Stability and Safety through Event-Triggered Intermittent Control
with Application to Spacecraft Orbit Stabilization
Pio Ong, Gilbert Bahati, and Aaron D. Ames
Abstract
— In systems where the ability to actuate is a scarce
resource, e.g., spacecrafts, it is desirable to only apply a given
controller in an intermittent manner—with periods where the
controller is on and periods where it is off. Motivated by
the event-triggered control paradigm, where state-dependent
triggers are utilized in a sample-and-hold context, we generalize
this concept to include state triggers where the controller
is off thereby creating a framework for
intermittent control
.
Our approach utilizes certificates—either Lyapunov or barrier
functions—to design intermittent trigger laws that guarantee
stability or safety; the controller is turned on for the period for
which is beneficial with regard to the certificate, and turned off
until a performance threshold is reached. The main result of
this paper is that the intermittent controller scheme guarantees
(set) stability when Lyapunov functions are utilized, and safety
(forward set invariance) in the setting of barrier functions.
As a result, our trigger designs can leverage the intermittent
nature of the actuator, and at the same time, achieve the
task of stabilization or safety. We further demonstrate the
application and benefits of intermittent control in the context
of the spacecraft orbit stabilization problem.
I. I
NTRODUCTION
Modern control systems typically implement continuous-
time controllers in a discrete fashion—often using sample-
and-hold. The controller is, therefore, held at a constant
value over a fixed interval or, through the modern paradigm
of event-triggered control [1]–[3], over variable intervals
determined by a triggering law. Yet in many systems it is
not desirable to keep the controller on at all times, especially
if there are finite resources for actuation, as this requires
control effort to be constantly expended. A prime example
of such systems are spacecrafts which have limited resources
(e.g., fuel and power), and so thrusters can only fire in an
intermittent fashion. The goal of this paper is to capture this
notion in a principled fashion through the introduction of
event-triggered intermittent control
.
Literature Review:
There are, broadly speaking, two
exiting approaches taken in the synthesis of intermittent
controllers: direct and indirect. The first approach designs
the controller that captures the intermittent nature in its
implementation. Typically, intermittent control systems are
treated as switched systems, either with time-based switch-
ing [4] or state-based [5]–[7]. The second approach is an
indirect one as it first designs the continuous-time controllers
and then implements them in an intermittent fashion. Most
This research is supported in part by Raytheon Technologies and the
National Science Foundation (CPS Award #1932091).
Pio
Ong,
Gilbert
Bahati,
and
Aaron
D.
Ames
are
with
the
Department
of
Mechanical
and
Civil
Engineering,
Cal-
ifornia
Institute
of
Technology,
Pasadena,
CA
91125,
USA.
{
pioong,gbahati,ames
}
@caltech.edu
works [8]–[11] enable intermittent control by prescribing a
constant threshold for the error introduced by the intermittent
implementation. However, the analyses and methods rely on
the systems being linear. Through the use of certificates,
this paper develops an intermittent control framework for
nonlinear systems.
The approach to intermittent control taken in this paper
leverages the event-triggered control framework. In this
setting, to enable sample-and-hold implementation of a con-
troller, [1] utilizes ISS Lyapunov functions [12] for their
robustness. Through monitoring the Lyapunov function and
ensuring that its time-derivative remains negative, the task
of stabilization can be accomplished. Event-triggered control
has been employed for intermittent control in [13]; however,
the scheme relies on using a linear predictor, and the result
is limited to linear systems. The main obstruction of using
event-triggered control for intermittent control is that the
traditional framework developed by [1] does not allow for
the possibility of Lyapunov function to increase, which can
happen when the control input is set to zero. To this end,
there are trigger frameworks, dynamic triggering [14] and
performance-barrier-based triggering [15], that can accom-
modate this behavior. In particular, we build our intermit-
tent control results on the work [15] because it already
incorporates the concept of control barrier functions [16]
in its design—this will enable the synthesis of intermittent
controllers in the context of safety. Other examples of event-
triggered control in the context of safety include [17], [18].
The latter work uses the concept of Input-to-state safe barrier
function [19] to establish minimum inter-event time. This
paper builds on the [18] with the concepts in [15] to address
the intermittent control problem in the context of safety.
Statement of Contribution:
This paper presents a novel
intermittent control framework for nonlinear systems lever-
aging certificate-based event triggers. To this end, we take
inspiration from event-triggered control and its opportunistic
nature in sampling control inputs—extended this concept to
include periods where the controller is off. The first contri-
bution of this paper is an intermittent trigger scheme that
opportunistically determines when to switch the controller
between on and off in order to achieve (set) stabilization.
Our design is based on monitoring the value of a given input-
to-state stable (ISS) Lyapunov function and guaranteeing
that overall, it decreases over time. Our second contribution
is the extension of this framework to safety, wherein we
develop a trigger scheme that guarantees forward invariance
of a desired time-varying set. The idea, analogous to the
stabilization case, is based on monitoring a strong input-to-
arXiv:2204.03110v1 [eess.SY] 6 Apr 2022
state safe barrier function (sISSf-BF).
The trigger schemes developed and presented in this paper
allow continuous-time controllers to be implemented in an
intermittent fashion with formal guarantees of stability (via
Lyapunov functions) and safety (via barrier functions). Thus,
to the best of our knowledge, this paper presents the first
instance of a certificate-based event triggered control scheme
that effectively allows for the implementation of continuous-
time controllers for nonlinear systems in an intermittent
fashion. To demonstrate the utility and benefits of inter-
mittent control, we consider stabilization of a spacecraft
around a small asteroid in a tight orbit—the spacecraft orbit
stabilization problem. We provide a detailed exposition of
how the theoretic methods developed in this paper can be
used to design intermittent control inputs that stabilize the
spacecraft to a tube around the desired orbit. Simulations
demonstrate the effectiveness of our results.
Notation:
We use
N
,
R
,
R
≥
0
,
R
>
0
to denote natural, real,
nonnegative, and positive numbers, respectively. For a vector
x
∈
R
n
and a matrix
A
∈
R
n
×
n
,
‖
x
‖
and
‖
A
‖
denotes
the Euclidean norm and the spectral norm, respectively. A
function
α
: [0
,a
)
→
R
≥
0
with
a >
0
, is of class-
K
∞
if
α
(0) = 0
,
α
is strictly increasing, and
lim
s
→∞
α
(
s
) =
∞
.
Given a system and an initial condition
x
0
, let
x
:
R
≥
0
→
R
n
be a solution, a time-varying set
C
is forward invariant if
x
(
t
)
∈C
(
t
)
for all time whenever
x
0
∈C
(0)
.
II. O
PPORTUNISTIC
C
ONTROLLER
I
MPLEMENTATION
This section reviews the concept of event-triggered con-
trol. We consider the nonlinear control system:
̇
x
=
f
(
x,u
)
(1)
where
x
∈
R
n
is the state and
u
∈
R
m
is the control input.
In practice, a control signal of a state-feedback controller
k
:
R
n
→
R
m
is digitally implemented in a sample-and-
hold fashion. The control signal is updated by sampling the
controller at time
t
i
, and it is held constant until the controller
next sampled at
t
i
+1
. The closed-loop system for the time
t
∈
[
t
i
,t
i
+1
)
is then given by:
̇
x
=
f
(
x,k
(
x
(
t
i
))) =
f
(
x,k
(
x
+
e
))
(2)
where
e
=
x
(
t
i
)
−
x
is the error introduced from sample-
and-hold implementation. Typically, in order to minimize the
error, the controller is sampled periodically and frequently,
in which case we can rely on sampling theory to guarantee
the expected system behavior. Alternatively, event-triggered
control takes a more opportunistic approach by prescribing
state-dependent trigger criteria for when the control signal
gets adjusted. Under this approach, each prescribed criterion
ensures the satisfaction of a certificate that guarantees a
desired system objective. For instance, a criterion may be
designed to guarantee that a Lyapunov function is monoton-
ically decreasing along the trajectory.
Event-triggered control relies on system robustness to
allow for sample-and-hold error. The key idea behind event-
triggered control is to monitor the error, and only remove the
error (i.e., by adjusting the controller to the correct value)
when the system can no longer accommodate for it. One
robustness property often used in event-triggered control is
from the
Input-to-State Stability (ISS) Lyapunov function
[12]
for the system (2). In this paper, we also assume the existence
of such a function
V
:
R
n
→
R
satisfying:
α
(
‖
x
‖
)
≤
V
(
x
)
≤
α
(
‖
x
‖
)
,
(3a)
∂V
∂x
∣
∣
∣
∣
x
f
(
x,k
(
x
+
e
))
︸
︷︷
︸
,
L
f
V
(
x,e
)
≤−
α
(
‖
x
‖
) +
γ
(
‖
e
‖
)
(3b)
with class-
K
∞
functions
α
,
α
,
α
, and
γ
. With the ISS
Lyapunov function, [1] provides the trigger design:
t
k
+1
,
min
{
t > t
i
| −
σα
(
‖
x
(
t
)
‖
) +
γ
(
‖
e
(
t
)
‖
) = 0
}
(4)
with a design parameter
σ
∈
(0
,
1)
for robustness. This
trigger criterion ensures that
γ
(
‖
e
‖
)
< σα
(
‖
x
‖
)
, and the
Lyapunov function is monotonically decreasing along any
trajectory. Furthermore, as established in [1] under mild
assumptions, there exists a minimum inter-event time (MIET)
between two consecutive update times, which rules out the
possibility of an incomplete solution, i.e., Zeno behavior.
We discuss next the performance-barrier-based trigger
framework [15], which builds on the trigger design (4). The
framework incorporates the concept of barrier function [20]
to abandon the monotonic decrease of the Lyapunov function
in order to extend inter-event times. In this framework, we
use a time-varying set defined with the sublevel set of the
Lyapunov function.
Definition 1.
(Safe Performance Set):
A
performance speci-
fication function
is a continuously differentiable function
S
:
R
→
R
≥
0
. Associated with
S
, and an ISS Lyapunov function
V
, is the time-varying
safe performance set
:
C
(
t
) =
{
x
∈
R
n
|
V
(
x
)
≤
S
(
t
)
}
.
(5)
With the performance specification function, the trigger
design put forth by [15] is given by:
t
k
+1
,
min
{
t > t
i
|L
f
V
(
x
(
t
)
,e
(
t
))
−
(1
−
σ
)
α
(
‖
x
(
t
)
‖
)
=
β
(
S
(
t
)
−
V
(
x
(
t
)))
}
(6)
where
β
is a class-
K
∞
function. The condition in the trigger
above is based on the control barrier function concept, and
it ensures that the system trajectory is contained within the
safe performance set
C
, under an assumption on the time-
derivative of the performance specification function
S
. Under
this approach, one notable benefit is that the certificate
V
is
allowed to increase along the trajectory. We will exploit this
special characteristic in the following section.
III. E
VENT
-T
RIGGERED
I
NTERMITTENT
C
ONTROL
This section proposes a trigger scheme that enables the
implementation of a state-feedback controller in an inter-
mittent fashion. We consider systems where the controllers
gets turned off after each usage. Particularly, the controller
is sample-and-held from time
t
on
i
to
t
off
i
, and it is then
turned off up to the time
t
on
i
+1
. Assuming that
k
(0) = 0
,
the
intermittently-implemented control system
is given by:
̇
x
=
{
f
(
x,k
(
x
(
t
on
i
)))
, t
∈
[
t
on
i
,t
off
i
)
f
(
x,k
(0))
,
t
∈
[
t
off
i
,t
on
i
+1
)
(7)
where
t
on
i
< t
off
i
for all
i
∈
N
. Our goal is to design
trigger conditions that prescribe the sequences
{
t
on
i
}
i
∈
N
and
{
t
off
i
}
i
∈
N
such that a desired set (or just the origin) is
asymptotically stable.
Figure 1 shows an overview of our trigger scheme. Our
main idea is to monitor a certificate function as it evolves
in time, more specifically, we ensure that
V
is strictly
decreasing when the controller is on, but only ensure that
it is below a performance specification function
S
when the
controller is off. The latter allows for
V
to increase, but we
can make sure it decreases overall by properly prescribing
the performance specification
S
.
A. Trigger Design: Controller Off
We start with the trigger design for when to turn the
controller off. We follow the simple idea of allowing the
controller usage as long as it performs desirably or until it
is required to be turned off for other reasons. That is, we
define the trigger:
t
∗
i
,
min
{
t > t
on
i
|
L
f
V
(
x
(
t
)
,e
on
i
(
t
)) + (1
−
σ
)
α
(
‖
x
(
t
)
‖
) = 0
}
(8a)
where
e
on
i
(
t
) =
x
(
t
on
i
)
−
x
(
t
)
. Then with
T
max
∈
R
>
0
∪∞
as the maximum time the controller can remain on, we turn
the controller off at:
t
off
i
,
min
{
t
∗
i
,t
on
i
+
T
max
}
.
(8b)
By design, the trigger assures
dV
dt
<
(
σ
−
1)
α
(
‖
x
(
t
)
‖
)
between time
t
on
i
and
t
off
i
, and the certificate
V
decreases
during the time interval. In addition, the work [1] provides
a MIET for the trigger design (8a), which we can use to
establish a MIET for our trigger design (8), as stated below.
Lemma 2.
(Minimum Inter-event Time): Consider the
intermittently-implemented control system
(7)
. Given an ISS
Lyapunov function
(3)
for the sample-and-hold system
(2)
,
let
t
off
i
be determined according to the trigger
(8)
. Assume
f
,
k
,
α
−
1
, and
γ
are locally Lipschitz. Then, for a given
forward invariant compact set
Ω
, if
x
(
t
on
i
)
∈
Ω
, then there
exists a MIET
τ
such that
t
off
i
−
t
on
i
≥
τ
.
Proof.
We begin by noting that at time
t
on
i
,
e
on
i
(
t
on
i
) = 0
by its definition. Then, the left hand side of the trigger
condition (8a) is bounded as:
L
f
V
(
x
(
t
on
i
)
,
0) + (1
−
σ
)
α
(
‖
(
x
(
t
on
i
)
‖
)
≤−
σα
(
‖
(
x
(
t
on
i
)
‖
)
from the bound (3b). Hence, it is negative at the beginning
of the interval
[
t
on
i
,t
off
i
)
. As the error
e
on
i
grows, the trigger
condition (8a) monitors and ensures that the left hand side
expression remains negative for the duration. Here we note
from the bound (3b):
L
f
V
(
x,e
on
i
) + (1
−
σ
)
α
(
‖
x
‖
)
≤−
σα
(
‖
x
‖
) +
γ
(
‖
e
on
i
‖
)
.
Fig. 1. Trigger scheme overview for intermittent controller implementation.
Along the trajectory, the upper bound must reach the value
of zero first, and thus:
t
∗
i
≥
min
{
t > t
on
i
| −
σα
(
‖
x
(
t
)
‖
) +
γ
(
‖
e
on
i
(
t
)
‖
) = 0
}
.
Then, as proven in [1, Thm. 3.1], under the Lipschitzness
assumptions, there exists a MIET
τ
∗
such that the right hand
side is lower bounded by
t
on
i
+
τ
∗
. Hence,
t
∗
i
−
t
on
i
≥
τ
∗
,
and the MIET for the overall trigger design (8) is
τ
=
min
{
τ
∗
,T
max
}
.
The MIET provided in Lemma 2 rules out the possibility
of a Zeno solution to the intermittently-implemented control
system (7). Thus, if we can enforce the convergence of the
certificate
V
towards zero, we may conclude asymptotic
stability of the equilibrium of the system. To this end, we
next discuss our trigger design for when to turn the controller
back on, in order to guarantee an overall decrease of the
certificate
V
over time.
B. Trigger Design: Controller On
The certificate
V
may increase while the controller is off.
When the controller is turned off, the control input is set to
zero. The sample-and-hold-error
e
on
i
is replaced with
e
off
i
.
Assuming
k
(0) = 0
, we have
k
(0) =
k
(
x
+
e
off
i
)
. Thus, we
find that
e
off
i
=
−
x
and:
dV
dt
(
t
) =
L
f
V
(
x
(
t
)
,e
off
i
(
t
))
≤−
α
(
‖
x
(
t
)
‖
) +
γ
(
‖
x
(
t
)
‖
)
.
In general, we cannot assume that the origin is asymptotically
stable without any control input, so it is possible that the
rate of change of
V
is positive. As such, we leverage the
performance-barrier-based trigger design (6) idea of allowing
the certificate
V
to increase. We summarize our trigger
design in the following result.
Lemma 3.
(Trigger Design: Controller On): Consider the
intermittently-implemented control system
(7)
. Given an ISS
Lyapunov function
(3)
for the sample-and-hold system
(2)
,
let
t
on
i
+1
be determined according to:
t
on
i
+1
,
min
{
t > t
off
i
|L
f
V
(
x
(
t
)
,e
off
i
(
t
))
−
dS
dt
(
t
)
=
c
β,i
(
S
(
t
)
−
V
(
x
(
t
)))
}
(9)
with a design parameter
c
β,i
>
0
. Assuming
V
(
x
(
t
off
i
))
6
=
S
(
t
off
i
)
, let
c
β,i
be such that:
c
β,i
>
L
f
V
(
x
(
t
off
i
)
,e
off
i
(
t
off
i
))
−
dS
dt
(
t
off
i
)
S
(
t
off
i
)
−
V
(
x
(
t
off
i
))
.
(10)
Then for time
t
∈
[
t
off
i
,t
on
i
+1
)
,
S
(
t
)
> V
(
x
(
t
))
and the safe
performance set
C
is rendered forward invariant.
Proof.
Given
x
(
t
off
i
)
∈C
(
t
off
i
)
and
V
(
x
(
t
off
i
))
6
=
S
(
t
off
i
)
, we
have
V
(
x
(
t
off
i
))
< S
(
t
off
i
)
. Thus,
c
β,i
satisfying (10) ensures:
L
f
V
(
x
(
t
)
,e
off
i
(
t
))
−
dS
dt
(
t
)
< c
β,i
(
S
(
t
)
−
V
(
x
(
t
))
)
at time
t
=
t
off
i
. Then because of the trigger design (9), the
inequality above continues to hold, due to continuity of the
trajectory, until it becomes equality at
t
on
i
+1
. As a result, it
follows from the Comparison Lemma [21, Lemma 3.4] that:
d
(
V
◦
x
)
dt
(
t
)
−
dS
dt
(
t
)
< c
β,i
(
S
(
t
)
−
V
(
x
(
t
)))
,
⇒
S
(
t
)
−
V
(
x
(
t
))
> e
−
c
β,i
(
t
−
t
off
i
)
(
S
(
t
off
i
)
−
V
(
x
(
t
off
i
)))
⇒
S
(
t
)
−
V
(
x
(
t
))
>
0
,
∀
t
∈
[
t
off
i
,t
on
i
+1
)
,
since
S
(
t
off
i
)
−
V
(
x
(
t
off
i
))
>
0
. Therefore, the performance
set
C
is forward invariant.
Lemma 3 provides a trigger for when the controller needs
to be back on. The trigger has two design elements: the
constant
c
β,i
and the performance specification function
S
.
Regarding the former, it may be difficult to find a common
c
β
that satisfy the bound (10) for all
i
∈
R
n
, which is
why we add the subscript
i
to the design parameter in order
to emphasize that they can be different. Consequently, the
parameter can be chosen in an online fashion, specifically
at each time
t
off
i
. Similarly, the function
S
on the interval
[
t
off
i
,t
on
i
)
can be defined at each time
t
off
i
. Particularly,
S
simply needs to be picked so that
S
(
t
off
i
)
> V
(
x
(
t
off
i
))
.
Remark 4.
(Generalization of the controller on trigger
design): In this paper, the trigger
(9)
is given with a de-
sign parameter
c
β,i
. This parameter relates the relationship
between the speed at which the certificate function
V
is
allowed to approach the bound
S
, and the difference,
S
−
V
,
between the two. In general, this constant can be replaced
with a class-
K
∞
function
β
i
:
R
→
R
, and the proof
for Lemma 3 will invoke Nagumo’s theorem [22], instead
of proving the positivity of the difference
S
−
V
with the
Comparison Lemma. The reason we use a linear function
β
i
with the constant
c
β
i
is that the exponential bound for
S
−
V
may be useful for analyses in future works. We further believe
it is more intuitive to tune a linear constant than a function.
•
C. Trigger Scheme for Intermittent Implementation
We now combine the two trigger conditions to obtain result
on intermittent control.
Theorem 5.
(Trigger Scheme for Intermittent Implementa-
tion): Consider the intermittently-implemented control sys-
tem
(7)
with the sequences
{
t
on
i
}
i
∈
N
and
{
t
off
i
}
i
∈
N
iteratively
determined by trigger designs
(8)
and
(9)
. In addition to all
the assumptions of Lemmas 2 and 3, let
S
be a bounded
function such that
S
(
t
)
≥
V
(
x
(
t
))
for time
t
∈
[
t
on
i
,t
off
i
)
for all
i
∈
N
. Then the safe performance set
C
is forward
invariant, i.e.,
x
(
t
)
∈C
(
t
)
at all time.
Proof.
From Lemma 3 and the assumption of the theorem,
we ensure that
S
(
t
)
≥
V
(
x
(
t
))
at time
[
t
on
i
,t
on
i
+1
)
. Con-
sequently, let
S
max
∈
R
>
0
be the upper bound of
S
, the
compact sublevel set
Ω =
{
x
∈
R
n
|
V
(
x
)
≤
S
max
}
is
forward invariant, and we can use Lemma 2 to establish a
MIET
τ
to lower bound
t
on
i
+1
−
t
on
i
> τ
. This rules out the
possibility of Zeno behavior, and therefore,
lim
i
→∞
t
i
=
∞
.
Hence,
x
(
t
)
∈C
(
t
)
for all time, concluding the proof.
Theorem 5 offers a trigger scheme that enables an inter-
mittent implementation of the controller
k
. Note importantly
that there is an additional assumption introduced by the
theorem on the performance specification function
S
. That
is, the theorem requires
S
(
t
)
≥
V
(
x
(
t
))
for time
t
∈
[
t
on
i
,t
off
i
)
, However, because the function
S
does not appear
in the trigger design (8) on the interval
[
t
on
i
,t
off
i
)
, it can
be implicitly defined to meet the requirement. Consequently,
we only need to specify
S
so that
S
(
t
off
i
)
> V
(
x
(
t
off
i
))
.
Nevertheless, if we want to achieve stabilization tasks, we
need to further specify the convergence of
S
. We formalize
this in the next result.
Corollary
6.
(Sublevel
Set
Stabilization):
For
the
intermittently-implemented control system
(7)
with the
sequences
{
t
on
i
}
i
∈
N
and
{
t
off
i
}
i
∈
N
iteratively determined
by trigger designs
(8)
and
(9)
. Let the performance
specification
function
S
satisfy
the
assumptions
of
Theorem 5. If
lim
t
→∞
S
exists then the sublevel set
C
∞
=
{
x
∈
R
n
|
V
(
x
)
≤
lim
t
→∞
S
(
t
)
}
is globally
asymptotically stable. Furthermore, if
lim
t
→∞
S
= 0
, then
the origin of the system is globally asymptotically stable.
Corollary 6 follows directly from the forward invariance of
C
from Theorem 5, and it suggests an additional condition
on
S
in order to enforce the certificate
V
to evolve in a
meaningful way. As an example for how to prescribe the
function
S
so that the origin is rendered globally asymptot-
ically stable,
S
can be defined, for each interval
[
t
off
i
,t
on
i
+1
)
,
with
S
(
t
off
i
) = (
V
(
t
on
i
) +
V
(
t
off
i
))
/
2
and
̇
S
=
−
λS
for
some convergence rate
λ >
0
. An alternative way of picking
the function
S
is to consider it as a performance criteria,
cf. [15]; however, such a method may require an estimation
of a convergence parameter which may lead to conservatism
in the overall convergence speed.
Remark 7.
(Inactive Dwell Time):
We refer to the length
of time at which the controller can remain off as
inactive
dwell time
. The inactive dwell time is particularly important
because it ties directly to resource conservation. In order to
maximize the inactive dwell time, the function
S
should be
picked as large as possible. Such a choice of
S
would provide
the certificate
V
more room to increase before the trigger
condition (9) is met. Note however that a large
S
will slow
down convergence towards the desirable set (or the origin).
Another method to lengthen the inactive dwell time is by
increasing
c
β,i
, which affects how close the value of
V
can
get to
S
before the trigger condition is met. However, there is
a limit to how much the inactive dwell time is lengthened via
this method. That is, when
c
β,i
→∞
, the inactive dwell time
is precisely how long it takes for the value of the certificate
V
to reach the function
S
.
•
IV. E
XTENSION TO
S
AFETY
C
ONSTRAINTS
Thus far, we have synthesized intermittent controllers
through the use of an ISS Lyapunov function,
V
, together
with a performance specification function,
S
. In particular,
the main result (specifically Theorem 5) establishes that
the trigger laws render the performance set
C
(
t
)
forward
invariant. The goal of this section is to generalize these
results to performance sets that may not be defined by
Lyapunov level sets. We consider a time-varying safe set:
H
(
t
)
,
{
x
∈
R
n
|
h
(
x,t
)
≥
0
}
where
h
:
R
n
×
R
→
R
is a continuously differentiable
function, wherein its positivity defines a safety condition.
That is, the system is safe if
x
(
t
)
∈ H
(
t
)
. Note that the
performance set,
C
(
t
) =
H
(
t
)
for
h
(
x,t
) =
S
(
t
)
−
V
(
x
)
.
Our starting point is the assumption of safety robustness of
a state-feedback system with a controller
k
, now designed to
accomplish the task of guaranteeing safety. The assumption
we use is the
strong Input-to-State Safety (sISSf)
condition
(see also, [18]):
∂h
∂t
+
∂h
∂x
∣
∣
∣
∣
(
x,t
)
f
(
x,k
(
x
+
e
))
︸
︷︷
︸
,
̇
h
(
x,e,t
)
≥−
ω
(
h
(
x,t
))
−
ι
(
‖
e
(
t
)
‖
)+
d
(11)
where
ω
and
ι
are class-
K
∞
functions, and
d >
0
is
a constant. This condition suggests that the controller
k
enforces forward invariance and asymptotic stability of a
superlevel set
H
e
smaller than
H
. The set
H
e
grows as
e
grows in size.
In the stabilization case, we choose to turn off the con-
troller when the certificate decreases too slowly, due the
presence of sample-and-hold error. Analogously in the safety
case, our idea is to turn off the controller when
H
e
grows
too large (still contained within
H
). Our trigger condition for
turning off the safeguarding controller is given by:
t
∗
i
,
min
{
t > t
on
i
|
̇
h
(
x
(
t
)
,e
on
i
(
t
)
,t
)
=
−
ω
(
h
(
x
(
t
)
,t
)) +
θd
}
(12a)
t
off
i
,
min
{
t
∗
i
,t
on
i
+
T
max
}
(12b)
where
θ
∈
(0
,
1)
. As will be shown later, using this trigger
design,
x
(
t
)
will be in the interior of
H
(
t
)
. Not only does
this accomplish our goal of establishing safety, being in the
interior of the set allow the possibility of turning off the
controller because it will take at least some time to reach the
boundary of the safe set. We provide the following trigger
design for when to turn the controller back on:
t
on
i
,
min
{
t > t
off
i
|
̇
h
(
x
(
t
)
, e
off
i
(
t
)
, t
) =
−
c
β,i
ω
(
h
(
x
(
t
)
, t
))
}
(13)
where
c
β,i
is large enough such that:
c
β,i
>
−
̇
h
(
x
(
t
off
i
)
,e
off
i
(
t
off
i
)
,t
off
i
)
ω
(
h
(
x
(
t
off
i
)
,t
off
i
))
.
This trigger design monitors the safety criterion and deter-
mines the time for turning the controller back on as soon as
the criterion is violated. Assembling the two trigger designs
above, we guarantee safety of system trajectories with the
following result.
Theorem 8.
(Trigger Scheme for Intermittent Implementa-
tion - Safeguarding Controller): Consider the intermittently-
implemented control system
(7)
. Given a barrier function
h
with the sISSf property
(11)
, let the sequences
{
t
on
i
}
i
∈
N
and
{
t
off
i
}
i
∈
N
iteratively determined by trigger designs
(12)
and
(13)
. If the function
f
is bounded and
ι
is Lipschitz
continuous, then
H
is forward invariant, i.e.,
x
(
t
)
∈ H
(
t
)
for all time.
Proof.
We first note that according to [18, Thm. 1], there
exists a MIET
τ
∗
for the trigger design (12a), and thus,
t
off
i
−
t
on
i
≥
min
{
τ
∗
,T
max
}
. Hence, Zeno behavior is ruled out and
all system trajectories will be a complete solution.
At
t
on
i
, the sample-and-hold error
e
on
i
(
t
on
i
) = 0
by defini-
tion, so we have from (11) that:
̇
h
(
x
(
t
)
,e
(
t
)
,t
)
>
−
ω
(
h
(
x
(
t
)
,t
)) +
θd.
The trigger (12) then enforces the above inequality for the
duration
[
t
on
i
,t
off
i
)
by continuity of the system trajectory.
Consequently during this time duration, if
h
(
x
)
< ω
−
1
(
θd
)
(
ω
is invertible because it is a class-
K
function), then
̇
h >
0
.
In particular,
̇
h >
0
when
h
(
x
) = 0
, and thus according to
Nagumo theorem [22],
H
is forward invariant for the time
interval
[
t
on
i
,t
off
i
)
.
Also, following the deduction above, the function
h
must
evolve during
[
t
on
i
,t
off
i
)
from
h
(
x
(
t
on
i
))
≥
0
to
h
(
x
(
t
off
i
))
>
0
. That is, at time
t
off
i
, the inequality must be strict. This
ensures that the trigger design (13) is well-defined with a
possible choice of
c
β,i
. The bound on
c
β,i
directly assures:
̇
h
(
x
(
t
)
,e
(
t
)
,t
)
>
−
c
β,i
ω
(
h
(
x
(
t
)
,t
))
at time
t
off
i
. Then with continuity, the trigger design (13)
ensures the inequality holds for the duration
[
t
off
i
,t
on
i
+1
)
. Once
again, according to Nagumo theorem [22],
H
is forward
invariant for the time interval, concluding the proof.
Theorem 8 assembles the two trigger designs for turning
the controller on and off based on a given barrier function.
Our final result shows that our trigger scheme render the
desired time-varying set forward invariant. The idea is anal-
ogous to the stabilization case. That is, we turn leave the
controller on for as long as the controller drives the state
away from the boundary of the safe set. Then after we turn
off the controller, we leave it off as long as it is safe.
V. A
PPLICATION IN
S
PACECRAFT
O
RBIT
S
TABILIZATION
To illustrate the effectiveness of our trigger design, we
study the task of stabilizing a satellite to a desired orbit.
More specifically, we wish to find a discrete scheduling
of satellite thrusters to maneuver the spacecraft around a
central body so that it eventually tracks a circular orbit.
We consider a satellite whose dynamics are described by
Newton’s gravitational model defined below, cf. [23]:
̇
r
̇
θ
̇
z
̈
r
̈
θ
̈
z
︸
︷︷
︸
̇
x
=
̇
r
̇
θ
̇
z
r
̇
θ
2
−
μr/
(
r
2
+
z
2
)
3
/
2
−
(2
/r
) ̇
r
̇
θ
−
μz/
(
r
2
+
z
2
)
3
/
2
︸
︷︷
︸
F
(
x
)
+
0
0
0
u
1
u
2
/r
u
3
︸
︷︷
︸
G
(
x
)
u
(14)
where
q
= (
r,θ,z
)
are the cylindrical coordinates describing
the radial position, angle, and height, respectively, of the
satellite with respect to a desired orbital plane and the state
x
= (
q,
̇
q
)
. Next, we illustrate our approach of designing an
intermittent controller that stabilizes a desired orbit.
Remark 9.
(Generalization to Feedback Linearization Prob-
lems): Even though we use the spacecraft orbit stabilization,
as an example, to demonstrate our results, the general
ideas in the following procedure are applicable to any other
feedback linearizable system.
•
Task I: Obtaining a Control Lyapunov Function
We begin by using feedback linearization to help construct
a Control Lyapunov Function (CLF). Feedback linearization
allows us to synthesize a coordinate transformation from the
nonlinear system (14) to a linear system, allowing us to use
linear control techniques to synthesize a CLF. In particular,
we consider (vector relative degree 2 [24]) outputs:
y
,
r
−
r
des
,
θ
−
(
θ
0
+
√
μ/r
3
des
t
)
z
⇒
̇
y
=
̇
r
̇
θ
−
√
μ/r
3
des
̇
z
where the origin corresponds to a circular orbit with radius
r
des
. It follows that
y
has relative degree 2 since:
̈
y
=
r
̇
θ
2
−
μr/
(
r
2
+
z
2
)
3
/
2
−
(2
/r
) ̇
r
̇
θ
−
μz/
(
r
2
+
z
2
)
3
/
2
︸
︷︷
︸
L
2
F
y
(
x
)
+
1 0 0
0
1
r
0
0 0 1
︸
︷︷
︸
L
F
L
G
y
(
x
)
u
(15)
with the decoupling matrix
L
F
L
G
y
(
x
)
invertible (we assume
r >
0
along the trajectory). Therefore, for
η
= (
y,
̇
y
)
,
applying the feedback linearizing control input:
u
=
L
F
L
G
y
(
x
)
−
1
(
−L
2
F
y
(
x
) +
v
)
,
(16)
with an auxiliary input
v
∈
R
3
, yields the linear system:
̇
η
=
[
0
3
×
3
I
3
×
3
0
3
×
3
0
3
×
3
]
︸
︷︷
︸
A
η
+
[
0
3
×
3
I
3
×
3
]
︸
︷︷
︸
B
v.
Since
(
A,B
)
is a controllable pair, the idea is to find a
CLF with a gain matrix
K
such that
(
A
+
BK
)
is Hurwitz
resulting in a closed-loop system:
̇
η
= (
A
+
BK
)
η,
which renders
η
= 0
(i.e. our desired circular orbit with
radius
r
des
) exponentially stable. Particularly, there exists a
Lyapunov matrix
P
=
P
>
0
satisfying the Continuous-
Time Lyapunov Equation (CTLE):
(
A
+
BK
)
>
P
+
P
(
A
+
BK
) =
−
Q
(17)
for any given
Q
=
Q
>
0
. The above steps, through feed-
back linearization, help us synthesize a CLF which certifies
stability of the origin of the system. More specifically:
V
FL
(
η
)
,
η
>
Pη
̇
V
FL
(
η,v
)
,
η
>
(
A
>
P
+
PA
)
η
+ 2
η
>
PBv
In particular, there exists a control input
v
=
Kη
such that
̇
V
FL
(
η,Kη
) =
−
η
>
Qη <
0
, so
V
is a valid CLF.
It is easy to show that this is also a CLF for the original
nonlinear system (14). In fact, we define the same Lyapunov
function by using our coordinate transformation as:
V
(
x,t
)
,
η
(
x,t
)
>
Pη
(
x,t
)
(18)
̇
V
(
x,u,t
)
,
−
η
(
x,t
)
>
(
A
>
P
+
PA
)
η
(
x,t
)
+ 2
η
(
x,t
)
>
PB
(
L
2
F
y
(
x
) +
L
F
L
G
y
(
x
)
u
)
.
(19)
Then we know for each
(
x,t
)
, there exists a
u
∗
=
L
F
L
G
y
(
x
)
−
1
(
−L
2
F
y
(
x
) +
Kη
(
x,t
))
such that
̇
V
(
x,u
∗
,t
) =
−
η
(
x,t
)
>
Qη
(
x,t
)
. Although we
could use this
u
∗
, we follow the theme of this paper of
conserving resource and instead use a pointwise optimal
controller, as described in the next task.
Task II: Controller Design
Now that we have obtained a CLF, in order design a
controller
k
:
R
6
→
R
3
, we consider a set of admissible
inputs for the transformed system:
K
u
(
x,t
)
,
{
u
∈
R
m
|
̇
V
(
x,u,t
)
≤−
η
(
x,t
)
>
Qη
(
x,t
)
}
.
Since we have a feasible constraint, we choose the control
pointwise optimally with the following Quadratic Program
(QP) based controller:
k
(
x,t
) = argmin
u
∈
R
3
||
u
||
2
(CLF-QP)
s.t.
̇
V
(
x,u,t
)
≤−
η
>
Qη
Because the controller must satisfy its constraint, the control
feedback
u
=
k
(
x
)
renders the origin exponentially stable.
This is the controller we will be using for our system.
Task III: Establishing ISS Lyapunov Function
Now that we have obtained a controller (CLF-QP), we
need to establish that the closed-loop system has an ISS
Lyapunov function (3), in order to apply our results to
implement the controller in an intermittent fashion. Given
the sample and hold implementation
u
=
k
(
x
(
t
i
))
, we begin
by transforming (2) to the linear case with:
v
=
L
2
F
y
(
x
) +
L
F
L
G
y
(
x
)
k
(
x
(
t
i
))
where
k
(
x
(
t
i
))
is the control input being held constant at
t
i
.
Our goal to establish an ISS Lyapunov Function of the form:
dV
dη
∣
∣
∣
∣
η
(
Aη
+
Bv
)
≤−
α
(
‖
η
‖
) +
γ
(
‖
e
i
‖
)
(20)
where
e
i
=
η
(
t
i
)
−
η
is the error introduced from holding
our control input. To establish (20), we analyse how
v
(from
the held control input) deviates from the desired auxiliary
input
v
des
, which is given by:
v
des
=
L
2
F
y
(
x
) +
L
F
L
G
y
(
x
)
k
(
x
)
Given
v
,
v
des
and
k
(
x
(
t
i
))
, we can explicitly write the
evolution of the Lyapunov function along the trajectory as:
dV
dη
∣
∣
∣
∣
η
(
Aη
+
Bv
) =
η
>
(
A
>
P
+
PA
)
η
+ 2
η
>
PBv
=
η
>
(
A
>
P
+
PA
)
η
+ 2
η
>
PBv
des
+ 2
η
>
PB
(
v
−
v
des
)
≤−
η
>
Qη
+ 2
η
>
PB
(
v
−
v
des
)
=
−
η
>
Qη
+ 2
η
>
PB
L
F
L
G
y
(
x
)(
k
(
x
(
t
i
))
−
k
(
x
))
The above equation is not yet in the form described in
(20). In order to proceed with our derivation, we will make
a few assumptions.
Assumption 10.
(Bounded Decoupling Matrix Assumption):
Let
t
7→
x
(
t
)
be the solution to the system
(14)
. We assume
‖L
F
L
G
y
(
x
(
t
)
‖≤
H
∀
t.
•
For our spacecraft problem, the assumption is reasonable
because we will consider only initial conditions such that we
can guarantee
r > r
min
along the trajectory for some
r
min
>
0
corresponding to the minimum radius for the satellite to
crash into the central body. This allows us to assume that
L
F
L
G
y
(
x
)
described in (15) is bounded above.
Given this assumption and noting that
k
is Lipschitz
continuous because it is a QP-based controller with one
control affine constraint [25], we obtain:
dV
dη
∣
∣
∣
∣
η
(
Aη
+
Bv
)
≤−
η
>
Qη
+ 2
η
>
M
‖
e
x,i
‖
where
M
=
‖
PB
‖
HL
k
for some Lipschitz constant
L
k
and
e
x,i
=
x
(
t
i
)
−
x
. This shows that
V
is an ISS Lyapunov
function with respect to the state deviation error in the
original nonlinear coordinate. To get the error in the linear
coordinate, we further make the ensuing assumption.
Assumption 11.
(Relationship Between State Deviations):
There exists a class
K
function
ψ
such that the state
deviations of the two different coordinates are related as
‖
e
x,i
‖≤
ψ
(
‖
e
i
‖
)
where
e
i
=
η
(
t
i
)
−
η
.
•
This assumption relies on the intuition that the coordinate
transformation is diffeomorphic. However, for our problem,
the transformation is also time dependent, so it is unclear
whether this will be true and is part of our ongoing research.
Finally, with the above assumption:
dV
dη
∣
∣
∣
∣
η
(
Aη
+
Bv
)
≤−
η
>
Qη
+ 2
η
>
M
‖
e
x,i
‖
≤−
λ
min
(
Q
)
‖
η
‖
2
+
‖
2
η
>
M
‖
ψ
(
‖
e
i
‖
)
≤−
α
(
‖
η
‖
) +
γ
(
‖
e
i
‖
)
where
α
and
γ
can be found using Young’s Inequality [26].
Task IV: Intermittent-Control Trigger Design
Now that we have obtained an ISS Lyapunov Function and
the controller (CLF-QP), we will apply the results in this
paper to implement the controller in an intermittent fashion.
Particularly, we design a trigger law that corresponds to
(8) for triggering the controller off, as follows:
t
∗
i
= min
{
t > t
on
i
|
dV
dη
∣
∣
∣
∣
η
(
Aη
+
Bv
) + (1
−
σ
)
η
>
Qη
= 0
}
Then, once we turn the controller off at
t
off
i
, we need to
prescribe conditions required to find a time to turn the
controller back on. To do this, we need to define a
safe
performance set
(5) described by a
performance specification
function
S
. With
λ >
0
, let
S
be:
S
(
t
off
i
) = (
V
(
t
on
i
) +
V
(
t
off
i
))
/
2
,
̇
S
=
−
λS.
for time
t
∈
[
t
off
i
,t
on
i
+1
)
. This helps us set the conditions to
turn the controller back on. More specifically, by choosing
the design parameter
c
β,i
>
0
satisfying (10), the resulting
trigger law will be of the form described in (9):
t
on
i
+1
,
min
{
t > t
off
i
|
dV
dη
∣
∣
∣
∣
η
(
Aη
+
Bv
)
−
̇
S
(
t
)
=
c
β,i
(
S
(
t
)
−
V
(
η
))
}
.
We simulate our results with an eighth-order harmonics
gravity model in MATLAB. Due to imperfection in the shape
of the asteroid, there are gravity disturbances unaccounted
for by the Newton’s gravitational model. Nevertheless, our
results illustrate robustness of our controller design. Figure 2
shows the resulting trajectory. At all times, the spacecraft
stays within the safe performance set (transparent red).
Note that the figure shows the safe performance set at the
final time, so past trajectory may appear out of bounds.
In addition, as shown in Figure 3 (top), we report that
the certificate
V
(blue) remains below the performance
specification
S
(red) at all times. With the thruster firing limit
time of
T
max
of 10 seconds, the control inputs appears as
spikes in Figure 3 (middle), and the intermittent nature of the
control input is evident. Finally, Figure 3 (bottom) verifies
that the radial distance (blue) remains within the prescribed
safe performance set
C
(red) at all time.
Fig. 2. The figure shows the trajectory as projected on the x-z plane, which
is perpendicular to the ecliptic plane. The desired orbit has right ascension
of the ascending node (RAAN) of
45
◦
and an inclination angle of
90
◦
.
Fig. 3. (Top) Certificate function along the trajectory. (Middle) Acceleration
input. Each spike lasts no longer than
T
max
of 10 seconds. (Bottom)
Distance of the spacecraft from the central body with estimated safe
performance set
C
getting smaller over time.
VI. C
ONCLUSION
This paper synthesized trigger schemes that permit the
intermittent implementation of state-feedback controllers in
both the context of stabilization and safety. In particular, our
trigger scheme turns the controller off when it no longer
provides satisfactory performance, and turns the controller
back on before all the prior progress made by the controller
is undone. To demonstrate the effectiveness of our results, we
applied them to the problem of spacecraft orbit stabilization.
Future work will study the co-design problem, seeking
controllers that can lengthen the controller inactive dwell
time for as long as possible. This will be studied in the
context of stability, safety, and their interaction.
Acknowledgement.
The authors would like to thank JPL for
their feedback on the application of these ideas to spacecraft,
and Saptarshi Bandyopadhyay in particular for discussions
and providing the eighth-order harmonics gravity model used
in our simulation results.
R
EFERENCES
[1] P. Tabuada, “Event-triggered real-time scheduling of stabilizing control
tasks,”
IEEE Transactions on Automatic Control
, vol. 52, no. 9,
pp. 1680–1685, 2007.
[2] W. P. M. H. Heemels, K. H. Johansson, and P. Tabuada, “An intro-
duction to event-triggered and self-triggered control,” in
IEEE Conf.
on Decision and Control
, (Maui, HI), pp. 3270–3285, Dec. 2012.
[3] R. Postoyan, P. Tabuada, D. Ne
ˇ
si
́
c, and A. Anta, “A framework for the
event-triggered stabilization of nonlinear systems,”
IEEE Transactions
on Automatic Control
, vol. 60, no. 4, pp. 982–996, 2015.
[4] C. Li, G. Feng, and X. Liao, “Stabilization of nonlinear systems via
periodically intermittent control,”
IEEE Transactions on Circuits and
Systems II: Express Briefs
, vol. 54, no. 11, pp. 1019–1023, 2007.
[5] N. Yoshikawa, Y. Suzuki, K. Kiyono, and T. Nomura, “Intermittent
feedback-control strategy for stabilizing inverted pendulum on manu-
ally controlled cart as analogy to human stick balancing,”
Frontiers in
Computational Neuroscience
, vol. 10, 2016.
[6] R. Dash and H. J. Palanthandalam-Madapusi, “When to use in-
termittent control for stabilization?,” in
2019 Sixth Indian Control
Conference (ICC)
, (IIT Hyderabad, India), pp. 526–531, Dec. 2019.
[7] Q. Wang, Y. He, G. Tan, and M. Wu, “Stabilization of linear systems
via state-dependent intermittent control,” in
IEEE Chinese Control
Conference (CCC)
, pp. 1556–1561, 2016.
[8] L. Yang, W. Marian, I. James, and P. Ekaterina, “Intermittent control
of coexisting attractors,”
Philosophical Transactions of the Royal
Society A: Mathematical, Physical and Engineering Sciences
, vol. 371,
no. 1993, p. 20120428, 2013.
[9] P. J. Gawthrop and L. Wang, “Event-driven intermittent control,”
International Journal of Control
, vol. 82, no. 12, pp. 2235–2248, 2009.
[10] P. J. Gawthrop, I. Loram, M. Lakie, and H. Gollee, “Intermittent con-
trol: a computational theory of human control,”
Biological cybernetics
,
vol. 104, no. 1, pp. 31–51, 2011.
[11] P. J. Gawthrop, I. Loram, H. Gollee, and M. Lakie, “Intermittent
control models of human standing: similarities and differences,”
Bio-
logical cybernetics
, vol. 108, no. 2, pp. 159–168, 2014.
[12] E. D. Sontag, “Input to state stability: Basic concepts and results,”
Nonlinear and Optimal Control Theory
, vol. 1932, pp. 163–220, 2008.
[13] P. J. Gawthrop and L. Wang, “Intermittent redesign of continuous
controllers,”
International Journal of Control
, vol. 83, no. 8, pp. 1581–
1594, 2010.
[14] A. Girard, “Dynamic triggering mechanisms for event-triggered con-
trol,”
IEEE Transactions on Automatic Control
, vol. 60, pp. 1992–
1997, 2015.
[15] P. Ong and J. Cort
́
es, “Performance-barrier-based event-triggered
control with applications to network systems,”
IEEE Transactions on
Automatic Control
, 2021. Submitted.
[16] A. D. Ames, S. Coogan, M. Egerstedt, G. Notomista, K. Sreenath,
and P. Tabuada, “Control barrier functions: Theory and applications,”
in
European Control Conference
, (Naples, Italy), pp. 3420–3431, June
2019.
[17] G. Yang, C. Belta, and R. Tron, “Self-triggered control for safety
critical systems using control barrier functions,” in
American Control
Conference
, (Philadelphia, PA), pp. 4454–4459, July 2019.
[18] A. J. Taylor, P. Ong, J. Cort
́
es, and A. Ames, “Safety-critical event
triggered control via input-to-state safe barrier functions,”
IEEE Con-
trol Systems Letters
, vol. 5, no. 3, pp. 749–754, 2021.
[19] S. Kolathaya and A. D. Ames, “Input-to-state safety with control
barrier functions,”
IEEE Control Systems Letters
, vol. 3, no. 1,
pp. 108–113, 2018.
[20] A. D. Ames, X. Xu, J. W. Grizzle, and P. Tabuada, “Control barrier
function based quadratic programs for safety critical systems,”
IEEE
Transactions on Automatic Control
, vol. 62, no. 8, pp. 3861–3876,
2017.
[21] H. K. Khalil,
Nonlinear Systems
. Prentice Hall, 3 ed., 2002.
[22] F. Blanchini and S. Miani,
Set-Theoretic Methods in Control
. Boston,
MA: Birkh
̈
auser, 2007.
[23] W. Kang, A. Sparks, and S. Banda, “Coordinated control of multi-
satellite systems,”
AIAA Journal of Guidance, Control, and Dynamics
,
vol. 24, no. 2, pp. 360–368, 2001.
[24] S. Sastry,
Nonlinear Systems: Analysis, Stability, and Control
. New
York: Springer, 2013.
[25] X. Xu, P. Tabuada, J. W. Grizzle, and A. D. Ames, “Robustness of con-
trol barrier functions for safety critical control,”
IFAC-PapersOnLine
,
vol. 48, no. 27, pp. 54–61, 2015.
[26] G. H. Hardy, J. E. Littlewood, and G. Polya,
Inequalities
. Cambridge,
UK: Cambridge University Press, 1952.