eess.SYApr 6, 2026

Safe and Near-Optimal Gate Control: A Case Study from the Danish West Coast

Authors: Martin Kristjansen, Kim Guldstrand Larsen, Marius Mikučionis, Christian Schilling

Organizations: Aalborg University · Department of Computer Science, Aalborg University Aalborg, Denmark

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Ringkoebing Fjord is an inland water basin on the Danish west coast separated from the North Sea by a set of gates used to control the amount of water entering and leaving the fjord. Currently, human operators decide when and how many gates to open or close for controlling the fjord's water level, with the goal to satisfy a range of conflicting safety and performance requirements such as keeping the water level in a target range, allowing maritime traffic, and enabling fish migration. Uppaal Stratego. We then use this digital twin along with forecasts of the sea level and the wind speed to learn a gate controller in an online fashion. We evaluate the learned controllers under different sea-level scenarios, representing normal tidal behavior, high waters, and low waters. Our evaluation demonstrates that, unlike a baseline controller, the learned controllers satisfy the safety requirements, while performing similarly regarding the other requirements.

Figures & tables

Figure 1: Satellite image of the 14 gates and the sluice lock at Hvide Sande harbor.
Figure 2: A 3D model provided by the DCA of the 14 sluices.
CriticalityIdRequirement
SafetyS.1The fjord water level must be between 0.00 m0.00\text{\,}\mathrm{m} and 0.25 m0.25\text{\,}\mathrm{m} DVR90
S.2Allow water into the fjord only when the wind speed is above 8 m/s8\text{\,}\mathrm{m}\mathrm{/}\mathrm{s}
S.3Gates are closed when the water level difference is above 1 m1\text{\,}\mathrm{m}
PerformanceP.1Enable fish migration
P.2Minimize the number of operations (wear and tear)
P.3Minimize the waiting time for boat passage
Table 1: Requirements for the operation of gates.
Figure 3: General setup of reinforcement learning.
Figure 4: View of a single open gate and the values used to compute the area through which water flows between the fjord and the sea.
Figure 5: Automaton for the fjord’s water level h_f . It makes use of the built-in function fabs , returning the absolute value of a floating-point expression.
MonthJanFebMarAprMayJunJulAugSepOctNovDec
Weight1.451.391.301.010.820.710.660.640.720.871.121.29
Table 2: The monthly weights of the water inflow from the fjord’s surrounding streams.
Figure 6: Automaton for the gate controller. The dashed lines represent uncontrollable (environment) decisions, whereas the solid lines represent actions by the controller. Guards are written in green , updates in blue , invariants in magenta , and synchronization channels in cyan .
Figure 9
Figure 9: Automaton measuring the durations of (1) the fjord level being unsafe and (2) fish migration being prohibited due to the gates being closed but otherwise being allowed by the water levels.
Figure 10: Three-day profiles for the sea levels.
Figure 11: Automaton representing the behavior of the baseline controller. This controller is deterministic, i.e., exactly one transition is enabled in the yellow locations.
ControllerSafetyFish MigrationMax Waiting Time (minutes)Gate Operations
Normal Waters ( Figure 10(a) )
Baseline63.2%95.70%8.95 ±\pm 0.1826.15 ±\pm 0.92
Learned100%99.05%8.87 ±\pm 0.2340.30 ±\pm 0.00
Low Waters ( Figure 10(b) )
Baseline82.03%99.62%9.00 ±\pm 0.2436.14 ±\pm 0.93
Learned100%99.50%8.83 ±\pm 0.2337.36 ±\pm 1.17
Table 3: Experiment results of the baseline controller and the learned controllers in three scenarios.
Sea Level ScenarioControllerEstimated Min LevelEstimated Max Level
Normal Waters ( Figure 10(a) )Baseline−0.001\mathbf{-0.001} DVR900.073 DVR900.073\text{\,}\mathrm{D}\mathrm{V}\mathrm{R}\mathrm{9}\mathrm{0}
Learned0.040 DVR900.040\text{\,}\mathrm{D}\mathrm{V}\mathrm{R}\mathrm{9}\mathrm{0}0.076 DVR900.076\text{\,}\mathrm{D}\mathrm{V}\mathrm{R}\mathrm{9}\mathrm{0}
Low Waters ( Figure 10(b) )Baseline−0.002\mathbf{-0.002} DVR900.147 DVR900.147\text{\,}\mathrm{D}\mathrm{V}\mathrm{R}\mathrm{9}\mathrm{0}
Learned0.035 DVR900.035\text{\,}\mathrm{D}\mathrm{V}\mathrm{R}\mathrm{9}\mathrm{0}0.147 DVR900.147\text{\,}\mathrm{D}\mathrm{V}\mathrm{R}\mathrm{9}\mathrm{0}
High Waters ( Figure 10(c) )Baseline0.055 DVR900.055\text{\,}\mathrm{D}\mathrm{V}\mathrm{R}\mathrm{9}\mathrm{0}0.270\mathbf{0.270} DVR90
Learned0.060 DVR900.060\text{\,}\mathrm{D}\mathrm{V}\mathrm{R}\mathrm{9}\mathrm{0}0.172 DVR900.172\text{\,}\mathrm{D}\mathrm{V}\mathrm{R}\mathrm{9}\mathrm{0}
Table 4: Minimum and maximum fjord levels for the baseline controller and the learned controllers in three scenarios. The numbers are given in meters with respect to DVR90. Violations of the safety range ( 0.0 m0.0\text{\,}\mathrm{m} – 0.25 m0.25\text{\,}\mathrm{m} ) are marked in bold face.
Figure 12: Boxplots of the expected performance of controllers generated under different water-level scenarios (normal, low, high) . The safety weight w1w_{1} of the learning query ranges from 10110^{1} to 10610^{6} .
More in this topic

Safety-Critical Control

Safety-critical control designs controllers that keep physical systems within hard safety constraints despite uncertainty, disturbances, and limited actuation.

See all 128 papers

Explore similar work

CardsList
Jul 30, 2026

Safety-Gated Agentic Supervisory Control on a Coupled Distillation Benchmark: Regime Map, Auditable Gate, and Co-Design Findings

An open-weight LLM can write composition setpoints every five minutes. What a plant still needs is a hard check: named constraints, logged margins, and an admit/block decision before the regulatory layer moves. This paper puts that check in a rule-based forked-twin counterfactual gate (nine pinned constraints) and leaves the regulatory layer unchanged. On Skogestad's Column A the ladder is PID-only (C0), linear MPC (C1), ungated agent (C2), and gated agent (C3) under one contract: identical level closure (M_D, M_B), scenarios, and seeds; C2/C3 share the linear-MPC backend. The split is not subtle. Off-nominal target acquisition: the agent beats Pareto-tuned linear MPC in the strong band (C2/C1 IAE ratio 0.361 at the upper CI). Disturbance rejection on the same 16-point grid inverts by 16.03 at the upper CI (10.18 at the point estimate), where an ungated LLM supervisor does not belong. The gate compresses a specification-abandonment attractor into a bounded offset (d approx. -1.4; P95 cell IAE 11.5 to 0.77). A one-line prompt fix removes the attractor at source (6/10 to 0/10; sensitivity only, not a new headline). In a 250-cell statistical pass, 534 of 590 gate interventions are spec-on-bound geometry: the operating specification sits on a safety limit, so a well-behaved OP becomes inoperable while misbehaving ones are only contained; 318 blocks still correct actively harmful proposals. Headlines are single-column and model-conditional on DeepSeek-V4-Flash. A second-family sweep (NVIDIA Nemotron-3-Super) keeps the disturbance-rejection fails band and plant-side failure geography; magnitudes and protocol operability stay model-conditional, and Super target-acquisition strong cells are survivors only (not confirmation). Transfer means twin, constraint envelope, and setpoint interface, not a second plant class measured here.

Christian Rosenthal

Sole author — independent research, industrial AI methodology

Language Model-Based ControlSafety-Critical ControlFeedback ControlContinuous ControlRuntime Assurance
AskPDF
May 19, 2026

Explainable Wastewater Digital Twins: Adaptive Context-Conditioned Structured Simulators with Self-Falsifying Decision Support

Operators of safety-critical industrial processes increasingly rely on digital twins to screen control interventions, but such simulators rarely carry certified safety guarantees. Wastewater treatment plants exemplify the gap: operators face a daily safety-efficiency trade-off where aerating too little risks effluent violations and nitrous-oxide (N2O) spikes, and aerating too much wastes energy. We develop an explainable digital twin for aeration and dosing setpoints. CCSS-IX, the simulator, is a bank of interpretable locally linear state-space "experts" adaptively mixed by a context-aware gating network, building on a continuous-time regime-switching scaffold. A runtime decision layer applies conformal risk control to abstain, reopen, or return a falsifying temporal witness for any operator-proposed action that cannot be statistically certified. The artificial-intelligence contribution is twofold: an identifiable, context-conditioned structured surrogate that retains operator-readable dynamics, and a self-falsifying decision rule with finite-sample coverage guarantees. The engineering contribution is a validated, end-to-end decision-support pipeline, tested on a 1000-step slice of the Avedøre full-scale plant (42.6% sensor missingness, 2-minute sampling), the Agtrup/BlueKolding full-scale plant in Denmark, and the Benchmark Simulation Model No. 2 (BSM2) international benchmark, under a matched ten-seed protocol. The static structured ensemble lies within 0.78% root-mean-square error of an unconstrained black-box reference, and the adaptive variant within 1.08%. The calibrated reopen rule cuts aggregate two-plant regret by 43.6% at an unsafe-action cost weight of 4 and eliminates unsafe chosen actions on the BSM2 main slice. Event-aligned temporal witnesses prevent 93 of 187 false-safe N2O approvals, about 4.65x the dyadic baseline (paired McNemar p < 1e-21).

Gary Simethy, Daniel Ortiz Arroyo, Petar Durdevic

Department of Energy, Aalborg University, Niels Bohrs Vej 8, Esbjerg, 6700, Denmark

Surrogate ModelingSafety-Critical ControlConformal Risk ControlDigital Twins
AskPDF
Sep 29, 2026

All You Need Is Low Fidelity: Zero-Shot Sim-to-Real of Learned Robotic Fish Control

Complex tasks for underwater robots remain limited by the capabilities of their controllers. Learning a better one for a soft, underactuated robotic fish trades simulator cost against fidelity. We show that an intentionally low-fidelity simulator is enough: a stateless, quasi-steady fluid model with no wake and no added-mass history suffices to learn a general, closed-loop controller that transfers to hardware without tuning. Our platform is a soft, single-motor, tendon-driven fish whose policy observes only what the hardware can measure. A staged pipeline grounds the simulator in two independent identifications, fixing the tail dynamics and a stateless fluid model; the policy then acts through a band-limited rhythmic trajectory generator rather than commanding the tail directly. Deployed unchanged in an outdoor pool, a single policy performs closed-loop target reaching, disturbance rejection, and out-of-distribution target acquisition and tracking. The transfer rests on the constraint rather than the fidelity: the generator cannot leave the band over which the fluid was identified. This raises the question of how much of the physics can reside in the controller rather than in the simulator.

Liam Maloney, Simon Ramchandani, Mike Y. Michelis +2

Soft Robotics Lab, ETH Zurich, Switzerland · ETH AI Center, ETH Zurich, Switzerland

Robotic ControlRobotics SimulationSim-to-Real TransferUnderwater RoboticsSoft Robotics
AskPDF