Introduction to Robust Control, Sensitivity Bounds, and Non-Linear Describing Functions

Lesson 8.1 — Sample delay and discrete-time stability

Unit: Networked control, faults and verification. Prerequisites: Book 11 feedback and state-space fundamentals; preceding lessons in this unit. Learning objectives: explain the model, reproduce the worked case, identify an important failure condition, and independently solve the problems.

Concept and mechanism

In a digital loop, the output used to compute the input may be one or more sample periods old. A delay changes the closed-loop characteristic polynomial and can destabilize a loop whose no-delay recurrence is stable. Stability of a finite-dimensional discrete linear system requires all eigenvalues to lie strictly inside the unit circle. Jitter and missed updates require more than one fixed-delay model.

Governing relation: No delay: x_{k+1}=a x_k-bK x_k; one-step delay: x_{k+1}=a x_k-bK x_{k-1}

To interpret this expression, mark each symbol as a state, command, observation, uncertainty, noise statistic or design weight. Determine whether the result is continuous-time, sampled-time, a static mapping, or a bound. The statement may require nonsingular matrices, bounded variation, a linear model or known timing. List the specific hypotheses before drawing an engineering conclusion.

Worked example

Take a=0.8, b=0.2, K=5. With no delay, multiplier is 0.8−1=−0.2, stable. With one-step delay the polynomial is λ²−0.8λ+1=0; its complex roots have product 1 and magnitude 1, so the system is marginal rather than asymptotically stable. Raising K beyond five pushes the product bK above one and makes at least one root magnitude exceed one in this example.

Independent check: Write the same example as an equation whose two sides must agree after substitution. Check the sign and limiting cases; then change only one number and predict whether the outcome increases, decreases, or requires a full recalculation. Do not mistake numerical agreement under synthetic data for physical validation. A result describing a covariance is conditional on the noise model; one describing stability is conditional on the model and its defined perturbations; one describing an optimum is conditional on both the objective and the feasible set.

Interpretation and decision

The timestamp on a logged command is not necessarily the time the actuator actually applies it. Measure the compute, network and hold delays separately before choosing a model.

The design choice should identify the goal being improved—tracking, robustness, estimation, control effort or timing—and a quantity that may become worse. Distinguish a sufficient theorem condition from a necessary condition. For optimization explicitly report actuator limits; for estimation report which measurements support the inference. A calculated number is useful only when its assumptions and units are available to the reader.

When the argument fails

A controller that changes its sample time under CPU load cannot be represented exactly by one fixed a and b. A stability proof for constant timing does not automatically cover switched timing.

Describe a falsifiable counterexample by naming an omitted dynamic, a violated constraint, an unobservable mode or a mischaracterized uncertainty set. Indicate which measured variable or computed check would reveal the discrepancy. Repeating the original calculation at the same nominal point cannot test a modeling assumption that never appeared in the equation.

Engineering case — Remote instrumentation over a network

A simulated sampling service receives sensor packets with timestamps, occasional losses and quantized values. A controller should know whether it acts on the current estimate or a held previous reading. A simple loss rate is less informative than the maximum burst length for a worst-case requirement. Run nominal timing, late-packet, dropout and sensor-stuck cases, and document the required fallback action without implying that this simulated response meets a real-world safety standard.

Lab protocol: Timing and fault audit. Record sample creation time, packet arrival time, computation completion time and actuator application time separately. Add a fault table with the intended detection, fallback behavior and independent evidence for each mode.

Create an assumption ledger listing sensor availability, actuator limits, initial state, operating point and the variable intentionally changed. For the main claim, separate what follows algebraically from what would require a second independent experiment. If the proposed experiment is unable to distinguish competing hypotheses, redesign it before collecting more repeated data.

Exercises

1. Calculation: With a=0.6, b=0.2 and K=2, find the roots of λ²−aλ+bK and test the unit-circle condition. Show the intermediate arithmetic, a dimensions or sign check, and the condition under which the result is valid.

2. Alternative model: Construct an alternative interpretation of the same nominal observation, then name one additional signal that would separate the alternatives.

3. Sensitivity: Change one uncertain parameter by 20%. State which original claim remains logically valid, which result needs recalculation, and what new numerical input is required.

4. Connection: Compare the present method to Packet loss, quantization and stale samples. Name an assumption they share and one kind of answer each method cannot produce alone.

5. Verification: Draft a five-line test specification listing input, expected outcome, numeric tolerance, potential failure and the reason a passing simulation would not establish hardware safety.

Reference guidance

A complete answer to the calculation question begins from the displayed governing relation and shows substitutions. The alternative-model answer must predict a different outcome in a specified observation. The sensitivity answer must distinguish parameter error from measurement noise. The connection question should identify a difference in mathematical object or guarantee, not just a difference in terminology. A suitable test reports reproducible settings and a clear fail condition. Use the accompanying unit assessment for explicit numerical checks and worked answer guidance.

Lesson 8.2 — Packet loss, quantization and stale samples

Unit: Networked control, faults and verification. Prerequisites: Book 11 feedback and state-space fundamentals; preceding lessons in this unit. Learning objectives: explain the model, reproduce the worked case, identify an important failure condition, and independently solve the problems.

Concept and mechanism

Communication losses can produce a zero-order-held command, an omitted measurement or a stale state estimate. These mechanisms differ, and each demands a declared update rule. Quantization limits the resolution of sensed or commanded signals; its effect depends on closed-loop gain, signal scaling and whether deterministic limit cycles occur. Statistical loss rates alone do not certify worst-case stability.

Governing relation: Uniform quantizer Q_delta(x)=delta*round(x/delta); |Q_delta(x)-x|<=delta/2 away from overflow

To interpret this expression, mark each symbol as a state, command, observation, uncertainty, noise statistic or design weight. Determine whether the result is continuous-time, sampled-time, a static mapping, or a bound. The statement may require nonsingular matrices, bounded variation, a linear model or known timing. List the specific hypotheses before drawing an engineering conclusion.

Worked example

For a sensor step δ=0.1 in the same units as x, a true value x=1.24 rounds to 1.2 and the quantization error is −0.04. The absolute error bound is 0.05 if the quantizer is not saturated. If the sensor holds a stale measurement of 1.2 while the true state has moved to 2, the error is 0.8—far larger than the quantization step—and should be analyzed as a delay or loss problem.

Independent check: Write the same example as an equation whose two sides must agree after substitution. Check the sign and limiting cases; then change only one number and predict whether the outcome increases, decreases, or requires a full recalculation. Do not mistake numerical agreement under synthetic data for physical validation. A result describing a covariance is conditional on the noise model; one describing stability is conditional on the model and its defined perturbations; one describing an optimum is conditional on both the objective and the feasible set.

Interpretation and decision

A quantizer’s mathematical bound depends on rounding convention and a nonsaturated range. ADC over-range and integer overflow can violate the small-error model completely.

The design choice should identify the goal being improved—tracking, robustness, estimation, control effort or timing—and a quantity that may become worse. Distinguish a sufficient theorem condition from a necessary condition. For optimization explicitly report actuator limits; for estimation report which measurements support the inference. A calculated number is useful only when its assumptions and units are available to the reader.

When the argument fails

Random loss simulations averaged over many trials may overlook a rare long burst of missing packets. Systems with hard limits need explicit burst-handling behavior and independent protective actions.

Describe a falsifiable counterexample by naming an omitted dynamic, a violated constraint, an unobservable mode or a mischaracterized uncertainty set. Indicate which measured variable or computed check would reveal the discrepancy. Repeating the original calculation at the same nominal point cannot test a modeling assumption that never appeared in the equation.

Engineering case — Remote instrumentation over a network

A simulated sampling service receives sensor packets with timestamps, occasional losses and quantized values. A controller should know whether it acts on the current estimate or a held previous reading. A simple loss rate is less informative than the maximum burst length for a worst-case requirement. Run nominal timing, late-packet, dropout and sensor-stuck cases, and document the required fallback action without implying that this simulated response meets a real-world safety standard.

Lab protocol: Timing and fault audit. Record sample creation time, packet arrival time, computation completion time and actuator application time separately. Add a fault table with the intended detection, fallback behavior and independent evidence for each mode.

Create an assumption ledger listing sensor availability, actuator limits, initial state, operating point and the variable intentionally changed. For the main claim, separate what follows algebraically from what would require a second independent experiment. If the proposed experiment is unable to distinguish competing hypotheses, redesign it before collecting more repeated data.

Exercises

1. Calculation: For δ=0.05 and true values 0.12, 0.13 and −0.12, compute rounded readings and errors. How does a six-packet dropout differ conceptually? Show the intermediate arithmetic, a dimensions or sign check, and the condition under which the result is valid.

2. Alternative model: Construct an alternative interpretation of the same nominal observation, then name one additional signal that would separate the alternatives.

3. Sensitivity: Change one uncertain parameter by 20%. State which original claim remains logically valid, which result needs recalculation, and what new numerical input is required.

4. Connection: Compare the present method to Sensor fault residuals and diagnostic logic. Name an assumption they share and one kind of answer each method cannot produce alone.

5. Verification: Draft a five-line test specification listing input, expected outcome, numeric tolerance, potential failure and the reason a passing simulation would not establish hardware safety.

Reference guidance

A complete answer to the calculation question begins from the displayed governing relation and shows substitutions. The alternative-model answer must predict a different outcome in a specified observation. The sensitivity answer must distinguish parameter error from measurement noise. The connection question should identify a difference in mathematical object or guarantee, not just a difference in terminology. A suitable test reports reproducible settings and a clear fail condition. Use the accompanying unit assessment for explicit numerical checks and worked answer guidance.

Lesson 8.3 — Sensor fault residuals and diagnostic logic

Unit: Networked control, faults and verification. Prerequisites: Book 11 feedback and state-space fundamentals; preceding lessons in this unit. Learning objectives: explain the model, reproduce the worked case, identify an important failure condition, and independently solve the problems.

Concept and mechanism

Residuals compare measurements with predictions or redundant signals. Under a correct model and healthy sensor, the residual should lie in an expected distribution or deterministic envelope. A persistent bias, stuck-at value, drift or timing jump can violate the envelope. Detection rules must balance sensitivity with false alarms, and diagnostic uncertainty must be logged rather than silently turned into a fault label.

Governing relation: r_k=y_k-H*xhat_k; simple alarm when |r_k|>threshold for m consecutive samples

To interpret this expression, mark each symbol as a state, command, observation, uncertainty, noise statistic or design weight. Determine whether the result is continuous-time, sampled-time, a static mapping, or a bound. The statement may require nonsingular matrices, bounded variation, a linear model or known timing. List the specific hypotheses before drawing an engineering conclusion.

Worked example

Suppose a nominal sensor residual has standard deviation 0.1 and a provisional threshold is 0.3. A residual sequence [0.1,0.4,0.5,0.1] exceeds threshold twice consecutively. With m=2 the rule signals an alert at the third reading; with m=3 it does not. Such threshold selection must be validated against noise, autocorrelation and false-alarm tolerance.

Independent check: Write the same example as an equation whose two sides must agree after substitution. Check the sign and limiting cases; then change only one number and predict whether the outcome increases, decreases, or requires a full recalculation. Do not mistake numerical agreement under synthetic data for physical validation. A result describing a covariance is conditional on the noise model; one describing stability is conditional on the model and its defined perturbations; one describing an optimum is conditional on both the objective and the feasible set.

Interpretation and decision

Detection is not the same as diagnosis: a high residual can arise from actuator failure, sensor fault, unexpected disturbance, or wrong model parameters. Isolation requires extra information or deliberately discriminating checks.

The design choice should identify the goal being improved—tracking, robustness, estimation, control effort or timing—and a quantity that may become worse. Distinguish a sufficient theorem condition from a necessary condition. For optimization explicitly report actuator limits; for estimation report which measurements support the inference. A calculated number is useful only when its assumptions and units are available to the reader.

When the argument fails

If a faulty sensor and the estimator share the same bias, the residual can remain small. An independent measurement principle or cross-check can be more valuable than narrowing the numerical alarm limit.

Describe a falsifiable counterexample by naming an omitted dynamic, a violated constraint, an unobservable mode or a mischaracterized uncertainty set. Indicate which measured variable or computed check would reveal the discrepancy. Repeating the original calculation at the same nominal point cannot test a modeling assumption that never appeared in the equation.

Engineering case — Remote instrumentation over a network

A simulated sampling service receives sensor packets with timestamps, occasional losses and quantized values. A controller should know whether it acts on the current estimate or a held previous reading. A simple loss rate is less informative than the maximum burst length for a worst-case requirement. Run nominal timing, late-packet, dropout and sensor-stuck cases, and document the required fallback action without implying that this simulated response meets a real-world safety standard.

Lab protocol: Timing and fault audit. Record sample creation time, packet arrival time, computation completion time and actuator application time separately. Add a fault table with the intended detection, fallback behavior and independent evidence for each mode.

Create an assumption ledger listing sensor availability, actuator limits, initial state, operating point and the variable intentionally changed. For the main claim, separate what follows algebraically from what would require a second independent experiment. If the proposed experiment is unable to distinguish competing hypotheses, redesign it before collecting more repeated data.

Exercises

1. Calculation: Given residuals [0.31,0.33,0.05,0.42,0.43,0.44], threshold 0.3 and m=3, find the first alert index. What evidence would help distinguish sensor bias from a disturbance? Show the intermediate arithmetic, a dimensions or sign check, and the condition under which the result is valid.

2. Alternative model: Construct an alternative interpretation of the same nominal observation, then name one additional signal that would separate the alternatives.

3. Sensitivity: Change one uncertain parameter by 20%. State which original claim remains logically valid, which result needs recalculation, and what new numerical input is required.

4. Connection: Compare the present method to Verification matrix, fallback behavior and control assurance. Name an assumption they share and one kind of answer each method cannot produce alone.

5. Verification: Draft a five-line test specification listing input, expected outcome, numeric tolerance, potential failure and the reason a passing simulation would not establish hardware safety.

Reference guidance

A complete answer to the calculation question begins from the displayed governing relation and shows substitutions. The alternative-model answer must predict a different outcome in a specified observation. The sensitivity answer must distinguish parameter error from measurement noise. The connection question should identify a difference in mathematical object or guarantee, not just a difference in terminology. A suitable test reports reproducible settings and a clear fail condition. Use the accompanying unit assessment for explicit numerical checks and worked answer guidance.

Lesson 8.4 — Verification matrix, fallback behavior and control assurance

Unit: Networked control, faults and verification. Prerequisites: Book 11 feedback and state-space fundamentals; preceding lessons in this unit. Learning objectives: explain the model, reproduce the worked case, identify an important failure condition, and independently solve the problems.

Concept and mechanism

Verification builds an argument from requirements to mathematical analysis, simulations, unit tests, timing measurements, integration tests and guarded physical trials. Each test can establish only a bounded claim. A fallback or safe-state strategy must be defined for actuator saturation, missing samples, infeasible optimization and sensor disagreement. Safety protection should not rely only on the same software path being tested.

Governing relation: Requirement -> assumption -> test input -> predicted limit -> observed result -> acceptance decision

To interpret this expression, mark each symbol as a state, command, observation, uncertainty, noise statistic or design weight. Determine whether the result is continuous-time, sampled-time, a static mapping, or a bound. The statement may require nonsingular matrices, bounded variation, a linear model or known timing. List the specific hypotheses before drawing an engineering conclusion.

Worked example

Suppose the requirement is |u|≤2 at every sample, sensor age≤40 ms, and command updates every 20 ms. A test log showing |u|=1.8 does not establish the sensor-age condition. If one measurement arrives at age 65 ms, the timing requirement fails even if tracking error is excellent. A complete report includes the violation, triggering event and tested fallback response.

Independent check: Write the same example as an equation whose two sides must agree after substitution. Check the sign and limiting cases; then change only one number and predict whether the outcome increases, decreases, or requires a full recalculation. Do not mistake numerical agreement under synthetic data for physical validation. A result describing a covariance is conditional on the noise model; one describing stability is conditional on the model and its defined perturbations; one describing an optimum is conditional on both the objective and the feasible set.

Interpretation and decision

Tests need independent oracles: comparing a solver to its own copied formula is weaker than using a separately derived simple case. Record random seeds and data versions for reproducibility and explicitly mark tests that were not run.

The design choice should identify the goal being improved—tracking, robustness, estimation, control effort or timing—and a quantity that may become worse. Distinguish a sufficient theorem condition from a necessary condition. For optimization explicitly report actuator limits; for estimation report which measurements support the inference. A calculated number is useful only when its assumptions and units are available to the reader.

When the argument fails

The absence of logged failures is not proof that a failure mode cannot occur. A fault injection test may support a bounded claim, but it does not replace formal risk assessment, qualified review or independent protective circuitry.

Describe a falsifiable counterexample by naming an omitted dynamic, a violated constraint, an unobservable mode or a mischaracterized uncertainty set. Indicate which measured variable or computed check would reveal the discrepancy. Repeating the original calculation at the same nominal point cannot test a modeling assumption that never appeared in the equation.

Engineering case — Remote instrumentation over a network

A simulated sampling service receives sensor packets with timestamps, occasional losses and quantized values. A controller should know whether it acts on the current estimate or a held previous reading. A simple loss rate is less informative than the maximum burst length for a worst-case requirement. Run nominal timing, late-packet, dropout and sensor-stuck cases, and document the required fallback action without implying that this simulated response meets a real-world safety standard.

Lab protocol: Timing and fault audit. Record sample creation time, packet arrival time, computation completion time and actuator application time separately. Add a fault table with the intended detection, fallback behavior and independent evidence for each mode.

Create an assumption ledger listing sensor availability, actuator limits, initial state, operating point and the variable intentionally changed. For the main claim, separate what follows algebraically from what would require a second independent experiment. If the proposed experiment is unable to distinguish competing hypotheses, redesign it before collecting more repeated data.

Exercises

1. Calculation: Create five distinct tests for a networked temperature loop: nominal response, stale sensor data, actuator limit, computation overrun and sensor bias. Assign an observable pass/fail criterion for each. Show the intermediate arithmetic, a dimensions or sign check, and the condition under which the result is valid.

2. Alternative model: Construct an alternative interpretation of the same nominal observation, then name one additional signal that would separate the alternatives.

3. Sensitivity: Change one uncertain parameter by 20%. State which original claim remains logically valid, which result needs recalculation, and what new numerical input is required.

4. Connection: Compare the present method to Sample delay and discrete-time stability. Name an assumption they share and one kind of answer each method cannot produce alone.

5. Verification: Draft a five-line test specification listing input, expected outcome, numeric tolerance, potential failure and the reason a passing simulation would not establish hardware safety.

Reference guidance

A complete answer to the calculation question begins from the displayed governing relation and shows substitutions. The alternative-model answer must predict a different outcome in a specified observation. The sensitivity answer must distinguish parameter error from measurement noise. The connection question should identify a difference in mathematical object or guarantee, not just a difference in terminology. A suitable test reports reproducible settings and a clear fail condition. Use the accompanying unit assessment for explicit numerical checks and worked answer guidance.

Unit 8 applied project — Communication, sensor and fallback test plan

Engineering question

Simulate x_{k+1}=0.8x_k+0.2u_k with K=5. Compare no-delay feedback and one-sample delayed feedback using identical initial states, and separately test quantization resolution δ=0.1. Inject stale-sample bursts, a sensor offset and an update deadline miss in a table. Define explicit pass/fail rules for packet age and a fallback rather than treating average tracking error as a complete acceptance metric.

This is an offline design and evidence exercise. Its output is a reproducible mathematical study and a bounded conclusion, not permission to commission a physical controller. Write the study question in a sentence that could be falsified by a measured trajectory or a computed counterexample. Explain why the chosen input variation contains more information than an arbitrary random curve.

Setup, model and data protocol

Specify each variable, unit and initial state. The baseline model must be documented independently of the controller. List any linearization point, noise covariance, uncertainty interval, constraints or bounded disturbance. If the project contains a numerical experiment, provide either a short script or a CSV data table, and log the equation and numerical integration interval that produced it. Avoid a test in which the same output is used both to choose every model parameter and to certify accuracy. If this project cannot be evaluated without a missing sensor or unsupported assumption, make the gap an explicit result.

Required analytical work

1. Derive the governing state equation, transfer equation, cost, covariance update or stability inequality appropriate to this unit. Where possible, independently derive a special case without a library solver.
2. Calculate a baseline numerical value and check it using a distinct method: direct substitution, a matrix identity, a simulated recurrence or an analytically known limit. Include the expected dimensions.
3. Declare a testable range for one key parameter. Sample several values and describe what is and is not proven by that sample. For a mathematical worst-case guarantee, state why the chosen analytic bound applies to the full nominated uncertainty set.
4. Check performance and feasibility separately. A low cost does not imply constraints are met; a stable trajectory does not prove that an actuator command is allowed. Where the optimizer or model predicts an impossible demand, report infeasibility plainly.
5. Record at least one deliberately adverse scenario: sensor bias, delayed packet, perturbation outside the fit range, insufficient excitation, a saturated actuator, or a change in the model’s region of validity.

Measurement and critical interpretation

Timing and fault audit: Record sample creation time, packet arrival time, computation completion time and actuator application time separately. Add a fault table with the intended detection, fallback behavior and independent evidence for each mode.

A technically useful report separates mathematical truths under explicit assumptions, simulations of those assumptions, and empirical claims that require physical evidence. Explain which additional variable would most improve confidence. A compelling graph should show labeled axes and a model-versus-reference comparison, not just a beautiful output trace. If a proposed controller improves response time but worsens effort, the tradeoff belongs in the conclusion. Do not discard a failed scenario merely because it disrupts the nominal result.

Required report package

• Model card: signals and dimensions, operating range, nominal and uncertain parameters, initial state and constraints.
• One derivation checked by a second independent calculation, with all rounding disclosed.
• A baseline numeric table and an adverse-case numeric table, each with reproducible values.
• At least two plots with captions explaining what the curves demonstrate and what they do not.
• A decision paragraph about the next cheapest test that could reject an important assumption.
• A separate limitations note identifying implementation, sensor, timing, actuator and safety evidence not supplied by this exercise.

Assessment rubric

25% analytical correctness means the mathematical object and its conditions are identified precisely. 20% numerical traceability means the results can be recomputed from the stated data. 20% comparison requires a meaningful alternative, sensitivity or failure scenario. 20% engineering interpretation requires an explicit distinction between a passed model test and an unverified deployment assumption. 15% communication covers units, graph labels, repeatability and clear identification of the limits of conclusions. Strong work may conclude that a proposed design is not justified by the evidence; that is not a failure of the assignment.

Unit 8 assessment — Networked control, faults and verification

Instructions: Show the derivation and dimensions, not only the final value. Work independently before reading the reference key. Every number refers to a synthetic model and should not be interpreted as a device setting. The assessment combines computation, experimental design, and evaluation of whether a claim follows from the evidence.

Part A — quantitative short questions

A1. Given a=0.8,b=0.2,K=5 without delay, calculate the named mathematical quantity. State the model assumptions that make the requested result well defined. Explain whether the answer represents a transfer characteristic, a state estimate, an optimal action, a bounded inequality or a verification verdict. Show the intermediate arithmetic and one reason an actual data set might disagree.

A2. Given a=0.8,b=0.2,K=5 with one-step delay, calculate the named mathematical quantity. State the model assumptions that make the requested result well defined. Explain whether the answer represents a transfer characteristic, a state estimate, an optimal action, a bounded inequality or a verification verdict. Show the intermediate arithmetic and one reason an actual data set might disagree.

A3. Given quantization δ=0.1 at x=1.24, calculate the named mathematical quantity. State the model assumptions that make the requested result well defined. Explain whether the answer represents a transfer characteristic, a state estimate, an optimal action, a bounded inequality or a verification verdict. Show the intermediate arithmetic and one reason an actual data set might disagree.

A4. Given ages 65 ms measured under max 40 ms, calculate the named mathematical quantity. State the model assumptions that make the requested result well defined. Explain whether the answer represents a transfer characteristic, a state estimate, an optimal action, a bounded inequality or a verification verdict. Show the intermediate arithmetic and one reason an actual data set might disagree.

Part B — distinct lesson problems

B1. Sample delay and discrete-time stability. With a=0.6, b=0.2 and K=2, find the roots of λ²−aλ+bK and test the unit-circle condition. Include the model, numerical or logical solution, and a limiting-case check. Then design one follow-up measurement or computed counterexample that can challenge the result under an untested assumption.

B2. Packet loss, quantization and stale samples. For δ=0.05 and true values 0.12, 0.13 and −0.12, compute rounded readings and errors. How does a six-packet dropout differ conceptually? Include the model, numerical or logical solution, and a limiting-case check. Then design one follow-up measurement or computed counterexample that can challenge the result under an untested assumption.

B3. Sensor fault residuals and diagnostic logic. Given residuals [0.31,0.33,0.05,0.42,0.43,0.44], threshold 0.3 and m=3, find the first alert index. What evidence would help distinguish sensor bias from a disturbance? Include the model, numerical or logical solution, and a limiting-case check. Then design one follow-up measurement or computed counterexample that can challenge the result under an untested assumption.

B4. Verification matrix, fallback behavior and control assurance. Create five distinct tests for a networked temperature loop: nominal response, stale sensor data, actuator limit, computation overrun and sensor bias. Assign an observable pass/fail criterion for each. Include the model, numerical or logical solution, and a limiting-case check. Then design one follow-up measurement or computed counterexample that can challenge the result under an untested assumption.

Part C — synthesis and model criticism

C1. Data and claims. A team plots attractive curves on its calibration data and calls the controller robust and safe. Identify the exact robust or feasible property that would need to be established, a missing uncertainty or fault class, and a test that could falsify the unsupported conclusion. Avoid generic assurances.

C2. Evidence hierarchy. Separate a theoretical identity, a result from a discrete simulation, a laboratory observation and a physical safety approval. For the current unit, provide one concrete example of each, then explain why one cannot silently replace another.

C3. Design comparison. Select two approaches studied in this unit. Compare their required model detail, computational or measurement burden, failure sensitivity and interpretability. Name one operating condition in which the less elaborate approach could be preferable.

C4. Integration with Book 11. Start from a textbook PID or linear state-space example and show which assumption must be changed to require the advanced tool from the present unit. Identify an actuator constraint, sensor characteristic or nonlinear effect the simple representation had omitted.

Reference answers and grading notes

A1 reference. a=0.8,b=0.2,K=5 without delay leads to closed-loop multiplier −0.2 in the stated ideal model. The answer is incomplete without the numerical relationship, relevant units, and an explicit condition such as positivity, stability, nonsingularity, observability or a known sample interval. Where an inequality appears, the conclusion is restricted to that bound and the defined uncertainty class; where an estimated value appears, the inference is conditioned on its assumed noise model.

A2 reference. a=0.8,b=0.2,K=5 with one-step delay leads to marginal roots with modulus 1 in the stated ideal model. The answer is incomplete without the numerical relationship, relevant units, and an explicit condition such as positivity, stability, nonsingularity, observability or a known sample interval. Where an inequality appears, the conclusion is restricted to that bound and the defined uncertainty class; where an estimated value appears, the inference is conditioned on its assumed noise model.

A3 reference. quantization δ=0.1 at x=1.24 leads to rounded x=1.2,error=−0.04 in the stated ideal model. The answer is incomplete without the numerical relationship, relevant units, and an explicit condition such as positivity, stability, nonsingularity, observability or a known sample interval. Where an inequality appears, the conclusion is restricted to that bound and the defined uncertainty class; where an estimated value appears, the inference is conditioned on its assumed noise model.

A4 reference. ages 65 ms measured under max 40 ms leads to timing acceptance fails in the stated ideal model. The answer is incomplete without the numerical relationship, relevant units, and an explicit condition such as positivity, stability, nonsingularity, observability or a known sample interval. Where an inequality appears, the conclusion is restricted to that bound and the defined uncertainty class; where an estimated value appears, the inference is conditioned on its assumed noise model.

B series marking. Award credit for four independent elements: correct mathematical relationship, transparent substitution, meaningful limiting-case or sensitivity check, and a proposed measurement that would discriminate among possible models. The four named lesson scenarios demand different reasoning; a generic statement about noise or risk is not sufficient. Problems involving constraints must state whether a proposed solution is feasible rather than only desirable.

C series marking. Accept conclusions that identify an information gap rather than inventing missing values. A strong answer describes the exact signal at which the model would first fail, a safe way to expose that failure in software, and which human or independent engineering review would be needed for any later physical test. For stochastic examples insist on a distinction between model variance and guaranteed error. For optimization distinguish an unconstrained minimum from a feasible command. For robust control do not confuse sufficient tests with necessary ones.

Post-assessment research note

Write a final one-page technical summary with the columns: claim, equation, required assumptions, numerical evidence, strongest counterexample and next verification step. The purpose is to practice deciding what is established, what is conditional and what remains unknown. A model may be educationally useful even when publication-quality validation is absent. Never treat an optimized cost, a stable nominal trace, or an intact software archive as an independent functional-safety assessment.