Union and Intersection Operators for Thick Ellipsoid State Enclosures : Application to Bounded-Error Discrete-Time State Observer Design

Thick ellipsoids were recently introduced by the authors to represent uncertainty in state variables of dynamic systems, not only in terms of guaranteed outer bounds but also in terms of an inner enclosure that belongs to the true solution set with certainty. Because previous work has focused on the definition and computationally efficient implementation of arithmetic operations and extensions of nonlinear standard functions, where all arguments are replaced by thick ellipsoids, this paper introduces novel operators for specifically evaluating quasi-linear system models with bounded parameters as well as for the union and intersection of thick ellipsoids. These techniques are combined in such a way that a discrete-time state observer can be designed in a predictor-corrector framework. Estimation results are presented for a combined observer-based estimation of state variables as well as disturbance forces and torques in the sense of an unknown input estimator for a hovercraft.


Introduction
Predictor-corrector approaches for the model-based estimation of state variables and disturbances were presented in several previous research activities [1,2]. These approaches rely on predicting state enclosures for sets of ordinary differential equations either in an interval-based form [3,4], perform Taylor series expansions with respect to time as well as uncertain parameters and initial conditions [5], or employ Taylor model-based approaches [6,7]. However, these techniques are not directly capable of representing inner and outer bounds of the estimated domain in a unified manner as they were determined by means of affine sets [8], combinations of affine arithmetic with automatic differentiation [9], and data-driven overapproximation techniques for a reachability analysis [10] in current references. On the one hand, the predictor-corrector methods mentioned above provide guaranteed outer bounds of all state variables that are consistent with the state equations as well as with measured output information. Both, state equations and output models, the latter representing sensor characteristics with bounded noise, may include interval parameters to reflect limited knowledge and the influence of model simplifications. On the other hand, however, the lack of information concerning domains that belong to the exact sets of reachable states makes it impossible to distinguish between the phenomena of wide state enclosures as a consequence of uncertainty or the result of wide bounds due to pessimism in numerical evaluations. The latter aspect is well-known in the frame of interval analysis and denoted as overestimation that can be traced back to the so-called dependency effect (numerous variables are treated as independent despite underlying physical or mathematical correlations) or to the wrapping effect (complex-shaped solution sets are replaced conservatively by more simple outer bounds which are subsequently propagated further) [11][12][13][14].
From this description, it becomes obvious that it is desirable to express uncertainty on the bounds of the domains of reachable states in the frame of simulation and state estimation techniques. Recently, corresponding set representations were developed which allow to express either a notion of variables certainly belonging to a solution set or certainly not belonging to the set (denoted as a relative distance measure interval arithmetic [15]); alternatively, the notion of thick intervals, thick boxes, thick functions, and thick ellipsoids can be seen as an approach to handle this kind of uncertainty on set boundaries [16]. Moreover, combinations of fuzzy and interval methods as those presented in [17] represent other currently investigated techniques that aim at expressing uncertainty on state boundaries.
Especially the use of ellipsoids as enclosures for reachable sets [18,19] is a promising approach because such domains naturally arise as descriptions of provable stability domains for nonlinear dynamic systems if the corresponding analysis is performed with the help of quadratic Lyapunov functions. Moreover, propagating ellipsoids over a dynamic system model with sufficient smoothness properties typically leads again to a solution set with boundaries that can effectively be described by enclosing ellipsoids if the domains of interest are sufficiently small. For a proof of this property, see [20], where it has been shown that the Hausdorff distance between the true solution and the ellipsoidal enclosure reduces at least linearly for decreasing domain sizes.
Computations of ellipsoidal enclosures inherently have the property of a constant complexity if they are applied recursively. In addition, their enclosure quality enhances automatically for reducing domain sizes which is in contrast to the propagation of polytopic and zonotopic domains [21,22]. There, the number of vertices of the solution setsespecially after intersecting the results of measurement-based innovation steps with the outcome of state prediction stages-tends to increase in each time step. This leads to the necessity to employ specific techniques to reduce the complexity at least after a certain number of evaluation steps [23]. Although these polytopic and zonotopic techniques help to reduce overestimation, a constant complexity over subsequent time steps for the evaluation of dynamic systems can typically only be observed if the solutions are restricted to domains with a fixed number of vertices such as axis-aligned intervals or parallelepipeds as a special kind of preconditioned interval boxes after a linear change of coordinates.
Previous work of the authors has focused on the development of thick ellipsoid function evaluations [20] and recursive simulation approaches [24], where the inner bounds represent the domains of certainly reachable states and the outer bounds reflect the worstcase uncertainty. So far, only extensions of sufficiently smooth function evaluations (the basic arithmetic operations of addition, subtraction, multiplication and division) as well as the evaluation of nonlinear standard functions (such as trigonometric or exponential functions) were investigated. In order to implement state estimation schemes, it is further necessary to define outer and inner solution enclosures in ellipsoidal form for union and intersection operators. These operators are investigated in more detail in this paper so that they form the basis for the implementation of a discrete-time state estimation procedure. The estimator's structure resembles the one of a discrete-time Kalman filter [25] or of suitable generalizations for nonlinear systems [26][27][28][29], where a state prediction stage is employed to forecast future reachable states and this a-priori knowledge is subsequently refined in an innovation (i.e., correction) stage as soon as measured data become available.
In Section 2 of this paper, a review of thick ellipsoids as a representation of uncertain state domains for dynamic systems is given. Based on their introduction, inner and outer union as well as intersection operators are derived and summarized in Section 3 which form the basis for state estimation in the frame of (quasi-)linear discrete-time system models. The corresponding novel, thick ellipsoid state estimation procedure is derived in Section 4 before a representative benchmark scenario for state and disturbance estimation of a hovercraft model is discussed in Section 5. Finally, this article is concluded by an outlook on future work in Section 6.

Thick Ellipsoids
Thick ellipsoids were introduced by the authors in [20,24] to represent conservative outer bounds of the domains of reachable states of dynamic systems in parallel with inner bounds which represent those states that belong to the reachable solutions with absolute certainty. Geometrically, a thick ellipsoid can be understood as an ellipsoid with an uncertain boundary as illustrated in the left-hand side of Figure 1 that allows for enclosing a complexly shaped domain A k according to The previous publications [20,24] focused on propagating this ellipsoidal domain via a nonlinear map so that the true outputs A k+1 after performing a state prediction according to (2) are again enclosed by a thick ellipsoid in a computationally cheap manner. For that reason, linear matrix inequalities are only employed in offline phases for the derivation of the proposed solution technique. Our procedure avoids the search for the globally optimal (i.e., tightest possible) solution of state prediction (and also the subsequent innovation stages) by a replacement of the online use of linear matrix inequalities or complex minmax optimization tasks by low-dimensional optimizations. Classically, the task of finding ellipsoidal state enclosures would be solved by using the aforementioned, often time-consuming techniques in each time step if the approaches published in [19,[30][31][32] were applied directly. However, for the goal of a reduction of the computational effort and, hence, for a simplification of real-time implementability, we propose low-dimensional optimization procedures which avoid the search for the typically large number of degrees of freedom if the optimal inner and outer ellipsoids E I k and E O k , respectively, were computed. In the following, we recapitulate the mathematical definitions of thick ellipsoids together with binary operators and function extensions. Note, similar concepts were also introduced in [16] for so-called thick intervals (which represent scalar interval variables with uncertain lower and upper bounds) as well as thick boxes as the Cartesian product of thick intervals. A closely related concept is the so-called type-2 interval arithmetic discussed in detail in [15]. Definition 1 (Thick ellipsoid). Define a thick ellipsoid ( (E ) ) = ( (E ) ) µ, Γ, ρ ; ρ as a subset of the power set P (R n ) so that and 0 ≤ ρ ≤ ρ.

Definition 2.
(Thick ellipsoid binary operators and function extensions). A thick ellipsoid extension of the binary operators ∈ {+, −, ·, /, ∪, ∩} (For the case of division, the value zero is assumed not to belong to the denominator expression in analogy to classical interval arithmetic [11]) satisfies the relation The quantity ( (C) ) = ( (A) ) ( (B) ) is also a thick ellipsoid, which is typically neither minimal with respect to its width nor uniquely defined. Analogously, ( (f) ) is a thick ellipsoid function extension of For the implementation of algorithms that allow for evaluating nonlinear mapping functions (2) with the help of thick ellipsoids, the reader is referred to [20,24]. In this paper, we impose a specific, (quasi-)linear structure of the considered system models, so that the thick ellipsoid function evaluation can be simplified by a newly derived simulation scheme according to Section 3.1.

Union and Intersection of Thick Ellipsoid Enclosures
Parameter-dependent quasi-linear system models in the form with p k ∈ p k ; p k , where p j,k ≤ p j,k ≤ p j,k , j ∈ {1, . . . , m}, are a special case of the nonlinear system representation introduced in (2). In many cases, they arise if discrete-time state equations (2) with an equilibrium state at x k+1 = x k = 0 are re-written by means of symbolic formula manipulation in which the dependence on the state vector x k is factored out from the system model (2). In such cases, it needs to be ensured that all entries of A(x k , p k ) are well-defined because they do not contain any singularities after factoring out the state vector x k and are, therefore, finite for the complete operating domain of interest. In addition, these models arise if centeredform representations of nonlinear system models are computed either by determining interval extensions of the system's Jacobian or by means of techniques for slope arithmetic. For details concerning these latter two options, the reader is referred to [33][34][35].

Mapping of Thick Ellipsoidal Domains via (Quasi-)Linear System Models
In general, the evaluation of system models in the form (7) is possible with the help of the general solution approach presented in [20,24] if an augmented state vector is introduced that contains not only the actual state variables x k but also the parameter vector p k in terms of discretized integrator disturbance models for which p k+1 = p k holds. However, the examples investigated in [24] have shown that doing so leads to conservativeness of the solutions. The reason for this observation is that the parameters p k become correlated with the state vector x k so that their outer bounds start to expand despite the aforementioned assumption of uncertain but temporally constant values. Hence, the methods summarized in this subsection (together with the intersection operators included in the state estimator according to Section 4) resolve the corresponding issue by introducing uncertain parameters as entries in the system matrix. When doing so, their enclosures may even be reset at each sampling instant k to new interval bounds. As shown subsequently, this option allows for analogously dealing with (outer) state bounds influencing the dynamics matrix A(x k , p k ).
For the sake of compactness, the short-hand notation A k = A(x k , p k ) ∈ [A k ] is used in the following to denote an interval matrix containing the worst-case outer range bounds of all matrix entries at a specific time instant k.

Outer Bounds
Given an ellipsoid that is described by a positive definite shape matrix Q k = Q T k > 0 and centered at the origin x k = 0 of the state space, it is desired to enclose the exact (generally non-ellipsoidal) solution set of the mapping (7) in terms of a guaranteed outer ellipsoidal bound with degrees of freedom concerning the choice of the shape matrix Q k+1 and its stretch parameter α O,k+1 > 0. The latter will be computed by means of a simple line-search optimization procedure to avoid the necessity for an online solution of linear matrix inequalities.
With the help of the free matrix variable R k , the shape matrix of the predicted ellipsoid is described by whereÃ k is some invertible point matrix typically satisfying This definition is inherited from the propagation of a representative point in the interior of E k which was chosen to be its midpoint in [20,24].

Remark 1.
Possible choices for the parameterization of the matrices R k andÃ k introduced in (10) and (11) are discussed in the illustrating example in Section 3.1.3.

Assuming regularity of
, the exact solution of the mapping (7) is defined by where E * k+1 ⊆ E O k+1 needs to be satisfied for (9) to represent a guaranteed outer bound of the solution domain. Note, even if this regularity assumption does not hold, the following Theorem 1 remains true.
holds for all x k ∈ E k and p k ∈ [p k ].
Proof. Without any assumptions on the regularity of Geometrically speaking, this means that the level curve of height 1 of the quadratic form in (8), which corresponds to the bound of the ellipsoid E k , must be an inner bound for the level curve of identical height of S k . This condition corresponds to the scalar inequality for all x k ∈ E k and p k ∈ [p k ].
Factoring out the vector x k to the left and right of (15) turns this scalar inequality into the matrix inequality which (for the choice of a regular matrixÃ k ) is equivalent to the condition Removing the difference of the two matrices in (17) with the help of the Schur complement formula [36,37] leads to Equation (13) which completes the proof of Theorem 1.

Remark 2. As stated before, the quasi-linear system matrix
Therefore, a conservative solution to the matrix inequality in Theorem 1 can be determined by searching for a state-and parameter-independent, strictly positive definite matrix α 2 O,k+1 R k that satisfies the interval-valued matrix inequality This matrix inequality can be cast into a linear one by the substitution to make standard routines for linear matrix inequalities such as the MATLAB toolbox SEDUMI in combination with YALMIP [38,39] applicable if (18) is further replaced by the convex combination of a finite number of extremal realizations with the help of the ideas given in [40,41]. The extremal realizations can be obtained by computing an interval extension of the state-and parameter-dependent system matrix A(x k , p k ) with the help of toolboxes such as INTLAB [42] for MATLAB and determining all matrix entries that have a non-zero diameter. Then, it is possible to represent (18) by the convex polytope which is only used in the following example for the sake of comparison with the proposed method, where for the list of all n v = 2 n 2 interval vertices formed of A k and A k the corresponding extremal realizations are defined and need to be negative semi-definite with M v,k+1 ≤ 0. Note, this formulation of all (21) directly accounts for the structural symmetry of (18). A (nearly) optimal solution can be obtained by minimizing trace P O k+1 , cf. [43,44], which can be employed as a substitute for the optimization task involving the logarithm of the shape matrix determinant according to ([45], Appendix C).
To avoid the necessity to solve linear matrix inequalities in each temporal discretization step of a dynamic system, the following Theorem 2 describes a relaxed version of the solution procedure after a-priori fixing the matrix R k , for example, by setting R k = Q k . Theorem 2 (Eigenvalue criterion for outer ellipsoidal bounds). For a fixed combination of the shape and stretch parameters R k and α O,k+1 , respectively, E O k+1 is a guaranteed outer enclosure of the solution set E * k+1 , if ] are guaranteed to be real-valued. According to Rohn [46,47], interval bounds for the range of each eigenvalue are given by the enclosures located on the real axis of the complex plane. If sup([λ i,M ]) ≤ 0 holds for all i ∈ {1, . . . , 2n}, Theorem 1 is satisfied due to the negative semi-definiteness of the interval matrix (18).

Remark 3.
To enhance the efficiency of the enclosure technique, the eigenvalue bounds from (23) can be combined with the upper eigenvalue bound λ max,M obtained from the Gershgorin circle criterion [48] If this is not efficient, all vertices of the interval matrix (18) could be tested for negative semi-definiteness.

Remark 4.
The optimal, i.e., smallest volume ellipsoid after fixing the matrix R k , for example, by the choice R k = Q k , is obtained with the help of Theorem 2 if the parameter α O,k+1 > 0 is minimized by a line search procedure so that (22) remains satisfied. For α O,k+1 → ∞, the outer bound becomes infinitely large.

Inner Bounds
Inner ellipsoidal bounds with the shape matrix defined in (10) describe domains that are guaranteed to belong to the solution set according to E I k+1 ⊆ E * k+1 are characterized by the following Theorem 3.

Theorem 3 (Guaranteed inner bound).
The ellipsoid E I k+1 according to Equation (25) is a guaranteed outer bound for E * k+1 if the matrix inequality Proof. The proof of Theorem 3 follows a similar reasoning as the proof of Theorem 1. If the matrix holds, if the level curve of height 1 of the quadratic form in (25), which corresponds to the bound of the ellipsoid E I k+1 , is fully contained in the interior of E * k+1 according to the scalar inequality This condition corresponds to the matrix inequality which is equivalent to under the above-mentioned regularity assumption.
Removing the difference of matrices in (29) by the application of the Schur complement formula completes the proof of Theorem 3. (18), a conservative formulation of Theorem 3 can be given by the interval-valued matrix inequality

Remark 5. In analogy to Equation
for which a common solution after the linearizing variable substitution needs to be found. An optimization of this solution is possible by a minimization of trace P I k+1 , (replacing the optimization task involving the logarithm of the shape matrix determinant according to [45] Appendix C), where for a polytopic representation of the domain [N k+1 ] according to (21) the entry-wise defined vertices of the matrix inverse need to be found. A relaxation into a computationally less expensive eigenvalue test is given by Theorem 4.
Theorem 4 (Eigenvalue criterion for inner ellipsoidal bounds). For a fixed combination of the shape and stretch parameters R k and α I,k+1 , respectively, E I k+1 is a guaranteed inner enclosure of the solution set E * k+1 , if holds for all i ∈ {1, . . . , 2n}, where the mid and rad operators are defined as in Theorem 2.
Proof. The proof of Theorem 4 results from a direct application of the proof of Theorem 2 after exchanging the sign condition of the respective inequalities, where inf([λ i,N ]) ≥ 0 needs to hold for all i ∈ {1, . . . , 2n}.

Remark 6.
To enhance the efficiency of the enclosure technique, the eigenvalue bounds from (32) can be combined with the lower eigenvalue bound λ min,N obtained from the Gershgorin circle criterion If this is not efficient, all vertices of the interval matrix (30) could be tested for positive semidefiniteness. However, this is only recommended for sufficiently small values of n.

Remark 7.
The optimal, i.e., largest volume ellipsoid after fixing the matrix R k , for example, by the choice R k = Q k , is obtained with the help of Theorem 4 if the parameter α O,k+1 > 0 is maximized by a line search procedure so that (32) remains satisfied. For α I,k+1 = 0 or non-regular matricesÃ −1 k · [A k ], the inner ellipsoidal bound is the empty set.
Using identical matrices R k for the outer and inner ellipsoids, the thick ellipsoid sets is defined by

Illustrating Example
As an illustrating example, consider the system model with the independent parameters p 1 and p 2 , where To show the influence of parameter uncertainty on the computed ellipsoidal enclosures, the following cases are distinguished in Figure 2: In the left column of Figure 2, the parameter matrix R k = Q k is chosen, while it is set to R k =Ã −T k · Q k ·Ã −1 k in the right column, whereÃ k is the interval midpoint of the uncertain system matrix. Obviously, for the smaller uncertainty in the cases 2 and 3, the first setting is superior. This is not astonishing because it corresponds to that choice of matrix that would be employed for the covariance prediction in an Extended Kalman Filter (EKF). As it is well known, strong deviations from a point-valued system matrix A k may turn an EKF quite inaccurate. Then, other choices of the forecasted covariance are often superior, as they could be determined by the Unscented Kalman Filter technique [27]. This approach was not investigated here. However, the almost symmetric interval bounds of [A k ] motivate the second choice of R k , which corresponds to Q k+1 = Q k .
Moreover, it should be pointed out that the case 1 in Figure 2a,b corresponds to a scenario in which the inner bound is empty, the case 2 in Figure 2c,d to a scenario in which the inner bound just appears due to the matrix [A k ] containing purely regular realizations; finally, Figure 2e,f shows the case of small uncertainty with a clearly visible inner solution set, where the proposed one-parameter optimization task from the previous subsections provides results that are close to the solution of the robust linear matrix inequality design, where R k is not predefined but rather optimized with the help of the matrices P O k+1 and P I k+1 to obtain independent outer and inner enclosures (dashed and dotted lines, respectively).

Dikin Ellipsoids for the Intersection of Ellipsoids
The intersection of two ellipsoidal (state) domains is a fundamental operation for the estimation of state variables in a bounded-error framework. For that reason, this section introduces corresponding procedures that are readily applicable to thick ellipsoids, starting with the well-known case of two ellipsoids with identical midpoints. These results are further generalized to the case, where the ellipsoid midpoints may be different from each other.

Intersection of Ellipsoids with Identical Midpoints
Outer as well as inner ellipsoidal representations for the intersection of various ellipsoidal domains were investigated in numerous publications. Especially, the reference [49] gives a thorough overview of a large number of applicable techniques that can be cast into computationally feasible optimization problems. Basically, all of these routines are based on the use of linear matrix inequalities. At each intersection stage, such linear matrix inequalities need to be solved when computing so-called inner and outer bounds by means of a technique that is based on findings of Löwner and John [50]. Analogously, this holds for the Nerimovski approximation [51] that is compared with the first option in [49].
To avoid the necessity for solving linear matrix inequalities explicitly during online applications (note, these matrix inequalities are exploited for the offline proof of the validity of the following enclosure relations), a conservative approximation based on the so-called Dikin ellipsoids [49] is considered in this paper. These ellipsoids can be applied to describe inner and outer bounds for the intersection I k of m ellipsoids with an identical center located in the origin of the state space. The following relations for the shape matrices hold equally for identical non-zero center points.
Using the results of Lemma 5 in [49], the inner and outer bounds are given by with E D,I,k = E 2 D,k and E D,O,k = E 2m D,k , respectively, where is defined for the common shape matrix This definition of inner and outer ellipsoidal enclosures corresponds to a thick ellipsoid introduced in the Definitions 1 and 2 in the form Although these enclosures are generally suboptimal, we restrict ourselves to these Dikin ellipsoids due to their computational inexpensive evaluation which is advantageous if real-time state estimation procedures are desired. A generalization to the case of ellipsoids with different midpoints is presented in the following subsection.
Efficient techniques that allow for checking whether the intersection of two ellipsoids is empty were published in [52,53]. This check is especially interesting if the thick ellipsoid state observer technique derived in the following section is applied to tasks in the area of fault detection. There, the case that a predicted state domain does not intersect with those domains that are compatible with sensor data typically indicates failures of system components, actuators, or sensors. This corresponds to the fact that the investigated (nominal) system model is proven to be infeasible.
A further related technique, however, not only relying on ellipsoidal state enclosures was very recently derived in [54]. There, outer bounds for the domains of reachable states are characterized by ellipsoids, while disturbances are bounded by zonotopes that may become degenerate if one or more coordinates are unbounded. This property of degeneracy will be picked up again in Section 3.2.3, where an example is presented in which only partial state measurements are available in the thick ellipsoid framework.

Generalization to the Intersection of Ellipsoids with Different Midpoints
An extension of the technique for computing Dikin ellipsoids to a scenario in which two ellipsoids with different centers are intersected, is based on the following threestage procedure: Step 1 Determine the common center point for the desired inner and outer bounds of the intersection that must be included in all ellipsoids to be intersected; Step 2 Determine initial approximations of the shape matrices for the inner and outer bounds according to Section 3.2.1; Step 3 For non-empty inner bounds, correct the outer enclosure so that the inner and outer ellipsoid surfaces become parallel to each other and, thus, form a thick ellipsoid ( (E ) ).
Step 3* As an alternative to Step 3, the initial outer enclosure remains fixed and the inner ellipsoid surface is adapted to become parallel to each other to form a thick ellipsoid ( (E ) ).
As a heuristic approach for the computation of the common center pointμ k in Step 1 of two ellipsoids that are described by the midpoints µ 1,k and µ 2,k as well as the shape matrices Q 1,k and Q 2,k , respectively, the first one is interpreted as the prior knowledge in the innovation step of a Kalman filter [25,55] and the second one as the corresponding information of the state measurement.
Under this assumption, one obtains the Kalman gain matrix with the updated ellipsoid midpoint that is now used for the solution of the Steps 2 and 3 listed above. For both ellipsoids i ∈ {1, 2} to be intersected, scaling factors ξ i > and ζ i > are determined which represent the minimum and maximum distances of the new midpoint from the ellipsoid surface according to with and ∆µ i,k as the Euclidean norm of the vector-valued argument.
In such a way, both ellipsoids to be intersected can be enclosed by thick ellipsoids The initial inner approximation of the shape matrix of the resulting intersection is given by according to the previous subsection, while its outer counterpart results in Usually, these two shape matrices are not proportional to each other in an elementwise sense. Hence, the inner shape matrix Q I k is inflated in Step 3 according to the following theorem so that it contains the outer ellipsoid with certainty. Proof. The validity of the inner bound is a direct consequence of Lemma 5 in [49], and the construction of the matrix (45) as a guaranteed underapproximation of the domains to be intersected. The outer bound of (49) is represented by the shape matrix

Theorem 5 (Thick interval representation of the Dikin intersection of ellipsoids with different midpoints). The thick Dikin ellipsoid
It results from Equation (16) after setting A k = I,Ã k = I, Q k = Q O k , and R k = Q I k which yields This inequality is satisfied if where the expression in curly brackets denotes the minimum eigenvalue of the corresponding matrix product. Taking the square root of the inverse of this expression completes the proof of Theorem 5.
The alternative solution according to Step 3* is given by the thick ellipsoid enclosure which is a direct consequence of Theorem 5 by searching for an ellipsoid parallel to the outer bound that is guaranteed to belong to the interior of the one with the shape matrix Q I k .

Remark 8.
Due to the fact that the relation max i∈{1,...,n} holds for arbitrary positive definite matrices Q I k and Q O k , the ratio between the volumes of the outer and inner ellipsoids in Equations (49) and (53) is identical. Hence, the variant (49) is typically preferred if thick ellipsoids with maximum volume inner enclosures are desired, while (53) provides tighter outer bounds.

Remark 9.
For ellipsoids with identical midpointsμ k = µ 1,k = µ 2,k , the ellipsoid of Theorem 5 is identical to the one in (41) if the midpoint parameterμ k is used instead of the value 0 in (41).

Illustrating Example
In this subsection, various examples for the intersection of ellipsoids and the result interpretation by means of the thick ellipsoids ( (E ) ) D,k and ( (E ) ) * D,k , respectively, are summarized. Figure 3a deals with the application of the intersection procedure of Section 3.2.1 for two ellipsoids identically centered at the origin with the shape matrices Here, both enclosures ( (E ) ) D,k and ( (E ) ) * D,k are identical. Moreover, the fact that the ellipsoid midpoints are identical results in inner and outer enclosures E I D,k and E O D,k that are quite close to the optimal ellipsoidal result representation.
To visualize the procedure of Section 3.2.2 for the case of two different midpoints either with the shape matrices (55) or with the new shape matrices the results in Figure 3c,d are presented. These results confirm the observation described in Remark 8 that the use of Equation (49) leads to tighter inner bounds, while Equation (53) possesses the better outer bounds. Depending on the application to detect states belonging to the solution set with certainty or proving in a guaranteed way that specific state domains are not reachable in the frame of a safety or feasibility test, either the first or the second option should be preferred. However, the observed larger distance between the resulting inner and outer bounds in comparison with Figure 3a gives rise to the assumption that further improvements of the solution could be possible. This could either be done by means of the procedures in [49] or by intersecting the newly obtained outer bounds of both ( (E ) ) D,k and ( (E ) ) * D,k . Note, also the choice of the common ellipsoid midpoint represents a degree of freedom that can be investigated in future work together with possibilities to intersect the enlarged dasheddotted bounds (which correspond to the outer ellipsoid surfaces of (46)) in a recursive manner with both ( (E ) ) D,k and ( (E ) ) * D,k . Interestingly, the proposed intersection procedures can also be applied to the case where one of the original ellipsoids becomes degenerate. In practice, this is the case for a pure measurement of a single state variable. This case is considered in Figure 4, where in all subplots the matrices Q 1,k from Equations (55) and (57) were replaced with Q −1 1,k = 1 0 0 0 , Due to the fact that the basic Formula (40) for computing Dikin ellipsoids only makes use of the inverted shape matrices, the solution procedure remains applicable for the degenerate case. This is a crucial requirement to use this intersection approach in cases in which only a subset to the state variables appears in the system's output equation when considering state estimation procedures according to the following two sections. In Figure 4b,c, the new ellipsoid midpointμ k results from the following adapted Kalman gain with the updated ellipsoid midpoint for which all remaining parameter values are defined in (56) and (57).

General Solution Procedure
The thick ellipsoid union of two ellipsoids with different midpoints is a direct consequence of the procedure in Section 3.2.2. Firstly, the shape matrix Q I k of the thick ellipsoid is determined as in Equation (47). The remaining degree of freedom η * k can be found according to the work of John [50]. For that purpose, specific points on the ellipsoids to be merged were extracted in [24] with subsequently inflating the inner bound by the factor η * k ≥ 1 until all points are included in its interior.
To avoid the extraction of individual points, which has to be performed with sufficient care so that the new outer bound is guaranteed to be conservative, Equation (50) with ζ j,k given in (44) is generalized to find the maximum scaling so that all outer bounds of the thick ellipsoids in (46) are guaranteed to be contained in the union.

Remark 10.
This inflation operation generalizes naturally to an arbitrary integer number j of ellipsoids to be merged after they have been converted into representations with a common midpoint.
As an alternative parameterization (similar to the computation of the intersection of ellipsoids), both outer and inner bounds can be tuned by an alternative option. For that purpose, firstly define an approximation to the resulting shape matrix of the union according to the covariance prediction of a Kalman filter, where the state equation in the Kalman filter corresponds to computing the mean value of the data from each of the ellipsoids, withQ Then, the scaling factors according to (49) and (53) yield the shape matrices for the outer bound as well as for the inner bound. Together, they result in the thick ellipsoid

Illustrating Example
Using the same examples as in (55)-(57), the procedure from Section 3.3.1 is visualized in Figure 5. Due to the fact that the outer hull in Figure 5c is more conservative than necessary (computed by means of Equation (60)), the alternative procedure from Equation (65) is preferable in the considered example. More complex options for computing optimal outer ellipsoidal enclosures typically need to employ the solution of matrix inequalities and/or minmax optimization problems in each evaluation step. Due to the resulting computational effort, such options are not further considered for the desired online application in this paper. However, the reader is referred to [19,30,56] for related work.

Thick Ellipsoid State Estimation Algorithm
As shown in Figure 6, the thick ellipsoid state estimation procedure consists of two stages. Prediction steps, which are based on the (uncertain) discrete-time state equation, are executed up to the point of time at which a new measurement becomes available. There, a measurement-based correction of the a-priori knowledge resulting from the previous state prediction is performed. This corrected state information then serves in a recursive manner as the input for a subsequent state prediction. Figure 6. Thick ellipsoid state estimation algorithm consisting of prediction and correction stages.

Thick Ellipsoid Prediction Step
For state estimation purposes, typically thick ellipsoids have to be considered in the prediction step according to Section 3.1 which have a non-zero midpoint. Their propagation then consists of separating the state equation as illustrated in Figure 7 into a part that depends on an ellipsoid centered at the origin and an offset term that accounts for the non-zero center according to where x 1,k+1 Then, the following steps are executed during the state prediction: 1.
Propagate the inner bound of the thick ellipsoid (68) and extract the inner hull of the image set that is obtained by applying the mappinǧ Denote the corresponding shape matrix of the inner ellipsoid byQ I k+1 . This matrix is related to the shape matrix α 2 I,k+1 · Q k+1 in Equation (25) by 2.
Propagate the outer bound of the thick ellipsoid (68) and extract the outer hull of the image set that is obtained by applying the mapping (71). Denote the corresponding shape matrix of the outer ellipsoid byQ O k+1 . This matrix is related to the shape matrix α 2 O,k+1 · Q k+1 in Equation (9) by 3. Compute interval bounds for the term with x k ,Ã k , and p k defined according to (67), (69), and (70) and deflate the inner ellipsoid bound as well as inflate the outer bound according to the procedure described in [20,24] with and Note, for ρ I ≥ 1, the inner bound becomes the empty set.

4.
Compute the updated ellipsoid midpoint as

5.
Finally, determine the predicted thick ellipsoid set where Remark 11. In cases where the inner ellipsoid becomes the empty set, purely the outer ellipsoid hull is further propagated to represent worst-case outer state enclosures.

Thick Ellipsoid Correction Step
The correction step of the thick ellipsoid state estimator at the point k + 1 is given by the application of Theorem 5 with the following step-by-step procedure (in this description, we prefer the version of maximized inner bounds to reduce the likelihood of empty inner enclosures; however, the task of minimizing the outer volume can be stated in full analogy):

1.
Determine the inner shape matrix on the basis of Equation (47) according to where (based on the change of the ellipsoids' midpoint positions according to (43)) Q I k+1 from (75) is the inner bound of the previous prediction; Q m,k+1 characterizes the measurement uncertainty (possibly given in terms of a degenerate ellipsoid).

2.
Use Equation (48) to determine the intermediate outer bound Finally, Equation (49) yields the thick Dikin ellipsoid as the result of the measurementbased correction step.

Visualization of the Thick Ellipsoid State Estimation Procedure
To visualize the individual steps of the thick ellipsoid state estimation procedure, the test example The corresponding ellipsoid is shown as the dash-dotted line in Figure 8a. Performing a single prediction step leads to a shift in the ellipsoid midpoint according to Equation (77). Moreover, the nonlinearity in the system model (82) causes the resulting distance between the inner and outer bounds of the predicted ellipsoid ( (E ) ) 1 . Now, this ellipsoid is intersected with the measurement information that is highlighted by the vertical strip in Figure 8a,b. According to Figure 8b, the correction step leads again to a shift of the midpoint of the new thick ellipsoid ( (E ) ) 1 according to Equations (58) and (59). The inner bound of ( (E ) ) 1 is always fully contained in the band of possible state measurements ( (E ) ) m,1 , while its outer bound becomes tighter than the result of the preceding state prediction. Now, the result ( (E ) ) 1 serves as the input for the subsequent state prediction. For the sake of a compact notation and for compatibility with Figures 6 and 7, the prime symbol is suppressed in Figure 8c, where the prediction from k = 1 to k = 2 is shown. After this prediction, the next correction step can be executed according to Figure 8d. Note, tight measurement tolerances or strongly nonlinear dependencies in the system model (re-written into the quasi-linear form) may lead to empty inner bounds after either the prediction or the correction step. Then, a slightly modified algorithm could be used. Instead of interpreting the inner bound as the state domain that is guaranteed to belong to the reachable solution set after the execution of all computations until the current instant k, it can be used to determine a measure for the precision of the sequence of prediction and correction steps at a single point of time k. For that purpose, it is necessary to initialize the inner bound of ( (E ) ) k with the same scaling parameter as the outer bound (cf. the interval parameter with identical bounds in (83)) and to use it in analogy to the initialization of the ellipsoid in Figure 8a.

Application Scenario: State and Disturbance Estimation for an Underactuated Hovercraft
As a more complex benchmark application, consider the motion of an underactuated hovercraft in its body-fixed coordinate frame [57,58]. In these coordinates, it is desired to employ the ellipsoid techniques summarized in the previous sections to compute guaranteed outer state enclosures in the presence of bounded noise and disturbances. Moreover, the thick ellipsoid state estimation algorithm of Section 4 is employed to reconstruct bounds on external disturbances.

Modeling
According to Figure 9, denote the surge and sway velocities by x 1 and x 2 , respectively, and the hovercraft's yaw rate by x 3 in a body-fixed coordinate frame. For the following derivation of the equations of motion, assume that the translational velocities are summarized in the vector V = x 1 x 2 0 T , while the angular velocity vector W with respect to the ship's center of gravity (COG) is given by W = 0 0 x 3 T . In this formulation, the dynamics associated with the motion in heave, roll, and pitch are neglected by setting the corresponding vector entries to zero. Figure 9. Definition of the velocity components in a body-fixed coordinate systems, velocityproportional damping as well as disturbance forces and torques.

COG
As also shown in [59,60], a force and torque balance in all degrees of freedom yields the equations of motion d dt where is the total kinetic energy of the ship (under the assumption of purely diagonal mass and inertia matrices [60]) with the strictly non-negative entries m ii ≥ 0 and J ii ≥ 0, i ∈ {1, 2, 3}. For a hovercraft, it can be assumed that m 11 = m 22 = m corresponds to the mass of the ship, without additional hydrodynamic effects, while J 33 = J r is the mass moment of inertia of the vessel in the direction of x 3 . Defining further the vectors of non-conservative, external generalized forces and torques with the control inputs u 1 and u 2 and independent, velocity-proportional damping effects in each coordinate with the coefficient c > 0 for both translational degrees of freedom as well as c r > 0 for the rotary motion, the equations of motion (84) simplify to where d i , i ∈ {1, 2, 3}, represent external disturbances according to Figure 9 due to wind and currents. These disturbances are included in the state equations (87) by means of integrator disturbance models. For the following simulation, a linear state feedback controller corresponding to a feedback of the actual velocity, is parameterized by means of pole assignment to decelerate the hovercraft up to standstill at the desired operating point For the use of the proposed ellipsoidal state estimation scheme, that will be applied to the closed-loop system, the state equations are discretized in time with the step size T according to The (normalized) parameters used for the following simulations are: c = 0.01, m = 5, J = 0.8, c r = 0.01, k 11 = 0.5, k 12 = 1.5, k 13 = 0, k 21 = 0, k 22 = 0, k 23 = 0.1, and T = 0.1.
As measured system outputs, all three velocities (surge, sway, and yaw) are assumed to be available. For the simulation, they are described by the three independent sensor models 1 where y mi,k , i ∈ {1, 2, 3}, are the data provided by the velocity sensors and δ i > 0 their corresponding maximum uncertainty. Besides filtering the velocity signals, the proposed observer is used to reconstruct the ranges of the disturbance inputs d i that are compatible with the system model and the sensor data. Due to the assumption of constant but uncertain disturbances, see Equations (87) and (89), it is permitted to intersect disturbance estimates at a specific time step k with those of previous steps and to employ those intersected results as virtual measurements in analogy to the sensor models (90). In the system model (89), the influence of the yaw rate x 3 on the system matrix during the state prediction is accounted for by an interval parameter that corresponds to its estimated range from the preceding correction step.
Without any modification, the proposed method is capable of handling imprecisely known damping coefficients c ∈ [c ; c] and c r ∈ [c r ; c r ] or uncertain masses and mass moments of inertia.

Simulation Results
To illustrate the performance of the thick ellipsoid state estimation algorithm of Section 4, two different levels of uncertainty are compared for the sensor models (90). These are and with the help of these parameters, bounded measurement noise (in the sense of scaled uniformly distributed random numbers) has been generated for the simulations presented in this section. Moreover, we assume true initial system states x 0 randomly chosen from the interior of an ellipsoid centered at with the diagonal shape matrix The hovercraft's external disturbances originate from setting d 1 = −0.25 and d 3 = 0.05. The state estimation procedure is initialized with an ellipsoid (containing the true initial state) with the same shape matrix (94) and the shifted center µ 0 = µ * 0 − 0 0 0 0.1 0 0 T . Figures 10 and 11 display the evolution of the outer state enclosures for k = 1000 steps of the estimation algorithm from Figure 6 in the left columns. In the right columns of these figures, an enlarged view is given which compares outer and inner bounds of the thick ellipsoid after the first prediction step, the propagation of the prediction results in terms of outer bounds and the respective corrected ellipsoids after accounting for the measured data. In addition, the measured and true state values are depicted.
Throughout this section, the intersection of the predicted ellipsoids with the degenerate information according to (90) is performed by the application of formula (53). The gap between the outer and inner enclosures for k = 1 indicates the non-negligible influence of nonlinearities for sufficiently uncertain values of x 3,k . For the sake of forecasting the domains of reachable states, only the outer bounds are investigated further in Figures 12 and 13. It can be seen that the smaller measurement uncertainty (92) leads to reduced uncertainty in the state reconstruction. Most noticeable, however, is the fact that the observer becomes also applicable to reconstruct bounds for the disturbance d 3,k in this case which are tighter than their initialization and consistent with the system model as well as the uncertain state observations, cf. Figure 13d.
The disturbance estimation was performed as described at the end of the previous subsection by intersecting the current estimate for the disturbance (after the correction step) with the previously obtained best disturbance bounds.
For the case of temporally varying disturbances, this procedure has to be modified. Instead of intersecting the bounds from previous time steps, it would be necessary to account for worstcase variations of the disturbance during the prediction step by inflating the corresponding domains similarly to the influence of process noise in a Kalman filter implementation.
For the time-invariant case, future work can also aim at disturbance reconstruction by accounting for the estimates over a window of multiple time steps k and to find a common solution for the resulting set of algebraic constraints which are obtained when evaluating the state Equations (89) in which both x i,k and x i,k+1 are replaced by the outcomes of the respective correction steps.

Conclusions and Outlook on Future Work
In this paper, a thick ellipsoid state estimation procedure was presented which allows for a computation of outer and (if the uncertainties are not too large) inner ellipsoidal enclosures. The advantage of the presented technique over other ellipsoidal bounding approaches such as those in [19,56] is the applicability to general (differentiable) nonlinear state equations (in this paper, in quasi-linear form) as well as its reduced complexity by using a solution technique in which complex minmax optimization procedures are replaced by simple one-parameter optimizations which only require the online computation of eigenvalues.
In future work, a combination of stochastic and set-valued uncertainty models can be investigated using the novel thick ellipsoid definitions. Other existing techniques such as those presented in [61] also make use of a Kalman filter-like structure. However, they are mainly focused on linear measurement equations. This can be circumvented by the proposed technique if the system's output equations are reformulated in a quasi-linear form and the influence of nonlinearities is mapped onto the uncertainty that represents the measurement noise.
In addition, the simulation results in Section 5 have shown that the observer approach is capable of reconstructing bounded disturbances. This property can be exploited in future work also for an observer-based parameter identification. Finally, the thick ellipsoid-based state prediction can be employed directly for a numerical evaluation of classical Luenbergerlike observers and Extended Kalman Filters. With these results, it will become possible to perform a stability analysis of these estimation schemes when applied to nonlinear dynamic systems. The procedure will be similar to the one proposed in [33], where a centered-form representation of discrete-time dynamic systems was employed for the derivation of stability contractors.

Author Contributions:
The algorithm was designed jointly by A.R., A.B., and L.J. and implemented as well as validated numerically by A.R. The illustrations were made by A.R. and A.B. The paper was jointly written by A.R., A.B., and L.J. All authors have read and agreed to the published version of the manuscript.
Funding: This research received no external funding.

Conflicts of Interest:
The authors declare no conflict of interest.