Approximate predictability of Pseudo-Metric Systems

Nonlinear Analysis: Hybrid Systems 36 (2020) 100869

Contents lists available at ScienceDirect

Nonlinear Analysis: Hybrid Systems journal homepage: www.elsevier.com/locate/nahs

Approximate predictability of Pseudo-Metric Systems✩ , ✩✩ Elena De Santis, Maria Domenica Di Benedetto, Gabriella Fiore, Giordano Pola

∗

Department of Information Engineering, Computer Science and Mathematics, Center of Excellence DEWS, University of L’Aquila, 67100 L’Aquila, Italy

article

info

Article history: Received 1 February 2019 Accepted 11 December 2019 Available online xxxx Keywords: Pseudo–metric systems Piecewise affine systems Symbolic models Approximate simulation Approximate predictability

a b s t r a c t In this paper, we introduce and characterize the notion of approximate predictability for the general class of pseudo-metric systems, which are a powerful modeling framework to deal with complex heterogeneous systems such as hybrid systems. Approximate predictability corresponds to the possibility of predicting the occurrence of specific states belonging to a particular subset of interest, in advance with respect to their occurrence, on the basis of observations. We establish a relation between approximate predictability of a given pseudo-metric system and approximate predictability of a pseudo-metric system that approximately simulates the given one. This relation allows checking approximate predictability of a system with an infinite number of states, provided that one is able to construct a pseudo-metric system with a finite number of states and inputs, approximating the original one in the sense of approximate simulation. To demonstrate the usefulness of our results, we apply them to the analysis of approximate predictability of Piecewise Affine (PWA) systems, a well studied class of hybrid systems for which, however, to the best of our knowledge, there are no results available in the current literature on predictability. An illustrative example is also included, which demonstrates the applicability of our results. © 2020 Elsevier Ltd. All rights reserved.

1. Introduction Safety issues in modern control systems are presently one of the most significant challenges, see e.g. [1]. In this regard, it is fundamental to be able to understand if the system’s behavior enters a given subset of the state space on the basis of the observations. This particular subset of states, which in the following will be called critical set, may represent faulty states, unsafe operations or, more generally, any subset of states which is of particular interest from the system’s behavior point of view; a state belonging to the critical set will be called critical state (or also faulty state or fault). The safety problem can then be addressed either by detecting the occurrence of states belonging to the critical set within a finite time interval (diagnosability property), or by predicting in a deterministic way the occurrence of specific states belonging to the critical set, in advance with respect to their occurrence (predictability property). In this paper we focus on the latter. ✩ The research leading to these results has been partially supported by the Center of Excellence DEWS. ✩✩ No author associated with this paper has disclosed any potential or pertinent conflicts which may be perceived to have impending conflict with this work. For full disclosure statements refer to https://doi.org/10.1016/j.nahs.2020.100869. ∗ Corresponding author. E-mail addresses: [email protected] (E. De Santis), [email protected] (M.D. Di Benedetto), [email protected] (G. Fiore), [email protected] (G. Pola). https://doi.org/10.1016/j.nahs.2020.100869 1751-570X/© 2020 Elsevier Ltd. All rights reserved.

2

E. De Santis, M.D. Di Benedetto, G. Fiore et al. / Nonlinear Analysis: Hybrid Systems 36 (2020) 100869

Diagnosability has been extensively studied for: (i) finite state systems, see e.g. [2–4]; (ii) continuous systems, see e.g. [5,6]; (iii) hybrid systems, see e.g. [7–9], to name a few. In the recent paper [10] a novel notion of approximate diagnosability has been introduced for the general class of metric systems. Metric systems are a powerful modeling framework to deal with complex heterogeneous systems such as hybrid systems, characterized by the interaction of continuous dynamics, modeling physical processes, and discrete dynamics, modeling computational and communication components, see e.g. [11]. In safety critical applications, predicting the future occurrence of particular states of interest is of paramount importance. Indeed, this allows pro-actively performing operations on the system to enhance its reliability, optimizing performance or ensuring safety by avoiding abnormal behaviors. Motivated by this need, predictability (also referred to, as prognosability) has been investigated for: (i) discrete-event systems, see e.g. [12–16] and the references therein; (ii) petri nets, see e.g. [17]; (iii) stochastic untimed and timed discrete event systems, see e.g. [18,19]; (iv) stochastic petri nets, see e.g. [20]; (v) continuous systems, see e.g. [21]. In this paper we introduce the notion of approximate predictability which extends to the general class of pseudo-metric systems, the notion of (exact) predictability given in [22], see also [12,13], for finite state machines. The main result of this paper is the relation between the approximate predictability of a given pseudo-metric system and the approximate predictability of a pseudo-metric system that approximately simulates the given one. Thanks to this relation, it is possible to check approximate predictability of a system Σ with an infinite number of states, e.g. a nonlinear system or a hybrid system, provided that one is able to construct a pseudo-metric system that is symbolic (i.e. with a finite number of states and inputs), and that approximates Σ in the sense of approximate simulation. The construction of symbolic models for continuous or hybrid control systems can be achieved under the conditions and by means of the numerous results existing in the literature on this topic, see e.g. [11] and references therein. To demonstrate this important consequence of the main result, we apply it to establishing approximate predictability of discrete-time Piecewise Affine (PWA) systems. An illustrative example on approximate predictability of PWA systems is also included in the paper. A preliminary version of this paper appeared in the conference publication [23]. In this paper we present a mature version of the results announced in [23], which extends the results of [23] from metric systems to pseudo-metric systems, includes proofs of the results and an example. At the technical level the output function of the PWA systems is here modified with respect to what proposed in [23] to deal with measurements errors at the sensors which were not considered in [23] and are common in real applications. The paper is organized as follows. In Section 2 we introduce notation and preliminary definitions. In Section 3 we define the approximate predictability property. In Section 4 we derive the relation between approximate simulation and approximate predictability. This relation is applied in Section 5 to the approximate predictability of PWA systems. Section 6 presents an illustrative example. Section 7 offers some concluding remarks and the Appendix provides algorithms to check approximate predictability of symbolic pseudo-metric systems. 2. Notation and preliminary definitions The symbols N, Z, R, R+ and R+ 0 denote the set of nonnegative integer, integer, real, positive real, and nonnegative real numbers, respectively. The symbols 0n and In denote the origin in Rn and the identity matrix in Rn×n , respectively. Symbol conv{x1 , x2 , . . . , xN } denotes the convex hull of vectors x1 , x2 , . . . , xN of Rn . Given a, b ∈ Z, we denote [a; b] = [a, b] ∩ Z and [a; b) = [a, b) ∩ Z. For a finite set X , the symbol card(X ) denotes the cardinality of X . Given a pair of sets X and Y and a relation R ⊆ X × Y , the symbol R−1 denotes the inverse relation of R, i.e. R−1 = {(y, x) ∈ Y × X : (x, y) ∈ R}. Given X ′ ⊆ X and Y ′ ⊆ Y , we denote R(X ′ ) = {y ∈ Y |∃x ∈ X ′ s.t. (x, y) ∈ R} and R−1 (Y ′ ) = {x ∈ X |∃y ∈ Y ′ s.t. (x, y) ∈ R}. Given a function f : X → Y and X ′ ⊆ X the symbol f (X ′ ) denotes the image of X ′ through f , i.e. f (X ′ ) = {y ∈ Y |∃x ∈ X ′ s.t. y = f (x)}. Given a set X , a set Y ⊆ X × X is said to be symmetric if (y, y′ ) ∈ Y implies (y′ , y) ∈ Y . The minimal symmetric set Y ⊆ X × X containing a set Z ⊆ X × X is a symmetric set such that Z ⊆ Y ⊆ Y ′ for any symmetric set Y ′ ⊆ X × X containing n n Z . Given θ ∈ R+ and x ∈ Rn , we define B[−θ ,θ ) (x) = {y ∈ R |yi ∈ [−θ + xi , θ + xi ), i ∈ [1; n]}, where xi and yi denote the n i-th component of vectors x and y, respectively. Note that for any θ ∈ R+ , the collection of sets B[−θ,θ ) (x) is a partition of n R . We now define the quantization function. Given a positive n ∈ N and a quantization parameter θ ∈ R+ , the quantizer in Rn with accuracy θ is a function [ · ]θ : Rn → 2θ Zn , associating to any x ∈ Rn the unique vector [x]θ ∈ 2θ Zn such that x ∈ B[−θ ,θ ) ([x]θ ). Definition of [ · ]θ naturally extends to sets X ⊆ Rn when [X ]θ is interpreted as the image of X through function [ · ]θ . A polyhedron P ⊆ Rn is a set obtained by the intersection of a finite number of (open or closed) half-spaces. A polytope is a bounded polyhedron. Given a set X , a function d : X × X → R+ 0 ∪ {∞} is a quasi-pseudo-metric for X if: (i) for any x ∈ X , d(x, x) = 0 and (ii) for any x, y, z ∈ X , d(x, y) ≤ d(x, z) + d(z , y). If condition (i) is replaced by: (i’) d(x, y) = 0 if and only if x = y, then d is called to be a quasi-metric for X . If function d enjoys properties (i), (ii) and property: (iii) for any x, y ∈ X , d(x, y) = d(y, x),

E. De Santis, M.D. Di Benedetto, G. Fiore et al. / Nonlinear Analysis: Hybrid Systems 36 (2020) 100869

3

then d is called a pseudo-metric for X . If function d enjoys properties (i’), (ii) and (iii), it is called a metric for X . When function d is a (quasi) (pseudo) metric for X , the pair (X , d) is called a (quasi) (pseudo) metric space. From [24], given a quasi-pseudo-metric space (X , d), a sequence {xi }i∈N0 over X is left (resp. right) d-convergent to x∗ ∈ X , denoted lim xi = x∗ (resp. lim xi = x∗ ), if for any ε ∈ R+ there exists N ∈ N such that d(xi , x∗ ) ≤ ε (resp. d(x∗ , xi ) ≤ ε ) for ← → any i ≥ N. The symbol ∥ · ∥ denotes the infinity norm on Rn . Given X ⊆ Rn we denote by dh the Hausdorff pseudo-metric ⃗ h (X1 , X2 ), d ⃗ h (X2 , X1 )}, where induced by the infinity norm ∥·∥ on 2X ; we recall that for any X1 , X2 ⊆ X , dh (X1 , X2 ) := max{d

⃗ h (X1 , X2 ) = sup inf ∥x1 − x2 ∥ d x1 ∈X1 x2 ∈X2

is the Hausdorff quasi-pseudo-metric. 3. Pseudo-metric systems and approximate predictability In this paper we consider the class of pseudo-metric systems, defined as follows. Definition 1 ([11]). A system S is a tuple S = (X , X0 , U , −→, Y , H),

(1)

where:

• • • • • •

X is the set of states, X0 ⊆ X is the set of initial states, U is the set of inputs, −→⊆ X × U × X is the transition relation, Y is the set of outputs, H : X → Y is the output function. u

We follow standard practice and denote a transition (x, u, x′ ) ∈−→ of S by x −→ x′ . The evolution of a system is captured by the notions of state and output runs. Given a sequence of transitions of S u(0)

u(1)

u(l−1)

x(0) −→ x(1) −→ ... −→ x(l)

(2)

with x(0) ∈ X0 , the sequences: x(·) : x(0) x(1) . . . x(l),

(3)

y(·) : H(x(0)) H(x(1)) . . . H(x(l)),

(4)

are called a state run and an output run of S, respectively. State x(l) is called the ending state of the state run in (3). Given state run x(·) in (3) and l′ ≤ l, the symbol x|[0,l′ ] denotes the state run x(0) x(1) . . . x(l′ ). Given output run y(·) in (4) and l′ ≤ l, the symbol y|[0,l′ ] denotes the output run H(x(0)) H(x(1)) . . . H(x(l′ )). The accessible part of a system S, denoted Ac(S), is the collection of states of S that are reached by state runs of S. System S in (1) is said to be symbolic if Ac(S) and U are finite sets, and pseudo-metric if X is equipped with a pseudo-metric. Pseudo-metric systems are general enough to capture heterogeneous dynamics arising for example in cyber-physical systems, see e.g. [11]. Throughout the paper we assume that the inputs u of pseudo-metric system S are not available; this assumption corresponds to the point of view of an external observer that cannot have access to the inputs of the system S. We now introduce the notion of approximate predictability. Definition 2. Consider a pseudo-metric system S = (X , X0 , U , −→, Y , H) with pseudo-metric d, and denote by Bρ (x) the closed ball induced by pseudo-metric d centered at x ∈ X , and with radius ρ ∈ R+ 0 , i.e.: Bρ (x) = {x′ ∈ X |d(x, x′ ) ≤ ρ}.

(5)

′

Given X ⊆ X , define: Bρ (X ′ ) =

⋃

Bρ (x′ ).

(6)

x′ ∈X ′

Consider a set F ⊆ X of faulty states of S with F ∩ X0 = ∅. Given a desired accuracy ρ ∈ R+ 0 , system S is (ρ, F )−predictable if there exists ∆ ∈ N, such that for any finite state run xf (·) of S for which the ending state xf (tf ) ∈ F , and xf (t) ∈ / F for any t ∈ [0; tf ), there exists T ∈ [t0 , tf ) such that the following properties hold:

4

E. De Santis, M.D. Di Benedetto, G. Fiore et al. / Nonlinear Analysis: Hybrid Systems 36 (2020) 100869

⏐

(i) for any state run xs , with ys |[t0 ,T ] = yf ⏐[t

0 ,T ]

, xs |[t0 ,T ] does not contain states in F ;

⏐

(ii) for any state run xs such that xs ̸ = xf , with ys |[t0 ,T ] = yf ⏐[t ,T ] , and for any infinite state run xc (·) such that 0 xc |[t0 ,T ] = xs |[t0 ,T ] , xc (T + δ) ∈ Bρ (F ), for some δ ≤ ∆. Approximate predictability corresponds to the possibility of distinguishing, on the basis of the observations collected in a certain time interval [t0 ; T ] and in at most ∆ > 0 time steps (i.e., within T + ∆), state runs that will reach for the first time the set of faulty states F from both state runs that will not reach the set Bρ (F ) and state runs that already reached F at a previous time instant t < T . The definition above extends to pseudo-metric systems the notion of (exact) predictability given in [22], see also [12,13], for FSMs.1 In particular, when ρ = 0, the definition above coincides with the one given in [22]. Checking approximate predictability of symbolic pseudo-metric systems is a decidable problem with polynomial computational complexity. This is discussed in the Appendix, where we provide an extension of the algorithms proposed in [22] from exact predictability of FSMs to approximate predictability of pseudo-metric systems. We conclude with the following: Remark 1. Consider a pair of pseudo-metric systems Si = (X , X0 , U , −→, Y , Hi ), i = 1, 2 which differ only for the output maps H1 and H2 . Suppose that H1 and H2 enjoy the following property: for any x, x′ ∈ X such that H1 (x) = H1 (x′ ) we have H2 (x) = H2 (x′ ). Then it is readily seen by Definition 2 that (ρ, F )−predictability of S2 is implied by (ρ, F )−predictability of S1 . 4. Main result In this section we establish the relation between approximate predictability and approximate simulation. We start by recalling the following definition. Definition 3.

Consider a pair of pseudo-metric systems

Si = (Xi , X0,i , Ui , −→, Yi , Hi ), i

i = 1, 2,

with X1 and X2 subsets of some pseudo-metric set X equipped with pseudo-metric d, and let ε ∈ R+ 0 be a given accuracy. Consider a relation R ⊆ X1 × X2 satisfying the following conditions: (i) ∀x1 ∈ X0,1 ∃x2 ∈ X0,2 such that (x1 , x2 ) ∈ R; (ii) d(x1 , x2 ) ≤ ε , ∀(x1 , x2 ) ∈ R; (iii) H1 (x1 ) = H2 (x2 ), ∀(x1 , x2 ) ∈ R. Relation R is an ε -approximate simulation relation from S1 to S2 if it enjoys conditions (i)–(iii) and the following one: u1

u2

1

2

(iv) ∀(x1 , x2 ) ∈ R if x1 −→ x′1 then there exists x2 −→ x′2 with (x′1 , x′2 ) ∈ R. System S1 is ε -simulated by S2 , denoted S1 ⪯ε S2 , if there exists an ε -approximate simulation relation from S1 to S2 . Relation R is an ε -approximate bisimulation relation between S1 and S2 if R is an ε -approximate simulation relation from S1 to S2 , and R−1 is an ε -approximate simulation relation from S2 to S1 . Systems S1 and S2 are ε -bisimilar if there exists an ε -approximate bisimulation relation between S1 and S2 . Remark 1. The definition above extends the classical definition of bisimulation equivalence of [25,26] for concurrent processes, to the class of pseudo-metric systems in the sense of Definition 1; when condition (ii) is removed, it results in an adaptation to the notion of systems of the definition given in [25,26] for concurrent processes. It slightly differs from the one given in [27] where it is assumed that sets Y1 = Y2 are metric (not pseudo-metric) spaces with metric d, and conditions (ii) and (iii) are replaced by d(H1 (x1 ), H2 (x2 )) ≤ ε, ∀(x1 , x2 ) ∈ R. We can now present the main result of this paper. Theorem 1.

Consider a pair of pseudo-metric systems

Si = (Xi , X0,i , Ui , −→, Yi , Hi ), i

i = 1, 2,

with X1 and X2 subsets of some pseudo-metric set X equipped with pseudo-metric d and suppose that S1 ⪯ε S2 . Consider a set F1 ⊆ X1 of faulty states for S1 and define the set F2 = Bε (F1 ) ∩ X2 of faulty states for system S2 . If S2 is (ρ2 , F2 )−predictable for some accuracy ρ2 ∈ R+ , then S1 is (ρ1 , F1 )−predictable for all ρ1 ≥ ρ2 + 2ε . Before giving the proof, we point out that since S1 ⪯ε S2 , in view of conditions (i) and (iv) of Definition 3 we get R(F1 ) ̸ = ∅, where R is an ε -approximate simulation relation from S1 to S2 , and since by condition (ii) of Definition 3 we have R(F1 ) ⊆ Bε (F1 ), implying R(F1 ) ∩ X2 ⊆ Bε (F1 ) ∩ X2 , the set F2 is nonempty. 1 FSMs considered in [22] coincide with symbolic systems considered in this paper.

E. De Santis, M.D. Di Benedetto, G. Fiore et al. / Nonlinear Analysis: Hybrid Systems 36 (2020) 100869

5

Proof. Let R be an ε -approximate simulation from S1 to S2 which exists because S1 ⪯ε S2 . By contradiction, suppose that S2 is (ρ2 , F2 )-predictable but S1 is not (ρ1 , F1 )-predictable, with some ρ1 ≥ ρ2 + 2ε . Then, for any ∆ ∈ N there exists a state run xf (t0 ) xf (t0 + 1) . . .

(7)

of S1 with output run yf (t0 ) yf (t0 + 1) . . .

(8)

such that for some tf > 0 xf (tf ) ∈ F1 ∧ xf (t) ∈ / F1 , ∀t ∈ [t0 ; tf − 1] ,

(

)

(

)

(9)

and a state run xs (t0 ) xs (t0 + 1) . . .

(10)

of S1 with output run ys (t0 ) ys (t0 + 1) . . .

(11)

such that yf (t) = ys (t), ∀t ∈ [t0 ; tf ],

(12)

and xs (t) ∈ / Bρ1 (F1 ), ∀t ∈ [t0 ; tf + ∆]

)

(

( ) ∨ xs (t) ∈ F1 , t ∈ [t0 , tf )

(13)

Since S1 ⪯ε S2 , by (9) there exists a state run

ξ f (t0 ) ξ f (t0 + 1) . . .

(14)

of S2 with output run

ηf (t0 ) ηf (t0 + 1) . . .

(15)

which coincides with the corresponding output run (8) of S1 , i.e.

ηf (t) = yf (t), ∀t ∈ [t0 ; tf ]

(16)

and some T ∈ [t0 ; tf ] such that

) ξ f (T ) ∈ R(F1 ) ) ∧ (tf = t0 ) ∨ (ξ f (t) ∈ / R(F1 ), ∀t ∈ [t0 ; T − 1]) . (

(

(17)

Since by definition of R, see condition (ii) of Definition 3, R(F1 ) ⊆ Bε (F1 ) ∩ X2 ,

and, since Bε (F1 ) ∩ X2 = F2 by definition of F2 , condition (17) implies that for some T ′ ∈ [t0 ; T ]

) ξ f (T ′ ) ∈ F2 ( ) ∧ (T = t0 ) ∨ (ξ f (t) ∈ / F2 , ∀t ∈ [t0 ; T ′ − 1]) . (

(18)

Since S1 ⪯ε S2 , by (13) there exists a state run

ξ s (t0 ) ξ s (t0 + 1) . . .

(19)

of S2 with output run

ηs (t0 ) ηs (t0 + 1) . . .

(20)

coinciding with the corresponding output run (11) of S1 , i.e.

ηs (t) = ys (t), ∀t ∈ [t0 ; tf ],

(21)

and such that

(

) ξ s (t) ∈ / R(Bρ1 (F1 )), ∀t ∈ [t0 ; tf + ∆] ( ) ∨ ∃T ′′ ∈ [t0 , tf ) : ξ s (T ′′ ) ∈ R(F1 ) ,

(22)

6

E. De Santis, M.D. Di Benedetto, G. Fiore et al. / Nonlinear Analysis: Hybrid Systems 36 (2020) 100869

implying

( s ) ξ (t) ∈ / Bρ1 −ε (F1 ), ∀t ∈ [t0 ; tf + ∆] ( ) ∨ ∃t ∗ ∈ [t0 , T ′′ ) : ξ s (t ∗ ) ∈ F2

(23)

Since by assumption, ρ1 − 2ε ≥ ρ2 we get Bρ1 −ε (F1 ) = Bρ1 −2ε (Bε (F1 )) ⊇ Bρ2 (Bε (F1 ))

and hence, condition (23) implies

( s ) ξ (t) ∈ / Bρ2 (Bε (F1 )), ∀t ∈ [t0 ; tf + ∆] ( ∗ ) ∨ ∃t ∈ [t0 , T ′′ ) : ξ s (t ∗ ) ∈ F2

(24)

from which,

( s ) ξ (t) ∈ / Bρ2 (Bε (F1 ) ∩ X2 ) = Bρ2 (F2 ), ∀t ∈ [t0 ; tf + ∆] ( ∗ ) ∨ ∃t ∈ [t0 , T ′′ ) : ξ s (t ∗ ) ∈ F2 .

(25)

Conditions (12), (16) and (21) imply

ηf (t) = ηs (t), ∀t ∈ [t0 ; T ].

(26)

Hence, for any ∆ ∈ N there exists a pair of state runs (14) and (19) of S2 such that conditions (18), (25) and (26) hold, i.e., the output runs corresponding to the state runs (14) and (19) coincide, and ξ f terminates in F2 at a certain time instant, whereas ξ s stays in the complement of Bρ2 (F2 ) or it already reached F2 at a previous time instant than ξ f . We then conclude that S2 is not (ρ2 , F2 )−predictable and a contradiction holds. By Theorem 1, it is possible to check approximate predictability of a pseudo-metric system S1 on the basis of approximate predictability of a pseudo-metric system S2 such that S1 ⪯ε S2 . Therefore, when S2 has fewer states than S1 , Theorem 1 can reduce computational complexity in checking approximate predictability of S1 . In particular, provided that one is able to construct a symbolic pseudo-metric system approximating a continuous or hybrid control system Σ (with an infinite number of states) in the sense of approximate simulation, Theorem 1 allows leveraging the results reported in the Appendix to check approximate predictability of Σ . For example, Theorem 1 can be applied directly to the analysis of approximate predictability of incrementally stable nonlinear systems [28,29], possibly unstable nonlinear systems [30], incrementally stable switched systems [31]and Piecewise Affine (PWA) systems [32]. In the next section we focus on PWA systems. 5. Approximate predictability of piecewise affine systems In this section we investigate approximate predictability for the class of discrete-time Piecewise Affine (PWA) systems. The part of this section corresponding to the construction of approximate abstractions of the PWA systems is a slight extension of the results reported in [32], from PWA systems without outputs to PWA systems with outputs. Consider the discrete-time Piecewise Affine (PWA) system described by the tuple:

Σ = (Rn , U , {Σ1 , Σ2 , . . . , ΣN }, η)

(27)

where

• Rn is the state space, • U ⊆ Rm is the set of control inputs, • Σi , i = 1, . . . , N is a constrained affine control system with outputs defined by: ⎧ ⎨ xi (t + 1) = Ai xi (t) + Bi ui (t) + fi , xi (t) ∈ Xi , ui (t) ∈ U , ⎩ y (t) = [[ Ip 0 ] x (t)] , y (t) ∈ Y = η Zp , i i i η

(28)

where fi , i = 1, . . . , N is a constant vector; • η ∈ R+ is the quantization parameter for the output variable. We suppose that the sets Xi ⊆ Rn are polyhedral, with interior, and that their collection is a partition of Rn ; moreover we suppose that the set U ⊆ Rm is polyhedral. We denote by x(t , x0 , u) the state reached by Σ at time t ∈ N starting from an initial state x0 ∈ Rn with control input u : N → U . Since {Xi }i∈[1;N ] is a partition of Rn , the PWA system Σ is deterministic. The output function of Σ is given as the quantization with accuracy η of the first p components of the state variable. The quantization of the output variable allows considering sensor measurements with accuracy η. The general case of nonlinear output functions can be considered at the expense of a heavier notation, as done in our recent work [33]. Moreover, this assumption holds in many concrete applications.

E. De Santis, M.D. Di Benedetto, G. Fiore et al. / Nonlinear Analysis: Hybrid Systems 36 (2020) 100869

7

We are interested in the evolution of PWA systems within bounded subsets of the state space Rn . Let X be a polytopic subset of Rn representing the region of the state space of Σ we are interested in. Define: Xi = Xi ∩ X , i ∈ [1; N ]

(29)

and denote by P (X ) the set of polytopic subsets of X . In the sequel, we will work with the set S (P (X ), dh ) of pseudo-metric systems with pseudo-metric space (P (X ), dh ), where we recall that dh is the Hausdorff pseudo-metric induced by the infinity norm ∥ · ∥ on P (X ). The notion of approximate simulation relations induces certain pseudo-metrics on S (P (X ), dh ):

⃗ s from S1 Definition 4 ([27]). Consider two pseudo-metric systems S1 , S2 ∈ S (P (X ), dh ). The simulation pseudo-metric d to S2 is defined by: ⃗ s (S1 , S2 ) = inf{ε ∈ R+ |S1 ⪯ε S2 }. d 0

(30)

⃗ s ) is a quasi-pseudo-metric space.2 Theorem 2 ([27]). The pair (S (P (X ), dh ), d The expressive power of the notion of systems as in Definition 1 is general enough to describe the evolution of PWA systems within the bounded region X of the state space Rn , as formally stated in the following Definition 5.

Given the PWA system Σ and the polytopic subset X of Rn define the pseudo-metric system:

S(Σ ) = (X, X0 , U, −→, Y, H)

(31)

where:

• • • • •

X = X0 = X , equipped with dh , U = U, u x −→ x′ , if x ∈ Xi and x′ = Ai x + Bi u + fi , Y = Y, H(x) = [x]η , for any x ∈ X .

System S(Σ ) preserves important properties of Σ , such as reachability and determinism. Also, since dh ({x}, {y}) = ∥x − y∥, metric properties of Σ are naturally transferred to S(Σ ) and vice versa. Although system S(Σ ) correctly describes Σ within the bounded set X , it is not symbolic because X and U are not finite sets. For this reason, in the sequel we introduce a sequence of symbolic models AM (Σ ) that approximate the PWA system Σ . To this purpose we first need to introduce three operators. Definition 6. Given PWA system Σ , the bisimulation operator is the map: Bisim : 2X → 2X

(32)

that associates to any Z1 , Z2 , . . . , ZL ⊆ X the collection Bisim({Z1 , Z2 , . . . , ZL }) of sets {x ∈ Zj |∃u ∈ U s.t. Ai x + Bi u + fi ∈ Zj′ , x ∈ Xi } (j, j′ ∈ [1; L]). We can now introduce the second operator. We recall that the diameter Diam(X ) of a set X ⊆ Rn is defined by: Diam(X ) = sup ∥x − y∥. x,y∈X

(33)

Definition 7. Consider a finite collection of polytopes P = {P1 , P2 , . . . , PN } ⊂ P (X ). A splitting policy with contraction rate λ ∈ (0, 1) for P is a map

Φλ : P → 2P (X )

(34)

enjoying the following properties: (i) the cardinality of Φλ (Pi ) is finite, (ii) Φλ (Pi ) is a partition of Pi , j j (iii) Diam(Pi ) ≤ λDiam(Pi ) for all Pi ∈ Φλ (Pi ). In the sequel, Split ⋃λ denotes a splitting policy with contraction rate λ and we abuse notation by writing Splitλ ({P1 , P2 , i∈[1;N ] Splitλ (Pi ). We finally introduce the third operator. Consider a finite collection of polytopes P = {P1 , P2 , . . . , PN } ⊂ P (X ). The output splitting policy SplitYη (P) with quantization parameter η is defined by:

. . . , PN }) instead of

SplitYη (P) = {Z ⊆ Rn |∃Pi ∈ P ∧ ∃k ∈ N s.t. Z = ([−kη/2, kη/2) × Rn−p ) ∩ Pi }. 2 In [27] quasi-pseudo-metric spaces are termed directed pseudo-metric spaces.

8

E. De Santis, M.D. Di Benedetto, G. Fiore et al. / Nonlinear Analysis: Hybrid Systems 36 (2020) 100869

We now have all the ingredients to introduce a sequence of abstractions AM (Σ ) approximating the PWA system Σ . Consider the following recursive equations:

{

X0 = {X1 , X2 , . . . , XN }, XM +1 = SplitYη (Splitλ (Bisim(XM ))), M ∈ N.

(35)

At each order M ∈ N, the set XM naturally induces a system that is formalized as follows. Definition 8.

Given the set XM define the pseudo-metric system

AM (Σ ) = (XM , UM , −→, YM , HM )

(36)

M

where:

• XM = XM ∪ {X \ V

• XMj −→ M

j′ XM

j

⋃

X ∈XM

X }, equipped with the pseudo-metric dh ; a state in XM is denoted by XM , j

if there exist x ∈ XM and u ∈ U such that Ai x+Bi u+fi ∈

j′ XM ,

j

j′

and V = {u ∈ U |∃x ∈ XM s.t. Ai x+Bi u+fi ∈ XM },

j

where index i is such that XM ⊆ Xi ,

V

′

• UM is the collection of all sets V ⊆ U for which XMj −→ XMj , M

• YM = Y , • HM (XMj ) = [y]η for any y ∈ XMj . By construction, system AM (Σ ) is symbolic. Symbolic system AM +1 (Σ ) can be viewed as a refinement of AM (Σ ). We now proceed with a step further by providing our approximation scheme and a quantification of its accuracy. Define: j

Gran(AM (Σ )) = max Diam(XM ).

(37)

j

XM ∈XM

Function Gran provides a measure of the ‘‘granularity’’ of the symbolic system AM (Σ ) (i.e. how fine is the covering of the set X ). The following result provides an upper bound for the distance between the PWA system Σ and the abstraction AM (Σ ).

⃗ s (S(Σ ), AM (Σ )) ≤ Gran(AM (Σ )). d

Theorem 3.

The following two results state convergence properties of the sequence {AM (Σ )}M ∈N to the system representation S(Σ ) of the PWA system Σ . Lemma 1.

Gran(AM +1 (Σ )) ≤ λGran(AM (Σ )).

S(Σ ) = lim AM (Σ ). ←

Theorem 4.

Theorem 3, Lemma 1 and Theorem 4 are straightforward generalizations of Theorem 2, Lemma 1 and Theorem 3 in [32], respectively, from PWA systems to PWA systems equipped with outputs, and their proofs are therefore omitted. We can now state the following result that follows as a direct application of Theorems 1 and 3. Corollary 1. Consider a set F1 ⊂ Rn of faulty states for Σ . If there exists M ∈ N such that AM (Σ ) is (ρ2 , F2 )-predictable with F2 = Bε (F1 ) ∩ XM , with ε = Gran(AM (Σ )) and for some ρ2 ∈ R+ 0 , then Σ is (ρ1 , F1 )−predictable, for all ρ1 ≥ ρ2 + 2ε . Remark 2. It is well known that predictability is in general, an undecidable problem for systems with an infinite number of states. However, in [17] it has been shown that this property is decidable for unbounded (infinite) Petri nets. Corollary above shows that PWA systems are another class of systems with an infinite number of states for which predictability is decidable, though in an approximating setting. 6. An illustrative example Consider the PWA system Σ as in (27), described by the following matrices: 0.5 A1 = 0

0 0 , B1 = −0.5 0

0 3 , f1 = , 0 0.7

0.3 0

0.1 0.1 , B2 = 0.2 0

0 0 , f2 = , 0.2 0.4

0.8 A3 = 0.2

0 0.1 , B3 = 0.2 0

0 −2.5 , f3 = , 0.2 0

0.2 0

0 0.5 , B4 = 0.2 0

0 1.7 , f4 = , 0.5 1

[

[ A2 =

[

[ A4 =

]

]

]

]

[

[

[

[

]

[

]

]

]

]

[

]

[

[

]

]

(38)

E. De Santis, M.D. Di Benedetto, G. Fiore et al. / Nonlinear Analysis: Hybrid Systems 36 (2020) 100869

9

Fig. 1. Abstractions AM of the PWA system Σ for M = 1 in Figure (a), M = 2 in Figure (b) and M = 3 in Figure (c).

with η = 0.5, output function yi (t) =

[[

I1

0

]

xi (t)

]

η

, yi (t) ∈ Y = η Z,

for i = 1, 2, 3, 4 and with X1 = [−3, −1) × [0, 3), X2 = [−1, 1) × [0, 3), X3 = [1, 3) × [0, 3), X4 = [−3, 3) × [−3, 0), U = [−0.25, 0.25] × [−0.25, 0.25]. Consider the set of faulty states described by: F1 = conv{(1.8, 0), (1, 0.7), (1, −0.7), (1.5, −0.5), (0.5, 0.5), (1.5, 0.5)},

10

E. De Santis, M.D. Di Benedetto, G. Fiore et al. / Nonlinear Analysis: Hybrid Systems 36 (2020) 100869

and the set of initial states X0 = X1 = [−3, −1) × [0, 2). We constructed abstractions AM (Σ ) for M = 1, 2, 3, 4, with contraction rate λ = 0.95. Abstractions obtained for M = 1, 2, 3 are illustrated in Fig. 1. Abstraction for M = 4 is not illustrated because of its large size. The set of initial states and the set of faulty states of A1 (Σ ) obtained are {1} and {2, 3, 4}, respectively, see Fig. 1(a). The set of initial states and the set of faulty states of A2 (Σ ) obtained are [1; 8] and {11, 13, 15, 17, 19, 21, 23, 34, 35, 36, 37, 38, 39}, respectively, see Fig. 1(b). We do not report details about the sets of initial states and of faulty states of A3 (Σ ) and A4 (Σ ), because of the sizes of the abstractions; we only mention that: the cardinality of the set of initial states of A3 (Σ ) is 18, the cardinality of the set of faulty states of A3 (Σ ) is 32, the cardinality of the set of initial states of A4 (Σ ) is 52, the cardinality of the set of faulty states of A4 (Σ ) is 88. Some other data related to abstractions are reported in the following table:

(

M

card(XM )

card

1 2 3 4

4 40 124 499

7 70 455 2547

−→ M

)

Gran(AM ) 6 3 1.5 0.75

By picking ρ2 = 0.6, we obtained that abstractions AM (Σ ) with M = 1, 2, 3, 4 are (ρ2 , Fε )-predictable, with ε = Gran(AM (Σ )) and Fε = Bε (F ) ∩ XM . For example, it is easy to see that A1 (Σ ) is (ρ2 , Fε )-predictable, because any state run starting from the initial state, which is known by definition of Σ , will reach the faulty set after a finite number of steps. As a consequence, by Corollary 1, in view of approximate predictability of abstraction

• • • •

A1 (Σ ), A2 (Σ ), A3 (Σ ), A4 (Σ ),

we we we we

obtain obtain obtain obtain

that that that that

Σ Σ Σ Σ

is is is is

(12.6, Fε )-predictable; (6.6, Fε )-predictable; (3.6, Fε )-predictable; (2.1, Fε )-predictable.

Hence, on the basis of the analysis reported above, we can conclude that Σ is at least (2.1, F )-predictable. Times of computation for the construction of the abstractions AM (Σ ), M = 1, 2, 3, 4, and for the analysis of their approximate predictability, performed in MATLAB suite on a PC Intel(R) Core(TM) i7-5500U CPU @ 2.40 GHz RAM 16GB, are reported in the following table: M

time of computation of AM (Σ )

time for check of approximate predictability of AM (Σ )

1 2 3 4

2.7 s 39.8 s 375.3 s 5550.3 s

0.30 s 1.05 s 16.71 s 519.84 s

Given ρ2 , let us consider the values of ε for which AM (Σ ) is (ρ2 , F2 )-predictable. Since ε is a strictly decreasing function of order M, Corollary 1 assures that also the parameter ρ1∗ = ρ2 + 2ε is so. This means that the prediction for Σ is more and more accurate, as M increases. Obviously, because of the output quantization, we in general expect a bound in such accuracy. This fact explains why in the example we have been able to guarantee (ρ1∗ , F )-predictability up to ρ1∗ = 2.1. 7. Conclusions In this paper we introduced and characterized the notion of approximate predictability for pseudo-metric systems and we described how to check this property for symbolic pseudo-metric systems. Furthermore, we established a relation between approximate predictability and approximate simulation. This relation allows checking approximate predictability of a system Σ with an infinite number of states for which a symbolic pseudo-metric system (i.e., with a finite number of states and inputs) approximating Σ in the sense of approximate simulation can be constructed. This result was applied to the analysis of approximate predictability of PWA systems and an illustrative example was proposed. Our results do not take into account internal perturbations and presence of unknown-external disturbances in the considered class of pseudo-metric systems. In this regard, the abstractions of PWA systems we proposed need to be extended, and the results reported in [34,35] dealing with the construction of abstractions for nonlinear systems with unknown disturbances can be of help. These issues will be explored in our future work. Throughout the paper we assume that the inputs of pseudo-metric system S are not available. This assumption corresponds to the point of view of an external observer that cannot have access to the inputs of the system S. An interesting future research direction that we will pursue is to consider inputs u = (u1 , u2 ) where u1 is observable and u2 is unobservable.

E. De Santis, M.D. Di Benedetto, G. Fiore et al. / Nonlinear Analysis: Hybrid Systems 36 (2020) 100869

11

Acknowledgments We thank Dr. Andrea Clivio for having developed in his thesis at the University of L’Aquila, the software implementation of the algorithms presented in this paper, and the anonymous Reviewers for very insightful comments and suggestions. Appendix In this section we show how to check approximate predictability of pseudo-metric symbolic systems by extending the algorithm given in [22] for exact predictability. Given a symbolic pseudo-metric system S = (X , X0 , U , −→, Y , H), let ⋃ u Pre(x′ ) = {x ∈ X | ∃ x −→ x′ }. For a set X ′ ⊆ X , Pre(X ′ ) = x∈X ′ Pre(x) and ˆ F (X ′ ) denotes the subset of X such that any ′ state run starting from it reaches the set X in finite time. Given S and a set of faulty states F ⊆ X , define the symmetric sets:

Π=

{(

Θ=

{(

x, x′ ∈ X × X : H(x) = H(x′ )

)

}

(39)

x, x′ ∈ X × X : x = x′ ⊆ Π .

(40)

and

)

}

We recall, from e.g. [4], that (two state runs of system S are indistinguishable if their corresponding output runs coincide. ) Let I ∗ be the set of all pairs x, x′ ∈ Π reachable from X0 with two indistinguishable state runs. Set I ∗ can be computed by using the following recursion: I1 = Ik+1 = k ∈ N.

(X0 × X0 ) ∩ Π , {(x, x′ ) ∈ Π : (Pre(x) × Pre(x′ )) ∩ Ik ̸= ∅} ∪ Ik ,

(41)

Lemma 2. Consider recursion (41). Then: (i) The least fixed point of recursion (41) exists, is unique and is equal to I ∗ . (ii) Recursion (41) reaches the fixed point I ∗ in at most card(X )2 steps. Proof. Direct consequence of Lemma 9 in [4]. Given a set F ⊂ X , R−n (F ) is the set of states x ∈ X from which it is possible to reach the set F after n steps, but not before. Under the assumption that all the states in X are reachable from the set X0 , if R−n (F ) ̸ = ∅ and R−n (F ) ⊆ ˆ F (F ), then R−n (F ) will be called n−precursor of the set F , and will be denoted by Fn (F ). If R−n (F ) is not a n−precursor, then Fn (F ) = ∅. The set F (F ) =

⋃

Fn (F )

(42)

n ≥1

will be called precursor of F . It is easy to verify that Fn (F ) ∩ Fn+1 (F ) = ∅, ∀n ≥ 0.

(43)

Moreover for n ≥ 1 Fn (F ) ̸ = ∅ H⇒ Fi (F ) ̸ = ∅, ∀i = 1, . . . , n − 1 In what follows we will assume F (F ) ̸ = ∅. This condition is necessary for the exact predictability even in the case of full state knowledge. Therefore this assumption can be given without loss of generality. Given system S, define the symbolic pseudo-metric system

˜ S−1 = (X , X0 , U , −→, Y , H), ∼ u

u

∗ where x −→ x′ if and only if x −→ x′ and x ∈ / F1 (F ). Let ˜ I− 1 be the set of pairs of states reachable from X0 with two ∼

indistinguishable state runs of ˜ S−1 . Given X ′ ⊆ X , in what follows the symbol X ′ denotes the complement set of X ′ in X , ′ ′ i.e. X = {x ∈ X |x ∈ / X }. We can state the following: If ρ = 0, system S is (ρ, F )−predictable if and only if

Theorem 5. ∗ ˜ I− 1

) ∩ F1 (F ) × F (F ) = ∅ (

(44)

If ρ > 0, system S is (ρ, F )−predictable if

( ( )) ∗ ˜ I− =∅ 1 ∩ F1 (F ) × F F ∪ Bρ (F )

(45)

12

E. De Santis, M.D. Di Benedetto, G. Fiore et al. / Nonlinear Analysis: Hybrid Systems 36 (2020) 100869

Proof. Case ρ = 0 (Sufficiency): let us consider a state run σ of S, with initial state in X0 and with the only last state ∗ ˜∗ I− in F1 (F ). If ˜ 1 = ∅, then obviously S is (1, F )−predictable. Otherwise, by definition of I−1 and by condition (44), all the state runs of S which are indistinguishable from σ have the last state in F (F ). Therefore S is (1, F )−predictable and hence it is F −predictable. (Necessity): suppose that the condition (44) is false. Then there exist two state runs of S, σ ′ and σ ", such that the last state of σ ′ is in F1 (F ) and the last state of σ " is in F (F ). By definition of ˜ S−1 , this last state of σ " does not belong to F and therefore, by definition of F (F ), there is no state in σ " belonging to F (F ). Therefore S is not Ω − predictable. Case ρ > 0: obvious, by the proof of sufficiency of the case ρ = 0.

(

)

(

)

Remark 2. Space and time complexities in computing I ∗ are respectively, O card(X )2 ( and O card(X )5 (as described ) in [4]). Space and time complexities in computing F (F ) are respectively, O (card(X )) and O card(X )3 (as described in [22]). Therefore check of approximate predictability can be given with polynomial complexity. References [1] A.A. Cárdenas, S. Amin, S. Sastry, Secure control: towards survivable cyber-physical systems, in: 2008 The 28th International Conference on Distributed Computing Systems Workshops, 2008, pp. 495–500. [2] F. Lin, Diagnosability of discrete event systems and its applications, Discrete Event Dyn. Syst. 4 (2) (1994) 197–212. [3] M. Sampath, R. Sengupta, S. Lafortune, K. Sinnamohideen, D. Teneketzis, Diagnosability of discrete-event systems, IEEE Trans. Automat. Control 40 (9) (1995) 1555–1575. [4] E. De Santis, M.D. Di Benedetto, Observability and diagnosability of finite state systems: a unifying framework, Automatica 81 (2017) 115–122. [5] M. Benosman, A survey of some recent results on nonlinear fault tolerant control, Math. Probl. Eng. 2010 (2010). [6] Z. Gao, C. Cecati, S. Ding, A survey of fault diagnosis and fault–tolerant techniques–part I: fault diagnosis with model-based and signal-based approaches, IEEE Trans. Ind. Electron. 62 (2015) 3757–3767. [7] S. Narasimhan, G. Biswas, Model-based diagnosis of hybrid systems, IEEE Trans. Syst. Man Cybern. A 37 (3) (2007) 348–361. [8] M. Bayoudh, L. Travé-Massuyès, Diagnosability analysis of hybrid systems cast in a discrete-event framework, Discrete Event Dyn. Syst. (ISSN: 1573-7594) 24 (3) (2014) 309–338. [9] E. De Santis, M.D. Di Benedetto, Observability of hybrid dynamical systems, Found. Trends Syst. Control 3 (4) (2016) 363–540. [10] G. Pola, E. De Santis, M.D. Di Benedetto, Approximate diagnosis of metric systems, IEEE Control Syst. Lett. 2 (1) (2018) 115–120. [11] P. Tabuada, Verification and Control of Hybrid Systems: A Symbolic Approach, Springer, 2009. [12] S. Genc, S. Lafortune, Predictability of event occurrences in partially-observed discrete-event systems, Automatica 45 (2) (2009) 301–311. [13] J. Zaytoon, S. Lafortune, Overview of fault diagnosis methods for discrete event systems, Annu. Rev. Control 37 (2) (2013) 308–320. [14] S. Takai, R. Kumar, A generalized inference-based prognosis framework for discrete event systems, in: 20th IFAC World Congress, IFAC-PapersOnLine 50 (1) (2017) 6819–6824. [15] S. Takai, Robust prognosability for a set of partially observed discrete event systems, Automatica 51 (2015) 123–130. [16] X. Yin, Z. Li, Decentralized fault prognosis of discrete event systems with guaranteed performance bound, Automatica 69 (2016) 375–379. [17] X. Yin, Verification of prognosability for labeled petri nets, IEEE Trans. Autom. Control 63 (6) (2018) 1828–1834. [18] J. Chen, R. Kumar, Stochastic failure prognosability of discrete event systems, IEEE Trans. Autom. Control 60 (6) (2015) 1570–1581. [19] R. Ammour, E. Leclercq, E. Sanlaville, D. Lefebvre, Fault prognosis of timed stochastic discrete event systems with bounded estimation error, Automatica 82 (2017) 35–41. [20] R. Ammour, E. Leclercq, E. Sanlaville, D. Lefebvre, Faults prognosis using partially observed stochastic petri-nets: an incremental approach, Discrete Event Dyn. Syst. 28 (2) (2018) 247–267. [21] P.J. Mosterman, G. Biswas, Monitoring, prediction, and fault isolation in dynamic physical systems, in: AAAI/IAAI, 1997, pp. 100–105. [22] G. Fiore, E. De Santis, M.D. Di Benedetto, Predictability for finite state machines: a set-membership approach, in: 2018 14th International Workshop on Discrete Event Systems, WODES, 2018. [23] G. Fiore, E.D. Santis, G. Pola, M.D. Benedetto, On approximate predictability of metric systems, in: 4th IFAC Conference on Analysis and Design of Hybrid Systems, IFAC-PapersOnLine 51 (16) (2018) 169–174. [24] I. Reilly, P. Subrahmanyam, M. Vamanamurthy, Cauchy sequences in quasi–pseudo–metric spaces, Monatsh. Math. 93 (2) (1982) 127–140. [25] R. Milner, Communication and Concurrency, Prentice Hall, 1989. [26] D. Park, Concurrency and automata on infinite sequences, in: Lecture Notes in Computer Science, vol. 104, Springer-Verlag, 1981, pp. 167–183. [27] A. Girard, G. Pappas, Approximation metrics for discrete and continuous systems, IEEE Trans. Automat. Control 52 (5) (2007) 782–798. [28] G. Pola, P. Pepe, M.D. Di Benedetto, Symbolic models for networks of control systems, IEEE Trans. Automat. Control 61 (11) (2016) 3663–3668. [29] G. Pola, A. Girard, P. Tabuada, Approximately bisimilar symbolic models for nonlinear control systems, Automatica 44 (2008) 2508–2516. [30] M. Zamani, M. Mazo, G. Pola, P. Tabuada, Symbolic models for nonlinear control systems without stability assumptions, IEEE Trans. Autom. Control 57 (7) (2012) 1804–1809. [31] A. Girard, G. Pola, P. Tabuada, Approximately bisimilar symbolic models for incrementally stable switched systems, IEEE Trans. Autom. Control 55 (1) (2010) 116–126. [32] G. Pola, M.D. Di Benedetto, Symbolic models and control of discrete–time piecewise affine systems: an approximate simulation approach, IEEE Transact. Autom. Control 59 (1) (2014) 175–180. [33] G. Pola, M.D. Di Benedetto, A. Borri, Symbolic control design of nonlinear systems with outputs, Automatica 109 (2019) 1–9. [34] G. Pola, P. Tabuada, Symbolic models for nonlinear control systems: alternating approximate bisimulations, SIAM J. Control Optim. 48 (2) (2009) 719–733. [35] A. Borri, G. Pola, M.D. Di Benedetto, Symbolic models for nonlinear control systems affected by disturbances, Internat. J. Control 88 (10) (2012) 1422–1432.