A Tutorial on Sum of Squares Techniquesfor Systems Analysis

Antonis Papachristodoulou and Stephen Prajna

Abstract— This tutorial is about new system analysistechniques that were developed in the past few years basedon the sum of squares decomposition. We will presentstability and robust stability analysis tools for differentclasses of systems: systems described by nonlinear ordinarydifferential equations or differential algebraic equations,hybrid systems with nonlinear subsystems and/or nonlinearswitching surfaces, and time-delay systems described bynonlinear functional differential equations. We will alsodiscuss how different analysis questions such as modelvalidation and safety verification can be answered foruncertain nonlinear and hybrid systems.

I. INTRODUCTION

The sum of squares (SOS) technique was introducednearly five years ago in Parrilo’s thesis [34]. Ever since aplethora of questions on systems analysis were tackled,that were difficult to answer before. For example, itallowed the algorithmic analysis of nonlinear systemsusing Lyapunov methods — upon which most of nonlin-ear systems theory is based. Apart from stability analysisof nonlinear systems, the SOS technique has opened anew direction in the treatment of other system types andanswering different analysis and synthesis questions.

The SOS approach generalizes a well known algorith-mic tool in linear robust control theory — linear matrixinequalities (LMIs) [5]. Using LMIs to formulate severalanalysis and synthesis problems is advantageous, asthere are efficient algorithms to solve them, developed inthe framework of semidefinite programming (SDP) [55]with a complexity that is worst-case polynomial in time.The SOS technique uses exactly the same algorithm,but all questions are formulated at the polynomial orpolynomial matrix level.

Take as an example the problem of proving stabilityfor an equilibrium of a dynamical system x = f(x)using what is called a Lyapunov function [19]. All thatis required to prove stability is to find a positive definitefunction V (x) defined in some region of the state

Work financially supported by AFOSR MURI, NIH/NIGMS AfCS(Alliance for Cellular Signalling), DARPA, the Kitano ERATO Sys-tems Biology Project, and URI “Protecting Infrastructures from Them-selves”.

A. Papachristodoulou and S. Prajna are with Control and DynamicalSystems, California Institute of Technology, Pasadena, CA 91125,USA. Email: antonis,prajna@cds.caltech.edu.

This is an overview of work that both authors have developed eithertogether or on their own.

space containing the equilibrium point whose derivativeV (x) = ∂V

∂xf(x) is negative semidefinite along the

system trajectories. In the linear case, these conditionsamount to finding, for a system x = Ax, a positivedefinite matrix P such that AT P + PA is negativedefinite [5]; then the associated Lyapunov function isgiven by V (x) = xT Px. What is obvious but was notseen from that angle until recently, is that both V (x)and −V (x) are also sums of squares.

Hand-crafted Lyapunov functions constructions areinevitably limited to small state dimensions and dependon the analytic skills of the researcher. In the casein which both the vector field f and the Lyapunovfunction candidate V are polynomial, the Lyapunov con-ditions are essentially polynomial non-negativity condi-tions which can be NP hard to test [28] — probably oneof the reasons for the lack of algorithmic constructionsof Lyapunov functions. However, if we replace thenonnegativity conditions by SOS conditions, then notonly testing the Lyapunov function conditions — butalso constructing the Lyapunov function — can be doneefficiently using semidefinite programming (SDP) [55].This observation can be used to answer other analysisquestions for more complicated system descriptions al-gorithmically.

This tutorial begins with an overview of the theoryand computational aspects of the SOS decomposition.To facilitate the transformation of the polynomial for-mulation to the corresponding SDP formulation — thatis cumbersome if performed manually — software hasbeen developed. One such software is SOSTOOLS [44],a freely-available MATLAB toolbox for solving SOSprograms. A brief overview of SOSTOOLS will be givenin Section III.

The SOS methodology has allowed the stability anal-ysis of other system classes, including constrained non-linear, hybrid, and time-delay, as well as the verificationof other properties for these systems, such as modelinvalidation or safety verification. The rest of this tutorialdescribes these advances, through illustrative examples.

The first class of systems we will be looking at isnonlinear constrained systems. We present an extensionto Lyapunov stability theory to allow for the algorithmicanalysis of systems that evolve over equality, inequalityand integral constraints [32]. A special case of this

2005 American Control ConferenceJune 8-10, 2005. Portland, OR, USA

0-7803-9098-9/05/$25.00 ©2005 AACC

ThB13.1

2686

framework is systems with non-polynomial vector fields,which can be treated using a systematic recasting pro-cedure [33]. Section IV deals with these developments.

We will next cover the second class of systems,namely hybrid systems. These are systems that consist ofsubsystems with a switching rule, and have attracted theattention of researchers for many years now. Traditionalanalysis methods concentrate on the construction ofquadratic common or multiple Lyapunov functions us-ing LMI techniques [6], but only for systems with linearsubsystems and switching surfaces described by hyper-planes. Using the SOS approach, polynomial Lyapunovfunctions can be constructed for systems with nonlinearsubsystems and polynomial switching surfaces. A briefdescription of the SOS methodologies for treating thesesystems will be given in Section V.

The third class of systems we will be considering istime-delay systems. They are the simplest infinite di-mensional systems with a rich literature on their stabilityand stabilization properties [20]. LMI techniques haveallowed the construction of simple Lyapunov certificatesfor linear systems, that were many times conservative— the complete Lyapunov functional yields infinitedimensional LMI conditions which are difficult to solvealgorithmically. SOS techniques have enabled the algo-rithmic analysis of nonlinear time delay systems throughthe solution of these infinite dimensional LMIs. Themethodology will be presented in Section VI.

Lyapunov functions should be regarded asproofs/certificates guaranteeing the stability property.This aspect of Lyapunov methods is important,as analysis questions are answered in a way thatno simulation procedure can. Using Lyapunov-likearguments, other questions apart from stability can beanswered algorithmically. For example, estimating L2

gains in nonlinear systems can be done by constructingappropriate storage functions [56], [57].

More recently, questions such as model valida-tion [39] or safety verification [40], [41] were treatedusing barrier certificates, which can also be constructedusing SOS techniques. An overview of the techniquesbased on barrier certificates will be covered in Sec-tions VII and VIII. Safety verification of hybrid systemswithin this framework has found application on safe-critical systems of industrial interest, such as assuringthe safe performance of a life-support system [14].

This tutorial concludes with some remarks in Sec-tion IX.

II. THE SUM OF SQUARES DECOMPOSITION

In this section we give a brief introduction to sumof squares (SOS) polynomials as well as their use,and show how the existence of a SOS decompositioncan be verified using semidefinite programming [55].

A more detailed description can be found in [34],[36] and the references therein. A “dual” approach isgiven in [24]. There is a wealth of literature on SOSand positive polynomials, especially after Hilbert’s 17thproblem [49] was answered affirmatively by Artin in1926, a development that formed the foundation ofreal algebra and real algebraic geometry [48], [4]. Thesemidefinite programming method for computing theSOS decomposition is based on the Gram matrix method— see [7], [38] for more details.

Definition 1: For x ∈ Rn, a multivariate polynomial

p(x) is a sum of squares (SOS) if there exist somepolynomials fi(x), i = 1 . . . M such that

p(x) =

M∑i=1

f2i (x) . (1)

An equivalent characterization of SOS polynomials isgiven in the following proposition.

Proposition 2: A polynomial p(x) of degree 2d is aSOS if and only if there exists a positive semidefinitematrix Q and a vector of monomials Z(x) containingmonomials in x of degree ≤ d such that

p = Z(x)T QZ(x) (2)

Proof: See [34].

In general, the monomials in Z(x) are not alge-braically independent. Expanding Z(x)T QZ(x) andequating the coefficients of the resulting monomials tothe ones in p(x), we obtain a set of affine relations inthe elements of Q. Since p(x) being SOS is equivalentto Q ≥ 0, the problem of finding a Q which proves thatp(x) is an SOS can be cast as a semidefinite program(this was first observed by Parrilo in [34]). The followingis an example of how this is done.

Example 3: ([34]) Suppose that we want to knowwhether or not the quartic polynomial in two variablesp(x1, x2) = 2x4

1 + 2x31x2 − x2

1x22 + 5x4

2 is a SOS. Forthis purpose, define Z(x) = [ x2

1 x22 x1x2 ]T and

consider the following quadratic form:

p(x1, x2) = 2x41 + 2x3

1x2 − x21x

22 + 5x4

2

= Z(x)T

⎡⎣ q11 q12 q13

q12 q22 q23

q13 q23 q33

⎤⎦

︸ ︷︷ ︸Q

Z(x)

= q11x41 + q22x

42 + (2q12 + q33)x

21x

22

+2q13x31x2 + 2q23x1x

32,

2687

from which we get the following relations:

q11 = 2, q22 = 5,

q13 = 1, q23 = 0,

2q12 + q33 = −1.

Now, decomposing p(x) as an SOS amounts to searchingfor q12 and q33 satisfying the last equation, such thatQ ≥ 0. For q12 = −3 and q33 = 5, the matrix Q willbe positive semidefinite and we have

Q = LT L, where L =1√

2

[2 −3 10 1 3

].

This immediately yields the following SOS decomposi-tion:

p(x) =1

2(2x2

1 − 3x22 + x1x2)

2 +1

2(x2

2 + 3x1x2)2.

Note that p(x) being an SOS implies that p(x) ≥ 0for all x ∈ R

n. However, the converse is not alwaystrue. Not all nonnegative polynomials can be written asSOS, apart from three special cases: (i) when n = 2,(ii) when deg(p) = 2, and (iii) when n = 3 anddeg(p) = 4. See [49] for more details. Nevertheless,checking nonnegativity of p(x) is an NP-hard problemwhen the degree of p(x) is at least 4 [28], whereas asargued in the previous paragraph, checking whether p(x)can be written as an SOS is computationally tractable —it can be formulated as a semidefinite program, whichhas worst-case polynomial time complexity. We will notentail in a discussion on how conservative the relaxationis, but there are several results suggesting that this isnot too conservative [49], [36]. Note that as the degreeof p(x) or its number of variables is increased, thecomputational complexity for testing whether p(x) is anSOS increases. Nonetheless, the complexity overload isstill a polynomial function of these parameters.

Besides the above, what is more interesting is thecase in which the monomials in the polynomial p(x)have unknown coefficients, and we want to search forfeasible values of those coefficients such that p(x) isnonnegative. Since the unknown coefficients of p(x) arerelated to the entries of Q via affine constraints, it isevident that the search for the coefficients that makep(x) an SOS can also be formulated as a semidefiniteprogram (these coefficients are themselves decision vari-ables). This observation is crucial in the construction ofLyapunov functions and other S-procedure type multi-pliers [34].

Using Positivstellensatz (a central theorem in realalgebraic geometry [4]) and the SOS decomposition, theS-procedure can be strengthened to yield less conserva-tive conditions. With Positivstellensatz, a hierarchy of

polynomial-time computable stronger conditions can beobtained, and each test is always at least as powerfulas the standard one, and often strictly stronger. We willbe using this feature in the sequel. More details can befound in [34].

III. SOSTOOLS

The observation that the SOS decomposition canbe computed efficiently using semidefinite program-ming [34] has introduced the need for developing soft-ware that would facilitate the formulation of the semidef-inite programs from their SOS equivalents. One suchsoftware is SOSTOOLS [43], [44], [45]: a free, third-party MATLAB1 toolbox for solving SOS programs.

We define a SOS program as the convex optimizationproblem of the following form:

MinimizeJ∑

j=1

wjcj

subject to (3)

ai,0(x) +

J∑j=1

ai,j(x)cj is SOS, for i = 1, ..., I,

where the cj’s are the scalar real decision variables,the wj’s are some given real numbers, and the ai,j(x)are some given polynomials (with fixed coefficients).See also another equivalent canonical form of SOSprograms in [43], [44]. While the conversion from SOSprograms to semidefinite programs (SDPs) can be man-ually performed for small size instances or tailored forspecific problem classes, such a conversion can be quitecumbersome in general. It is therefore desirable to have acomputational aid that automatically performs this con-version for general SOS programs. This is exactly whatSOSTOOLS is useful for (see Figure 1). It automatesthe conversion from SOS program to SDP, calls theSDP solver, and converts the SDP solution back to thesolution of the original SOS program. In this way thedetails of the reformulation are abstracted from the user,who can work at the polynomial object level. The userinterface of SOSTOOLS has been designed to be simple,easy to use, and transparent while keeping a large degreeof flexibility. The current version of SOSTOOLS useseither SeDuMi [52] or SDPT3 [53], both of which arefree MATLAB add-ons, as the SDP solver.

The polynomial variables in the SOS programs canbe defined in SOSTOOLS in two different ways: usingthe MATLAB Symbolic Math Toolbox or the custom-built polynomial toolbox. The former method providesthe user the benefit of making use of all the featuresin the toolbox, which range from simple arithmetic

1A registered trademark of The MathWorks, Inc.

2688

SOSP SDP

SOSPSolution Solution

SDP

SeDuMi/SDPT3

SOSTOOLS

SOSTOOLS

Fig. 1. Diagram depicting how SOS programs (SOSPs) are solvedusing SOSTOOLS.

operations to differentiation, integration and polynomialmanipulation. Even though the integrated polynomialtoolbox has only some of the functions of the symbolictoolbox, it allows users that do not have access to thesymbolic toolbox to use SOSTOOLS. It also providesan alternative, sometimes faster SDP formulation path.

In many cases the SDPs that we wish to solve havecertain structural properties, such as sparsity, symmetryetc. The formulation of the SDP should take them intoaccount: this will not only reduce the computationalburden of solving them as their size is many timesreduced considerably, but it also removes numerical ill-conditioning. Provision has been taken for sparsity to betaken into account when formulating the SDPs.

The frequent use of certain SOS formulations, suchas finding lower bounds on polynomial minima andthe search for Lyapunov functions for systems withpolynomial vector fields are reflected in the introductionof customized functions in SOSTOOLS. A detaileddescription of how SOSTOOLS works can be found inthe SOSTOOLS user’s guide [44].

IV. ANALYSIS OF CONSTRAINED SYSTEMS

We will now turn to systems analysis using SOStechniques. We will first review the available resulton constructing Lyapunov functions for systems withpolynomial vector fields, and then extend the classof systems for which the construction is possible tononlinear systems with equality, inequality, and integralconstraints. This is a very general class of systems,covering differential algebraic equations and robust sta-bility analysis formulations, areas that have attracted theattention of many researchers in the past.

A. Lyapunov Stability

Here we concentrate on autonomous nonlinear sys-tems of the form

x = f(x), (4)

where x ∈ Rn and for which we assume without loss ofgenerality that f(0) = 0, i.e. the origin is an equilibriumof the system, and that in a region D around the originf is Lipschitz. One of the most important propertiesrelated to this equilibrium is its stability, and assessingwhether stability of the equilibrium holds can be doneby constructing what is called a Lyapunov function.

Theorem 4 ([19]): Consider the system (4), and letD ⊆ R

n be a neighborhood of the origin. If there is acontinuously differentiable function V : D → R+ suchthat the following two conditions are satisfied:

1) V (x) > 0 for all x ∈ D \ 0 and V (0) = 0,i.e., V (x) is positive definite in D

2) −V (x) = −∂V∂x

f(x) ≥ 0 for all x ∈ D, i.e., V (x)is negative semidefinite in D

then the origin is a stable equilibrium. If in condition (2)above V (x) is negative definite in D then the origin isasymptotically stable. If D = R

n and V (x) is radiallyunbounded, i.e., V (x) → ∞ as ‖x‖ → ∞, then theresult holds globally.

Let us for now assume that f(x) is a polynomialvector field, and that we will be searching for V (x)that is also a polynomial in x. Then the two condi-tions in Theorem 4 become polynomial nonnegativityconditions. To circumvent the difficult task of testingthem, we can restrict our attention to cases in whichthe two conditions admit SOS decompositions. This isthe procedure that was originally pursued by Parriloin his thesis [34]. The only apparent difficulty is therestriction of V (x) to be positive definite, not justpositive semidefinite. To work around this problem wecan use the following proposition.

Proposition 5: Given a polynomial V (x) of degree2d, let ϕ(x) =

∑n

i=1

∑d

j=1 εijx2ji such that:

m∑j=1

εij > γ ∀ i = 1, . . . , n,

with γ a positive number, and εij ≥ 0 for all i and j.Then the condition

V (x) − ϕ(x) is a SOS (5)

guarantees the positive definiteness of V (x).

Proof: The function ϕ(x) as defined above ispositive definite if εij’s satisfy the conditions mentionedin the proposition. Then V (x)−ϕ(x) being SOS impliesthat V (x) ≥ ϕ(x), and therefore V (x) is positivedefinite.

For D = Rn, the conditions in Theorem 4 can be

formulated as SOS conditions as follows:

Proposition 6: Suppose that for the system (4) there

2689

exists a polynomial V (x) such that V (0) = 0, and

V (x) − ϕ(x) is SOS, (6)

−∂V

∂xf(x) is SOS, (7)

where ϕ(x) is as defined in Proposition 5. Then thezero equilibrium of (4) is globally stable (i.e., theequilibrium is stable in the sense of Lyapunov and alsoall trajectories are bounded).

Below is an example of how the construction of aLyapunov function is performed using SOSTOOLS.

Example 7: Consider the system

x1 = −x1 + x32 − 3x3x4, x2 = −x1 − x3

2,

x3 = x1x4 − x3, x4 = x1x3 − x34,

which has the only equilibrium at the origin. As a firstattempt, we will try to construct a quadratic Lyapunovfunction of the form V =

∑4i=1

∑4j=i aijxixj where

the aij’s are the unknowns. We search for V that satisfythe conditions in Proposition 6.

It turns out that a Lyapunov function of the aboveform does not exist (the corresponding semidefiniteprogram is infeasible), so we will next search for aquartic Lyapunov function. One then finds a Lyapunovfunction that satisfies condition (6) and (7), and thusproves global asymptotic stability of the origin. To 3significant digits this reads:

V (x) = 1.12x1x2x23 − 0.785x1x2 + 0.713x3

2x1

+ 0.500x1x2x24 + 0.768x4

4 + 1.64x21 + 1.76x2

3

+ 0.392x22 + 1.63x2

4 + 1.69x21x

22 + 0.557x4

3

+ 0.724x31x2 + 0.181x4

1 + 1.07x42 + 0.561x2

1x23

+ 1.61x22x

23 + 0.525x2

1x24 + 0.969x2

2x24

+ 0.569x23x

24 − 0.251x4x3x1 + 0.432x4x3x2.

The above can be obtained by using the findlyapcommand in SOSTOOLS.

B. Stability of Systems with Constraints

In this section we present extensions of Lyapunov’sstability theorem for handling systems with equality,inequality and integral quadratic constraints.

Inequality constraints arise naturally when consider-ing positive systems or when describing uncertain pa-rameter sets for the study of robust stability of systemsin the presence of parametric uncertainty.

Equality constraints prove useful when describingsystems evolving over a manifold; these are also knownas differential algebraic equations or descriptor sys-tems [10]. They also appear in robust stability analysis,as constraints guaranteeing that the equilibrium of thesystem is at the origin.

The last type of constraints that can be incorporatedare integral quadratic constraints (IQCs) [26]. Theyprovide a rich framework to encapsulate many types ofuncertainty and unmodelled dynamics: dynamic, time-varying, L2 bounded uncertainty just to mention a few.Moreover one can formulate performance calculationsusing IQCs, such as L2 input-output gain estimation etc.

Consider the nonlinear system

x = f(x, u), (8)

with the following inequality, equality, and integralconstraints that are satisfied by x and u:

ai1(x, u) ≤ 0, for i1 = 1, ..., N1, (9)

bi2(x, u) = 0, for i2 = 1, ..., N2, (10)∫ T

0ci3(x, u)dt ≤ 0, for i3 = 1, ..., N3, and ∀T ≥ 0.(11)

Here x ∈ Rn is the state of the system, and u ∈ R

m isa collection of auxiliary variables (such as inputs, non-polynomial functions of states, uncertain parameters, andso on — we will see examples of these in Section IV-C).We assume that f(x, u) has no singularity in D, whereD ⊂ R

m+n is defined as

D = (x, u) ∈ Rm+n | ai1(x, u) ≤ 0, bi2(x, u) = 0,

for all i1 and i2.

Without loss of generality, it is also assumed thatf(x, u) = 0 for x = 0 and u ∈ D0

u, where

D0u = u ∈ R

m|(0, u) ∈ D.

The following theorem is an extension of Lyapunov’sstability theorem, and can be used to prove that theorigin is a stable equilibrium of the above system.It uses a technique reminiscent of the well-known S-procedure [59] in nonlinear and robust control theory.

Theorem 8: Suppose that for the above system thereexist functions2 V (x), pi1(x, u), qi2(x, u), and constantsri3 ≥ 0 such that

• V (x) is positive definite3 in a neighborhood of theorigin.

• pi1(x, u) ≥ 0 in D.

Then

−∂V

∂xf(x, u) +

∑pi1(x, u)ai1(x, u)

+∑

qi2(x, u)bi2(x, u) +∑

ri3ci3(x, u) ≥ 0

(12)

will guarantee that the origin of the state space is a stableequilibrium of the system.

2Although not written explicitly here, we assume that we keep trackof the indices.

3Strictly speaking, it is enough to require V to have a localminimum at the origin.

2690

For a proof see [32].

C. Constrained Systems Analysis: SOS Techniques

In this section we will use Theorem 8 along withthe SOS decomposition to analyze various cases ofsystems with constraints. Algorithmic verification of theconditions in Theorem 8 is difficult unless the conditionsare relaxed to SOS conditions. Therefore, in our analysiswe use the following assumption and relaxations:

• the vector field fx(x, u) is assumed to be poly-nomial or rational, and the constraint functionsai1(x, u), bi2(x, u), ci3(x, u) are assumed to bepolynomial.

• we search for bounded degree polynomial Lya-punov function V and multipliers pi1 , qi2 .

• polynomial nonnegativity and positive definitenessconditions are relaxed to an SOS condition, and tothe condition in Proposition 5, respectively.

For instance, a relaxation of Theorem 8 is stated below.Proposition 9: Suppose that for the above sys-

tem there exist polynomial functions V (x), pi1(x, u),qi2(x, u), a positive definite function ϕ(x) of the formgiven in Proposition 5 and constants ri3 ≥ 0 such that

V (x) − ϕ(x) is SOS, (13)

pi1(x, u) are SOS for i1 = 1, . . . , N1, (14)

−∂V

∂xf(x, u) +

∑pi1(x, u)ai1(x, u)

+∑

qi2(x, u)bi2(x, u) +∑

ri3ci3(x, u) is SOS.(15)

Then the origin of the state space is a stable equilibriumof the system.

The polynomials V (x) pi1(x, u), qi2(x, u), the con-stants ri3 and the positive definite function ϕ(x) canbe computed using SOSTOOLS [43]. We now turn to aseries of applications of the above proposition.

1) Robustness Analysis: In the case of parametricuncertainty, some of the auxiliary variables u may nowbe taken to be parameters. Additionally, some otherauxiliary variables can be used to account for the lo-cation of the equilibrium of interest, as for a nonlinearsystem the location of the equilibrium usually changeswhen the parameters are varied. The use of equality andinequality constraints in this case is natural: the region ofthe parameter space that is of interest can be describedby inequality constraints, and if the equilibrium movesas the parameters change, one can impose an equalityconstraint on the corresponding auxiliary variables. Herewe present an example motivated by a biological system.

Example 10: Two species models of interacting pop-ulations can exhibit limit cycle periodic oscillations [27].The simplest, but chemically plausible tri-molecular

0 0.2 0.4 0.6 0.8 1 1.2 1.4 1.6 1.8 20

0.2

0.4

0.6

0.8

1

1.2

1.4

1.6

1.8

2

b

a

Unstable Equilibrium Point

Region 1

Region 2

Intersection of regions 1 and 2

Fig. 2. Chemical Oscillator Example: Stability region for the chemicaloscillator problem, Regions 1 and 2 defined by equations (22) and (23).

reaction that admits periodic solutions is

Xk1k−1

A, Bk2→ Y, 2X + Y

k3→ 3X,

in which species X is in dynamical equilibrium withspecies A with a forward rate of reaction k1 and abackward rate of reaction k−1, and so on. Using the lawof mass action, and non-dimensionalising the equations,we get

u = a − u + u2v, (16)

v = b − u2v, (17)

where u, v are the non-dimensional concentrations of X

and Y , and a, b are non-negative constant parametersthat depend on the concentrations of A and B. It isknown that for a and b satisfying

(b − a) ≥ (b + a)3,

the system exhibits a stable limit cycle and the equilib-rium point is unstable (see Figure 2).

A Lyapunov function will be constructed for a regionof the rest of the parameter space, to prove robuststability of the equilibrium.

The equilibrium of the above system is a (u, v) pairthat satisfies

0 = a − u + u2v, (18)

0 = b − u2v. (19)

We translate the equilibrium to the origin using a statetransformation u → x1, v → x2, x1 = u−u, x2 = v−v,to get an equivalent system

x1 = a − (x1 + u) + (x1 + u)2(x2 + v), (20)

x2 = b − (x1 + u)2(x2 + v), (21)

whose equilibrium is at the origin. Now suppose thatthe parameters a and b are not exactly known, but

2691

belong to the set a ≥ a, b ≥ b. Notice that when theparameters a and b are changed, the equilibrium (u, v)also changes, see Equations (18)–(19). So there are fourparameters in the state equations (20)–(21) - namely a,b, u, and v - that are coupled via the algebraic equalityconstraints (18)–(19). Denote these parameters (whichcan be regarded as auxiliary variables) by u1 throughu4, in accordance with the notation in Theorem 8.

There exist inherent constraints on the state variables,as the concentrations of the reactants has to be positive.Furthermore, for our purpose, it is enough to find aLyapunov function that has non-positive derivative in alocal region around the equilibrium. In this case, we canimpose the inequality constraints x2

1 ≤ γu23, x2

2 ≤ γu24

where 0 < γ ≤ 1. Thus, our system (complete with theequality and inequality constraints) is described by

x1 = u1 − (x1 + u3) + (x1 + u3)2(x2 + u4)

x2 = u2 − (x1 + u3)2(x2 + u4)

0 ≥ x21 − γu2

3

0 ≥ x22 − γu2

4

0 ≥ a − u1

0 ≥ b − u2

0 = u1 − u3 + u23u4

0 = u2 − u23u4.

For this example, two quartic Lyapunov functions, whichprove stability of all the dynamical systems within thefollowing ranges of a and b and which are parameterizedby u1 and u2 have been constructed, using Proposition 9.

Region 1: (a, b) = (0.25, 0) (22)

Region 2: (a, b) = (0, 1.05) (23)

Each of them has more than 30 terms in it, and istherefore not listed here. However their level curves areshown for two different parameter values in Figure 3.

Dynamic uncertainty, on the other hand, can be char-acterized using integral constraints [26]. For example,an uncertain but L2-norm bounded feedback operatorrelating x and u can be represented by the IQC∫ T

0

(γxT x − uT u)dt ≥ 0.

Stability of the whole system can then be verified usingTheorem 8.

2) Input-Output and Dissipativity Analysis: Input-output analysis within the framework of dissipativesystems theory [56], [57] can also be addressed usingthe SOS technique. Let us consider the system

x = f(x, u), (24)

y = h(x, u), (25)

where u and y are respectively the input and output ofthe system, and f(x, u), h(x, u) are polynomials in x

and u. Dissipativity of the above system with respect to apolynomial supply rate function w(u, y) can be verifiedusing the following proposition.

Proposition 11: Suppose for the system (24)–(25)and a given supply rate function w(u, y) there existsa SOS polynomial S(x), such that S(0) = 0 and

w(u, h(x, u)) −∂S

∂xf(x, u) is SOS. (26)

Then the system is dissipative with respect to the supplyrate function w(u, y), as proven by the existence of astorage function S(x).

Proof: The function S(x) being an SOS impliesthat S(x) ≥ 0. Now notice that Equation (26) implies

∂S

∂xf(x, u) ≤ w(u, h(x, u)) ∀u and x,

which is the differential version of the dissipation in-equality [56]. Since S(x) satisfies the inequality, itfollows that S(x) is a storage function for the system,thus proving that the system is dissipative with respectto the supply rate w(u, y).

An important choice of supply rate function is

w(u, y) = γuT u − yT y,

since dissipativity of the system with respect to this sup-ply rate implies that the L2-gain of the input-output mapu → y is less than or equal to

√γ. Thus, by minimizing

γ and solving the corresponding SOS problem, we canobtain an estimate of the L2-gain of the above nonlinearinput-output map.

Example 12: Consider the system

x1 = −2x1 − x31 + x1x

22 + 5x1x3

x2 = −3x2 + x21 − x1x2 − x2

1x2 − x32 + x2

1x3 + x1x23

x3 = −2x21 − x1x2 − 0.5x3

1 − 4x33 + u

y = x1

We will compute an upper bound for the L2-gain of themap u → y using the method describe in Subsection IV-C.2. A quadratic storage function for this system cannotbe found, but a quartic one exists for γ = 0.47. Thisshows that the L2-gain of the system is less than orequal to

√0.47 = 0.6856.

V. ANALYSIS OF HYBRID SYSTEMS

Many systems have dynamics that are described bya set of continuous time differential equations in con-junction with a discrete event process. Such systems areusually referred to as switched or hybrid systems, andtheir stability analysis has been treated in [6], [18], [11].

2692

0 1 20

0.2

0.4

0.6

0.8

1

b

a

Parameter space

Unstableequilibrium

0.9 1 1.1

0.46

0.48

0.5

0.52

0.54

u

va = 0.5, b = 0.5

1.5 1.6 1.7

0.54

0.56

0.58

0.6

0.62

0.64

u

v

a = 0.1, b = 1.5

point

Fig. 3. Chemical Oscillator Example: Two parameter instances of the constructed parameterized Lyapunov functions. Arrows show the vectorfield, the level curves of Lyapunov functions are shown dashed, and a few trajectories are shown with solid lines.

One way of proving stability is by using piecewisequadratic Lyapunov functions [18], [16], which are con-structed by concatenating several quadratic Lyapunov-like functions. This approach is quite effective, as thesearch for such Lyapunov functions can be performedby solving linear matrix inequalities (LMIs). However,in some cases it can be conservative.

In this section we will show how polynomial andpiecewise polynomial Lyapunov functions can be con-structed using the SOS decomposition. The method gen-eralizes previous analysis methods using quadratic andpiecewise quadratic Lyapunov functions. Some featuresof the new approach are:

• it provides a less conservative test for provingstability under arbitrary switching;

• stability can be proven with a smaller number ofLyapunov-like functions, eliminating the need ofrefining the state space partition;

• the method can be applied to systems with nonlin-ear subsystems and nonlinear switching surfaces;

• parametric robustness analysis can be performed ina straightforward manner.

A. Preliminaries and Notation

Here we establish the notation we will be using in therest of this section. Consider systems of the form:

x = fi(x), i ∈ I = 1, ..., N, (27)

where x ∈ Rn is the continuous state, i is the discrete

state, fi(x) is the vector field describing the dynamicsof the i-th mode/subsystem, and I is the index set. Weassume that the origin is an equilibrium of the system.

Depending on how the discrete state i evolves, a sys-tem like (27) can be categorized as a switched system,if for each x ∈ R

n only one i ∈ I is possible, or asa hybrid system, if for some x ∈ R

n multiple i arepossible. The former type of systems includes systems

with saturation and variable structure systems, whereasthe latter type includes systems with hysteresis, systemswith finite automata, etc.

More specifically, in the case of switched systems, thesystem is in the i-th mode at time t if x(t) ∈ Xi, whereXi ⊂ R

n is a region of the state space described by

Xi = x ∈ Rn : gik(x) ≥ 0, for k = 1, ...,mXi

,(28)

for some gik : Rn → R. Additionally, the state space

partition Xi must satisfy⋃

i∈I Xi = Rn and int(Xi)∩

int(Xj) = ∅ for i = j. A switching surface between thei-th and j-th modes, i.e. a boundary between Xi andXj , is given by

Sij = x : hij0(x) = 0, hijk(x) ≥ 0, k = 1, ...,mSij,

(29)

for some hijk : Rn → R. Note that the transition be-

tween modes on this surface can occur in both directions.Although in principle the direction of transition for aparticular x ∈ Sij can be determined from the vectorfields fi(x) and fj(x), it is assumed in our analysis thatsuch a characterization is not performed a priori.

On the other hand, the evolution of the discrete statein a hybrid system is governed by

i(t) = φ(x(t), i(t−)), (30)

with φ : Rn × I → I . Corresponding to the transition

law φ, there exists a region of the state space where aparticular mode can be active. For the i-th mode, theactive region is denoted by Xi, and is given by4

Xi = x ∈ Rn : gik(x) ≥ 0, for k = 1, ...,mXi

.(31)

In the hybrid system case,⋃

i∈I Xi = Rn still holds,

4A notation similar to (28) is chosen here for simplicity; theinterpretation should be clear from the context.

2693

but int(Xi)∩ int(Xj) is not necessarily empty for i = j.The transition set from the j-th mode to the i-th modein a hybrid system is described by

Sij = x : i = φ(x, j)

= x : hij0(x) = 0, hijk(x) ≥ 0, k = 1, ...,mSij.

(32)

In contrast to switched systems, the transition betweenmodes on Sij for a hybrid system occurs only in onedirection, namely from j to i.

We assume that the discrete state i(t) is piecewisecontinuous. Systems with infinitely fast switching, suchas those that have sliding modes, are excluded from ourdiscussion. We also assume that fi, gik, and hijk arepolynomials. In the case where any of these functions isnonpolynomial, we can use a recasting technique [33].

B. Stability Analysis

1) Stability Under Arbitrary Switching: We will firstconsider stability of the system (27) under arbitraryswitching. A sufficient condition for such stability is theexistence of a global common Lyapunov function for allfi’s, as summarized in the following theorem.

Theorem 13: Suppose that for the set of vector fieldsfi there exists a polynomial V (x) such that V (0) = 0and

V (x) > 0 ∀x = 0, (33)∂V

∂xfi(x) < 0 ∀x = 0, i ∈ I, (34)

then the origin of the state space of the system (27) isglobally asymptotically stable under arbitrary switching.Notice in particular that if the vector fields are linear,i.e. fi(x) = Aix, and if V (x) is chosen to be quadratic,say V (x) = xT Px, then the conditions in Theorem 13correspond to the well-known LMIs P > 0, AT

i P +PAi < 0 for all i, which prove quadratic stability ofthe system. For higher degree polynomial vector fieldsand Lyapunov functions, the search for V (x) can alsobe performed using semidefinite programming by for-mulating the conditions as SOS conditions, as describedin Section II. The higher degree test is generally lessconservative than the quadratic test, as a higher degreeLyapunov functions may exist even if the system doesnot possess a quadratic Lyapunov function. At worst,these two tests have the same conservatism.

Example 14: Consider the system x = fi(x), x =[x1 x2

]T, with

f1(x) =

[−5x1 − 4x2

−x1 − 2x2

], f2(x) =

[−2x1 − 4x2

20x1 − 2x2

].

It can be proven using a dual semidefinite programthat no global quadratic Lyapunov function exists for

−4 −2 0 2 4

−4

−2

0

2

4

x1

x 2

Fig. 4. Trajectories of the system in Example 14 under arbitraryswitching. Dashed curves are level curves of the common Lyapunovfunction.

this system [18]. Nevertheless, a global sextic Lyapunovfunction

V (x) = 19.861x61 + 11.709x5

1x2 + 14.17x41x

22

+ 4.2277x31x

32 + 8.3495x2

1x42 − 1.2117x1x

52

+ 1.0421x62

exists, and therefore the system is asymptotically stableunder arbitrary switching (cf. Figure 4).

2) Piecewise Polynomial Lyapunov Functions: Mostswitched and hybrid systems come with a prescribedswitching scheme or a discrete transition rule. In thiscase, stability can be proven in a more effective wayusing piecewise polynomial Lyapunov functions. Suchfunctions are concatenations of polynomial functionsVi(x) (also termed Lyapunov-like functions), typicallycorresponding to the state space partition Xi. TheLyapunov-like function Vi(x) and its time derivativealong the trajectory of the i-th mode are required tobe positive and negative respectively, only within Xi.

The conditions in the previous paragraph can beaccommodated using a method similar to the S-procedure [5] as follows. To incorporate the fact thatVi(x) only needs to be positive on Xi, where Xi isdescribed by (28), we impose the relaxed condition

Vi(x) −

mXi∑k=1

aik(x)gik(x) > 0, (35)

for some aik(x) ≥ 0. Since gik(x) is nonnegative onXi, the above condition implies that Vi(x) is positiveon Xi. An analogous condition can be imposed on dVi

dt.

Note that there is no requirement that the multipliersaik(x) be constants (as in the S-procedure); they can alsobe polynomials of higher degree. Thus, our condition isgenerally less conservative than the S-procedure.

2694

−1 −0.5 0 0.5 1 1.5 2 2.5 3 3.5 4−1

−0.5

0

0.5

1

1.5

2

2.5

3

x1

x 2

Fig. 5. Trajectories of the system in Example 15. Dash-dotted lineand dashed curves show S21 and S12, respectively.

3) Nonlinear Vector Fields and Switching Sur-faces/Transition Sets: So far, the systems we haveconsidered in the examples have linear subsystems andlinear switching surfaces. As mentioned previously, theSOS conditions can be applied directly to systems withnonlinear vector fields and nonlinear switching surfacesor transition sets. To illustrate this, consider the follow-ing example.

Example 15: Let the hybrid system x = fi(x) becomposed of two subsystems

f1(x) =

[−2x1 − x3

1 − 5x2 − x32

6x1 + x31 − 3x2 − x3

2

],

f2(x) =

[x2 + x2

1 − x31

4x1 + 2x2

],

with its transition rule given by

φ(0) = 1,

φ(t) =

1, if i(t−) = 2 and x2

2(t) = x31(t),

2, if i(t−) = 1 and x2(t) = 0, x1(t) ≥ 0.

Figure 5 depicts some trajectories of the system. Theactive regions corresponding to the two modes are X1 =R

2 and X2 = x ∈ R2 : (x3

1 − x22) ≥ 0, while the

transition sets are S12 = x ∈ R2 : x2

2 = x31 and

S21 = x ∈ R2 : x2 = 0, x1 ≥ 0. We can construct

a sextic piecewise polynomial Lyapunov function givenby

V (x(t)) = Vi(x(t)), if φ(t) = i,

for some Vi(x)’s, proving global asymptotic stability.Even for a system with a rational or nonpolynomial

vector field, a system embedding can sometimes bemade such that a Lyapunov function that proves stabilitycan be computed using the SOS decomposition. Thishas been presented in [32] and will not be discussed in

this tutorial. The same technique can also be applied tononpolynomial switching surfaces or transition sets.

Robust stability analysis of switched or hybridsystems can be treated using parameter dependentLyapunov-like functions and multipliers. Computation ofparameter dependent quadratic Lyapunov-like functionsusing LMIs had been previously difficult, since suchfunctions are nonquadratic polynomials in the stateand parameter variables. Using the SOS decomposition,computation of even higher degree functions is straight-forward. A more detail description appeared in [42].

VI. ANALYSIS OF TIME-DELAY SYSTEMS

Significant progress has been made in the stabil-ity analysis of linear autonomous time-delay systems(TDS) using time-domain (Lyapunov) and frequencydomain methods [15], [20]. In the linear case so calledLyapunov-Krasovskii (L-K) functionals are constructedby solving LMIs. On the other hand, the stability analy-sis of nonlinear time delay systems is far more difficultand so-called Lyapunov-Razumikhin (L-R) functions areusually constructed ‘manually’ in this case [22].

Here we present an extension of this methodologyto the construction of L-K functionals for time-delaysystems. The functionals that we use have structuresthat are similar to the complete functionals used forstability analysis of linear systems but they have kernelsthat are polynomials. This allows the use of the SOSdecomposition to check the resulting stability conditionsthrough the solution of LMIs. The methodology reducesto the standard LMI conditions when the system underconsideration is linear and the functional has quadratickernels. The same methodology can be used to analyzerobust stability under parametric uncertainty.

The notation we will be using is standard, and isthe one that is used in [15]. R

n is an n-dimensionalreal Euclidean space with norm | · |. For b > a denoteC([a, b], Rn) the Banach space of continuous functionsmapping the interval [a, b] into R

n with the topology ofuniform convergence. For φ ∈ C([a, b], Rn) the norm ofφ is defined as ‖φ‖ = supa≤θ≤b |φ(θ)|, where | · | is anorm in R

n. Also Cγ = φ ∈ C : ‖φ‖ < γ.

A. Stability Analysis of Time-delay Systems

We will be concerned with autonomous RetardedFunctional Differential Equations (RFDEs) given by

x(t) = f(xt). (36)

where f : Ω → Rn, Ω ⊂ C, ‘ ˙ ’ represents the right-hand derivative and xt ∈ Ω, xt(θ) = x(t + θ), θ ∈[−r, 0]. Definitions of stability of the steady-state x∗ ofthis system satisfying f(x∗) = 0 can be found in [15].

Assessing the stability properties of the equilibrium of(36) can be done using time-domain methodologies by

2695

constructing a Lyapunov-Krasovskii (L-K) functional.Let Ω ⊂ Cγ , define V : Ω → R a continuous functionand let V denote the Upper Right Dini Derivative. Thenwe have the following theorem [20]:

Theorem 16: (Lyapunov-Krasovskii) Let Ω ⊂ Cγ .Suppose V : Ω → R is continuous and there existnonnegative functions a(s) and b(s) such that a(s) → ∞as s → ∞, and a(0) = b(0) = 0 such that

a(|φ(0)|) ≤ V (φ), V (φ) ≤ −b(|φ(0)|) ∀ φ ∈ Ω.

(37)

Then the solution x = 0 of (36) is uniformly stable. If,in addition, b(s) is positive definite, then the solutionx = 0 of (36) is uniformly asymptotically stable.

Just as in the case of ODEs, this is a powerful theoremas it answers questions about stability without requiringa solution to (36). At the same time, however, nomethodology exists to construct these functions. Here wewill use the SOS decomposition and construct Lyapunovfunctionals V with polynomial kernels, sacrificing non-negativity of V with the non-negativity of its kernel.Non-polynomial FDEs can be handled in a way similarto non-polynomial ODEs [32].

Consider the following functional:

V (xt) = V0(x(t)) +

∫ 0

−r

V1(θ, x(t), x(t + θ))dθ +

+

∫ 0

−r

∫ t

t+θ

V2(x(ζ))dζdθ (38)

for the system of the form (36). The first term isadded to impose positive definiteness of V and thelast term is added for convenience, as it will be usedin the derivative condition to ‘complete the squares’.Sufficient conditions for the (global) stability of the zeroequilibrium can then be formulated as follows:

Proposition 17: Let 0 be an equilibrium for the sys-tem given by (36). Let there exist polynomials V0, V1

and V2 and a positive definite polynomial ϕ(x(t)) suchthat:

1) V0(x(t)) − ϕ(x(t)) ≥ 0,2) V1(θ, x(t), x(t + θ)) ≥ 0 for θ ∈ [−r, 0],3) V2(x(ζ)) ≥ 0,4) r ∂V1

∂x(t)f + dV0dx(t)f − r ∂V1

∂θ+ rV2(x(t))− rV2(x(t+

θ))+V1(0, x(t), x(t))−V1(−r, x(t), x(t−r)) ≤ 0for θ ∈ [−r, 0].

Then the equilibrium 0 of the system given by (36) isglobally uniformly stable.A proof can be found in [30].

This proposition can be used in practice in a similarway as described in the delay-independent case. Toimpose the conditions θ ∈ [−r, 0], we use a processsimilar to the S-procedure, as it was done in Theorem 8.The polynomial V1(θ, x(t), x(t + θ)) is required to be

i = 1 i = 2

i = 3

l = 1 l = 2

Fig. 6. A simple network.

non-negative only when h(θ) = θ(θ + r) ≤ 0 issatisfied. We therefore adjoin this constraint to a, usinginstead of constant positive multipliers (S-procedure),SOS multipliers p, and we rewrite condition (2) inProposition 17 above, as follows:

V1(θ, x(t), x(t+ θ))+p(θ, x(t), x(t+ θ))h(θ) is a SOS

Condition (4) can be verified in a similar manner.This results in four SOS conditions in a relevant SOSprogramme which can be solved using SOSTOOLS [44].We can also consider different Lyapunov structures [30].

Remark 18: As remarked earlier, when dealing withnonlinear systems with multiple equilibria or with natu-ral constraints on their state-space, it is useful to use arestricted region for which stability is to be proven, inthe same way that it was done in the delay-independentcase. We will still need to specify Ω = xt ∈ C :‖xt‖ ≤ γ, and adjoin the relevant conditions on x(t),x(t − r) and x(t + θ) ∀ θ ∈ [−r, 0] to the relevantkernels of the Lyapunov functionals using the extendedS-procedure, in much the same way that the conditionsθ ∈ [−r, 0] were adjoined in Conditions (2) and (4) ofProposition 17.

B. Example: Stability Analysis of A Network CongestionControl Scheme

Consider the network shown in Figure 6 that usesa primal-dual version of FAST [25] as its protocol.We assume that all forward and backward delays areoverbounded by τ/2, and that the sources and linkshave dynamics that are described in [29]. The systemis not polynomial in its original form, but it can berendered polynomial through some nonlinear transfor-mations [31]. The closed loop system is then given by

z1(t) =

(− K1β

K1cτ[z1(t) + z4(t) + z1(t)z4(t)]

−ατ

[z1(t) + 1][K2z3(t − τ) + K1z1(t − τ)]

)

z2(t) =

(− K2β

K1cτ[z2(t) + z5(t) + z2(t)z5(t)]+

−ατ

[z2(t) + 1][K2z3(t − τ) + K1z2(t − τ)]

)

2696

z3(t) =

⎛⎜⎝

− β

K1cτ[(z3z4 + z3 + z4)K1 + (z3z5 + z3 + z5)K2]

− α2τ

[z3(t) + 1]

×[z1(t − τ)K1 + z2(t − τ)K1 + 2z3(t − τ)K2]

⎞⎟⎠

z4(t) =K1c

K1(K1z1(t − τ) + K2z3(t − τ))

z5(t) =K1c

K2((K1 + K2)z2(t − τ) + K3z3(t − τ))

We set c = 40, α = 1, τ = 0.2, and we calculateβ = 0.64α

τand we let K1 = 15, K2 = 20, K3 = 25;

furthermore, K1 = K1+K2K1+K2+K3

and K2 = K3K1+K2+K3

.We can construct a similar Lyapunov functional to (38)with all polynomials V0, V1 of second order and V2 oforder 4 for

0 ≤ x1t≤ 2.3x1,0, 0 ≤ x2t

≤ 2.3x2,0,

0 ≤ x3t≤ 2.3x3,0, q1 ≥ 0, q2 ≥ 0.

This proves stability of the equilibrium for τ = 0.2.

VII. MODEL VALIDATION

Modelling is an important precursor to system anal-ysis and controller design. For successful analysis anddesign, it is crucial to obtain a model that captures essen-tial behaviors of the system under consideration. Modelvalidation provides a way to evaluate the ability of aproposed model to represent observed system behaviors.However, as often mentioned in the literature [51], [37],[12], “model validation” is actually a misnomer; it isimpossible to validate a model, because to do so requiresan infinite number of experiments and data. The role ofmodel validation is to invalidate a model, by provingthat some experimental data are inconsistent with themodel, thus indicating that a refinement of the model isrequired.

In the simplest setting, consider the model

x(t) = f(x(t), p, t), (39)

where x(t) ∈ Rn is the vector of state variables, t is the

time, and p ∈ Rm is the parameter vector, assumed to

take its value in a set P ⊂ Rm. Let an experiment be

performed with the real system, and two measurementsbe taken at time t = 0 and t = T . Suppose that thesemeasurements indicate that x(0) ∈ X0 and x(T ) ∈ XT ,where both X0 and XT are subsets of R

n. In addition,assume that x(t) ∈ X for all t ∈ [0, T ], where X ⊆ R

n.With these notations, the invalidation problem can bestated as follows:

Problem 19: Given the model (39), parameter setP , and trajectory information X0,XT ,X, providea proof that the model (39) with parameter set P isinconsistent with X0,XT ,X. That is, prove that forall possible parameter p ∈ P , the model (39) cannotproduce a trajectory x(t) such that x(0) ∈ X0, x(T ) ∈XT , and x(t) ∈ X,∀t ∈ [0, T ].

Before proceeding further, we would like to remarkthat necessarily X0 ⊆ X and XT ⊆ X , and in mostcases X will be much larger than X0 or XT . In fact, X

can be the whole state space. The information about X

may come from the experiment and/or from a prioriknowledge about the system5, and such informationwill strengthen the model validation test. Note also thatoutput measurement using the output y = g(x) can beaccommodated, e.g. by defining X0 = x ∈ X : y

0≤

g(x) ≤ y0, and similarly for XT .If such a proof in Problem 19 can be found, then

we say that the model (39) and parameter set P areinvalidated by X0, XT , X. Traditional approaches forsolving this problem include exhaustive simulation of(39) using parameters p and initial conditions x(0)sampled randomly from P and X0. If after many suchsimulations no trajectory x(t) that satisfies the initial hy-pothesis can be found, then inconsistency is concluded.Indeed simulation (possibly after some parameter fitting)is a good way for proving that a model can reproducesome behaviors of the system it represents. However, forproving inconsistency, the required number of simulationruns will soon become prohibitive. Moreover, a proofby simulation alone is never exact, simply because it isimpossible to test all p and x(0).

On the other hand, our method relies on the existenceof a function of state-parameter-time, which we termbarrier certificate. A barrier certificate gives an exactproof of inconsistency by providing a barrier betweenpossible trajectories of the model starting at X0 and thefinal measurement XT . This is accomplished withoutperforming any simulation nor computing the flow ofthe model. The method is summarized in the followingtheorem.

Theorem 20 ([39]): Let the model (39) and the setsP,X0, XT , X be given. Assume that there is a functionB : R

n × Rm × R → R (a barrier certificate), differen-

tiable with respect to x and t, such that

B(xT , p, T ) − B(x0, p, 0) > 0

∀xT ∈ XT , x0 ∈ X0, p ∈ P, (40)∂B

∂x(x, p, t)f(x, p, t) +

∂B

∂t(x, p, t) ≤ 0

∀x ∈ X, p ∈ P, t ∈ [0, T ]. (41)

Then the model (39) and its associated parameter set P

are invalidated by X0, XT , T.Example 21: As the second example, consider the

model x = −px3, with X = R and P = [0.5, 2]. Themeasurement data used for invalidating this model areX0 = [0.85, 0.95] and XT = [0.55, 0.65] at T = 4. Us-

5For example, in biological systems typical state variables are theconcentration of some chemical substrates. In this case, they can beneither negative nor very large.

2697

0 0.5 1 1.5 2 2.5 3 3.5 4 4.50

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

t

x

Fig. 7. A level set of the barrier certificate B(x, t) in Example 21is shown as a dashed curve in this figure. Bold line at t = 4 is XT ,whereas the solid patch is the collection of all possible trajectories ofthe model with p ∈ P , starting at x(0) ∈ X0.

ing the SOS technique, we obtain as a barrier certificatefor this example B(x, t) = 8.35x + 10.4x2 − 21.5x3 +9.86x4 −1.78t+6.58tx−4.12tx2 −1.19tx3 +1.54tx4.It is shown in Figure 7 how a level set of this functionserves as a barrier in the state-time space.

With this methodology, we are able to treat in aunified way model validation of a very large classof continuous-time models — some of which havenever been addressed before. This includes differential-algebraic models, models with uncertain inputs, mod-els with memoryless and dynamic uncertainties, hybridmodels, and their combinations. Moreover, the methodsare computationally tractable, as barrier certificates canbe constructed using the SOS decomposition, in a waysimilar to what we have shown in the previous sections.These we consider as some of the most importantfeatures of our approach. For more on these, includinghow to extend the invalidation setting to the case wherethere are measurements at more than two time instants,see [39].

VIII. SAFETY VERIFICATION

Complex behaviors that can be exhibited by modernengineering systems, which typically have hybrid (i.e., amixture of discrete and continuous) dynamics, make thesafety verification of such systems both critical and chal-lenging. In principle, safety verification or reachabilityanalysis aims to show that starting at some initial condi-tions, a system cannot evolve to some unsafe region inthe state space. For safety verification, several methodshave been proposed (see e.g. [3], [2], [8], [54]). Explicitcomputation of either exact or approximate reachablesets corresponding to the continuous dynamics is crucialfor virtually all of these methods. Consequently, it is

hard to handle nonlinearity, uncertainty, and constraintswith these methods.

With regard to this, it is interesting to note that safetyverification addresses a question related to Problem 19 inthe previous section. If we assume that the set XT in theprevious section is the unsafe set, then verifying safetyrequires proving that no trajectory of the system startingfrom X0 enters this set for all positive time instant. Thus,it is natural to expect that barrier certificates can also beused for safety verification, and in fact it is.

The safety verification method based on barrier cer-tificates can be easily adapted to handle hybrid systems,as we will show in this section. We adopt the hybridmodelling framework that was first proposed in [1],which is more general than those in Section V. Seealso [2] for a more detailed explanation and example. Ahybrid system is a tuple H = (X , L,X0, I, F, T ) withthe following components:

• X ⊆ Rn is the continuous state space.

• L is a finite set of locations. The overall state spaceof the system is X = L × X , and a state of thesystem is denoted by (l, x) ∈ L ×X .

• X0 ⊆ X is the set of initial states.• I : L → 2X is the invariant, which assigns to each

location l an invariant set I(l) ⊆ X that containsall possible continuous states while at location l.

• F : X → 2Rn

is a set of vector fields. F assignsto each (l, x) ∈ X a set F (l, x) ⊆ R

n whichconstrains the evolution of the continuous stateaccording to the differential inclusion x ∈ F (l, x).

• T ⊆ X × X is a relation capturing discretetransitions between two locations. Here a transition((l, x), (l′, x′)) ∈ T indicates that from the state(l, x) the system can undergo a discrete jump tothe state (l′, x′).

Trajectories of the hybrid system H start from someinitial state (l0, x0) ∈ X0 and are concatenations of asequence of continuous flows and discrete transitions.During a continuous flow, the discrete location l is main-tained and the continuous state evolves according to thedifferential inclusion x ∈ F (l, x), as long as x remainsinside the invariant set I(l). At a state (l1, x1), a discretetransition to (l2, x2) can occur if ((l1, x1), (l2, x2)) ∈ T .Given a hybrid system H and a set of unsafe statesXu ⊆ X , the safety verification problem is concernedwith proving that all trajectories of the hybrid system H

cannot enter the unsafe region Xu.For each location l ∈ L, we define the set of initial

and unsafe continuous states as Init(l) = x ∈ X :(l, x) ∈ X0 and Unsafe(l) = x ∈ X : (l, x) ∈ Xu.To each tuple (l, l′) ∈ L × L with l = l′, we associatea guard set Guard(l, l′) = x ∈ X : ((l, x), (l′, x′)) ∈T for some x′ ∈ X, and a (possibly set valued) reset

2698

map Reset(l, l′) : x → x′ ∈ X : ((l, x), (l′, x′)) ∈ T,whose domain is Guard(l, l′). Obviously, if no discretetransition from location l to location l′ is possible, thenthe set Guard(l, l′) will be regarded as empty, and theassociated reset map needs not be defined.

Using this formalism, the following test for safety canbe stated.

Theorem 22 ([40]): Let the hybrid system H =(X , L,X0, I, F, T ) and the unsafe set Xu be given. Sup-pose there exists a collection of differentiable functionsBl(x) which, for each l ∈ L and (l, l′) ∈ L2, l′ = l,satisfy

Bl(x) > 0 ∀x ∈ Unsafe(l), (42)

Bl(x) ≤ 0 ∀x ∈ Init(l), (43)∂Bl

∂x(x)fl(x, d) ≤ 0 ∀(x, d) ∈ I(l) × D(l), (44)

Bl′(x′) ≤ 0 ∀x′ ∈ Reset(l, l′)(x),

for all x ∈ Guard(l, l′) s.t. Bl(x) ≤ 0. (45)

Then the safety of the hybrid system H is guaranteed.Again, when the vector fields of the system are

polynomials and the sets in the system description aresemialgebraic (i.e., described by polynomial equalitiesand inequalities), the SOS technique can be utilized forconstructing a polynomial barrier certificate Bl(x).While the computational cost of this construction de-pends on the degrees of the vector fields and the barriercertificate in addition to the dimension of the continuousstate, for fixed degrees the complexity is polynomialwith respect to the state dimension. Hence we expectour method to be more scalable than many other existingsafety verification methods.

A large class of hybrid systems can be treated withinthis framework, including those with nonlinear contin-uous dynamics, uncertain inputs, uncertain parameters,and constraints. More recently, the method has also beenextended to handle stochastic safety verification [41].For an application example, we refer the reader to [14].

IX. CONCLUSIONS

In this paper we have presented a brief tutorial onsum of squares techniques for systems analysis. We haveshown how it can be used to solve problems such asnonlinear stability and robustness analysis, analysis ofhybrid systems, analysis of time-delay systems, modelvalidation, and safety verification. Other work in thisarea includes estimation of the domain of attraction [34],[50], LPV analysis and synthesis [58] and nonlinearsynthesis [17], [47], [46]. We would also refer the readerto the paper [35] and the upcoming volume [13]. Forindustrial application examples, we refer the reader to[14], [21], [23], [9].

REFERENCES

[1] R. Alur, C. Courcoubetis, N. Halbwachs, T. A. Henzinger, P.-H. Ho, X. Nicollin, A. Oliviero, J. Sifakis, and S. Yovine. Thealgorithmic analysis of hybrid systems. Theoretical ComputerScience, 138:3–34, 1995.

[2] R. Alur, T. Dang, and F. Ivancic. Progress on reachabilityanalysis of hybrid systems using predicate abstraction. In HybridSystems: Computation and Control, LNCS 2623, pages 4–19.Springer-Verlag, 2003.

[3] A. Bemporad, F. D. Torrisi, and M. Morari. Optimization-basedverification and stability characterization of piecewise affine andhybrid systems. In Hybrid Systems: Computation and Control,LNCS 1790, pages 45–58. Springer-Verlag, 2000.

[4] J. Bochnak, M. Coste, and M.-F. Roy. Real Algebraic Geometry.Springer-Verlag, Berlin, 1998.

[5] S. Boyd, L. El Ghaoui, E. Feron, and V. Balakrishnan. LinearMatrix Inequalities in System and Control Theory. Society forIndustrial and Applied Mathematics (SIAM), 1994.

[6] M. S. Branicky. Multiple Lyapunov functions and other analysistools for switched and hybrid systems. IEEE Transactions onAutomatic Control, 43(4):475–482, 1998.

[7] M. D. Choi, T. Y. Lam, and B. Reznick. Sum of squares of realpolynomials. Proceedings of Symposia in Pure Mathematics,58(2):103–126, 1995.

[8] A. Chutinan and B. H. Krogh. Computational techniques forhybrid system verification. IEEE Trans. Automatic Control,48(1):64–75, 2003.

[9] R. Cogill and S. Lall. Decentralized stochastic decision problemsand polynomial optimization. In Proceedings of the AmericanControl Conference, 2005.

[10] L. Dai. Singular Control Systems. Springer-Verlag, New York,1989.

[11] R. A. DeCarlo, M. S. Branicky, S. Pettersson, and B. Lennartson.Perspectives and results on the stability and stabilizability ofhybrid systems. Proceedings of the IEEE, 88(7):1069–1082,2000.

[12] G. Dullerud and R. Smith. A nonlinear functional approach toLFT model validation. Systems and Control Letters, 47(1):1–11,2002.

[13] A. Garulli and D. Henrion, editors. Positive Polynomials inControl. Springer–Verlag, 2005. Forthcoming.

[14] S. Glavaski, A. Papachristodoulou, and K. Ariyur. Controlledhybrid system safety verification: Advanced life support systemtestbed. In Proceedings of the American Control Conference,2005.

[15] J. K. Hale and S. M. V. Lunel. Introduction to FunctionalDifferential Equations. Applied Mathematical Sciences (99).Springer-Verlag, 1993.

[16] A. Hassibi and S. P. Boyd. Quadratic stabilization and control ofpiecewise-linear systems. In Proceedings of American ControlConference, pages 3659–64, 1998.

[17] Z. Jarvis-Wloszek, R. Feeley, W. Tan, K. Sun, and A. Packard.Some controls applications of sum of squares programming. InProceedings of the IEEE Conference on Decision and Control,2003.

[18] M. Johansson and A. Rantzer. Computation of piecewisequadratic Lyapunov functions for hybrid systems. IEEE Trans-actions on Automatic Control, 43(4):555–559, 1998.

[19] H. K. Khalil. Nonlinear Systems. Prentice Hall, Inc., secondedition, 1996.

[20] V. Kolmanovskii and A. Myshkis. Introduction to the Theoryand Applications of Functional Differential Equations. KluwerAcademic Publishers, 1999.

[21] K. Krishnaswamy, G. Papageorgiou, S. Glavaski, and A. Pa-pachristodoulou. Analysis of aircraft pitch axis stability augmen-tation system using sum of squares optimization. In Proceedingsof the American Control Conference, 2005.

[22] Y. Kuang. Delay Differential Equations with Applications inPopulation Dynamics. Academic Press, 1993. Mathematics inScience and Engineering (191).

2699

[23] A. Lakshmikantha, C. L. Beck, and R. Srikant. On the use of SoSmethods for analysis of connection-level stability in the Internet.In Proceedings of the American Control Conference, 2005.

[24] J. B. Lasserre. Global optimization with polynomials and theproblem of moments. SIAM Journal on Optimization, 11(3):796–817, 2001.

[25] S. Low. Fast project. http://netlab.caltech.edu/FAST/,2004.

[26] A. Megretski and A. Rantzer. System analysis via integralquadratic constraints. IEEE Transactions on Automatic Control,42(6):819–830, 1997.

[27] J. D. Murray. Mathematical Biology. Springer-Verlag, secondedition, 1993.

[28] K. G. Murty and S. N. Kabadi. Some NP-complete problems inquadratic and nonlinear programming. Mathematical Program-ming, 39:117–129, 1987.

[29] F. Paganini, Z. Wang, S. H. Low, and J. C. Doyle. A newTCP/AQM for stable operation in fast networks. In Proceedingsof IEEE Infocom, San Francisco, 2003.

[30] A. Papachristodoulou. Analysis of nonlinear time delay systemsusing the sum of squares decomposition. In Proceedings of theAmerican Control Conference, 2004.

[31] A. Papachristodoulou, J. C. Doyle, and S. H. Low. Analysisof nonlinear delay differential equation models of TCP/AQMprotocols using sums of squares. In Proceedings of the IEEEConference on Decision and Control, 2004.

[32] A. Papachristodoulou and S. Prajna. On the construction ofLyapunov functions using the sum of squares decomposition. InProceedings of the IEEE Conference on Decision and Control,2002.

[33] A. Papachristodoulou and S. Prajna. Analysis of non-polynomialsystems using the sum of squares decomposition. To appear inPositive Polynomials in Control, Springer-Verlag, 2005.

[34] P. A. Parrilo. Structured Semidefinite Programs and Semialge-braic Geometry Methods in Robustness and Optimization. PhDthesis, California Institute of Technology, Pasadena, CA, 2000.

[35] P. A. Parrilo and S. Lall. Semidefinite programming relaxationsand algebraic optimization in control. European Journal ofControl, 9(2–3):307–321, 2003.

[36] P. A. Parrilo and B. Sturmfels. Minimizing polynomial functions.In Workshop on Algorithmic and Quantitative Aspects of RealAlgebraic Geometry in Mathematics and Computer Science,2001.

[37] K. Poolla, P. Khargonekar, A. Tikku, J. Krause, and K. Nag-pal. A time-domain approach to model validation. IEEETrans. Auto. Control, 39(5):951–959, 1994.

[38] V. Powers and T. Wormann. An algorithm for sums of squares ofreal polynomials. Journal of Pure and Applied Linear Algebra,127:99–104, 1998.

[39] S. Prajna. Barrier certificates for nonlinear model validation. InProceedings of the IEEE Conference on Decision and Control,2003.

[40] S. Prajna and A. Jadbabaie. Safety verification of hybrid systemsusing barrier certificates. In Hybrid Systems: Computation andControl, pages 477 – 492. Springer-Verlag, 2004.

[41] S. Prajna, A. Jadbabaie, and G. J. Pappas. Stochastic safetyverification using barrier certificates. In Proceedings of the IEEEConference on Decision and Control, 2004.

[42] S. Prajna and A. Papachristodoulou. Analysis of switchedand hybrid systems - beyond piecewise quadratic methods. InProceedings of the American Control Conference, pages 2779–2784, 2003.

[43] S. Prajna, A. Papachristodoulou, and P. A. Parrilo. IntroducingSOSTOOLS: A general purpose sum of squares programmingsolver. In Proceedings of the IEEE Conference on Decision andControl, 2002.

[44] S. Prajna, A. Papachristodoulou, and P. A. Parrilo. SOSTOOLS –Sum of Squares Optimization Toolbox, User’s Guide. Availableat http://www.cds.caltech.edu/sostools, 2002.

[45] S. Prajna, A. Papachristodoulou, P. Seiler, and P. A. Parrilo. Newdevelopments in sum of squares optimization and SOSTOOLS.In Proceedings of the American Control Conference, 2004.

[46] S. Prajna, A. Papachristodoulou, and F. Wu. Nonlinear controlsynthesis by sum of squares optimization: A Lyapunov-basedapproach. In Proceedings of the Asian Control Conference, 2004.

[47] S. Prajna, P. A. Parrilo, and A. Rantzer. Nonlinear control syn-thesis by convex optimization. IEEE Transactions on AutomaticControl, 49(2):310–314, 2004.

[48] A. Prestel and C. N. Delzell. Positive Polynomials: FromHilbert’s 17th Problem to Real Algebra. Springer-Verlag, NewYork, 2001.

[49] B. Reznick. Some concrete aspects of Hilbert’s 17th problem.In Contemporary Mathematics, volume 253, pages 251–272.American Mathematical Society, 2000.

[50] P. Seiler. Stability region estimates for SDRE controlled systemsusing sum of squares optimization. In Proceedings of theAmerican Control Conference, 2003.

[51] R. S. Smith and J. C. Doyle. Model validation: a connectionbetween robust control and identification. IEEE Trans. AutomaticControl, 37(7):942–952, 1992.

[52] J. F. Sturm. Using SeDuMi 1.02, a MATLAB toolboxfor optimization over symmetric cones. OptimizationMethods and Software, 11–12:625–653, 1999. Available athttp://fewcal.kub.nl/sturm/software/sedumi.html.

[53] K. C. Toh, R. H. Tutuncu, and M. J. Todd. SDPT3— a MATLAB software package for semidefinite-quadratic-linear programming, 1999. Available athttp://www.math.nus.edu.sg/ mattohkc/sdpt3.html.

[54] C. J. Tomlin, I. Mitchell, A. M. Bayen, and M. Oishi. Computa-tional techniques for the verification of hybrid systems. Proc. ofthe IEEE, 91(7):986–1001, 2003.

[55] L. Vandenberghe and S. Boyd. Semidefinite programming. SIAMReview, 38(1):49–95, 1996.

[56] J. C. Willems. Dissipative dynamical systems. I. General theory.Arch. Rational Mech. Anal., 45:321–351, 1972.

[57] J. C. Willems. Dissipative dynamical systems. II. Linear systemswith quadratic supply rates. Arch. Rational Mech. Anal., 45:352–393, 1972.

[58] F. Wu and S. Prajna. A new solution approach to polynomialLPV system analysis and synthesis. In Proceedings of theAmerican Control Conference, 2004.

[59] V. A. Yakubovic. S-procedure in nonlinear control theory. VestnikLeningrad University, 4(1):73–93, 1977. English translation;original Russian publication in Vestnik Leningradskogo Univer-siteta, Seriya Matematika, Leningrad, Russia, 1971, pp. 62–77.

2700