Ringkoebing Fjord is an inland water basin on the Danish west coast separated from the North Sea by a set of gates used to control the amount of water entering and leaving the fjord. Currently, human operators decide when and how many gates to open or close for controlling the fjord's water level, with the goal to satisfy a range of conflicting safety and performance requirements such as keeping the water level in a target range, allowing maritime traffic, and enabling fish migration. Uppaal Stratego. We then use this digital twin along with forecasts of the sea level and the wind speed to learn a gate controller in an online fashion. We evaluate the learned controllers under different sea-level scenarios, representing normal tidal behavior, high waters, and low waters. Our evaluation demonstrates that, unlike a baseline controller, the learned controllers satisfy the safety requirements, while performing similarly regarding the other requirements.
Figures & tables
Figure 1: Satellite image of the 14 gates and the sluice lock at Hvide Sande harbor.
Figure 2: A 3D model provided by the DCA of the 14 sluices.
Criticality
Id
Requirement
Safety
S.1
The fjord water level must be between 0.00m and 0.25m DVR90
S.2
Allow water into the fjord only when the wind speed is above 8m/s
S.3
Gates are closed when the water level difference is above 1m
Performance
P.1
Enable fish migration
P.2
Minimize the number of operations (wear and tear)
P.3
Minimize the waiting time for boat passage
Table 1: Requirements for the operation of gates.
Figure 3: General setup of reinforcement learning.
Figure 4: View of a single open gate and the values used to compute the area through which water flows between the fjord and the sea.
Figure 5: Automaton for the fjord’s water level h_f . It makes use of the built-in function fabs , returning the absolute value of a floating-point expression.
Month
Jan
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
Dec
Weight
1.45
1.39
1.30
1.01
0.82
0.71
0.66
0.64
0.72
0.87
1.12
1.29
Table 2: The monthly weights of the water inflow from the fjord’s surrounding streams.
Figure 6: Automaton for the gate controller. The dashed lines represent uncontrollable (environment) decisions, whereas the solid lines represent actions by the controller. Guards are written in green , updates in blue , invariants in magenta , and synchronization channels in cyan .
Figure 9
Figure 9: Automaton measuring the durations of (1) the fjord level being unsafe and (2) fish migration being prohibited due to the gates being closed but otherwise being allowed by the water levels.
Figure 10: Three-day profiles for the sea levels.
Figure 11: Automaton representing the behavior of the baseline controller. This controller is deterministic, i.e., exactly one transition is enabled in the yellow locations.
Controller
Safety
Fish Migration
Max Waiting Time (minutes)
Gate Operations
Normal Waters ( Figure 10(a) )
Baseline
63.2%
95.70%
8.95 ± 0.18
26.15 ± 0.92
Learned
100%
99.05%
8.87 ± 0.23
40.30 ± 0.00
Low Waters ( Figure 10(b) )
Baseline
82.03%
99.62%
9.00 ± 0.24
36.14 ± 0.93
Learned
100%
99.50%
8.83 ± 0.23
37.36 ± 1.17
Table 3: Experiment results of the baseline controller and the learned controllers in three scenarios.
Sea Level Scenario
Controller
Estimated Min Level
Estimated Max Level
Normal Waters ( Figure 10(a) )
Baseline
−0.001 DVR90
0.073DVR90
Learned
0.040DVR90
0.076DVR90
Low Waters ( Figure 10(b) )
Baseline
−0.002 DVR90
0.147DVR90
Learned
0.035DVR90
0.147DVR90
High Waters ( Figure 10(c) )
Baseline
0.055DVR90
0.270 DVR90
Learned
0.060DVR90
0.172DVR90
Table 4: Minimum and maximum fjord levels for the baseline controller and the learned controllers in three scenarios. The numbers are given in meters with respect to DVR90. Violations of the safety range ( 0.0m – 0.25m ) are marked in bold face.
Figure 12: Boxplots of the expected performance of controllers generated under different water-level scenarios (normal, low, high) . The safety weight w1 of the learning query ranges from 101 to 106 .
Safety-critical control designs controllers that keep physical systems within hard safety constraints despite uncertainty, disturbances, and limited actuation.