A distributed model predictive control scheme with robustness against noncompliant controllers.

This is a repository copy of A distributed model predictive control scheme with robustness against noncompliant controllers in the Depósito de Investigación de la Universidad de Sevilla Version: Author Accepted Version Citation: Maestre, J.M., Trodden, P.A. orcid.org/0000-0002-8787-7432 and Ishii, H. (2019) A distributed model predictive control scheme with robustness against noncompliant controllers. In: 2018 IEEE Conference on Decision and Control (CDC). 57th IEEE Conference on Decision and Control (CDC 2018), 17-19 Dec 2018, Florida, USA. IEEE. ISBN 978-1-5386-1395-5 https://doi.org/10.1109/CDC.2018.8619079 © 2018 IEEE. To cite this publication, please use the final published version (if applicable). Please check the document version above. Copyright: Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons. Takedown policy: Please contact us ([email protected]) and provide details if you believe this document breaches copyrights. We will remove access to the work immediately and investigate your claim A Distributed Model Predictive Control Scheme with Robustness Against Noncompliant Controllers Jos´ e M. Maestre1, Paul A. Trodden2and Hideaki Ishii3 Abstract— A tube-based distributed model predictive control (DMPC) scheme is proposed for dynamically coupled linear systems. The control scheme is designed to guarantee local performance even when neighboring controllers are not complying with the requirements of the algorithm (e.g., they are malicious or faulty). The resulting conservativeness is minimized, for controllers aim to minimize their state and input constraint sets to reduce mutual disturbances. Also, sufficient conditions for feasibility and exponential stability are given. Finally, these ideas are illustrated and assessed with respect to other robust DMPC via a simulated example. I. INTRODUCTION In standard MPC, a model of a system is used to build a finite horizon optimization problem (FHOP) in which the sequence of inputs to be implemented and the resulting predicted states are optimized with respect to a performance index [ 1 ]. The FHOP can deal explicitly with complex issues such as uncertainties, constraints, and delays, which is very convenient in many industrial applications [ 2 ]. When it is implemented in a distributed fashion, the control architecture is composed of a set of local MPC controllers —also known as agents— that exchange information to improve both local and overall performance. In addition, distributed MPC schemes must take into account aspects such as the organizational structure of the system and its information flows, constraints on the information exchange sources, among others. See for example [3], [4] for surveys on the topic. As is common in interactive decision making problems, incentives may exist for agents to deviate with respect to their nominal or expected behavior. For example, strategic behavior in energy demand networks is studied in [ 5 ]. Another related work is [ 6 ], where economic incentives are introduced to promote truthful communication in load frequency control. A different mechanism design approach is that of [ 7 ], where a hierarchical structure is considered so that a coordinator with access to agents’ private information computes a control law adjusted to the best interest of controllers. Also, the incentives for misbehaving agents might be other than economical, as it happens for example in cybersecurity problems [ 8 ], [ 9 ], *Financial support by the Spanish MINECO (project DPI2017-86918-R), the Japanese Society for the Promotion of Science (scholarship PE16048) and the ERC-ADG OCONTSOLAR (Project ID: 789051) is gratefully acknowledged. 1 J. M. Maestre is with the Department of Systems and Automation Engineering, University of Seville, Seville, Spain [email protected] 2 P. A. Trodden is with the Department of Automatic Control & Systems Engineering, University of Sheffield, Sheffield, England [email protected] 3 H. Ishii is with the Department of Computer Science, School of Computing, Tokyo Institute of Technology, Tokyo, Japan [email protected] where vulnerabilities in the elements that compose the system (sensors, communication channels, etc.) are often exploited to disrupt its normal operation. Even though this is a significant concern in networked applications such as the smart grid [ 10 ] and consensus problems [ 11 ], few attempts have been made to deal with it in a DMPC framework. For example, heuristic defense mechanisms for dual decomposition DMPC are proposed in [ 12 ], [ 13 ] to minimize the effects of attacks of the price based coordination mechanism. Finally, it must be noticed that problems due to mutual interaction can also arise as a consequence of faulty components [14], [15]. All the aforementioned issues have one thing in common: the existence of agents that do not operate as expected with consequences for the overall system that can range from the loss of performance to instability. This motivates us to extend the distributed MPC method presented in [ 16 ] to deal with noncompliant controllers, for it does not matter whether the undesired behavior stems from a malicious attack or is due to faulty events. In particular, the proposed approach is a tube-based distributed MPC scheme with guaranteed recursive feasibility and stability that is based on the optimization and exchange of the input and state constraint sets to minimize the mutual disturbances. The presence of noncompliant agents in the system is dealt with by the robustification of the disturbances expected by local controllers, so that feasibility and stability are preserved. A final improvement with respect to [ 16 ] is the relaxation of the conditions required for stability. The outline of the rest of the paper is as follows: Sections II and III present, respectively, the preliminaries of the problem setting and the distributed control problem. Section IV focuses on the detection and defense against noncompliant agents. Implementation details of the algorithm are given in Section V and its main theoretical properties are discussed in Section VI. Finally, Section VII presents an illustrative example and Section VIII concludes the paper with closing remarks. Notation: The sets of non-negative and positive reals are denoted, respectively, R0+ and R+ . The notation [a, b]n means the n -dimensional product set [a, b]×[a, b]×· · ·×[a, b] , where a, b ∈R . For a, b ∈Rn , a≤b applies element by element. The distance of a point x∈Rn from a set X⊂Rn is |x|X,infy∈X|x−y| . AX denotes the image of a set X⊂Rn under the linear mapping A:Rn→Rp , and is given by {Ax :x∈X} . For X, Y ⊂Rn , the Minkowski sum is X⊕Y,{x+y:x∈X, y ∈Y} ; for Y⊂X , the Minkowski difference is X⊖Y,{x∈Rn:Y⊕{x} ⊂ X} . For X⊂Rn and a∈Rn , X⊕a means X⊕{a} . The column vectors of zeros and ones are denoted 0 and 1 respectively, the length of which will be clear from the context. II. PRELIMINARIES We consider a set N=1, . . . , M of coupled systems whose dynamics in discrete time can be described as x+ i=Aiixi+Biiui+wi,(1) where xi∈Rni , ui∈Rmi , wi∈Rni are the state, input and disturbances of system i∈ N . Hence, Aij ∈Rni×nj and Bij ∈Rni×mj. The successor state is denoted as x+ i. Assumption 1: Each (Aii, Bii),i∈ N is stabilizable. The local disturbance vector includes disturbances due to interactions with neighboring agents and a safety term ws i to account for possible noncompliant events. That is, wi=X j∈Ni (Aijxj+Bijuj) + ws i, where the set of neighbours of subsystem iare defined as Ni,j∈ N \ {i}: [Aij Bij]6= 0. Assumption 2: Unexpected disturbances are bounded by a closed polytope that contains the origin in its interior, i.e., ws i∈Ws i, which can be described by rsinequalities as Ws i,ws i∈Rni:Cs iws i≤gs i,with gs i∈Rrs i 0+. Also, let x= (x1, . . . , xM) , u= (u1, . . . , uM) , and w= (ws 1, . . . , ws M) be respectively the aggregated state, input, and disturbance vectors. Then, the overall system model becomes x+=Ax +Bu +w, where the overall state and input matrices A and B are composed accordingly. A. Constraints and invariance Each system i∈ N is subject to local polytopic state and input constraints, i.e., xi∈Xi and ui∈Ui , that contain the origin in their interiors and are defined respectively by rx i and ru ilinear inequalities as Xi(ai),xi∈Rni:Cx ixi≤ai,∀ai∈Rrx i 0+, Ui(bi),ui∈Rmi:Cu iui≤bi,∀bi∈Rru i 0+, with ai≤1, bi≤1 . In particular, Xi,Xi(1) and Ui,Ui(1) define hard constraint sets on the system variables while Xi(ai) and Ui(bi) are tightened versions that the local controllers may decide to use to minimize mutual disturbances. Since input and state local constraints and unexpected disturbances are assumed to be polytopic, it can be seen that wi∈Wi,Ws i⊕W0 i=Ws i⊕M j∈Ni Wij, where W0 i=Lj∈Ni Wij is defined as the set of nominal disturbances, with Wij =AijXj⊕BijUj being the contribution of subsystem j to the disturbance of subsystem i . The set W0 i contains the origin in its interior and can be described by a set of rw0 iinequalities W0 i,W0 i(g0 i),wi∈Rni:Cw0 iwi≤gi,∀gi∈Rrw0 i 0+ , where Cw0 i is defined so that W0 i(1) is formed from the full sized constraint sets, i.e., W0 i(1) = M j∈Ni Wij(1) = M j∈Ni AijXj(1)⊕BijUj(1).(2) Also, Wiis described by a set of rw iinequalities: Wi,Wi(gi),wi∈Rni:Cw iwi≤gi,∀gi∈Rrw i 0+. Again, Cw i is defined so that Wi=Wi(1) is formed from the full sized constraint sets Xi(1)and Ui(1), i.e., Wi(1) = Ws i⊕Lj∈Ni Wij(1) =Ws i⊕Lj∈NiAijXj(1)⊕BijUj(1).(3) According to Assumption 1, it is possible to find, for each i , a local feedback Ki that stabilizes the local subsystem so that all the eigenvalues of Aii +BiiKi are within the unit circle. Hence, there also exists a polytopic robust positively invariant (RPI) set, Ri, which satisfies: (Aii +BiiKi)Ri⊕Wi⊆ Ri.(4) In particular, Rican be represented by rR iinequalities as Ri(qi),xi∈Rni:CR ixi≤qi, and qi∈RrR i 0+ . Moreover, following the previous definition of Wi(1) , we can normalize Ri(qi) so that Ri(1) is the RPI set that corresponds to the original disturbance set Wi(1) , i.e., (Aii +BiiKi)Ri(1)⊕Wi(1)⊆ Ri(1). Finally, it is assumed that the strength of couplings is limited in such a way that the invariant set is compatible with local state and input constraint sets [17]. Assumption 3: For all i∈ N , Ri(1)⊆interior(Xi(1)) and KiRi(1)⊆interior(Ui(1)). B. Control objective The goal of local controllers is to minimize the following global infinite-horizon cost ∞ X k=0 X i∈N ℓixi(k), ui(k)= ∞ X k=0 X i∈N (x⊤ iQixi+u⊤ iRiui), (5) where ℓi(xi, ui) is the stage cost defined by positive definite weighting matrices Qiand Ri. III. DISTRIBUTED OPTIMAL CONTROL PROBLEM Local controllers regulate a nominal subsystem without interactions z+ i=Aiizi+Biivi , with zi and vi being the corresponding nominal state and input. To this end, vi= ¯κi(zi) , where ¯κi(zi) is a MPC-based control law that implements the first element of the optimized sequence v∗ i(zi) . The MPC optimization also minimizes mutual disturbance sets by optimizing the corresponding parameters ai and bi in such a way that local performance is not affected. This information is transmitted to neighbors, which benefit from a decrease of their local uncertainty. Regarding the real subsystem, the following input is applied: u∗ i=κi(xi, zi) = ¯κi(zi) + Ki(xi−zi),(6) where the second term is included to reduce mismatch between the nominal and perturbed trajectories. A. Tube-based distributed optimal control problem At nominal state zi , an optimized sequence of controls vi= (vi(0), . . . , vi(N−1)) is obtained by local controller i by solving a FHOP ¯ Pi(zi;ai, bi, qi)defined as min (vi,ai,bi)Vf izi(N)+ N−1 X j=0 ℓizi(j), vi(j)+ρakaik1+ρbkbik1, where Vf i is a terminal cost and ρa>0 and ρb>0 are constant weighting parameters. The optimization is subject to the following constraints: (ai, bi)∈[0,1]rx i×[0,1]ru i and vi∈ Vi(zi;ai, bi, qi), where Vi(zi;ai, bi, qi)is defined by zi(j+ 1) = Aiizi(j) + Biivi(j), j = 1, . . . , N −1,(7a) zi(0) = zi,(7b) zi(j)∈Xi(ai)⊖ Ri(qi), j = 0, . . . , N −1,(7c) vi(j)∈Ui(bi)⊖KiRi(qi), j = 0, . . . , N −1,(7d) zi(N)∈Xf i(ai, bi;qi).(7e) Here, Xf i(ai, bi;qi) is a terminal set and qi is a parameter rather than an optimization variable. The domain zi∈ Zi(qi) for which ¯ Pi(zi;ai, bi, qi) has a feasible solution can be computed using standard methods [17] and is defined as zi:∃(ai, bi)∈[0,1]rx i×[0,1]ru is.t. Vi(zi, ai, bi;qi)6=∅. B. Parametric terminal set and cost design Recursive feasibility and closed-loop stability is attained following a standard terminal cost/constraint approach by means of Vf i and Xf i [ 17 ]. The terminal cost function is defined as Vf i(zi) = (1/2)z⊤ iPizi, with Pi>0satisfying Φ⊤ iPiΦi−Pi≤ −Qi−(Kf i)⊤RiKf i, where Φi,Aii +BiiKf i. The terminal constraint set Xf i is constructed to be invariant for local nominal dynamics when they are stabilized by a feedback vi=Kf izi and admissible for tightened constraints, i.e., Xf i⊆Xi(ai)⊖ Ri(qi),(8a) Kf iXf i⊆Ui(bi)⊖KiRi(qi).(8b) The terminal set Xf i has to be recomputed as Xi(ai) and Ui(bi) change. To this end, an inner approximation Xf i(ai, bi;qi) to the maximal constraint admissible set Xf i is parameterized by the state and input constraint vectors ai and bias in [16]. IV. NONCOMPLIANT AGENTS A noncompliance happens when an agent j violates its broadcasted limits aj and bj , which provide its neighbors with information regarding the bounds of their local disturbance sets. This can render the computations of neighbors infeasible. It is possible to employ the sets exchanged to perform a noncompliance detection based on a set-membership approach. To this end, neighbors in Ni are classified to be in either one of following disjoint sets: • Compliant neighbor set NC i , which comprises neighboring subsystems whose announced disturbance sets can be trusted, which allows reducing conservatism. • Uncertain compliance neighbor set NUC i , which comprises neighboring subsystems whose disturbance sets are compatible with the received disturbances. Initially, all agents are considered in this group. • Noncompliant neighbor set NNC i , which comprises agents not to be trusted so that the controller should be prepared for the worst possible case (i.e., that of maximum coupling). Note that Ni=NC i∪ NUC i∪ NNC i , with NC i∩ NNC i= NC i∩ NUC i=NUC i∩ NNC i=∅. To reduce conservatism we limit the number of noncompliant agents: Assumption 4: The maximum number of noncompliant agents in the neighborhood is known to be bounded by NNC max . A. Noncompliance Detection Given that we can measure xi and x+ i , it is possible to detect any noncompliance with respect to the transmitted values if wi=x+ i−Aiixi−Biiui/∈Wi holds. Any noncompliance not fulfilling this condition goes undetected, although it does not compromise the local controller, for the disturbance received can be tolerated. B. Identification Under our approach, constrained disturbance sets are broadcasted to neighbors and maximum disturbance sets are known by each agent from the beginning. The challenge is to classify neighbors using this information and measuring only aggregate disturbances. Three situations are possible: 1) Neighbors not compatible with disturbance: It is possible to identify whether a disturbance is compatible with a neighbor j∈ Niby checking whether wi/∈Wi⊕˜ Wij ⊕[ A⊆NNC i∪NUC i\{j}:|A|=NNC max−1M l∈A ˜ Wil holds. The fulfillment of this condition implies that j is not compatible with the disturbance received, for there is no set of neighbors A ⊆ NNC i∪ NUC i with |A| =NNC max −1 that can generate the disturbance received in combination with that of j . This condition should be checked for all neighbors. If the number of agents compatible with the disturbance is lower than or equal to NNC max , then noncompliant agents can be identified. 2) Neighbors responsible of disturbance: A neighbor j is responsible for the unexpected disturbance received if wi/∈Wi⊕[ A⊆NNC i∪NUC i\{j}:|A|=NNC max M l∈A ˜ Wil holds. That is, there is no set of noncompliant neighbors A ⊆ NNC i\ {j} that is compatible with the disturbance received. If this condition is fulfilled, then a noncompliant agent is identified. Once NNC max noncompliant agents are identified, the rest can be taken as compliant agents and be moved to NC i. 3) Neighbors compatible with disturbance: The compliance of neighbor j is uncertain, i.e., the disturbance received can be generated by combinations of neighbors that can involve j. In this case, jremains in NUC i. C. Robustification against malicious agents The maximum impact that a noncompliant neighbor j can have into the disturbances of subsystem iis given by ˜ Wij = (AijXj(1)⊕BijUj(1)) ⊖(Aij Xj(aj)⊕Bij Uj(bj)). (9) To avoid problems, agent i can use the set Ws i introduced in Assumption 2 to get an additional degree of robustness. Proposition 1: A subsystem i is robust against NNC max noncompliant controllers if Ws i⊇[ A⊆NNC i∪NUC i:|A|=NNC max M j∈A ˜ Wij holds. The proof is omitted but the rationale of the proposition is clear: robustness is guaranteed as long as unexpected disturbances stay within the safety set Ws i . According to Proposition 1, since agent i does not know which are the malicious agents A ⊆ Ni, it has to be prepared for all the |Ni| min(NNC max,|Ni|) possibilities that can arise when there is a maximum of NNC max noncompliant agents in the neighborhood. V. DISTRIBUTED CONTROL ALGORITHM AND IMPLEMENTATION In this section, we present an algorithm with defense mechanisms against noncompliant neighbors. In particular, it combines a set-membership detection mechanism to classify neighbors either as compliant/noncompliant and the optimal control problem Pi(zi;qi)to provide robustness. Algorithm 1: Initial data : Sets Xi(1) , Ui(1) , Wi(1) , Ri(1) , Xf i(ai, bi;qi) ; matrices Ki and Kf i , reconfiguration period T ; maximum number of noncompliant controllers in the neighborhood NNC max. Initialization : At k= 0 , set xi=zi=xi(0) , qi=1 , p= 0, and NUC i=Niand NC i=NNC i=∅. Online routine: 1) At time k and state (xi, zi) , solve Pizi;qi to obtain v∗ i= ¯κi(zi)and (a∗ i, b∗ i). 2) Apply ui=v∗ i+Ki(xi−zi)to subsystem i. 3) Measure x+ i , compute z+=Aiizi+Biiv∗ i and ˜wi= x+ i−Aiixi−Biiui. 4) If ˜wi/∈W0 i a) Set A=∅. b) For each neighbor j∈ N UC i • If j is responsible for ˜wi , NUC i=NUC i\ {j} , NNC i=NNC i∪ {j}. • Else if ˜wi is compatible with j , A=A ∪ {j} . c) If |A| ≤ NNC max , NNC i=NNC i∪ A , NUC i= NUC i\ A. d) If |NNC i|=NNC max , NC i=Ni\ NNC i , update Ws i and compute Wi(g+ i). 5) If k=pT, a) Transmit a∗ i,b∗ ito subsystems j∈ Ni. b) Compute Wi(g+ i). c) Set p=p+ 1. 6) Compute Ri(q+ i). 7) Set (xi, zi) = (x+ i, z+ i), set k=k+ 1, go to Step 1. A. Implementation: the polytopic case Here, we provide implementation details of the algorithm. 1) Computing Wi(g+ i) :Given a safety disturbance set Ws i(gs i) described by {ws i:Cs iws i≤gs i} , the local disturbance set Wi(gi) –defined by {wi:Cw iwi≤gi} – can be calculated by updating g+ ias g+ il = max{Cw il wl:wl∈Ws} +X j∈Ni max{Cw il Aijxl j:xl j∈Xj(a∗ j)} +X j∈Ni max{Cw il Bijul j:ul j∈Uj(b∗ j)}. for each entry lof g+ i. 2) Computing Ri(q+ i) given Wi(g+ i) :Step 6 requires the on-line calculation of a new a minimal RPI set to reduce conservatism and take advantage of the updated information regarding the disturbance set Wi(g+ i) and the knowledge regarding the state. To this end, the LP proposed in [ 18 ] is used, which allows computing an updated q+ i to form the minimal RPI set characterized by the given set of inequalities CR i that contains the state. In particular, Ri(1) is assumed to be designed off-line by a proper method as those in [ 19 ], [ 18 ]. Then, given Wi(g+ i) , it suffices to solve the following LP to calculate q+ i: q+ i=c∗ i+d∗ iwhere (c∗ i, d∗ i) = arg max {cil,dil,ξl i,ωl i} ∀l∈{1,...,rR i} rR i X l=1 cil +dil subject to, for all l∈ {1, . . . , rR i}, cil ≤CR il (Aii +BiiKi)ξl i, CR il (x+ i−z+ i)≤CR iξl i, CR iξl i≤ci+di, dil ≤CR il ωl i, Cw iωl i≤g+ i. VI. RECURSIVE FEASIBILITY AND STABILITY Given xi∈zi⊕Ri , a feasible solution v∗ i(zi) for Pi(zi;qi) guarantees that x+ i∈z+ i⊕ Ri and the satisfaction of the local true state and input constraints. Moreover, the sequence ˜ vi(z+ i) = {v∗ i(1; zi), . . . , v∗ i(N−1; zi), Kf iz∗ i(N;zi)} (10) is also feasible for Pi(z+ i) , which provides the controlled system with recursive feasibility as long as the constraint and invariant sets remain constant, i.e., the constraints of the true subsystem are satisfied for all future x+ i∈ (Aiixi+Biiκi(xi, zi)) ⊕Wi. Nevertheless, the fact that the RPI set changes, i.e., Ri(q+ i)6=Ri(qi) , demands special attention to avoid the loss of recursive feasibility, for ˜ vi(z+ i) may not be feasible for Pi(z+ i;q+ i) . Here we make a conservative assumption that requires that a feasible solution can always be found for the initial setup of the control scheme. Assumption 5: Problem Pi(zi;1)is feasible. A. Conditions for recursive feasibility Next, we discuss the different situations that can come up after the update of Ri: •Ri(q+ i)⊆ Ri(qi) : every decrease Ri makes the domain of the optimization problem Zi larger, as shown in [ 16 ]. Hence, the sequence is still feasible in future optimizations. Since the optimization promotes the reduction of Xi(ai)⊖ Ri(qi) and Ui(bi)⊖KiRi(qi) until these constraints become active, ai and bi must decrease, which reduces Wji for any j with i∈ Nj and allows Ri(qj) , aj and bj to decrease and hence reduce Wij and Ri(qi) . In this way, exponential stability towards the origin can be achieved if all agents comply with the scheme, as it was shown in [ 16 ] provided that ai and bi are non-increasing over time. If there are noncompliant agents, then agents state must remain inside a bounded region around the origin. •Ri(q+ i)⊃ Ri(qi) : Ri(q+ i) = Ri(qi) should always be a feasible solution for the minimal RPI calculation step, that is, this case should not happen. Nevertheless, let us assume this situation for the sake of analysis. In this case, the sequence ˜ vi(z+ i) may not be feasible for Pi(z+ i)and two situations can arise: – A new solution can be found for Pi(z+ i) in such a way that ai and bi are lower or equal to the last broadcasted values. In this case, neighbors are not affected and everything is handled internally by the local controller. – A new solution can be found for Pi(z+ i) but ai and bi must be increased with respect to the last transmitted values. For example, in the worst case the controller can resort to the initial case, which is assumed to be feasible. Here, it is necessary to communicate the new values before taking any control action. An iterative process could take place until agents converge on the values of their new bounds, which in the worst case are those corresponding to full sized constraints. VII. ILLUSTRATIVE EXAMPLE A modification of the four-truck system presented in [ 20 ] is used as test bench. Here, trucks have mass m1= 3 kg , m2= 2 kg,m3= 3 kg, and m4= 6 kg and dynamics ˙ri ˙vi=0 1 −1 miPj∈Nikij −1 miPj∈Nihij |{z } Aii ri vi +0 100 |{z} Bii ui+X j∈Ni0 0 1 miPj∈Nikij 1 miPj∈Nihij |{z } Aij rj vj |{z } wi where ri , vi , ui and wi are respectively the displacement of truck i with respect to its equilibrium position, its velocity, the acceleration, which is the control input, and the disturbance due to neighbors, which is generated in the following way: • trucks 1 and 2 are coupled via a spring (stiffness k12 = 0.5 N m−1) and damper (h12 = 0.2 N m−1s−1); • trucks 2 and 3 are coupled via a spring (stiffness k23 = 0.75 N m−1) and damper (h23 = 0.25 N m−1s−1); • trucks 3 and 4 are coupled via a spring (stiffness k34 = 1 N m−1) and damper (h34 = 0.3 N m−1s−1); Initial states are xT 1= [1.8,0] , xT 2= [−1,0] , xT 3= [1,0] and xT 4= [−1,0] . The goal is to take trucks to the origin while satisfying state and input constraints Xi(1) and Ui(1) , which are defined as |ri| ≤ 4 , |vi| ≤ 1 and |ui| ≤ 1 for trucks 1, 2, and 3; the constraints of truck 4 are simply |r4| ≤ 4 , |v4| ≤ 1 and |u4| ≤ 2 . Also, recall that initial disturbance sets are assumed to be known by all affected agents, which allow them to compute Wi(1). Local controllers approximate the continuous-time dynamics with a sampling time of 0.1 seconds to obtain a discrete-time model by using zero-order hold. Cost matrices are defined as Qi=I and Ri= 100 and ρa= 0.0001 , and the horizon is N= 25 . Note that there is no need for bi in this case study, for there is only state coupling. Also, a deadbeat controller is used for the tube control law, Ki , of each truck, so that the minimal RPI set is finitely determined. Finally, an LQR Kf i=K∞(Aii, Bi, Qi, Ri) is used as a terminal controller, which allows us to calculate the terminal cost matrix Pi as the solution of the corresponding Lyapunov equation and the maximal parametric terminal set that guarantees the satisfaction of Xi(ai)and U. We assume that NNC max = 1 and set agent 2 as noncompliant. In particular, we consider that its state remains constant at xT 2= [4,1] and also that it broadcasts that its state constraint set is empty so that neighbors will not expect any disturbances from it. Also, given the couplings, agents 1 and 4 are going to work in a pure decentralized tube MPC mode, for they have only one neighbor. Hence, we focus exclusively on agent 3, which is the only one that can benefit by applying the proposed method. Nevertheless, no detection can be carried out because the disturbance set that agent 3 can receive from its neighbor 2 is a subset of that generated by agent 4. In a 50 time step simulation, the cumulated cost of agent 3 when the method proposed in [ 16 ] was 8.1859. This result was obtained allowing agents to reconfigure their disturbance sets at each time step and without accounting for disturbances received from agent 2, for this is the information broadcasted by this agent. When standard decentralized tube MPC is applied, performance improves slightly and cumulated cost becomes 8.1830. In this case, agent 3 assumes worst case disturbances from agents 2 and 4 in its calculations. This improvement increases when the proposed method is used and cumulated cost becomes 8.1824. Here, it is considered that either agent 2 or agent 4 broadcasts false information, which allows local controller 3 to reduce conservatism. Figure 1 illustrates the conservatism of each approach by plotting simultaneously the evolution of the state of this agent and the size of the minimal RPI that corresponds to the information available from neighbors’ disturbances. Nevertheless, note that costs can be misleading, for disturbances generated by the noncompliant neighbor might be beneficial for some of its neighbors. For this reason we must stress that the most relevant contribution of the proposed approach is to preserve theoretical properties such as stability even when noncompliant neighbors might exist. Fig. 1. Evolution of the state of agent 3 for the tested methods (up: DMPC with minimization of dual disturbances [ 16 ]; mid: decentralized tube MPC; down: proposed approach.). VIII. CONCLUSIONS A distributed MPC scheme with robustness with respect to noncompliant agents has been presented. To this end, local controllers deal explicitly with the possible deviations of neighbors with respect to their broadcasted bounds. To avoid resorting to the conservative decentralized tube-based MPC, it is assumed that there is a maximum number of noncompliant agents. Also, the proposed scheme has interesting theoretical properties as recursive feasibility and stability. In the simulation example, the rationale of the proposed method has been illustrated by showing how the conservativeness of the calculations lies between those of the method presented in [ 16 ] and standard decentralized tube MPC. Future work will extend the theoretical properties of the scheme, which will also be tested in a larger size example. REFERENCES [1] J. M. Maciejowski, Predictive Control with Constraints, Prentice Hall, 2002. [2] S. J. Qin, T. A. Badgwell, A survey of industrial model predictive control technology, Control Engineering Practice 11 (2003) 733–764. doi:10.1016/S0967-0661(02)00186-7. [3] P. D. Christofides, R. Scattolini, D. Mu ˜ noz del la Pe ˜ na, J. Liu, Distributed model predictive control: A tutorial review and future research directions, Computers and Chemical Engineering 51 (2013) 21–41. doi:10.1016/j.compchemeng.2012.05.011. [4] J. M. Maestre, R. R. Negenborn (Eds.), Distributed Model Predictive Control Made Easy, Springer, 2014. [5] Y. Okajima, K. Hirata, T. Murao, T. Hatanaka, V. Gupta, K. Uchida, Strategic behavior and market power of aggregators in energy demand networks, in: Proceedings of the 56th IEEE Conference on Decision and Control, IEEE, 2017. [6] T. Tanaka, V. Gupta, Incentivizing truth-telling in mpc-based load frequency control, in: Proceedings of the 55th IEEE Conference on Decision and Control, 2016. [7] A. Gupta, T. Ba s¸ ar, Dynamic incentive design in multi-stage lineargaussian games with asymmetric information: A common information based approach, in: Proceedings of the 53rd IEEE Conference on Decision and Control, 2014. [8] H. Sandberg, S. Amin, K. H. Johansson, Special issue on cyberphysical security in networked control system, IEEE Control Systems Magazine 35 (1) (2015) 20 – 23. [9] P. Cheng, L. Shi, B. Sinopoli, Special issue on secure control of cyberphysical systems, IEEE Trans on Control of Network Systems 4 (1) (2017) 1 – 3. [10] J. Liu, Y. Xiao, S. Li, W. Liang, C. L. P. Chen, Cyber security and privacy issues in smart grids, IEEE Communications Surveys & Tutorials 14 (4) (2012) 981–997. [11] W. Zeng, M.-Y. Chow, Resilient distributed control in the presence of misbehaving agents in networked control systems, IEEE Transactions on Cybernetics 44 (11) (2014) 2038–2049. [12] P. Velarde, J. M. Maestre, H. Ishii, R. R. Negenborn, Vulnerabilities in lagrange-based distributed model predictive control, Optimal Control Applications and Methods 39 (2018) 601–621. [13] P. Velarde, J. M. Maestre, H. Ishii, R. R. Negenborn, Scenario based defense mechanism for distributed model predictive control, in: Proceedings of the 56th IEEE Conference on Decision and Control, 2017. [14] T. Wang, H. Gao, J. Qiu, A combined fault-tolerant and predictive control for network-based industrial processes, IEEE Transactions on Industrial Electronics 63 (4) (2016) 2529–2536. [15] S. V. Naghavi, A. A. Safavi, M. Kazerooni, Decentralized fault tolerant model predictive control of discrete-time interconnected nonlinear systems, Journal of the Franklin Institute 351 (3) (2014) 1644–1656. [16] P. A. Trodden, J. M. Maestre, Distributed predictive control with minimization of mutual disturbances, Automatica 77 (2017) 31–43. [17] J. B. Rawlings, D. Q. Mayne, Model Predictive Control: Theory and Design, Nob Hill Publishing, 2009. [18] P. A. Trodden, A one-step approach to computing a polytopic robust positively invariant set, IEEE Transactions on Automatic Control (in press). doi:10.1109/TAC.2016.2541300. [19] S. V. Rakovi ´ c, E. C. Kerrigan, K. I. Kouramas, D. Q. Mayne, Invariant approximations of the minimal robust positively invariant set, IEEE Transactions on Automatic Control 50 (4) (2005) 406–410. doi:10.1109/TAC.2005.843854. [20] S. Riverso, G. Ferrari-Trecate, Tube-based distributed control of linear constrained systems, Automatica 48 (2012) 2860–2865. doi:10.1016/j.automatica.2012.08.024.