural network is Intelligent Flight Control System (IFCS) which developed by National Aeronautics and Space Administration (NASA)

Adaptive Flight Controller

Figure 2: Flight Control System (IFCS) architecture Figure 2 shows sensor signals such as airspeed signals, altitude signals, and acceleration signals are sent to three components: Parameter Identification (PID), Online Learning Neural Network (OLNN), and the Pre-Trained Neural Network (PTNN). The PTNN comprising of baseline derivative data is just a look up table with data which is received from experiments. PTNNs output pass to the Stochastic Optimal FeedForward & Feedback Technology controller (SOFFT) which takes pilot inputs and determine a new command to feed back to the plant. It uses the stability and control derivatives data from PTNN output to determine a plant model used for desire performances. In an online adaptive mode, both switches shown in figure 2 are closed and then data from sensor passes through both PID and OLNN. Output from the PID and OLNN will be compared to the output from the PTNN before passing to the SOFET controller. OLNN will be trained by the derivative estimate from the PID and data from PTNN will be correct by OLNN. [12] Dynamic Cell Structure (DSC) neural network is used for OLNN. DSC is defined by an online storage function approximator, the DCS network is expected to approximate the differences between the parameter estimation of stability and control derivatives by a PID and the baseline derivatives generated by the PTNN. [9] OLNN module is used for updating the aircraft when change in control or model inaccuracies occurs. According to Yan Liu, this system must be capable of providing aerodynamic derivatives to the aircraft controller at least 10 times per second. OLNN has two mode of operation: Learning state: During this state, the difference between the derivative estimation PID and the baseline derivative from PTNN is used to train the network. Non-Learning state: During this state, only the baseline derivative value from PTNN is used. This state will be active when the derivative approximation from PID is inaccurate or unstable. Although OLNN is used for correcting the systems inaccuracies, we still cannot be sure about the systems safety. Hence, V&V techniques are needed to ensure systems reliability. [12]

Traditional V&V and the needs for the unconventional V&V of Adaptive Control Systems
According to Sommerviles book, validation is a procedure to ensure that our algorithms consistent with the users demands. And, verification is a procedure to ensure that our algorithms meet predetermined specifications. Thus, V&Vs aim is to make users confidence in our controller. The controller might not be perfect but it should be good enough for using in real world. The confident level depends on applications and users expectations. Traditional methods for software Verification and Validation (V&V) are classified into three categories. Fault Avoidance: These methods are a process to endure that there are no error in design procedure. Fault Removal: These methods are a process to ensure that errors can be removed from systems after finishing design procedure or implementation. Fault Tolerance: These methods are a process to ensure that systems can recover and operate accurately in the case that there are errors during operation. [1]

However, traditional V&V cannot be used for adaptive controllers as the following reasons. Fault Avoidance: In formal design methodology, we assume that we can determine the functional properties of a system by the way we design and implement it. While this is able to be applied for traditional systems, it cannot be applied for adaptive systems since their design determines how they learn but not what they will learn. Fault Removal: In the traditional design method, we assume that we can infer functional properties of a software product from an analysis of its source text. While this can be use for traditional systems, it does not hold for adaptive systems, whose design is also determined by what they learn. Further, all testing techniques are based on the assumption that the systems of interest will duplicate under field usage the behavior that they have exhibited under test. While this hold for traditional deterministic systems, it cannot be applied for adaptive system since the behavior of these systems changes over time. Fault Tolerance: these techniques are based on the assumption that we have clear expectations about the functions of programs and programs parts and use this information to design error recognition and error recovery tools for adaptive systems. Nevertheless, we cannot formulate such expectations since the functions of programs/ program part evolve over time.[11]

These inabilities to provide a V&V methodology leads to limited usage of adaptive controller to safety critical applications. However, NASA has developed the Intelligent Flight Controller System and has several standards to perform V&V as follow

NASA Procedures and Guidelines (NPG) 8730.DRAFT 2, Software Independent Verification and Validation. NASA Guidebook for Safety Critical Software, NASAGB-1740.13-96 IEEE Standard for Software Test Documentation, IEEE std 829-1998 (Revision of IEEE Std 829-1983) NASA Procedures and Guidelines (NPG) 2820.DRAFT and NASA Software Guidelines and Requirements. References IEEE/EIA Standards 12207.0, 12207.1, and 12207.2 which reference standards published in 1995 as ISO/IEC 12207. Trial-Use Standard for Information Technology Software Life Cycle Processes-Software Development, JSTD-016-1995. (IV&V) Management. Any mission which costs more than $100 million will required IV&VI [10]

There is also a guideline which V&V operate to ensure the accuracies at every phase of the Software Life Cycle as shown in Figure 3

Figure 3: Software Life Cycle with integrated V&V process [2]

Moreover, according to the RTCA DO-178B standard, all safety critical software for U.S. commercial avionics must be certified by the FAA [11]. Handling Quality In flight control systems, systems performance can be interpreted into handling quality rating such as Cooper-Harper rating which is easier to understand than providing a value of systems control signal to pilot. Figure 4 shows the various conditions for a pilot to rate the handling qualities. The rating system deduces the aircraft handling qualities in aircraft characteristics and pilot rating numbers from 1 to 10.

Figure 4: Cooper-Harper Aircraft handling Qualities Rating [13]

Issues and Methods in Unconventional V&V of Adaptive systems

Mili et al. purpose the V&V methods for on-line learning systems as follow. By analyzing the functional properties of the end results and how the systems adapt through learning data, we can verify the accuracies of the systems.

We cannot determine the exact function which the system defines at any state of the learning process to analyze. Hence, all we can do is to define the range of all possible functions which is defined in the learning history. We should ensure that the systems evolve in the better way. By better way, we mean that the systems properties will be more refine and accurate. Systems possible learning data must be considered since these data will affect the functional properties. [12]

Since the V&V methodology of NN control systems are depended on the knowledge of qualifying pervious control systems, the type of NNs, and the effect of NN on systems performance. Hence, [18] suggests the approach to verify and validate NN systems, so called the learning algorithm. We must consider the overall architecture of NN within the flight control systems and its performance We must take the type of NN into account We must consider the algorithm that used to NN to solve the particular problems

Also, [18] proposes the approach to ensure that the NN learns correctly on real-time adaptive flight control systems which is derived from nonlinear analysis and the NN structure. Verify the learning algorithm by sensitivity and noise analysis Evaluate the NN architecture with its learning algorithm which may require sensitivity and noise analysis techniques Validate the entire systems by using a real-time adaptive neural network to correct for surface failures/damages. This requires an extensive test matrix Systems stability and control must be evaluated for the whole flight envelope, all possible surface failure, and possible damage consequences. This step needs the damage matrix which includes such a parameter as loss of lift, pitch, yaw, and roll moment, asymmetrical drag and thrust failures. To validate such a large test matrix, it requires nonlinear simulations and the test on an actual plant. Ensure the correct of systems behavior Assigns bounds to their output error under all operating conditions and certify that there are no combination of input which can lead to catastrophic output

Literature Review
Towards Verifiable Adaptive Control for Safety Critical Applications [14] Although our interesting is about how can we verify and validate the adaptive control systems, Mac Schwagers Master thesis has another aspect to deal with V&V on safety critical problems by purposing the design methodology of verifiable controller for safety critical applications. In this thesis, they present Reduced Linear Asymptotic System (RLAS) which is derived from an asymptotic analysis of error dynamics of a direct adaptive controller and uncertain linear plant. RLAS can be used for designing adaptive systems to satisfy the transient requirements. With RLAS, we can analyze asymptotic oscillatory properties of adaptive systems. Moreover, it also provides a simpler method to design and

verify adaptive control systems standard transient specifications. Furthermore, they also develop an algorithm for direct-adaptive control of plants with magnitude saturation constraints on multiple inputs. Boundeness of all signals is proved for initial conditions in a compact region. Additionally, the notion of a class of multi-dimensional saturation functions and saturation compensation technique are introduced. Finally, they use these tools to apply to design a direct-adaptive controller for a realistic multi-input aircraft model. A control design for incorporating control allocation and reconfiguration is also introduced. An Approach to V&V of Embedded Adaptive Systems [15] This literature proposes a non-conventional V&V algorithm which can be applied for intelligent flight control systems (IFCS) which are implemented neural network as the adaptive learning paradigm. Their approach consists of a novelty data detector using Support Vector Data Description (SVDD) to detect an abnormal data patterns. The support vector data description can form a decision boundary for the learned data domain. In addition, they also invent the Online Stability Monitoring tools based on Lyapunovs Stability Theory to detect unstable learning in Dynamic Cell Structure (DCS) neural network. In this monitoring tool, they constructed four Lyapunov-like functions to analyze the DCS networks learning stability. The result from SVDD can define the nominal performance regions for the given application domain. It can also separate faulty event and normal event in the real time manner. Furthermore, the Lypunov-like function can provide a realization of convergence tracking of adaptation error to notify unsafe or safe state of the adaptive control systems. Lyapunov Stability Analysis of the Quantization Error for DCS Neural Networks [16] In this paper, they investigate the quantization error for Dynamics Cell Structure (DCS) Neural Network to show that it can be used to monitor the Lyapunov stability of the weight centers of NN. Nevertheless, the error of quantization is still not the perfect approach to verify a topological stability for a given fixed input manifold in DCS. Another problem about DCS is that we do not know when and what circumstances DCS will achieve the desire accuracies. They construct the Lyapunov function which work in parallel with DCS learning to measure how effective the placement of neural network during the NNs approximation is. However, it does still not provide any confident about systems accuracies in the feature manifold. Additionally, they prove by simulation that the formation of an accurate mapping of the input manifold onto the output manifold depends on the moment where the learning procedure stops. Further, the simulation result cannot provide information about a local minimum and maximum error during the formation of an accurate topology preserved feather map, hence, they cannot be used as a stopping criteria for learning process. On Verification & Validation of Neural Network Based Controllers [11] In this literature, they expound a layered approach for Artificial Neural Networks (ANNs) V&V methodologies for measuring and monitoring the confidence of the ANNs input, and some numerical issues related with their works. In this paper, they investigate V&V for IFCS which is consisted of two types of ANNs, pre-trained neural network (PTNN) and Online Learning Neural Network (OLNN). A PTNN is a purely deterministic while OLNN is difficult to determine since it depends on what it will learn. Due to the deterministic nature of PTNN, V&V on this kind of NN is expected to perform reasonably. On the other hands, OLNN needs more concern. Thus, their focuses are on algorithms for monitoring NNs behavior dynamically, confidence interval, and how reliable the NNs anticipation is. Nevertheless, their

work does not mention about the V&V of the entire system, instead, they just focus only on the NN controller. Lyapunov Analysis of Neural Network Stability in an Adaptive Flight Control System [17] In this paper, they emphasize on Lyapunovs Second Method approach to prove that while the neural networks are learning from a fixed input manifold, the neural networks are self-stabilizing in a Globally Asymptotically Stable (GAS) manner by creating Lyapunov function for DCS neural network. Additionally, they also propose an approach to monitor the systems stability in real-time manner when the systems deal with variable data manifolds. The test results are received by testing with F-15 flight simulator. Verification and Validation of Complex Adaptive Systems [18] In this paper, they invent an automatic test tool (Automated Neural Flight Control System Test Tool, ANCT) which can effectively perform a simulation using for V&V of adaptive control systems over the systems entire operating envelop and under specified fault situation. ANCT is developed in MATLAB environment. Also, ANCT can used to perform validation of adaptive neural flight control systems in various flight condition, performance, and regions of stability. Tools and Methods for the Verification and Validation of Adaptive Aircraft Control Systems [19] They present several V&V methodologies such as Lyapunov analysis, statistical inference, and comparison to Kalman filters. Also, they investigate in two monitoring tools for two kinds of neural networks implementing in the NASA F-15 system, the confidence tool for the output of a Sigma-Pi network and the validity index for the output of DCS network. Both tools provide statistical aspects in NN predictions and the real-time performance of the network. However, the tools discussed in this paper just provide a performance measurement for neural network but not for the entire controller. A tool for Verification and Validation of Neural Network Based Adaptive Controllers for High Assurance Systems [20] In this literature, they use a confidence interval (error bar) to develop a tool measuring the NN by calculating confidence interval around the NNs output. This tool can also use as a pre-implement and in-flight verification. The tool is developed in Simulink environment and use F-15 aircraft implemented IFCS Adaptive Control Architecture as a model for simulation. Verification and Validation Methodology of Real-time Adaptive Neural Networks for Aerospace Applications [21] This paper is a survey for the ongoing work on the V&V tool of NN based adaptive controllers in aerospace applications. The tool can monitor NNs behavior in real-time and provide a confidence interval and also determine the reliability sensitivity for parameters. By detecting the catastrophic failures, this tool can help us to establish reliability of NN based adaptive control system and provide us more understanding in performance of the adaptive systems. Further, these tools are also integrated into an ANCT.

Reference
[1] A. Mili, G. Jiang, B. Cukic, Y. Liu, and R. B. Ayed. Towards the Verification and Validation of Online Learning Systems: General Framework and Applications. in Proc. of the 37th Annual Hawaii International Conference on System Sciences (HICSS'04), track 9, vol. 9, 2004 [2] J. Schumann, S. Nelson. Toward V&V of Neural Network Based Controllers. WOSS, Charleston, SC, November 2002 [3] A. Mili, B, Cukic, Y. Liu and R.B. Ayed. Towards the verification and validation of online adaptive systems. accepted for Special Volume of CI in SE, October, 2002. [4] J. Schumann, S. Nelson. Toward V&V of Neural Network Based Controllers. WOSS, Charleston, SC, November 2002 [5] J. M. Wohletz, J. D. Paduano, and A. M. Annaswamy. Retrot systems for reconguration in civil aviation. In Proceedings of AIAA Guidance, Navigation, and Control Conference, pages 995{1005, Portland, OR, August 9-11 1999. [6] M. Bodson and J. E. Groszkiewicz. Multivariable adaptive algorithms for recongurable ight control. IEEE Transactions on Control Systems Technology, 5(2):217{229, March 1997. [7]K. S. Kim, K. J. Lee, and Y. Kim. Model following recongurable ight control system design using direct adaptive scheme. In Proceedings of AIAA Guidance, Navigation, and Control Conference, pages 995{1005, Monterey, CA, August 5-8 2002. [8] G. Tao, S. M. Joshi, and X. Ma. Adaptive state feedback and tracking control of systems with actuator failures. IEEE Transactions on Automatic Control, 46(1):78{95, January 2001. [9] Y. Liu. Verification and Validation of Online Adaptive Systems. Ph. D Thesis, Dept. of Computer Science and Electrical Engineering, West Virginia University, 2002 [10]A. Mili, G. Jiang, B. Cukic, Y. Liu, and R. B. Ayed. Towards the Verification and Validation of Online Learning Systems: General Framework and Applications. in Proc. of the 37th Annual Hawaii International Conference on System Sciences (HICSS'04), track 9, vol. 9, 2004 [11]Johann Schumann, Pramod Gupta and Stacy Nelson. On Verification & Validation of Neural Network Based Controller. URL: http://ti.arc.nasa.gov/people/schumann/publications/papers/2003/eann03.pdf [12]Thien-Anh Pham. Validation And Verification of Aircraft Control Software for Control Improvement. A project report, The faculty of the department of computer science, San Jose State University, May 2007

[13]Cooper-Harper Handling Qualities Rating Scale, URL: http://history.nasa.gov/SP-3300/fig66.htm, 2007. [14]Mac Schwager. Towards Verifiable Adaptive Control for Safety Critical Applications. MS. Thesis, Dept. of Mechanical Engineering, Massachusetts Institute of Technology, June 2005 [15]Sampath Yerramalla, Yan Liu, Edgar Fuller, Bojan Cukic, and Srikanth Gururajan. An Approach to V&V of Embedded Adaptive Systems. Lecture Notes in Computer Science : Formal Approaches to Agent-Based Systems, ISSN 0302-9743 (Print) 1611-3349 (Online) , ISBN 978-3-540-24422-6,Vol. 3228/2005,p 173188, Springer-Verlag Berlin Heidelberg 2005 [16] Sampath Yerramalla, Edgar Fuller. Lyapunov Stability Analysis of the Quantization Error for DCS Neural Networks. Proceedings of the 2003 International Joint Conference on Neural Networks, IEEE Press. [17] Sampath Yerramalla, Edgar Fuller, Martin Mladenovski, and Bojan Cukic. Lyapunov Analysis of Neural Network Stability in an Adaptive Flight Control System. Lecture note in computer science ISSN 0302-9743, International symposium on self-stabilizing system, San Francisco CA, ETATS-UNIS (24/6/2003), Vol. 2704, pp.77-91, ISBN 3-540-40453-8, Springer-Verlag Berlin Heidelberg 2003 [18] Phattanard Phattanasri, Kenneth A. Loparo, and Fola Soares. Verification and Validation of Complex Adaptive Systems. EECS Department, Case Western Reserve University and Contek Research, Inc. April 2005, URL: http://www.riacs.edu/navroot/Outreach/workshopAug05/docs/papers/loparo.pdf [19] Johann Schumann and Yan Liu. Tools and Methods for the Verification and Validation of Adaptive Aircraft Control Systems. In proceeding of Aerospace Conference, 2007 IEEE 3-10 March 2007. [20] Pramod Gupta and Johann Schumann. A tool for Verification and Validation of Neural Network Based Adaptive Controllers for High Assurance Systems. In proceeding of the Eighth IEEE International Symposium on High Assurance Systems Engineering 2004 (HASE04) [21] P. Gupta, K.A. Loparo, D. Mackall, J.Schumann, and F.R. Soares. Verification and Validation Methodology of Real-time Adaptive Neural Networks for Aerospace Applications. URL:http://ti.arc.nasa.gov/m/pub/archive/0777.pdf [22]Yan Liu, Bojan Cukic, Edgar Fuller, Sampath Yerramalla, and Srikanth Gururajan. Monitoring techniques for an online neuro-adaptive controller. The Journal of Systems and Software 79 (2006) 15271540 [23]Mac Schwager, Anuradha M. Annaswamy, and Eugene Lavretsky. Towards Verifiable Adaptive Flight Control for Safety Critical Applications. In proceeding of AIAA Guidance, Navigation, and Control Conference and Exhibit 15 - 18 August 2005, San Francisco, California . [24] Yaw, Pitch, and Roll. URL: http://en.wikipedia.org/wiki/Aircraft_principal_axes