Topology of sustainable management of dynamical systems with desirable states : from defining planetary boundaries to safe operating spaces in the Earth system

To keep the Earth system in a desirable region of its state space, such as defined by the recently suggested “tolerable environment and development window”, “guardrails”, “planetary boundaries”, or “safe (and just) operating space for humanity”, one needs to understand not only the quantitative internal dynamics of the system and the available options for influencing it (management) but also the structure of the system’s state space with regard to certain qualitative differences. Important questions are, which state space regions can be reached from which others with or without leaving the desirable region, which regions are in a variety of senses “safe” to stay in when management options might break away, and which qualitative decision problems may occur as a consequence of this topological structure? In this article, we develop a mathematical theory of the qualitative topology of the state space of a dynamical system with management options and desirable states, as a complement to the existing literature on optimal control which is more focussed on quantitative optimization and is much applied in both the engineering and the integrated assessment literature. We suggest a certain terminology for the various resulting regions of the state space and perform a detailed formal classification of the possible states with respect to the possibility of avoiding or leaving the undesired region. Our results indicate that, before performing some form of quantitative optimization such as of indicators of human well-being for achieving certain sustainable development goals, a sustainable and resilient management of the Earth system may require decisions of a more discrete type that come in the form of several dilemmas, e.g. choosing between eventual safety and uninterrupted desirability, or between uninterrupted safety and larger flexibility. We illustrate the concepts and dilemmas drawing on conceptual models from climate science, ecology, coevolutionary Earth system modelling, economics, and classical mechanics, and discuss their potential relevance for the climate and sustainability debate, in particular suggesting several levels of planetary boundaries of qualitatively increasing safety. Published by Copernicus Publications on behalf of the European Geosciences Union. 22 J. Heitzig et al.: Topology of sustainable management in the Earth system


Introduction
The sustainable management of systems mainly governed by internal dynamics for which one desires to stay in a certain region of their state space, such as a "tolerable environment & development (E & D) window" or within "guardrails" in a model of the Earth system (Schellnhuber, 1998;Petschel-Held et al., 1999;Bruckner and Zickfeld, 1998), requires first and foremost an understanding of the topology of the system's state space in terms of what regions are in some sense "safe" to stay in, and to what qualitative degree, and which of these regions can be reached with some degree of safety from which other regions, either by the internal ("default") dynamics or by some alternative dynamics influenced by some form of management.In the context of Earth system analysis for studying anthropogenic climate change (Schellnhuber, 1998(Schellnhuber, , 1999)), management options may correspond to global climate policies for mitigation of greenhouse gas emissions (IPCC, 2014) or technological interventions such as geoengineering (Vaughan and Lenton, 2011) and much debated criteria for desirability include the resemblance of a Holocene-like state or the provision of certain levels of human well-being.In this setting, it may be very hard to advance the definition of meaningful "planetary boundaries" and a corresponding "safe operating space for humanity" (Rockström et al., 2009a;Steffen et al., 2015) and relate them to sustainable development goals without such an in-depth analysis.
Also, the question of whether it suffices to influence the system by active management for only a limited time to reach a safe region, or whether it might be necessary to repeat active management indefinitely or even continue it uninterruptedly in order to avoid undesired state space regions, which is closely related to the "sustainability paradigms" of Schellnhuber (1998), seems quite relevant in view of urgent problems such as the climate policy debate.For example, if suitable climate change mitigation policies such as certain forms of energy market regulation can transform the economic system in a way that allows one to eventually deregulate the market again, then for how long can one delay mitigation until this feature is lost and only permanent regulation can help?Or, if certain adaptation or geoengineering options might be cheaper than mitigation but require an uninterrupted management or lead to a less well-known region of state space (Kleidon and Renner, 2013), which of these qualitatively different properties is preferable?
We will see that such questions about a "safe" or "safe and just operating space" (Rockström et al., 2009b;Raworth, 2012;Scheffer et al., 2015;Carpenter et al., 2015) may lead to decision dilemmas that cannot as easily be analysed in a purely optimization-based framework, but that are highly relevant for the design of resilient Earth system management strategies.A summary of these dilemmas is contained in Table 1 (the possible examples from Earth system management mentioned there are discussed in the next section).
The paradigm of optimal control, which is much applied in the engineering, on the one hand does not provide sufficient concepts for such a qualitative analysis and on the other hand typically requires quite a lot of additional knowledge, in particular, some or other form of quantitative evaluation of states, e.g. in terms of indicators of human wellbeing.Of course, the integrated assessment literature, although also using optimization as a basic tool, has long realized that the spatiotemporal distribution of wealth and the diversity and uncertainty of impacts imply that the problem is hard to frame in terms of a single objective function and has used several techniques to deal with this multi-issue multi-agent decision problem, including certainty-equivalent discount rates and hyperbolic discounting (Dasgupta, 2008), cost-efficiency instead of cost-benefit analyses (Edenhofer et al., 2010), lexicographic preferences (Ayres et al., 2001), and many-objective decision making (Singh et al., 2015), to name only a few, but although qualitative constraints appear in many of them, the actual analyses then typically still focus on quantitative assessments.
In this article, we will complement the above-mentioned set of assessment tools by deriving in a purely topological way a thorough and precise qualitative classification of the possible states of a system with respect to the possibility of avoiding or leaving some given undesired region by means of some given management options.Our results indicate that in addition to (or maybe rather before) performing some form of quantitative (constrained) optimization, the sustainable and resilient management of a system may require decisions of a more discrete type, e.g.choosing between eventual safety and permanent desirability, or between permanent safety and increasing future options.This appears even more so in the presence of strong nonlinearities, multistable regimes, bifurcations, and tipping elements (Lenton et al., 2008;Schellnhuber, 2009;Keller et al., 2005), where small state changes due to random perturbations or deliberate management may not only have large consequences but can also lead to qualitative and possibly irreversible changes.
To indicate the wide scope of applicability of our concepts in various subdisciplines of Earth system science, we illustrate the concepts and dilemmas with conceptual models from climate science, ecology, coevolutionary Earth system modelling, economics, and classical mechanics.
In contrast to the somewhat related but more formal approach of sequential decision problems in discrete-time systems (Botta et al., 2015), we focus on the more easily applicable class of continuous-time systems and their models here.Our classification is based on a distinction between default and alternative trajectories of a system, and suitably adapted reachability concepts from control theory and the important but vast field of viability theory (Aubin, 2009;Aubin et al., 2011;Aubin and Saint-Pierre, 2007;Frankowska and Quincampoix, 1990;Martin, 2004;Rougé et al., 2013).Since physical models of global-scale processes or other macroscopic systems are usually of a statistical

Name
Option 1 Option 2 Possible example "Glade" dilemma higher desirability/flexibility safety adaptation/mitigation "Lake" dilemma uninterrupted desirability eventual safety great transformation "Port" dilemma higher flexibility higher desirability land-use change "Harbour" dilemma uninterrupted desirability eventually higher desirability/flexibility space colonization "Dock" dilemma uninterrupted safety eventually higher desirability/flexibility new technologies physics nature in the sense that they represent the aggregate effects of many micro-scale processes by suitable approximations, their proper interpretation typically requires one to expect small (actually or seemingly) random perturbations.
We take this into account here by strengthening the usual notion of reachability to one of stable reachability, and by requiring the featured subsets of state space to be topologically open (instead of closed) sets, so that infinitesimal perturbations cannot kick the system out of them.
In the next subsection ("Metaphorical framework"), we will briefly summarize our main concepts with the help of a metaphorical illustration, before introducing the corresponding formal notation in Sect. 2 in a concise way, reserving a more detailed formal treatment for Appendix A. The framework is then exemplified at the hand of several lowdimensional, conceptual models from various subdisciplines of Earth system science including climate science, ecology, and coevolutionary social-environmental Earth system modelling (Sect.3) in order to indicate the wide scope of applicability of our concepts.A thorough analysis of more realistic and thus higher-dimensional models of the Earth system is something we have to leave for future studies since that would require further improvement of the numerical methods and algorithms employed for finding region boundaries.We conclude with a discussion and outlook in Sect. 4.

Metaphorical framework
As a start, let us take the common metaphor that "we're all in the same boat" literally and represent the state of the Earth system with all its natural and socio-economic parts at each point in time by a single small boat floating or being rowed somewhere on a rather complex system of waters such as in Fig. 1.
The boat can only be on water, not on land, and will generally float along with the stream that represents the inherent dynamics of the Earth system over hundreds and thousands of years (the "default trajectory"), but it may also be rowed in more or less different directions depending on how strong the current of the stream is, and this possibility of rowing represents humankind's agency in deliberately influencing the Earth system's course to some extent by some or other form of what we will call "management" below.Let us assume that the main qualitative distinction with regard to where humanity wants their boat to be is represented by a division of 1.1 ("Metaphorical framework") inspired by Schellnhuber (1998).It depicts a river flowing from the mountains to the sea while going through sunny (left) and dark parts (right) where humanity can float and row on a boat.In the shelter, no rowing is needed to remain in the sun.One can row against the stream direction in slowly flowing parts, shown with long thin arrows, but in fast parts marked with swirls this is not possible.This setting gives rise to a number of qualitatively different regions of the system's state space that can be found in any manageable dynamical system as well: upstream regions such as glades and lakes from where the shelter can be reached, downstream regions such as the backwaters from where one can at best stay in the sun by management, and several types of worse regions, all labelled here and explained in the text.See also Figs. 2 and 3.
the whole region into a desirable, "sunny" region on the left and an undesirable, "dark" region on the right, both containing several parts of the waters that may be connected in any imaginable ways, and with the natural water flow possibly drawing the boat back and forth between these two regions.The sunny region is meant to consist of all those possible states of the natural and socio-economic parts of the Earth system in which some generally agreed environmental and living standards are met, such as those defined by the human rights charter or the sustainable development goals (global goals) recently adopted by the United Nations.An alternative definition of the sunny region has been put forward in the planetary boundary framework (Rockström et al., 2009a;Steffen et al., 2015), where states lying within the corridor of Earth system variability during the Holocene that human societies are adapted to are considered as desirable.
We will show in this article that in such a setting, no matter how the waters look exactly, the general situation is in a certain sense always equivalent to the situation depicted in Fig. 1.There will in general be a certain sunny water region where one does not need to row at all in order to stay in the sun forever but can simply lean back and let the boat float around inside that region.In the picture, this region is the top-left tranquil tarn, but in general this region may also consist of several disconnected parts which we will call the shelters to emphasize their desirable and safe nature.Indeed, we will argue below that these shelters may be the most natural candidates for being called a "safe and just operating space for humanity", only that we may not yet be in them.In the Earth system, there may be several such shelters, one of which might correspond to resilient states of the world (Folke et al., 2010) where humanity lives reconnected to the biosphere (Folke et al., 2011) and no active intervention or constant large-scale management is needed.
Connected to the shelter(s), there will in general also be other parts of the sunny region where it would not be safe to just lean back since the flow would then draw the boat into the dark after some time, but from where the shelters can still be reached by some suitable rowing, as show to the left of the "danger" sign in the image.For their "almost-safe" character, we will call such regions glades.If the glade is for some reason more desirable or offers more flexibility in terms of where one may row, one may face a dilemma when in a glade, i.e. a qualitative decision problem, namely whether to prefer staying in the safety of the shelter or in the more desirable but unsafe glade.
The shelters may also be reached by rowing from some places within the dark region (e.g. to the right of the "danger" sign) or through such a dark region from some other sunny places (such as those above the "keep out" sign).Among these latter sunny places from where the shelters can be reached only through the dark, there will generally be some places where one may alternatively stay forever in the sun by continuous rowing instead of passing through the dark and leaning back eventually.Such special places as the one above the "keep out" sign will be called lakes here, and they are characterized by a moderate current towards a dark place that one can row against and by the decision dilemma that results from the question of whether one should indeed do so or rather row to a shelter through the dark.
All these regions together will be called the upstream region for reasons that should become clear soon.In any system's state space, the upstream consists of all states from which the shelters can be reached by management, and it is partitioned into one or several shelters, glades, dark upstream parts, lakes, and some remaining sunny upstream parts where it is not possible to stay in the sun forever.In Fig. 1, the upstream ends where the rapids left of the "keep out" sign begin since there the stream becomes so strong that it becomes impossible to row against it in order to eventually reach a shelter.Once the boat has left the upstream via such a rapid, there is no hope of leaning back eventually and staying in the sun, and for this reason the borders of the upstream may be called the "no-regrets planetary boundaries", forming a middle level of a hierarchy of planetary boundaries we will suggest in Sect. 4.
Further down the stream there will typically be places where it is still possible to stay in the sun forever, only that one has to row over and over again to do so, such as in the slow-moving side branch below the "keep out" sign in the picture.Such regions, called backwaters here, are similar to lakes, only without the option of rowing to a shelter, so that the lake dilemma does not occur since the only chance one has is to row against the slow current to stay in the backwater.While the upstream was defined by being able to reach a shelter, the downstream is now defined as all places from where a backwater but not a shelter can be reached, including the backwaters, some dark parts such as the slow-moving dark part just right of the backwater in the picture, and maybe some remaining sunny downstream parts from where one may reach a backwater only through the dark.An example of a backwater could be a "machine world" where humanity can fully control nature to its very minute detail.While they can stay within the sunny region for infinite time through this management, there is no way of reaching a shelter anymore because the ecosystem has been changed irreversibly.
The waterfall in Fig. 1 indicates that besides the upstream and downstream regions, where it is possible to stay in the sun eventually, there will in general be further, less hopeful places the system may be in, from where one cannot avoid entering the dark over and over again.In some of those, one can at least make sure that one also spends some time in the sun over and over again, as depicted by the kayak in the picture.Since this is typically connected to some form of cyclic motion, we will call such regions eddies.In some eddies, failing to row correctly may push the boat into an even less desirable region, called an abyss, from where one can no longer avoid ending up in the dark forever eventually, as in the ringshaped abyss shown inside the eddy in the figure.Finally, the dark region from where there is no escape, depicted in the centre of the abyss, will be called a trench.
This completes our main partitioning of the Earth system's or any other manageable system's state space into qualitatively different regions: upstream and downstream, defined by being able to reach shelters or backwaters; abysses, defined by not being able to avoid ending up in a trench; and eddies in between, defined by being at least able to switch between sun and dark forever.Figure 2 summarizes all these regions in the form of a decision tree, where one can identify the region the system is in by answering a small number of questions.That our partitioning is indeed complete and can be given a suitable and unambiguous mathematical form for all kinds of systems is shown in the next section.
While in Fig. 1, each of the introduced set of system states is just one topologically connected region, in general most of these sets are composed of several disjoint regions, so there may be several shelters, glades, lakes, etc.On a finer level, these may be analysed further by looking at which parts may be reached from which other parts, and this leads to a finer, hierarchical partition into ports, rapids, harbours, docks, etc. and to several new types of dilemmas, as shown in Fig. 3.
All of the five types of dilemmas listed in Table 1 can easily occur in the collective "management" or governance of the Earth system by humanity.A glade dilemma may occur if adaptation is seen as preferable to mitigation for welfare reasons but turns out to be a riskier option due to a higher uncertainty of the corresponding climate impacts.A lake dilemma can arise if a great transformation of the global energy system towards a carbon-free economy would temporarily lead to welfare losses in poorer countries.A port dilemma may come from the option of increasing welfare by extending industrial agriculture causing biodiversity loss (decreasing flexibility) due to the related large-scale land-use change.A harbour dilemma could occur in the future when colonization of other planets (increasing flexibility) becomes feasible but extremely costly.Finally, a dock dilemma arises whenever a very promising new technology with some unknown risks and side effects (such as genetically engineered food production) could be introduced on a planetary scale.

Formal framework
We will now put all of the above on thorough mathematical footing.Let us assume a manageable dynamical system with desirable states, given by the following components: i. a dynamical system with a state space X, default dynamics represented by a family of default trajectories τ x (t), and some basic topology on X (e.g. the Euclidean topology; see Appendix A1 for more detail); ii. a notion of desirable states represented by an open set X + ⊆ X, called the sunny region, whose complement X − = X − X + we call the dark; iii. a notion of management options represented by a family M x of admissible trajectories µ for each x ∈ X.
We assume that one can switch immediately to any trajectory µ ∈ M x whenever in state x.We say the system floats when it follows a default trajectory, and that we may row the system along any other admissible trajectory.Note that although, formally, we consider deterministic autonomous systems only, non-deterministic systems can be incorporated by considering probability distributions as states, time-delay systems can be treated similarly, and externally driven or otherwise explicitly time-dependent systems can be covered by including time t as a variable with ṫ = 1 into the state vector.Also, if management involves some form of inertia, e.g. if not the propelling vector v of a boat but only its acceleration v can be changed discontinuously, the proper way to model this in our framework would be to treat v as part of the state.

Qualitative distinction of regions with regard to sustainable manageability of desirability
The main idea of the coarsest of our classifications of states is to first identify (i) a safe region where management is unnecessary, called the shelters S, and (ii) a less safe but larger manageable region M where one can permanently avoid the dark at least by management.Then we classify all states with regard to whether and how X + , S, and M can be stably reached from the current state by management.For each state, we ask the following questions.(iii) Can S be stably reached, and if so, can the dark be avoided on the way?(iv) If not, can M be stably reached?(v) If not, can we stably reach X + over and over again, or at least once again?We will see that these criteria lead to a partition of state space into a "cascade" consisting of five main regions: upstream U , downstream D, eddies E, abysses ϒ, and trenches .Each of these will then be split up further into sets such as glades G, lakes L, and backwaters W by asking further qualitative questions.In choosing these figurative terms, we try to avoid a too technically sounding language and rather extend the useful and common metaphor of "flows" and "basins" in a natural way without trying to match their common-language meanings too accurately.
To acknowledge the fact that all real-world dynamics and management will be subject to at least infinitesimal noise and errors, we base the formal definition of these state space regions on certain notions of invariant open kernel, sustainability, and stable reachability, whose symbolic mathematical definitions and algebraic properties are detailed in Appendix A2.

Shelters, manageable region, upstream, and downstream
The invariant open kernel of a set A ⊆ X, denoted A ι Decision tree summarizing the partition of a manageable dynamical system's state space with regard to stable reachability of the desired region or the shelters (main cascade), and the finer partition of the manageable region.The colour scheme (grey undesired regions, green upstream regions, yellow downstream regions, red eddies, and abysses, with lighter meaning better) is also used in the remaining figures.
ries of all its own points.The shelters are the invariant open kernel of the sunny region, S contains all sunny states whose default trajectories stay in the sunny region X + forever without any management even when infinitesimal (or small enough) perturbations occur.In other words, when inside S, one will "stably" stay in X + by default.
We call an open set A sustainable (in the basic sense of the word, simply meaning that it can be sustained) iff it contains an admissible trajectory for each of its points.The sustainable kernel of a set A ⊆ X, denoted A S , is the largest sustainable open subset of A. We call the sustainable kernel of the sunny region the manageable region: In other words, when inside M, one can stably stay in X + by management.
In Appendix A2, we introduce a suitable notion of stable reachability to overcome two problems with the classical notion of (plain) reachability known from control theory.For now, let us assume we know what we mean when saying that a state y or a set Y ⊆ X is stably reachable from some state x through some set A ⊆ X, denoted x A y or x A Y .Using this notion of stable reachability for the choice A = X (other choices of A will be used in the next section), we can now define the upstream U as the set of states from where the shelters S can be stably reached at all.Likewise, the downstream D consists of all states from which the manageable region M but not the shelters can be stably reached: ).As in Fig. 1, humanity can float in and row a boat on a complex waterway.From the upper port city (upper dark-blue region), one can get to some unknown region to the left and to another, nicer port city (lower dark blue) at the shore through a rapid (hatched blue) which cannot be traversed in the other direction.This choice between desirability and flexibility forms a port dilemma.The nicer port city has two harbours (middle blue regions), of which the right one is more desirable, and between which one can switch only through an undesired region where pirates loom (circular area).Boats in the left harbour face the harbour dilemma of choosing between either avoiding the undesired region by all means or eventually reaching a place of higher desirability.Finally, in the left harbour there are two safe docks (light-blue regions), of which the top one is more desirable, and between which one can switch only through an unsafe part of the harbour from which one may be drawn into the undesired region if the engine fails.Boats in the bottom dock face the dock dilemma of choosing between uninterrupted safety and eventual higher desirability.

Trenches, abysses, eddies, and the main cascade
On the other, dark end of what we will call the main cascade, we first define the trenches as that region in the dark from which one cannot stably reach the sunny region even once, (this concept approximately corresponds to the "catastrophe domains" of Schellnhuber, 1998).Now we turn to the region from where one cannot avoid ending up in the trenches.We define the abysses ϒ as the closure of this region, minus the trenches: The closure is taken since even an infinitesimally small perturbation from a point in this closure can make the trenches unavoidable.
Finally, the eddies E are the remainder of X, i.e. the part from where the manageable region cannot be stably reached but the trenches can be avoided: Thus, when in the eddies, even though one can reach the sunny part over and over again, one cannot stay there forever but has to visit the dark repeatedly.
A connected component of , ϒ, or E will be called an individual trench, abyss, or eddy, and the latter two typically have sunny and dark parts.
The system C = {U , D, E, ϒ, } is a partition of X which we call the main cascade because of the following mutual reachability restrictions: In other words, one might at best be able to go in the "downstream" direction by default or by management, from upstream to downstream to the eddies to the abysses to the trenches, but not in the other, "upstream" direction (see also Fig. 2).

2.4
The glades and lake dilemmas, backwaters, and the manageable partition Some of the states in the manageable region M may be in U = ( X S) but not in ( X + S).This motivates the definition of two subsets of M via the relation of sunny stable reachability, X + , namely (i) the glades G, from where the shelters can be stably reached through the sun, and (ii) the lakes L, from where the shelters can be stably reached only through the dark: Glades and lakes are two particularly interesting types of regions since in both one has a qualitative decision problem.The glade dilemma occurs if a glade is for some reason more desirable than its shelter, since then one has to decide whether to stay in the more desirable but unsafe glade or row to the less desirable but safe shelter.The lake dilemma exists in every lake: shall one stay in the sun by rowing over and over again, but risking to float into the dark if the paddle breaks, or shall one move into a shelter, accepting a temporary passage through the dark, to be able to recline in safety eventually?In other words, the lake dilemma is a choice between uninterrupted desirability and eventual safety.Below we will encounter more qualitative dilemmas of this and other types.
While {S, G, L} is a partition of M ∩ U , the downstream D may also contain a manageable part, the backwaters W .This is the region where one may stay in the sun forever by rowing over and over again, but where one may not stably reach the shelters at all, not even through the dark: This completes the manageable partition Also, both U and D may contain points outside M, which we call the dark upstream/downstream, and the remaining sunny upstream/downstream, leading to the upstream and downstream partitions Finally, one can divide the eddies and abysses into sunny and dark parts: All the sets introduced so far are summarized in Fig. 2 in the form of a decision tree that allows for a fast classification of individual states.

Finer distinction of regions with regard to mutual reachability of different types
In addition to the glade and lake dilemmas introduced above, there exist at least three further types of qualitative decision problems, all related to the question of which parts or subregions of the above introduced regions may be stably reached from which other parts, and whether corresponding transition pathways exist that do not leave the shelters or at least the sunny region, or only through the dark.In order to study these questions, we introduce three additional, successively finer partitions derived from the reachability relations X (stable reachability) and X + (stable reachability through the sun) that we used already above, and from the even more restrictive relation S (stable reachability through the shelters).

The ports-and-rapids partition and network, and the port dilemma
While from each state in U , one can stably reach some part of S, one cannot in general navigate freely inside S or U or any other member of the main cascade C. Let us call a maximal region in which one can navigate freely a port (see Appendix A3 for more thorough formal definitions and proofs of the claimed properties).Each port is completely contained in one of the sets U , D, E, ϒ − , , and none can intersect ϒ + , so the notion of ports fits well into the hierarchy of regions that began with the main cascade and the manageable partition.But there are also transitional states not belonging to any port since one cannot return to them.Thus, to extend the system of all ports into a partition of all of X, we also have to classify these non-port states, and we do so by asking which ports they can reach and from which ports they can be reached.States that are equivalent in this sense form what we call a rapid.It turns out that U and D are then partitioned into ports and rapids, and so is each individual eddy, abyss, and trench.The reachability relations between ports and rapids form a directed network that concisely summarizes the overall structure of all management options.
Figure 1 shows the very simple case of a linear network: the whole upstream is one port, the sunny downstream and the adjacent fast-moving part of the dark downstream form a rapid, the backwater and the slow-moving part of the dark downstream form another port, the waterfall is another rapid, the eddy is a port again, and the abyss and the trench are rapids.In the examples below, we will, however, see that much more complex ports-and-rapids networks may occur in models, and one can prove that any acyclic graph may occur as the ports-and-rapids network of some system.
The ports-and-rapids partition is helpful in the discussion of a certain type of dilemma that results from two different objectives which may not be easily balanced: (i) the objective of being in or reaching a state with high intrinsic desirability, e.g. as measured by some qualitative preference relation finer than the mere distinction between "desirable" and "undesirable", or even by some quantitative evaluation such as a welfare function, and (ii) the objective of retaining an amount of flexibility as large as possible by being in or reaching a state from which a large part of state space is reachable.Flexibility may be important in particular in situations in which there is some uncertainty about future management options and/or future preferences (Kreps, 1979).We call this a port dilemma.

The harbours-and-channels partition and network, and the harbour dilemma
Since they do not take into account the definition of the desirable region X + at all, ports and rapids are not directly compatible with the regions from the manageable partition M since their members may overlap in complex ways.However, we can construct a very similar but finer partition based on stable reachability through the sun ( X + ) instead of (plain) stable reachability, restricted to the sunny region, and the result turns out to be compatible with M. A maximal region in which one can freely navigate without leaving the sun is called a harbour.A region of states that do not belong to any harbour but from which the same harbours can be reached through the sun and which can be reached from the same harbours through the sun is called a channel.Since each harbour or channel lies completely in a port or a rapid, the harbours and channels form a finer partition than the ports and rapids and form a finer layer of the reachability network in which the links represent reachability through the sun instead of mere reachability.
The harbours-and-channels partition allows one to identify decision problems involving (i) the objective of staying in a desirable state and (ii) the objective of eventually reaching a state with higher desirability or flexibility, which is called a harbour dilemma here.

The docks-and-fairways partition and network, and the dock dilemma
Note that although the harbours-and-channels partition is finer than that into ports and rapids, there is still one important region that can have nontrivial overlaps with harbours and channels, namely the shelters S. In order to complete our hierarchy of partitions and networks of regions, we therefore introduce a third and finest partition and network level, restricted to S, based on the notion of stable reachability through the shelters, S .
In complete analogy to the above, a maximal region of states that are mutually reachable through S is called a dock, and the non-dock states in S are classified into so-called fairways with regard to their reachability of these docks.Again, each dock or fairway lies completely in a harbour or channel, and they form a third layer of the reachability network whose links now represent the safest form of reachability, namely through the shelters.
Finally, the docks-and-fairways partition is helpful in the discussion of dilemmas involving (i) the objective of staying in a safe state (i.e. in the shelters) and (ii) the objective of eventually reaching a state with higher desirability or flexibility.We call this a dock dilemma.

Summary of the introduced hierarchy of partitions and networks
To summarize, we have now a hierarchy of ever-finer partitions of the system's state space at our hands.We began with the main cascade 2), and the further refinement by topological connectedness into individual shelters, glades, lakes, backwaters, eddies, abysses, and trenches.These partitions represent the qualitative differences in stable reachability of the shelters or the manageable set, thus allowing for a first classification of states with regard to the possibilities of sustainable management, and may reveal decision problems of the type of glade or lake dilemma which will occur in many of the examples below, where one has to choose between higher safety and higher desirability or flexibility or between uninterrupted desirability and eventual safety.
A different refinement of C into the ports-and-rapids network is still based on stable reachability alone but contains other details suitable for the identification and discussion of possible port dilemmas that involve a choice between higher desirability and higher flexibility.Inside the desirable region X + , this partition can be refined into the harboursand-channels network suitable for the discussion of harbour dilemmas that involve a choice between uninterrupted desirability and eventually higher desirability or flexibility, and further into the docks-and-fairways network suitable for the discussion of dock dilemmas that involve a choice between uninterrupted safety and eventually higher desirability or flexibility (Table 1).
These three networks may also be interpreted as a threelevel "network of networks" with nodes representing state space regions of different quality and size.A networktheoretic analysis of it using methods such as the nodeweighted measures of Heitzig et al. (2012) may especially be interesting in the context of varying system parameters and bifurcations such as those in Fig. B2, but this is beyond the scope of this article.

Examples
In this section, we will apply the introduced framework to several illustrative examples from natural and coevolutionary Earth system modelling, ecology, socio-economics, and classical mechanics.The examples have been chosen not for their realism but for their simplicity in order to show the broad scope of potential applicability of our concepts, as well as the relevance of the identified types of decision dilemmas in both the natural and socio-economic components of the Earth system.

Carbon cycle and planetary boundaries
Our first example is from natural Earth system modelling and illustrates which of the above-introduced regions occur most often for systems that possess only a single, globally stable, and desirable attractor.Anderies et al. (2013) proposed a conceptual model of the global carbon cycle capturing its main features while keeping the model sufficiently low-dimensional to be able to discuss the planetary boundaries concept with it.We use their model for pre-industrial times, which has three dynamical variables c m , c t and c a = 1 − c m − c t representing the maritime, terrestrial, and atmospheric shares of the fixed global carbon stock.The dynamics are of the form where a m and β are diffusion parameters, f is a function representing photosynthesis and respiration, and α governs the human offtake rate from the terrestrial carbon stock.See Anderies et al. (2013) for details and parameter values.
Since the parameter α can be considered the natural human management option for this system, we assume the default flow has a value of α = α + = 0.5, while management can reduce it by half to α = α − = 0.25, which results in the trajectories shown in Fig. 4.Both have a unique stable fixed point in the interior of the state space which is globally attractive for all states with c t > 0.
In order to roughly represent the planetary boundaries relating to climate change, biosphere integrity, and ocean acidification (Rockström et al., 2009b;Steffen et al., 2015), we require a "sunny" state to have sufficiently low atmospheric carbon, at least a minimum value of terrestrial carbon, and not too large maritime carbon, leading to a dark region of the shape shown in Fig. 4 in grey.If, as shown, the unmanaged fixed point is sunny, one obtains a purely upstream situation with a shelter surrounding the fixed point, a glade, and a remaining sunny upstream U (+) as shown in the figure.For our (quite arbitrarily) chosen parameter values, a trajectory starting in the sunny upstream is likely to first cross the climate boundary and then the biosphere boundary before getting back into the sunny region, whereas it seems quite unlikely to cross the acidification boundary.
In this example, all non-upstream regions are empty, and so is the lake region; hence, no lake dilemma occurs.On the other hand, if one considers a higher c t to be preferable, we get an example of the glade dilemma since the managed fixed point in the less safe glade has higher c t than the unmanaged fixed point in the safer shelter.Note that this is neither a port, harbour, or dock dilemma since both points are in the same port and harbour and only the unmanaged one is in a dock.
If, instead, we had chosen the minimum value for c t to be larger than the unmanaged equilibrium value, the shelter would be empty and the whole situation would change from upstream-only to either a downstream-only or an abyss-andtrench situation.This type of topological bifurcation will be studied in Sect.3.4.In the next example, we will see a lake dilemma instead of a glade dilemma.

Competing plant types and multistability
The second example, from ecology, demonstrates how the lake dilemma may occur in a multistable system with a sunny and a dark attractor.
In this fictitious example, two plant types (1 and 2) compete for some fixed patch of land, modify the soil, and are harvested.Their growth follows logistic-type dynamics, with land cover proportions x 1,2 ∈ [0, 1] following the equations In this, r > 1 is a constant productivity quotient, h 1,2 are the harvest rates, and the two dynamic capacities ) 1 represent the fact that each type modifies the soil quickly to its own benefit but to the other type's disadvantage (see Supplement 1 for a discussion of the model design based on Bever (2003), Kourtev et al. (2002), Kulmatiski et al. (2011), Levine et al. (2006), Poon (2011), andRead et al. (2003).
For our illustration, we assume that, on the default trajectories, both harvest rates h 1,2 equal some rather high value h + , leading to low equilibrium harvests.We assume management can repeatedly choose between this default and two types of alternative trajectories.Type 1 has a lower value for both harvest rates, h 1,2 = h − < h + , representing management by restricting harvests politically in order to yield higher longterm harvests, but without aiming to change the plant mix, as depicted in Fig. 5 (left panel).Type 2 management option has harvest rates h 2 = 0 and h 1 = 2h + , representing management by temporarily protecting type 2 in order to change the plant mix to the higher productivity plant; we assume that this moratorium results in more intense harvesting of type 1, as depicted in Fig. 5 (right panel).We assume that both options exist simultaneously at all times (the separate plots of Fig. 5 are only for better discernibility of the trajectories).We set the desirable region to where x 1 + x 2 > for some > 0 in order to ensure some minimum harvests.
For the choice r = 2, h + = 0.2, h − = 0.1, = 0.65 of the figure, the desirable high-productivity stable fixed point of the default dynamics at ≈ (0, 0.79) is in the sunny region and is thus contained in a shelter S. The latter is delimited by the default trajectory that meets the boundary to the undesired region tangentially.S can be stably reached from all states with x 2 > 0, and hence the upstream is U = {(x 1 , x 2 )|x 2 > 0}.The border of the glade G next to S can be found by backtracking the "widest" admissible trajectory that meets the boundary to the undesired region tangentially; this turns out to be a type 2 management trajectory as seen in Fig. 5 (right panel).This shows how the boundaries of regions may often be found by identifying tangential or otherwise significant points and backtracking the default and alternative trajectories leading to them.
The lower-productivity stable fixed point of the default dynamics (with h 1,2 = h + ) at ≈ (0.52, 0) is undesired for this choice of X + .From it one cannot only navigate to S but can also (and faster) get to the higher productivity stable fixed point of the first type of managed dynamics with h 1,2 = h − , at ≈ (0, 0.79), and stay there as long as management holds.Hence the region around (0, 0.79) is part of the manageable region M. The exact boundary of this region (which soon turns out to be a lake, L) is the "widest" admissible trajectory that meets the boundary to the undesired region tangentially; in this case, this trajectory turns out to be a type 1 management trajectory as seen in Fig. 5 (left panel).To get from this type 1-dominated region to the type 2-dominated shel-ter S via the other management option of protecting type 2, one has to cross the undesired middle region in which both types coexist at a low level due to soil conditions that are suboptimal for both types.Hence the region around (0, 0.79) is a lake.The associated lake dilemma is similar to a glade dilemma in that staying in a lake is unsafe as in a glade, but it differs in the reason why one may want to stay there: while staying in a glade may be attractive simply because the glade may be more desirable than the shelter in some quantitative sense, staying in a lake may seem attractive since that avoids having to pass through the dark to reach safety.
This form of the lake dilemma can also occur in other multistable systems when one of the attractors is in the dark but sufficiently close to the sunny region so that constant management can sustain the system in a sunny place near that attractor, and when other management options may push the system towards another, sunny attractor after crossing the dark.
Note that, in this example, the lake dilemma falls together with a port dilemma since after leaving the lake for the shelter, one cannot return.If we choose a slightly larger sunny region by lowering to = 0.45, the unmanaged fixed point with y = 0 gets into X + and the former lake around it now becomes a second shelter, which might be called a shelterlake transition.But from this shelter the other, more desirable shelter can still only be reached through the dark.Since the two shelters correspond to two harbours in the reachability network, this means the former lake dilemma has been converted into a harbour dilemma.
. Substitution of a dirty technology.Coevolution of the cumulative production of a dirty technology (x 1 ) and a clean one (x 2 ) without (pale-blue curves) and with (dotted dark-blue curves) a subsidy for the clean technology.Undesired region with too high future usage of the dirty technology coloured in grey.Knowledge stocks x 1,2 were transformed to z 1,2 = x 1,2 /(0.3 + x 1,2 ) in order to capture their divergence to +∞.
The example also shows that the more management options exist, the less trivial it is to find the boundaries between regions even in two-dimensional systems.For higher dimensions, one will usually have to rely on specialized numerical algorithms such as the viability kernel algorithm of Frankowska and Quincampoix (1990) from viability theory.

Substitution of a dirty technology
Our third example concerns a purely socio-economic part of the Earth system that bears some similarity to the preceding example but features regions from both ends of the main cascade: upstream and abyss/trench, without having the intermediate regions of downstream and eddies.
Instead of plants, in this example a certain produced good (e.g.electric energy) comes in two types which are economically perfectly substitutable but whose production processes use two different technologies -one "dirty" and one "clean" (e.g.conventional and renewable energy).The production costs C 1 and C 2 are convex functions of production output per time y i and decrease over time via learning-by-doing dynamics that are similar to Wright's law (Nagy et al., 2013): In this, x i is cumulative past production (with ẋi = y i ), γ i are cost factors, σ i > 0 are convexity parameters, and α i > 0 are learning exponents.We assume that demand D depends linearly on price, D(p) = D 0 − δp, δ > 0; that demand equals production, D = y 1 + y 2 ("market clearance"); and that price equals marginal costs, p = ∂C/∂y i = γ i y σ i i /x α i i , due to perfect competition among producers.One can then uniquely solve for the produced amounts y i , getting some formula y i = f i (x 1 , x 2 ).This results in a two-dimensional dynamical system with state variables x 1 , x 2 and equations ẋi = f i (x 1 , x 2 ) .
The main dynamical difference to the plant example is, however, not the diverging behaviour, but has to do with the choice of management options.While in the plant example, the choice of management options led to an upstream-only situation in which the more desirable fixed point could be reached from everywhere, in this example we will get regions from which the desirable fixed point cannot be reached and which are thus non-upstream.We consider the management option of lowering γ 2 to a value of, say, 1/2 by subsidising the clean technology to induce a technological change (Jaffe et al., 2002;Kalkuhl et al., 2012).This leads to the alternative dynamics depicted in Fig. 6, showing that for some initial states with x 1 > x 2 one can now get x 2 (t) → ∞ and y 1 (t) → 0. The goal of keeping the usage of the dirty technology below some limit, y 1 < < 1, corresponds to a desirable region in terms of x 1 , x 2 , whose border can be computed as x 1 ) 2/5 (see Fig. 6).That goal is automatically fulfilled in the top-left shelter region, can also be sustained by management (subsidies) in the glade region below it, and can at least be reached eventually from the remaining sunny upstream U (+) below the glade and from the dark upstream U − , which is delimited by the management trajectory that meets the upper right corner.
But from below the latter trajectory, the shelter cannot be reached.In other words, when in U − , one has to act fast in order not to lose the option of reaching S. From the dark part denoted , not even the sunny region is reached, and hence that region is a trench, while the sunny part to its left is the abyss leading to that trench.There are no intermediate regions (downstream or eddies) between upstream and abyss in this example.
coupled with a socio-economic Earth system component and shows how different parameters may qualitatively move the resulting state space topology through the whole main cascade, from an upstream-only situation via downstream-only and eddies-only to an abyss-and-trench situation.
The model was used in Brander and Taylor (1998) to explain the rise and fall of the native civilization on Rapa Nui (Easter Island) before western contact, but it may also be interpreted as a conceptual model of global populationvegetation interactions.It is derived from simple economic principles and leads to a modified Lotka-Volterra model with a finite resource.The human population x is preying on the island's forest stock y, which itself follows logistic growth dynamics: for some parameters γ , δ, κ, φ, and r representing growth and harvest rates and the stock's capacity.
We assume management will either reduce the default harvest rate γ 0 to some smaller value γ 1 < γ 0 to avoid overexploitation of the resource or increase it to a larger value γ 1 > γ 0 to avoid famine.Our choice of the sunny region relies on two principles.The absolute population should not drop below a threshold x min and the relative decline in population under the default dynamics, − ẋ/x, should not exceed a value of .Hence X + = {x > x min and y > y min = max(0, −( + δ)/φ γ 0 )}.
The resulting state space partition is depicted in Fig. 7 for φ = 4, r = 0.04 and different choices of γ 0 , γ 1 , δ, κ, x min , y min .One either gets an upstream-only situation, a downstream-only one, an eddy-only one, or an abyss-andtrench situation, depending on whether the unmanaged and www.earth-syst-dynam.net/7/21/2016/Earth Syst.Dynam., 7, 21-50, 2016 managed fixed points belong to the desired or undesired region.In Appendix B2, these kinds of transitions are more formally interpreted as bifurcations.
An interesting case occurs when the whole state space is a single eddy as in Fig. 7 (bottom-left panel): one can then repeatedly visit the sunny region by suitably switching between a low default harvest rate and a managed higher harvest rate, but one cannot avoid getting back into the undesired region of a low or fast declining population.An "optimal" management strategy would then lead to slowly but strongly oscillating behaviour.

Gravity pendulum fun ride
While in the above examples typically only some of the possible regions were non-empty for each parameter combination, the following example from classical mechanics displays a rich diversity of state space regions that coexist at a single choice of parameter values.Despite extremely simple dynamics, it features both a glade and a lake dilemma, an eddy, and a trench at the same time.
In the model, people sit in a fun ride resembling a gravity pendulum with angle θ and angular velocity ω and default dynamics given by θ = ω, ω = − sin θ.
An optional additional clockwise acceleration of the pendulum of magnitude a > 0 ("management") leads to alternative admissible trajectories on which for some time interval(s) one has ω = − sin θ − a.The sunny region is where |ω| < , for some > 0 representing a safety speed limit above which people might get sick.
The unique shelter S is delimited by the default trajectory leading through the points θ = 2kπ , ω = ± that surrounds the stable resting state of θ = ω = 0 (see Fig. 8).If a state lies on a default trajectory that has ω > 0 (anticlockwise pendulum motion) at least some of the time, then there is an admissible trajectory from it leading into the shelter, generated by the management strategy of "braking" whenever ω > 0. Hence the upstream U equals the region strictly above the default trajectory with ω < 0 that connects the unstable saddle point at θ = (2k + 1)π , ω = 0 (pendulum balancing upright) with itself.
Just left of the shelter is the unique glade G. Depending on the parameter values, the stable fixed point of the managed dynamics (hanging pendulum inclined by constant acceleration) may either belong to the shelter or to the glade.In the latter case (Fig. 8), we have a glade dilemma since the inclined position is preferred to the resting position by the riders but is unsafe since if the engine breaks, people will get sick.
An even more exciting position is close to the upright balancing saddle point, at θ slightly larger than (2k + 1)π and ω 1, where there is an admissible trajectory that stays close to there (by braking repeatedly for short intervals while staying almost upright), so that this point is in the manageable region M.This is a typical example of how a region close to a saddle point of the default dynamics may become manageable due to an alternative feasible trajectory that has a slightly shifted saddle point, so that in the diamond-shaped region between the two saddle points, one can concatenate unmanaged and managed trajectories into periodic orbits.
However, for choices such as a = 0.6 and = 0.5 (Fig. 8), there is no admissible trajectory leading from the exciting region with θ ≈ (2 k + 1)π , ω ≈ 0 into the shelter without entering the region with |ω| > .In that case the diamondshaped region is a lake and we have a lake dilemma.
Finally, the region below and including the default trajectory that touches the line ω = − from below is the trenches since one cannot brake in that direction, and the region between the trench and the upstream is the eddies.Downstream and abysses are empty in this example.

Bifurcations with manageable parameter
This final example system is designed to illustrate the relationship of reachability and bifurcations of a dynamical system that can be managed through a parameter and shows bifurcations of the type typically associated with tipping elements of the Earth system (Schellnhuber, 2009).
It has a two-dimensional state space X = {(r, y)}, where the "fast" variable y ∈ R has default dynamics which cannot be managed directly, and r ∈ R is a "slow" variable with (approximately) no default dynamics (ṙ = 0) Earth Syst.Dynam., 7, 21-50, 2016 which, however, can be changed by management up to a velocity at most 100 and with arbitrarily large acceleration, leading to admissible trajectories with ṙ ∈ [−100, 100] and ẏ = h(y|r).We assume that values of y −1/3 are undesirable.
If r is instead interpreted as a parameter of the onedimensional system ẏ = h(y|r), the set X can be interpreted as its bifurcation space in which one can plot a bifurcation diagram consisting of the loci of stable (solid lines) and unstable (dotted lines) fixed points, as shown in Fig. 9.As one can see, there are three saddle-node bifurcations at r 1 ≈ −2.2, r 2 ≈ 1.735, and r 3 ≈ 4.9 with monostable parameter regimes r 1 < r < r 2 and r > r 3 , and bistable parameter regimes r < r 1 and r 2 < r < r 3 .Individual and paired saddle-node bifurcations (which often result from fold bifurcations) occur frequently in bistable Earth system components such as the hysteretic thermohaline circulation (Stommel, 1961;Rahmstorf et al., 2005), monsoonal soil-vegetation feedbacks (Janssen et al., 2008), or other tipping elements (Schellnhuber, 2009).Hysteresis also occurs on other spatial and temporal scales, e.g. in local hydrology (Beven, 2006) and in long-term glacial climate dynamics (Ganopolski and Rahmstorf, 2001).
The main part of the resulting network of ports and rapids of our example system is depicted in Fig. 10.On its coarsest level, there are two ports, each containing one of the two connected loci of stable/unstable fixed points, and a rapid in between through which one can pass from the left to the right port but not back.If the right port seems more attractive, e.g. because it allows a higher value of y, we have a port dilemma since by leaving the left port for the right one, we lose flexibility in terms of reachable regions.
The right port contains two harbours, similarly connected by a narrow "internal" channel, as well as another "exit" channel leading from the right harbour to the dark region.Note that on the leftward-pointing dashed management trajectory in the middle of the bifurcation diagram, there is a leftmost point from where one can still "turn around" and reach (if only unstably) the right part without entering the dark region; this point is a corner of the right harbour (but not belonging to it, for stability reasons), and below it is a channel leading to another harbour in the bottom left.Again, if the right harbour seems more attractive, we have a dilemma, this time a harbour dilemma, since in order to reach the right harbour from the left one, we have to pass through the dark.
Finally, the right harbour contains two docks again connected by a fairway, plus some more fairways.Again, we get a dilemma if the top-right dock is more attractive than the top-left one: the dock dilemma is that, in order to reach the top-right dock from the top-left one, one has to pass through the unsafe middle region and risk ending up in the dark if management breaks down.

Discussion and conclusions
We have presented a formal classification of the possible states of a dynamical system such as the Earth system into regions of state space which differ qualitatively in their safety, the possibilities of reaching a safe state, the possibilities of avoiding undesired states, and in the amount of flexibility for future management.
Based on an assumed main division of the system's states into only two classes, desirable ("sunny") and undesirable ("dark"), we have constructed a hierarchy of partitions of a system's state space, whose member regions we suggested to name by metaphorical names either corresponding to the general image of a boat floating or rowing on a complex water system, such as "upstream", "downstream", "eddy", "abyss", "trench", "lake", and "backwater", or corresponding to the image of a "shelter" surrounded by a "glade".To capture the nature of and relationships between the different regions, we have introduced the notion of stable reachability and the corresponding three-level reachability network of "ports", "harbours", "docks", "rapids", "channels", and "fairways", and illustrated our concepts with conceptual example models from climate science, ecology, coevolutionary Earth system modelling, economics, and classical mechanics.Most of the different regions can readily be found in most models for either most or at least selected parameter settings.A notable exception is the "eddies", which, due to their circular nature, can be expected to occur much more rarely in realworld, non-conservative systems, especially when thermodynamic or otherwise irreversible processes are involved, such as soil degradation.Section 3.4, however, illustrates how eddies may occur in coevolutionary systems and might incentivize management cycles that lead to undampened periodic www.earth-syst-dynam.net/7/21/2016/Earth Syst.Dynam., 7, 21-50, 2016 ups and downs.It must remain an open question here whether this effect might be an additional explanation for empirically observable cycles such as business or resource cycles when management is involved.The introduced concepts have then been used to point out a number of qualitatively different decision problems: the glade, lake, port, harbour, and dock dilemmas.In our opinion, one particularly nasty form of decision problem is the lake dilemma, where one has to choose between uninterrupted desirability and eventual safety, and Sect.3.2 indicates that this dilemma may easily occur at least in ecological systems or other multistable systems with a sunny attractor and another one slightly in the dark.Since the transformation of socio-metabolic processes or complex industrial production systems may resemble the soil transformation of Sect.3.2, one may also expect the lake dilemma to occur in the sociometabolic and economic subsystems of the Earth, e.g. in the context of a great transformation leading to decarbonisation of the world's energy system.The form of lake seen near the saddle point in the pendulum (Sect.3.5) can also occur in other nonlinear oscillators, e.g. the Duffing oscillator or models of glacial cycles that resemble it such as Saltzman et al. (1982) and Nicolis (1987), when a management option exists that has a slightly shifted saddle point.This indicates that the lake dilemma may also occur in purely physical subsystems of the Earth system.
We argue that our concepts may be especially useful in the context of the current debate about planetary boundaries (PBs), a possible safe and just operating space (SAJOS) for humanity, and the necessary socio-economic transitions to reach it or stay in it.We suggest that the region delimited by some identified set of PBs in the sense of Rockström et al. (2009a) and Steffen et al. (2015) and some similar socioeconomic limits, e.g.those relating to the United Nations sustainable development goals (Raworth, 2012), should be interpreted in our framework as a natural choice for the desirable region X + , although their definitions already contain some reasoning about the consequences for the respective subsystems when the boundaries are violated.Such boundaries might be called the ultimate planetary boundaries (UPBs), and they are typically defined by some simple thresholds for relevant indicators as in Rockström et al. (2009a) and Steffen et al. (2015), not taking into account the overall system's inherent dynamics much.In this sense, UPBs are typically "non-interacting".Based on the UPBs, one may then try to identify one or more smaller shelter regions S that can be considered a SAJOS in the sense that, once there, no further large-scale management in the form of global policies is necessary to stay within the limits for all times (or at least for a sufficiently long planning horizon).The borders of these shelters are also a form of PBs but are much more restrictive than the UPBs we started with, and we suggest to call them safe planetary boundaries (SPBs).
If it turns out that the current state of the Earth is outside the shelters, one should then aim next at trying to decide whether it is in the upstream.If so, knowledge about whether it is in a glade or lake or not, and which safe docks can be stably reached, will be necessary in order to choose a management path.In the glade case, one can still reach the shelter without ever violating the UPBs by appropriate management; hence we suggest to refer to the border of shelters and glades together as the provident planetary boundaries (PPBs).
In the lake case, one has to decide instead whether a temporary violation of the UPBs can be justified by the eventual safety of the shelters.In addition, a port dilemma may necessitate a decision between higher desirability and higher flexibility at this point.Only after these qualitative decisions have been made does it seem advisable to optimize the chosen type of management pathway by means of more traditional control and optimization theory, hopefully using accurate enough quantitative estimates of the involved options, costs, and benefits.Once in the shelters, one may start caring about improving the state further by moving between docks to either improve desirability or flexibility, but this may require a risky temporary passage through a sunny but unsafe region (which poses a dock dilemma) or even a passage trough the dark (which poses a harbour dilemma).Of course, many combinations of these qualitative and quantitative criteria may appear in the actual global decision process, e.g. in the form of lexicographic preferences, decision trees, or more sophisticated welfare measures or other quantitative objective functions that take the topology suitably into account and that may relate to some form of market (or other game-theoretic) equilibrium or else be governed by some suitable policy instruments, as kindly suggested by an anonymous referee.
If we are not in the "upstream" of the Earth system, prospects are worse.Violating the limits can then only be avoided by management, either eventually forever (if in the downstream), or only repeatedly but with repeated violations occurring (if in the eddies), or even only for a limited time with an ultimate descent into the undesired region (if in the abysses or already in the trench).We suggest to call the upstream borders the no-regrets planetary boundaries (NRPBs).
If the diagnosis reads "eddy", "abyss", or "trench", one may repeat the analysis with a less ambitious, "second best" definition of the desirable region by choosing less restrictive UPBs, or revert to quantitative optimization, e.g. to minimize some damage function along the system's trajectory.On the other hand, as long as one is in the "manageable region" M (shelters, glades, lakes, and backwaters), the UPBs need never be transgressed if managed wisely; hence we propose to call the borders of M the foresighted planetary boundaries (FPBs).
This completes our suggested hierarchy of PBs from the relatively looser UPBs via the successively narrower FPBs and NRPBs, then the PPBs, to the narrowest SPBs that define the SAJOS.While UPBs are "non-interacting", FPBs, PPBs, NRPBs, and SPBs will typically have a more complex geometry in the system's state space and are thus "interactwww.earth-syst-dynam.net/7/21/2016/Earth Syst.Dynam., 7, 21-50, 2016 ing boundaries".This means that they cannot be expressed as a simple "threshold" for individual indicators but as conditional thresholds for several indicators that depend on each other as shown by the curved region boundaries in the examples, e.g. in the carbon cycle model of Anderies et al. (2013) in Sect.3.1.Obviously, the real world is less black and white than suggested by the idealized division into "desirable" and "undesirable", so the actual location of these bounds will in reality be somewhat vague, but this does not change the fact that the different bounds and regions represent qualitatively different states of the system, not just quantitative shades of grey.
It should be noted that one strategy to decide the dilemmas described throughout this work is to follow certain "sustainability paradigms" such as those suggested by Schellnhuber (1998).For example, the "pessimization paradigm" is based on the basic precautionary principle of "avoiding the worst" and, hence, can be interpreted as suggesting to stay in or aim for the shelter.In this way, the "pessimization paradigm" decides the glade and lake dilemmas in favour of safety.In turn, the "optimization paradigm" could be interpreted to decide all but the harbour dilemma in favour of uninterrupted or (eventually) higher desirability.The "stabilization paradigm", which seems to fit best the popular notions of "sustainable development", reflecting a "longing for stable equilibria" in the coevolutionary dynamics of human societies and the biophysical Earth system (Schellnhuber, 1998), might imply staying in a lake favouring uninterrupted desirability over eventual safety in the sense of this work.Finally, the "equitization paradigm" might imply choosing higher flexibility, e.g. in terms of a larger set of remaining options for future generations in the sense of intergenerational justice, in all dilemmas but the lake dilemma.As also argued by Schellnhuber (1998), the remaining "standardization paradigm" is entirely based on static choices of norms or development corridors instead of dynamical systems or "geocybernetic" principles and, hence, cannot directly decide any of the dilemmas.However, this paradigm can be viewed as a way for identifying desirable domains in the Earth system's state space in the first place and, thereby, facilitate a subsequent topological classification of state space structure.
Contemplating sustainability paradigms gives rise to other relevant qualitative decision problems.For what might be called an "optimization/pessimization dilemma", consider the debate on geoengineering by solar radiation management (Lenton and Vaughan, 2009;Vaughan and Lenton, 2011) as a strategy for averting some of the consequences of global climate change that are induced by anthropogenic emissions of greenhouse gases (Stocker et al., 2013).According to the recent update of the planetary boundary framework by Steffen et al. (2015) and the corresponding definition of desirability (see Sect. 1.1, "Metaphorical framework"), the Earth system is currently in the dark region of its state space, because core planetary boundaries such as those related to climate change and biosphere integrity have likely already been transgressed.
Following current assumptions on the feasibility of management options (IPCC, 2014), assume further that the Earth system is currently in the dark upstream.In this situation, efforts for mitigation of greenhouse gas emissions, e.g. by means of global energy market regulations, as well as conservation and restoration of biosphere integrity, would correspond to navigating the Earth system from the dark upstream towards the shelters following the "pessimization paradigm".In turn, massive investments in solar radiation management as an alternative to mitigation could be seen as manoeuvring the Earth system into the glades or lakes going along with a severe loss of resilience, since interruption of these efforts due to global crisis or technological failure would lead to very rapid and catastrophic climate change (Barrett et al., 2014).In short, starting in the dark upstream, does one choose to navigate to a glade or lake because this appears economically cheaper on the shorter term or politically more feasible ("optimization paradigm") or does one aim for the shelters right away, even if this is more expensive on the shorter term ("pessimization paradigm")?Note, however, that geoengineered Earth system states within the glades or lakes would be expected to have a considerably reduced desirably in the long-term compared to the shelters, since current proposals for solar radiation management can only control a very small set of Earth system properties such as global mean temperature, while regional temperature patterns and the hydrological cycle would change strongly (Kleidon and Renner, 2013;Kleidon et al., 2015), going along with corresponding climate impacts.
We hope that the theoretical considerations outlined here may be of some help to sharpen the important debate of how a transition to a safe desirable state of the Earth system can be managed.To this end, future studies should apply the proposed framework for comparing different Earth system governance strategies in the form of various management options (e.g.mitigation of greenhouse gas emissions vs. geoengineering) and different notions of desirability (e.g.resemblance of a Holocene-like state or satisfaction of a certain standard of human well-being) in terms of their feasibility and resilience.Furthermore, the structural stability of future development pathways generated by integrated assessment models through optimizing utility functions based on certain notions of human well-being could be evaluated.For achieving these aims, performant computer algorithms need to be developed for automatically generating the proposed topological charts also for higher-dimensional Earth system models given a set of management options and desirability criteria, e.g.building on algorithms from viability theory (Frankowska and Quincampoix, 1990), the graph-theoretical analysis of phase space transition networks (Padberg et al., 2009), and flow networks from fluid dynamics (Ser-Giacomi et al., 2015;Froyland and Padberg-Gehle, 2015).While the examples discussed in this work have been limited to two dynamical variables for facilitating the visualization of the corresponding topological charts, investigation of more detailed models of Earth system dynamics calls for advanced visualization techniques (Nocke et al., 2015) as well as the application and further development of quantitative measures of the size (Menck et al., 2013;Hellmann et al., 2015;van Kan et al., 2015) and shape (Mitra et al., 2015) of the phase space regions of interest.The fact that the introduced state space partitions depend on qualitative rather than quantitative properties of states may also make them a natural tool for the analysis of complex but qualitative or "generalized" models in the spirit of Kuipers (1994) and Petschel-Held et al. (1999) or Lade et al. (2013Lade et al. ( , 2015b, a), a).

Appendix A: Formal derivation of partitions and properties
We use sloppy set theoretic notation when no confusion arises: union A + B = A ∪ B, difference A − B = A B, power set 2 A = {B ⊆ A}.Proofs only require an understanding of general topological spaces, in particular of openness and continuity, but not of any higher-level concepts from differential topology or the like.

A1 Assumptions and notation
For a more formal treatment than in the main text, we assume a manageable dynamical system with desirable states, made of the following ingredients.
A state space X = 0 with some Hausdorff topology T ⊆ 2 X (i.e. a system of open sets that separate each two points) on it whose elements we call states or points (e.g.X ⊆ R n with Euclidean topology).X may be compact or unbounded, finite-or infinite-dimensional, etc.
A flow (i.e.deterministic continuous-time autonomous dynamical system) on X (e.g. a model of human-nature coevolution or any other Earth system model) given by a family of continuous ("business-as-usual" or) default trajectories τ x : [0, ∞) → X with τ x (0) = x and τ τ x (t) (t ) = τ x (t + t ) for all initial conditions x ∈ X and all relative time points t, t 0. We do not require further smoothness properties of the flow, like differentiability, to avoid having to assume a richer topological structure for X than just a general topological space, and to avoid unnecessarily complicated notions and familiarity with, for example, differential geometry.Although flows are often represented by ordinary differential equations, their solutions are sometimes not unique, and hence our notion of flow is in terms of trajectories instead so as to allow us to distinguish, for example, a 1-D flow with ẋ = √ x and τ 0 (t) ≡ 0 from the flow that also has ẋ = √ x but τ 0 (t) = t 2 /4.
An open nonempty set X + ∈ T of desirable states, called the sunny region, e.g.defined by means of some notion of "tolerable E & D window" (Schellnhuber, 1998).We call the complement X − = X − X + = 0 the dark (region).We require openness for convenience so that infinitesimal perturbations cannot lead from the sunny to dark part, and trajectories cannot touch the sunny region without entering it for a strictly positive amount of time.Although in most of our examples, X + is a simply shaped, connected, convex, and often bounded set, none of these properties is required for the theory presented here except topological openness.
To represent "management options", a family of nonempty sets M x of admissible trajectories from each x ∈ X that includes τ x and is closed under switching between trajectories at any time, i.e. if µ ∈ M x , t > 0, x = µ(t), and µ ∈ M x , then the trajectory defined by µ (t ) = µ(t) for t t and µ (t ) = µ (t − t) for t > t is also in M x .This requirement corresponds to the so-called semigroup axiom of math-ematical control theory (Sontag, 1998).Note that we do not allow any explicit time dependency of flow or management, but such dependencies can as usual be encoded by including time as a state variable.Also, if management can change a parameter of the model, that parameter has to be transformed to a (slow) state variable with zero default dynamics of its own to meet our framework.

A2 Open invariance, sustainability, and stable reachability
The invariant open kernel of a set A ⊆ X, denoted A ι• , is the largest open subset of A that contains the default trajectories of all its own points.Its existence and uniqueness is nontrivial and will be proved below.Note that A ι• may be empty.Each (topologically) connected component of S = (X + ) ι• is called an individual shelter.
We call an open set A ∈ T sustainable iff, for all x ∈ A, there is µ ∈ M x with µ(t) ∈ A for all t 0. Again, the openness requirement ensures a minimal form of stability against small perturbations.The sustainable kernel of a set A ⊆ X, denoted A S , is the largest sustainable open subset of A. Again, existence and uniqueness will be proved below.In viability theory (Aubin, 2001), A S roughly corresponds to the "viability kernel" of A (see the discussion in Supplement 3).Also, A S may be empty.

Lemma 1 (Existence and uniqueness) For all A ⊆ X:
1.There is a unique largest (default-trajectory-) invariant and open subset A ι• ⊆ A, containing all other such sets.

Every invariant and open set is sustainable. In particular, S is.
3. There is a unique largest sustainable subset A S ⊆ A with A S ⊇ A ι• , containing all other such sets.Proof.
1. Let I(A) be the system of all open subsets B ⊆ A for which τ x (t) ∈ B for all x ∈ B, t > 0. The proposition is proved by showing that I(A) is a kernel system, i.e. contains the empty set (which is trivial) and contains the union B of any of its subsets B ⊆ I(A).The latter follows from the fact that the system of all open sets, T , is a kernel system by definition, and if x ∈ B, then x ∈ B ∈ B, and hence τ x (t) ∈ B ⊆ B for all t > 0. Now A ι• = I(A) ∈ I(A).
2. This follows because τ x ∈ M x .
3. Similarly, the system S(A) of all sustainable subsets B ⊆ A is a kernel system: if x ∈ B, then x ∈ B ∈ B, and hence there is will be called an individual trench, abyss, or eddy, and the latter two typically have sunny and dark parts.Some further properties of these introduced partition sets are as follows.
1. U = ( X S) and the union D open, and the system {U , D, E, ϒ, } forms a partition of X.

Proof.
1. Openness follows from Proposition 1, the partition covers X by definition of E, and the only nontrivial disjointness is that between the open set D + U = ( X M) and the closed set ϒ + = {x ∈ X|∀µ ∈ M x ∃t 0 : µ(t) ∈ }.If x is in both sets, there is also x ∈ ( X M) ∩ {x ∈ X|∀ µ ∈ M x ∃ t 0 : µ(t) ∈ }, but then there is µ x ∈ M x , t > 0 with µ x (t ) ∈ M, and by definition of M there is then also some µ ∈ M x with µ(t) ∈ X + for all t t .But, by assumption, there is t 0 with µ(t) ∈ .Since ∩ X + = 0, we have t < t , but by definition of , this contradicts µ(t ) ∈ X + .Hence such an x cannot exist.Since the latter is closed, its complement is open, so there is µ ∈ M y and t > 0 with µ(t) ∈ ϒ + .For x = µ(t), we find µ ∈ M x and t > 0 with µ (t ) ∈ for all t > t .Concatenating µ with µ gives a similar member of M y , in contradiction to y ∈ .Finally, if θ X y and θ ∈ , then y ∈ by definition of , and hence y ∈ ϒ.

This follows from (
Note that in the (pathological) no-management case in which M x = {τ x }, the upstream U = ( X S) is basically (i.e. up to boundary effects due to our openness requirement) the basin of attraction of S, the downstream D = ( X M) − ( X S) is then empty, the trenches basically equal the invariant kernel of X − , the abysses basically equal the rest of the basin of attraction of the trenches, and the eddies are basically the union of those trajectories that will forever alternate between X + and X − .In that case, some of the finer regions may coincide or be empty as well, and one can also represent their relationship by means of symbolic dynamics (beim Graben and Kurths, 2003): assign each state x a symbolic sequence representing the sequence of its trajectory's transitions between the sunny (+) and dark (−) regions, and use the wildcard * to denote repetitions of zero or more symbols.Then (up to peculiarities that may occur for boundary states) To formally define the ports-and-rapids partition, we say that a set P ⊆ X is portish iff it has x X y for all x, y ∈ P ; is topologically connected; and does not intersect two different eddies, abysses, or trenches.A maximal portish set is called a port.
We show below that all ports are disjoint; each port is completely contained in one of the sets U , D, E, ϒ − , ; none can intersect ϒ + ; and each returnable state (i.e. an x with x X x) is in a port, but no transitional state (x with ¬(x X x)) is.
In the pendulum example of Fig. 8, the returnable points are those in U + D because of the periodic frictionless default flow and the possibility of counteracting small perturbations by braking or acceleration at some later point of the perturbed trajectory.In the eddies and below, this is not possible after an accelerating perturbation; hence those regions are transitional.In the plant types example of Fig. 5, there are also transitional regions, e.g. to the top and right, where all admissible trajectories lead down and left, and in the technological change example of Fig. 6, all points are transitional because of the positive growth of the knowledge stocks.
To extend the system P of all ports into a partition of all of X that is finer than the main cascade C, we say that two non-port states x, y are port-equivalent iff they are in the same member of C; do not lie in two different eddies, abysses, or trenches; and fulfil x X P ⇔ y X P and P X x ⇔ P X y for all P ∈ P. Each maximal topologically connected set of port-equivalent states is now called a rapid.This ensures that not only U and D are partitioned into ports and rapids but also each individual eddy, abyss, and trench.The ports and rapids together form the ports-andrapids partition, PR, which is finer than C.
A set H ⊆ X is harbourish iff it has x X + y for all x, y ∈ H ; is topologically connected, does not intersect two different lakes, eddies, or abysses; and does not intersect two different connected components of S + G.A maximal harbourish set is called a harbour.Let H be the system of all harbours.Two non-harbour states x, y ∈ X + are harbourequivalent iff they (i) are in the same member of {S + G, L, U (+) , W , D (+) , E + , ϒ + }; (ii) do not lie in two different lakes, eddies, or abysses; (iii) do not lie in two different connected components of S + G; and (iv) fulfil the equivalences x X + H ⇔ y X + H and H X + x ⇔ H X + y for all H ∈ Each maximal topologically connected set of harbour-equivalent states is called a channel and lies completely in either one port or one rapid (see below for a proof), and hence the resulting harbours-and-channels partition of X + , HC, is finer than PR.
A set O ⊆ X is dockish iff it has x S y for all x, y ∈ O, is topologically connected and does not intersect two different shelters.A maximal dockish set is called a dock.
Let O be the system of all docks.Two non-dock states x, y ∈ S are called dock-equivalent iff they belong to the same shelter and x S O ⇔ y S O and O S x ⇔ O S y for all O ∈ O.Each maximal topologically connected set of dock-equivalent states is called a fairway and lies completely in either one harbour or one channel, and hence the resulting docks-and-fairways partition of S, OF, is finer than HC.
1.Each two ports [or harbours or docks] are disjoint.5.These partitions are successive refinements of each other: C, PR, HC, OF.

Each port lies completely in one of
6.If a harbour H intersects some of the regions S + G, L, U + , W , or D + , it is already completely contained in that region. Proof.
1. Assume y ∈ A ∩ A for two different maximal portish (or harbourish or dockish) sets A, A and put B = A + A .But then B is itself portish (or harbourish or dockish) because stable reachability is transitive.This contradicts the maximality of A and A .
2. By Proposition 2, if x P y P x then x and y must belong to the same member of C, and hence each port lies completely in one of them.
To show that a port P ⊆ ϒ is already in ϒ − , assume x ∈ P ∩ ϒ + ⊆ X + ∈ T .We will now construct a contradiction by constructing an admissible trajectory from x that avoids forever.Since x X x and X + is open, there is an open set A ⊆ X + with y X x for all y ∈ A. Since τ x is continuous and A open, we find t 0 > 0 with τ x (t) ∈ A for all t ∈ [0, t 0 ].Let y = τ x (t 0 ) and pick a µ ∈ M y that returns arbitrarily closely to x.Let A be the set of all open A ⊆ X + with x ∈ A, and choose a t A > 0 with µ(t A ) ∈ A for all A ∈ A (this requires the axiom of choice, which we will assume here).Let t 1 = inf A∈A sup B∈A,B⊆A t B 0. Since y ∈ ϒ + , there is t > 0 with µ(t ) ∈ for all t > t , and hence t A t for all A ∈ A and thus t 1 t .Next we show that µ(t 1 ) = x.If µ(t 1 ) = y = x, one can choose A ∈ A and C ∈ T with y ∈ C and A ∩ C = ∅ (this is the only point where we need the Hausdorff property).Since µ is continuous, there are t l < t 1 and t u > t 1 with µ(t ) ∈ C for all t ∈ [t l , t u ].By definition of t 1 , there is A ∈ A with sup B∈A,B⊆A t B ∈ [t 1 , t u ].Putting A = A ∩ A ∈ A, we then also have sup B∈A,B⊆A t B ∈ [t 1 , t u ], and hence there is B ∈ A with B ⊆ A ⊆ A and t B t l and hence µ(t B ) ∈ C by choice of t l .But µ(t B ) ∈ B ⊆ A by choice of t B .Hence µ(t B ) ∈ A ∩ C = ∅, a contradiction.Thus µ(t 1 ) = x after all.Finally we concatenate τ x [0, t 0 ] and µ[0, t 1 ] infinitely many times and get an admissible trajectory from x that avoids forever.
3. This follows because S refines X + , which refines X .
6.This follows directly from the definitions of S + G, L, U + , W , and D + by means of X and X + and the transitivity of those relations.

A4 Remarks
-In general, A ι• may be properly smaller than both the interior (A ι ) • of the largest invariant subset A ι of A and www.earth-syst-dynam.net/7/21/2016/Earth Syst.Dynam., 7, 21-50, 2016 the largest invariant subset of A • , (A • ) ι .The three sets can only be shown to be equal under additional smoothness assumptions on τ and µ ∈ M x .
-The set of all states that are stably reachable from x need not be closed or open and need not contain any of the intermediate states that lie on the trajectories µ ∈ M x used in stable reachability.
x A Y does not imply x y for any y ∈ Y , since, after a perturbation, other points in Y may be reachable than before.
-For two points x, y in the same port, harbour, or dock A, one may still not have x A y since the intermediate states on the trajectories from x to y may not be stably reachable from x and thus may not belong to A.
In other words, perturbations may still push the system temporarily out of a port, harbour, or dock, but one can then return to the same port, harbour, or dock.For this reason, the directed reachability network is typically acyclic but may contain reachability cycles in pathological situations.
-Any attractor A with the return property (e.g. a stable fixed point or limit cycle, and most strange and chaotic attractors) of the default dynamics lies completely within one port, and hence within one member of C. If A ⊆ X + then already A ⊆ S, and A lies completely within one dock.
-The scope of possible connection topologies that may occur as the reachability network of a managed system contains at least all acyclic finite or countably infinite directed graphs, as can be seen by the following construction: given an acyclic directed graph, one can construct a topologically equivalent network of water bowls which are connected by water tubes leading from a dedicated "drain" at the bottom of the source ball to a common entrance at the top of the target ball.Let water flow into all balls without incoming tubes and out of all outgoing tubes through grilles, determining the default dynamics of a small submarine floating in the water.Then assume the submarine can be propelled strongly enough to move freely inside each ball and to each drain, but not strongly enough to leave the ball through the entrance at the top, against the direction of the water flow.By making parts of the balls and tubes opaque and moving some of the drains from the bottom to the sides of the ball, the construction can be extended to show that also all internally consistent three-level acyclic networks can occur as the three-level network of ports, harbours, and docks.

B1 One-dimensional potential function
This simple model shows how almost all of the introduced state space regions (except eddies and dark abysses) may already occur in a one-dimensional system ẋ = −df/dx that is defined by a potential function f (x) and already for simple desirable regions such as X + = ]0, ∞[, as depicted in Fig. B1.
Our example has default dynamics along the blue line downwards at a speed proportional to slope, but management is able to move upwards instead on the thin blue lines where the slope is small enough (for |df/dx| < 3/2).The chosen undesirable region of x 0 is indicated in grey.The shelter consists of the two segments just left of point a and it can be stably reached from everywhere properly left of a; hence that whole region constitutes the upstream.The manageable region is the union of shelter, glade, lake, and backwater, and it can be stably reached from everywhere properly left of point b; hence the downstream is the right-open interval from a to b.
That there are no eddies and no dark abysses in this example is typical for systems without any circular flows and with a sufficiently simply shaped X + .
There are two ports, i.e. the two closed intervals where the default flow is slow: one in the upstream and one in the downstream.Note that the latter is only partially contained in the backwater.One rapid lies to the left of the left port, another between the left port and point a, and these two rapids are port-equivalent since both can reach the left but not the right port.Similarly, the right port is surrounded by two portequivalent rapids.Finally, there is a singleton rapid consisting only of the point a and a last one formed by point b and all that is to the right of it; from these two port-equivalent rapids, no port can be stably (!) reached.

B2 Bifurcations of a directly manageable flow
If a system passes through a bifurcation, the classification of states by the criteria outlined above will typically change.Let us examine some archetypical cases that can occur in the exemplary case where management can directly affect the flow by changing the default derivative ẋ = F (x) of a onedimensional system by at most one unit, so that the admissible trajectories are those with ẋ ∈ [F (x) − 1, F (x) + 1].(See Sect.3.6 above for the case where management is via changing a parameter instead.)Assume X + = {|x| < } for some 1, and the default flow has a subcritical pitchfork bifurcation, say F (x) = x 3 − r x, where for r > 0 the stable fixed point x 0 = 0 is surrounded by two unstable ones at x ± = ± √ r and becomes unstable itself for r 0, as depicted by the solid and dotted pale-blue lines in Fig. B2a.Then for r > 0, we have a shelter-and-glade situation with a shelter The Supplement related to this article is available online at doi:10.5194/esd-7-21-2016-supplement.

Figure 1 .
Figure 1.Metaphorical summary of concepts introduced in Sect.1.1 ("Metaphorical framework") inspired bySchellnhuber (1998).It depicts a river flowing from the mountains to the sea while going through sunny (left) and dark parts (right) where humanity can float and row on a boat.In the shelter, no rowing is needed to remain in the sun.One can row against the stream direction in slowly flowing parts, shown with long thin arrows, but in fast parts marked with swirls this is not possible.This setting gives rise to a number of qualitatively different regions of the system's state space that can be found in any manageable dynamical system as well: upstream regions such as glades and lakes from where the shelter can be reached, downstream regions such as the backwaters from where one can at best stay in the sun by management, and several types of worse regions, all labelled here and explained in the text.See also Figs.2 and 3.

Figure 4 .
Figure 4. Phase portrait of the pre-industrial carbon cycle model of Anderies et al. (2013).Arrows indicate default/unmanaged dynamics (pale blue) and alternative/managed dynamics (dotted dark blue) from reducing the human offtake rate by half.Filled dots: corresponding stable fixed points.Grey area: undesired region defined by (i) upper bounds for maritime carbon c m (white horizontal line, representing a planetary boundary related to ocean acidification) and atmospheric carbon 1 − c t − c m (white diagonal line, related to a climate change boundary) and a lower bound for terrestrial carbon c t (white vertical line, representing an ecosystem services planetary boundary).Coloured areas and labels: derived state space partition (see text); colours as defined in Fig. 2: a shelter S around the globally stable fixed point of the default dynamics, a glade G from where S can be reached by management without violating the bounds, and a remaining sunny upstream U (+) from where one cannot avoid violating the bounds temporarily.

Figure 5 .
Figure 5. Competing plant types example, showing all upstream regions and illustrating the lake dilemma.A bistable system of two competing plant types with two simultaneous management options (depicted in separate plots only for discernibility).Management by a general harvesting quota (dotted arrows shown left) can ensure desirable long-term harvests of the less productive type x 1 (lake L).Management by temporary protection of the more productive type x 2 (dashed arrows shown right) can cause a transition to the desirable fixed point (in the shelter S), but only through the undesired region of low harvests (grey region).The state space partition boundaries resulting from both options together (white curves) and a desirable minimum harvest boundary (white diagonal) follow some admissible trajectory at each point.

Figure 8 .
Figure 8. Gravity pendulum fun ride with management by onesided acceleration and undesirable fast rotations.The 2π -periodic coordinate θ is the pendulum's inclination angle.If its angular velocity ω exceeds ± , people get sick (grey region).Since staying in L (balancing almost upright) or G (balancing somewhat inclined) is more exciting than in S (resting downward), we have both a glade and a lake dilemma.

Figure 10 .
Figure 10.Main part of the three-level reachability network of ports and rapids (top panel), harbours and channels (middle panel), and docks and fairways (bottom panel, and related dilemmas in the bifurcation example.Arrows indicate stable reachability (top panel), stable reachability through the sun (middle panel), and stable reachability through the shelters (bottom panel).Some further arrows between rapids, channels and fairways have been omitted here.

2.
Because of transitivity and (1), d X u ∈ U = ( X S) would imply d X S and thus d ∈ U ∩ D = ∅; e X d ∈ D = ( X M) − U would imply e X M and thus e ∈ (U + D) ∩ E = ∅.If one could reach the eddies from the abysses, one could avoid the trenches: assume y X e ∈ ϒ + = {x ∈ X|∀µ ∈ M x ∃t 0 : µ(t) ∈ }.
U , D, E, ϒ − , , no port intersects ϒ + .3. Each harbour [or dock] lies completely in one port [or harbour].4. Each channel [or fairway] lies completely in one member of PR [or HC].

Figure B2 .
Figure B2.Parameter changes can change the quality of states due to bifurcations.Top-left panel: backwater/glade bifurcation and later port pitchfork bifurcation caused by a subcritical pitchfork bifurcation of the default flow (similar in the supercritical case).Top-right panel: glade-backwater-abyss transition caused by a saddle-node bifurcation, with the second critical value marked in red.Bottom-left panel: shelter-backwater-abyss transition caused by the transition of a stable fixed point into the deep dark.Bottom-right panel: shelter-backwaterlake-upstream transition caused by the transition of a stable fixed point through a dark strip.

Table 1 .
Preview of dilemma types discussed in the article.

Shelters Glades Lakes Remaining sunny upstream Dark upstream Backwaters Remaining sunny downstream Sunny eddies Dark eddies Dark downstream Dark abysses Sunny abysses Generic state The manageable partition
• , is the largest open subset of A that contains the default trajecto- ) Figure 3. Illustration of port, harbour, and dock dilemmas introduced in Sect.1.1 ("Metaphorical framework"