Robust MPC via Min-Max Differential Inequalities

This paper is concerned with tube-based model predictive control (MPC) for both linear and nonlinear, input-affine continuous-time dynamic systems that are affected by time-varying disturbances. We derive a min-max differential inequality describing the support function of positive robust forward invariant tubes, which can be used to construct a variety of tube-based model predictive controllers. These constructions are conservative, but computationally tractable and their complexity scales linearly with the length of the prediction horizon. In contrast to many existing tube-based MPC implementations, the proposed framework does not involve discretizing the control policy and, therefore, the conservatism of the predicted tube depends solely on the accuracy of the set parameterization. The proposed approach is then used to construct a robust MPC scheme based on tubes with ellipsoidal cross-sections. This ellipsoidal MPC scheme is based on solving an optimal control problem under linear matrix inequality constraints. We illustrate these results with the numerical case study of a spring-mass-damper system.


Introduction
Model predictive control (MPC) refers to a class of feedback controllers, which proceed by solving, at each time step, an optimal control problem predicting the future behavior of a dynamic system on a finite, receding timehorizon, using the current state estimate as initial condition [34]. The predicted optimal control trajectory is applied to the actual system until the next measurement becomes available, and the process is then repeated. The implementation of such controllers is based on a certainty-equivalence principle, whereby the future of the system is optimized as if neither external disturbances nor model mismatch were present, despite the fact that such disturbances and mismatch are the reason why feedback is needed in the first place.
The main advantage of certainty-equivalence in MPC is that the resulting optimization problems can often be solved efficiently, in real time [10,17]. This approach works well in many practical applications, and it often exhibits a certain robustness due to its inherent ability to reject disturbances [28,43]. However, the constraints may become violated when large disturbances occur, since uncertainty is not taken into account in optimizing the predicted state trajectories. In such cases, robust MPC schemes can be used to mitigate these optimistic, certainty-equivalence-based predictions [34]. Nonetheless, a rigorous formulation of robust MPC calls for the solution, at each sampling time, of an optimization problem whose decision variables are the future control policies, that is, functions mapping the state measurements onto the control actions. Such optimization problems are hard to solve in general, and brute-force approximations, e.g. based on scenario trees [8,11], can currently only be used for very short time-horizons. Because scenario-tree approaches scale exponentially with the length of the time-horizon, they may even be worse than robust dynamic programming approaches [3,9,34], which scale linearly with the length of the prediction horizon, yet exponentially with the state dimension.
Convex formulations of robust MPC have been derived for certain classes of problems, for instance when the dynamic system is jointly affine in the state, control and uncertainty and the feedback control law is itself affine in the disturbance [15,14]. There, the number of the (matrix-valued) optimization variables scales quadratically with the length of the prediction horizon. The conservatism introduced by an affine parameterization of the control law is discussed in [38]. In this context, we also refer to [44], where real-time variants of robust MPC based on certain affine feedback laws are analyzed. Other convex formulations can be obtained by reformulating the semi-infinite constraints arising in robust MPC as linear matrix inequalities (LMIs). One such LMI reformulation for bounding the worst-case performance of linear systems under additive bounded uncertainty using constant state-feedback control laws was derived in [20]. Another approach was presented in [26], where the future model variations are bounded by a family of polytopes expressed as LMI constraints.
Other state-of-the-art approaches in robust MPC adopt a set-theoretic perspective. These methods find their origins in viability theory [1,21,22] or, more specifically, in set-theoretic methods for control [4,5]. Robust MPC schemes based on these parametric setpropagation methods are also known collectively under the name tube-based MPC. There, the predicted trajectory is replaced by a robust forward invariant tube (RFIT) in the state-space, namely a tube that encloses all possible state trajectories under a given feedback control law, which is independent of the uncertainty realization [24]. Tube-based approaches are typically analyzed under the assumption that exact state measurements are available [31], or that the equations of a parameterized state estimator, e.g. a linear filter, can be added to the system dynamics so that standard tube-based methods transfer readily [27].
A parameterized tube-based MPC formulation for linear discrete-time systems with affine uncertainty has been proposed in [33]. This formulation allows for the simultaneous optimization of tubes and control laws that are nonlinear in the state measurements, resulting in a computationally tractable, linear programming (LP) formulation, whose decision variables and constraints scale quadratically with the prediction horizon. A generalization handling more general cost functions is considered in [32], and a way of reducing the online complexity of this approach to linear complexity via offline computations is further presented in [29]. Tube-based methods have also been developed for linear systems with multiplicative uncertainty, for example by using polytopic tubes with quadratic cost, which leads to a quadratic programming (QP) formulation [12]. Regarding nonlinear dynamics, a possible tube-based approach involves linearizing the system around a feasible, but suboptimal, trajectory and computing the tube by regarding the linearization errors as additional uncertainty. This idea was used in [25] with polytopic tubes and affine feedback laws. A similar approach was developed by [7] in the case of quadratic cost terms and ellipsoidal tubes. A tube-based approach for nonlinear continuous-time systems was proposed in [42], where the feedback control laws are affinely parameterized and computed offline. This paper presents a novel numerical approach for addressing tube-based MPC problems. In contrast to existing methods which parameterize the control law, our approach introduces a min-max differential inequality exploiting the properties on the boundary of RFITs. These min-max differential inequalities yield a non-trivial generalization of differential inequalities [23,41,37,40] and provide sufficient conditions for a time-varying convex-set-valued function to be a RFIT for a class of continuous-time nonlinear control systems. We show that these (on the first view) rather abstract concepts can be used to derive practical implementations of tubebased MPC, which i) scale linearly with the length of the prediction horizon, and ii) do not rely on a particular parameterization of the control law. In principle, this approach can achieve arbitrary precision, insofar as the tubes are represented with sufficient accuracy.
The rest of the paper is organized as follows. The problem formulation is described in Sect. 2. The main theoretical framework for characterizing RFITs for nonlinear input-affine systems is developed in Sect. 3 and its application to RFITs with ellipsoidal cross-sections is presented in Sect. 4. A practical implementation of tubebased MPC based on these results is discussed in Sect. 5 and illustrated with a numerical case study in Sect. 6. Finally, Sect. 7 concludes the paper.
Notation and preliminaries The sets of real and positive real numbers are denoted by R and R ++ . The sets of compact and compact convex subsets of R n are denoted by K n and K n C , respectively. The support function V [Z] : R n → R of a set Z ∈ K n C is defined as Moreover, bd Z denotes the boundary of Z and Π(Z) its power set. The Hausdorff distance between W, Z ∈ K n C is given by A set Z ∈ K n C is said to be strictly convex if each of its supporting hyperplanes meets bd Z at exactly one point z ∈ bd Z, and it is called a smooth set if bd Z is itself a smooth submanifold of R n . Moreover, there exists a C ∞ -smooth convex function g : R n → R such that as discussed in [2].
Let S n−1 denote the unit sphere in R n . Given a smooth set Z ∈ K n C , the Gauss map G Z : bd Z → S n−1 is a continuous function assigning to every boundary point z ∈ bd Z its unique outward normal. It is defined as for any continuously-differentiable and convex function g satisfying (2). The differential ∂G Z /∂ζ(ζ) defines a linear operator from T ζ Z, the tangent space of bd Z at ζ, onto itself. The set Z is said to have positive curvature In particular, any smooth set Z with positive curvature everywhere is also strictly convex. Moreover, if Z is both smooth and strictly convex, then G Z has a continuous inverse G −1 Z , called the inverse Gauss map. In other words, bd Z is homeomorphic to S n−1 through G Z .
The set of n-dimensional Lebesgue-integrable functions on the interval I ⊆ R is denoted by L(I) n , or simply L n if I = R. Unless otherwise stated, Lebesgue integration is understood with respect to the time variable. The abbreviation a. e. is used to indicate that a property holds almost everywhere.
The sets of n × n symmetric positive semi-definite and symmetric positive definite matrices are denoted by S n + and S n ++ , respectively. Ellipsoids in R n with center q ∈ R n and positive semi-definite shape matrix Q ∈ S n + are defined as with Q 1 2 being the symmetric square-root of Q. By a small abuse of notation, E(Q) denotes the ellipsoid with shape matrix Q and centered at zero. The (Moore-Penrose) pseudoinverse of a matrix A ∈ R m×n is denoted by A † , and its Frobenius norm by A F := Tr(A T A).

Problem Formulation
Consider a nonlinear control system in the form: are potentially nonlinear functions, for which regularity assumptions will be stated later on, as necessary; the state trajectory is denoted by The class of nonlinear control systems (3) is affine in the control function u. Although the reasons for this assumption will become apparent later on, it is important to note that it is not as restrictive as it may seem. In engineering practice, many physical systems possess such an affine control structure. Moreover, any nonlinear controlled system may be reformulated into the desired form under a stronger assumption on u [16]; for instance, under the assumption that u is at least locally Lipschitz continuous, an integrable control v can be introduced such that u is now regarded as a auxiliary state satisfying the differential equationu(t) = v(t).

Assumption 1
The sets U ⊆ R nu and W ⊆ R nw are compact and convex, i.e. U ∈ K nu C and W ∈ K nw C . Furthermore, U has a non-empty interior.
Our focus throughout the paper is on a tube-based robust MPC approach, whereby the following optimization problems are solved in a receding horizon manner: where Y denotes the set of all RFITs for (3) on [t, t + T ]; ℓ : Π(R nx ) → R is the objective of the MPC controller; the feasibility set F x is a subset of R nx ; andx t is the state measurement at t, assumed to be noise free.
Observe that optimizing over the tube Y in problem (4) is equivalent to optimizing over a feedback control policy µ, since every Y is generated by at least one µ according to Definition 1. This also makes the link with standard MPC formulations, where the optimization is over the (open-loop) control trajectory.
The following analysis aims to develop a tractable computational approach to addressing the tube-based robust MPC problem (4). For simplicity, computational delays are not taken into account in this analysis. Specifically, given any feedback control policy µ(t, x) keeping the response x in an optimal RFIT Y * -e.g., as found from the repeated solution of (4) in a receding horizon mannerwe assume that the control u(t) = µ(t,x t ) is fed back into the system instantaneously.

Characterization of Robust Forward Invariant Tubes
This section presents sufficient conditions for a convex tube to be a RFIT for the nonlinear input-affine control system (3), under the following generic assumption: Assumption 2 The function f is jointly continuous in x, w and locally Lipschitz-continuous in x. Moreover, the function G is continuously differentiable.
The derivation builds upon a recent result for computing enclosures of the reachable set of uncertain ODEs [40]. For a given control u ∈ U and a given set of initial states X 1 ∈ K nx C at t 1 , we denote the reachable set of (3) at t 2 > t 1 as: For notational convenience, we also define the set-valued function Γ g : R nu × R nx × K nx C → K nx associated with the right-hand-side function g in (3) as: The following theorem is adapted from [40, Theorem 3 & Remark 2] for the class of controlled dynamic systems of interest.
Theorem 1 Consider the uncertain dynamic system (3) with initial condition x(t 1 ) ∈ X 1 , with X 1 ∈ K nx C , and a given control u ∈ U, and let Assumptions 1 and 2 hold.
, and (2) the set-valued function Y satisfies, for all c ∈ R nx , the differential inequality Then, Y is an enclosure of the reachable tube of (3), i.e.
The following theorem sets the basis for the tube-based MPC methods that are proposed in the paper. Unlike Theorem 1, the control policy u is not given, but chosen in the set U of admissible controllers in order to reduce the cross-section of the tube, while accounting for every possible realization of the exogenous disturbance w ∈ W. These sufficient conditions come in the form of a min-max differential inequality (DI), which describes the convex cross-sections of a RFIT in terms of their support functions.
Theorem 2 Consider the uncertain dynamic system (3), and let Assumptions 1 and 2 hold. Let Y : Proof. See Appendix A.
The following corollary is a direct side-product of the proof of Theorem 2.
Corollary 3 Let the set-valued function Y : [t 1 , t 2 ] → K nx C satisfy the conditions of Theorem 2. Under the additional regularity conditions that the set of admissible controls U and the tube cross-sections Y (t), for all t ∈ [t 1 , t 2 ], are smooth and their boundaries have positive curvature everywhere, an explicit feedback control law keeping the uncertain system trajectories within the RFIT is and the inverse Gauss

Remark 1
The feedback control law given by Eqs. (6) is not necessarily unique.
Remark 2 It is clear from Eq. (A.1) in Appendix A, that the construction of the feedback control law (6) relies heavily on the assumption of a control-affine structure for g as well as the absence of uncertain inputs w in the matrix-valued function G.
Although heavily inspired by set-theoretic methods for the synthesis of model predictive controllers (see [30] for an introduction), Theorem 2 also provides a constructive approach for nonlinear feedback control laws by exploiting properties at the boundaries of RFITs. This approach has not been exploited so far in the robust MPC literature.
Checking the sufficient conditions provided by Theorem 2 for an arbitrary convex set-valued function may prove computationally challenging in general. Nevertheless, the min-max differential inequality can be checked constructively for certain parameterizations of the tube cross-sections, as shown for ellipsoidal tubes next.

Ellipsoidal Robust Forward Invariant Tubes
This section derives computationally tractable conditions for checking whether a particular set-valued function Y is a RFIT for the dynamic system (3). The focus is on tubes with ellipsoidal cross-sections, given by where q x (t) ∈ R nx and Q x (t) ∈ S nx + denote the center and shape matrix of the tube, pointwise in time. Moreover, we make the following additional assumptions: Assumption 4 The functions f and G are twice continuously differentiable in all of their arguments.
The following construction of ellipsoidal tubes is based on Theorem 2 and uses the same ideas as the construction of ellipsoidal bounds for uncertain ODEs based on Theorem 1; see, e.g., [21,18,40]. The control u, disturbance w and state x are decomposed into their nominal and perturbed components as where q x satisfies the ODĖ for a reference control u x (t) ∈ E(q u , Q u ). It follows that the perturbed state component δ x satisfies the ODĖ Here, the function n : R × R nx × R nw × R nu → R nx is defined in such a way that (8) is equivalent to (3) and A number of remarks are in order. Since the central path q x corresponds to the nominal state, u x can be understood as the control input that would be applied if no uncertainty were affecting the system. Moreover, the decomposition of the right-hand side per (8) is valid with any integrable functions A and B of suitable dimensions, as long as n is chosen in an appropriate manner. For instance, if A and B are constructed through a first-order Taylor expansion, n is given by the remainder function per Taylor's theorem.
The present tube construction relies on the existence of an inner approximation of E(q u , Q u ) centered at u x (t), as given by the following lemma.
Lemma 4 For any reference control u x (t) ∈ E(q u , Q u ), any function γ : R → (0, 1], and any matrix-valued function R u : R → S nu + such that R u (t) 0 and Proof. See Appendix C.
We also introduce the following technical assumptions regarding the control constraint set and the nonlinearities in the functions G and n.

Assumption 6 There exists a nonlinearity bounder
Sufficient conditions for a tube with ellipsoidal crosssection to be a RFIT for system (3) are stated in the following theorem. For notational convenience, we introduce the matrix-valued function Φ g : R nx × S nx + × R nx×nu × S nu + × R ++ × R ++ → S nx + associated with the right-hand-side function g in (3) as: .
for some functions λ, κ : Proof. See Appendix B.
The following corollary is an immediate consequence of the proofs of Theorem 2 (Step S1) and Theorem 5.
, Q x (t)) satisfy the conditions of Theorem 5. Then, an explicit feedback law associated with this RFIT is given by where G Y (t) and G −1 Y (t) denote the Gauss map of E(q x (t), Q x (t)) and its inverse respectively, i.e.
and µ * t is given by Remark 3 Another feedback law can be obtained by extending the the domain of the Gauss map of an ellipsoid from bd E(q, Q) to E(q, Q) \ {q}, and replacing the condition ξ ∈ bd Y (t) with ξ = q x in the feedback law (12).
Depending on the problem at hand, the required nonlinear bounders in Assumptions 5 and 6 may be constructed either symbolically, as proposed in [18], or numerically, e.g. using tools from interval analysis [40]. A difficulty with the latter approach, however, is that operations performed using usual interval arithmetic are Lipschitz continuous, yet typically nonsmooth. This would impair the use of gradient-based methods for solving the optimization problems. Instead of applying interval analysis directly, Lemma 7 in Appendix D presents a way of constructing a smooth nonlinearity bounder for any twice continuously-differentiable function.

Robust Tube-Based MPC Based on Min-Max Differential Inequalities
This section discusses how the developments in Sect. 3 and Sect. 4 can be used in the context of robust MPC. Using Theorem 2, any solution to the following optimization problem turns out to also be a feasible solution to the tube-based MPC problem (4), in the case of RFITs with convex cross-sections: Notice that (13) is not a standard optimal control problem, as it embeds semi-infinite differential inequality constraints. However, discretizing this problem leads to a band-structured optimization problem whose complexity scales linearly with respect to the length of the time horizon.
With the results from Theorem 5, Problem (13) can be further specialized to the case of tubes with ellipsoidal cross-sections as: Observe that (14) now yields a standard optimal control problem with linear matrix inequality (LMI) constraints. A solution to this problem provides a RFIT in the form Y (τ ) = E(q x (τ ), Q x (τ )), from which an explicit feedback control law can be derived by applying Corollary 6.
A practical implementation of this tube-based MPC scheme calls for the specification of the performance criterion ℓ and the feasibility set F x . In the case of tracking control, we may use the so-called generalized rotational inertia of the set Y (t) with respect to a given reference x ref [19], defined by: where D ∈ S nx ++ is any weighting matrix. In the ellipsoidal case, Regarding the feasible set, we may consider linear state constraints of the form with h i ∈ R nx and η i ∈ R. In the ellipsoidal case, the feasibility constraint E(q x (τ ), Q x (τ )) ⊆ F x can be rewrit-ten as [22]: One of the main issues in robust MPC is ensuring recursive feasibility, namely the ability to find, for every possible initial state, a feasible state at every time along the closed-loop trajectory. This requirement can be addressed by adding the following constraint to the optimization problem (14): where Y ref ⊆ F x is a robust forward invariant set, i.e. a time-invariant RFIT. If Y ref satisfies Definition 1 on any time interval, then the sets {µ(t+ T, x(t+ T ))|x(t+ T ) ∈ Y (t + T )} ∈ U will remain non-empty by construction, and the MPC procedure discussed previously is indeed recursively feasible. This recursive feasibility condition is satisfied, if For instance, one such matrix Q ref can be found by solving the following optimization problem: The following section presents an application of the ellipsoidal approach of tube-based MPC on a numerical case-study.

Numerical Case Study
We consider a spring-mass-damper system [35] given by Bounds for the disturbance and the control sets are given by the ellipsoids E(Q w ) ∈ K 2 C and E(Q u ) ∈ K C , with Q w = diag(10 −2 m 2 /s 2 , 0.25 N 2 ) and Q u = 36 N 2 . The length of the prediction horizon is set to T = 10 s, and the initial state of the system is x start = (0.7 m, 0.7 m/s) T . Fig. 1. Comparison of the robust (ellipsoidal) tube-based controller with a certainty-equivalent model predictive controller. The plot shows the optimal ellipsoidal RFIT (grey area) forxt = xstart as well as a nominal trajectory (red line) and a disturbed closed-loop trajectory (green line) for the certainty-equivalent controller.
The optimization problem in the tube-based MPC controller is based on (14) and involves minimizing the functional This cost corresponds to the generalized rotational inertia, except for the term u x (t) 2 which can be interpreted as a control regularization. Moreover, a state constraint is enforced, so that E(q Problem (14) is solved numerically using the optimal control sofware ACADO [17], 1 using a piecewise constant control discretization on 40 equidistant intervals. All the nonlinearity bounders are constructed using the technique in Appendix D. Fig. 1 compares the optimal ellipsoidal RFIT (grey area) with closed-loop trajectories for the nominal system (red line) and a system subject to a random disturbance taking values in E(Q w ) (green line) for a certaintyequivalent MPC controller. The latter minimizes the 1 Since ACADO Toolkit does not support LMI constraints, our implementation substitutes the LMI constraints in (14) with equivalent standard (nonlinear) state constraints using Schur complement techniques [6].
and is implemented in ACADO using the same parameter values and state constraint as the robust tube-based MPC controller above. Notice that in the case where no uncertainty is present, the certainty-equivalent MPC controller performs as expected-although it touches the state constraint, it is able to steer the state to a neighbourhood of the origin without violating it. In contrast, when the system is subject to disturbances this controller fails in about 50% of the uncertainty scenarios, after causing a constraint violation.
The results of the tube-based MPC controller are shown in Fig. 2. As expected, the controller steers the nominal state (center of the RFIT) close to the origin at t = 10. In order to prevent violation of the path constraint against all the possible uncertainty scenarios, the controller rotates the ellipsoidal cross-sections of the RFIT quite drastically initially. Moreover, solving a conservative approximation of the min-max differential inequality appears to have a small adverse effect on the controller's performance in this simple case study.

Conclusions
A novel approach to tube-based robust MPC has been proposed for control-affine nonlinear systems, which relies on a min-max differential inequality formulation in order to provide sufficient conditions for a time-varying convex set-valued function to be a RFIT. Unlike other robust MPC approaches, the procedure based on this differential inequality does not call for any particular parameterization of the feedback control law, while benefiting from having linear complexity with respect to the time horizon. Another benefit of the proposed approach is that a semi-explicit representation of a feedback control law may be obtained as a side-product of the RFIT propagation under mild conditions, namely when the RFIT cross-sections and the control sets are smooth with positive curvature. This property has been exploited to devise a practical implementation involving tubes with ellipsoidal cross-sections. This ellipsoidal tube-based MPC approach was tested for a spring-massdamper system. In contrast to the certainty-equivalent model predictive controller it guarantees feasibility for all uncertainty scenarios. A Proof of Theorem 2 The proof of Theorem 2 proceeds in two steps. In the first step (S1), we establish the results under the following auxiliary assumptions: (A1) The set of admissible controls U is smooth with positive curvature; (A2) The pointwise-in-time cross-sections Y (t) of the tube Y are smooth with positive curvatures at each t ∈ [t1, t2].
In the second step (S2), we argue that the result still holds by removing these extra assumptions.

S1
We start by noting that since the inequality (5) is invariant under scaling of the directions c ∈ R nx , it is sufficient to consider those directions c with c T c = 1, namely c ∈ S nx−1 .
It follows from Assumption A2 that the Gauss map G Y (t) : bd Y (t) → S nx−1 is a diffeomorphism [36]. For all c ∈ S nx−1 and all t ∈ [t1, t2], the inverse Gauss map values G −1 Y (t) (c) correspond to the elements of the singletons In particular, we have S2 In the case that certain tube cross-sections Y (t) or the control constraint set U fail to be smooth with positive curvature on [t1, t2], we can-due to Assumption 1-always construct a family of set-valued functions Yǫ : [t1, t2] → K nx C as well as a family of compact sets Uǫ ⊆ U with smooth boundary and positive curvature such that the following statements hold for all ǫ > 0: (2) There exists a continuous function α : R+ → R+ with α(0) = 0 such that dH(Yǫ(t), Y (t)) ≤ α(ǫ), dH(Uǫ, U ) ≤ α(ǫ), for all t ∈ [t1, t2] with L := 1 2(t 2 −t 1 ) . In particular, L can be made arbitrarily large by choosing t2 −t1 sufficiently small.
The existence of such outer approximations has been proven in [40, see Lemma 1 and Lemma 2 in the appendix]. This way, the result follows from the application of the procedure in S1 above and taking the limit as ǫ → 0 by invoking a continuity argument. In detail, we can always choose t2 > t1 so thatV for a sufficiently small ǫ > 0. Thus, it follows from step S1 that Yǫ is a RFIT for all sufficiently small ǫ > 0. The final technical difficulty involves analyzing the limit behavior of the sequence µǫ(t, ξ) := µ * t,ǫ (G Yǫ(t) (ξ)) with µ * t,ǫ (c) := arg min which may fail to converge as ǫ → 0. Since µǫ(t, ξ) takes values in Uǫ and the sets Uǫ converge in the Hausdorff sense to a compact set U , the sequence µǫ(t, ξ) is bounded uniformly with respect to ǫ > 0. Consequently, we can use the Bolzano-Weierstrass theorem to establish the existence of a sequence ǫ1, ǫ2, ... ∈ R+ with limi→∞ ǫi → 0 such that the limit µ(t, ξ) = lim i→∞ µǫ i (t, ξ) exists. By construction, µ(t, ξ) is a control law that generates the limit tube Y , therefore Y is a RFIT. ✷

B Proof of Theorem 5
In analogy to the proof of Theorem 2, the following proof proceeds in two steps. In the first step (S1), we establish the results under the following auxiliary assumption: (A3) The shape matrices Qu and Qx(t), t1 ≤ t ≤ t2, are positive definite.
In the second step (S2), we argue that the result still holds by removing this extra assumption.

S2
In order to show that the result also holds for general positive semidefinite matrices, we can add a small regularization term ǫI to the matrices Qw, Qu and Qx(t), and then take limits as ǫ → 0 by invoking the exact same continuity argument as in Step S2 of the proof of Theorem 2. This process results in the feedback control law µ(t, ξ) = µ * t (G Ex(t) (ξ − qx(t))), with µ * t given by Eq. (B.4); and the Gauss map G Ex(t) given by which follows from the fact that lim ǫ→0 (Qx(t) + ǫI) −1 ξ = Q † x (t)ξ for all ξ ∈ bd E (Qx(t)) ⊆ span(Qx(t)). ✷
(C.1) Using the standard formula for the ellipsoidal bounding of the Minkowski sum of ellipsoids [21], we find that (C.1) holds if for any γ(t) ∈ (0, 1). Solving Eq. (C.2) with respect to Ru(t) yields the statement of Lemma 4. ✷