Control oriented strategy to consider constraints of the deformable mirror M4 for the Mid-infrared ELT Imager and Spectrograph

Abstract. The Mid-infrared ELT Imager and Spectrograph (METIS) will be equipped with a single conjugate adaptive optics (SCAO) system comprising the deformable mirror M4, the tip–tilt mirror M5, a wavefront sensor, and a modal controller implemented on real-time computers. To prevent any damage to M4 during operation and windup phenomena due to internal checks of M4, its absolute shape, time-discrete change of shape, and inter-actuator strokes are limited. Hence, we present a strategy to consider M4’s Cartesian constraints in the modal METIS-SCAO controller within this conceptual study. This strategy modifies the modal control error before it is fed into the SCAO controller considering the spatio-temporal and segmented characteristics of M4. Additionally, we present three different algorithms realizing this strategy. Furthermore, the presented strategy features the following characteristics, among others: add-on to a previously designed METIS-SCAO controller, no permanent trade-off between performance and constraint compliance, and application of numerically cheap approximating models. Moreover, we verify the functionality of the presented algorithms via standalone and closed loop simulations of the METIS-SCAO system. The simulations show that all presented algorithms work as intended and successfully enforce M4’s constraints. Therefore, the presented strategy and the three corresponding algorithms are applicable to the METIS-SCAO system.


Introduction
As one of the first-light instruments of the Extremely Large Telescope (ELT) [see Fig. 1(a)], the Mid-infrared ELT Imager and Spectrograph (METIS) is currently under development and is expected to be operational in the late 2020s. METIS will search for and characterize exoplanets, proto-planetary disks, as well as low-mass brown dwarfs, among others. It will be equipped with a single conjugate adaptive optics (SCAO) system to compensate for atmospheric and windinduced wavefront disturbances, thereby, fully exploiting the ELT's maximum spatial resolution capability. The METIS-SCAO system (see Sec. 2.1) is a cascaded control loop and comprises the deformable mirror M4 (see Sec. 2.2), the tip-tilt mirror M5, an infrared pyramid wavefront sensor, and a controller implemented on real-time computers. 1,2 M4 is a thin annular mirror composed of six identical independent segments and can adopt arbitrary deformations using 5352 actuators. 2 To prevent any damage to M4 during operation and windup phenomena due to internal checks of M4, its absolute shape, time-discrete change of shape, and inter-actuator strokes (IAS) are limited. Hence, the modal METIS-SCAO controller, the outer controller for the cascaded SCAO system described in Sec. 2.3, must adhere to the constraints of M4 defined in a Cartesian world. In this conceptual study, we will focus on the provision of M4's constraints for *Address all correspondence to Philip L. Neureuther, neureuther@isys.uni-stuttgart.de the modal METIS-SCAO controller without jettisoning the previously developed control scheme.
One of the most used methods to consider input constraints in control loops is anti-windup. Its theory is well established and functions by modifying the (internal) states or inputs of a preexisting controller to prevent windup phenomena in presence of input constraints. [3][4][5][6][7] A similar idea is to switch controllers when operating near an input constraint. 8,9 In contrast to these concepts, the constraints considered in this work refer to the output of M4.
Another highly popular framework for control loops featuring arbitrary constraints is model predictive control (MPC). It has attracted tremendous interest for many decades and the corresponding theory is well established and described extensively. [10][11][12] Variants of MPC potentially applicable to AO systems running at high loop rates ≥500 Hz are explicit MPC (Ref. 12, Ch. 7), distributed MPC (Ref. 12,Ch. 6), and fast solvers for general MPC problems. [13][14][15] However, MPC has been successfully applied only in an AO systems with few degrees of freedom (≤100), requiring a high numerical or algorithmic effort. 15,16 Hence, the design and real-time implementation of MPC for a high-dimension multi-input multi-output (MIMO) system running at high rates, such as the METIS-SCAO system (≈3200 control inputs, loop rate ≤1 kHz), is challenging. A distant cousin of MPC is the well-known linear-quadratic (LQ) controller [cf. (Ref. 17,Ch. 8)], which has been successfully applied to AO systems with input constraints. [18][19][20] The LQ controller minimizes some quadratic objective function and provides a closed-form controller. However, it can only address soft constraints while permanently reducing the overall performance of the control loop [see (Ref. 17,Ch. 8.4) and (Ref. 21,Ch. 13.4)].
The reference governor, also referred to as a command governor, is an add-on for control loops with reference trajectories and controllers designed without regard for constraints. It modifies the loop's reference trajectory to satisfy arbitrary constraints. In the past 35 years, the reference governor has attracted significant interest, and literature overviews are given by Kolmanovsky et al. 22 and Garone et al. 23 The realization of a reference governor can be based on online optimization, 24,25 invariant sets, 26,27 and explicit formulas. 28 However, the METIS-SCAO system rejects arbitrary disturbances, and its reference is always piece-wise constant and usually zero (see Sec. 2.3).
A related but less-known concept is the error governor, which is again an add-on for control loops. It modifies the loop's control error before it is fed into the controller to satisfy arbitrary constraints and is, therefore, a promising concept for the METIS-SCAO controller. The error governor was originally introduced by Kapasouris et al. 29,30 and extended by Tan et al. 31,32 They applied a scalar scaling of the control error to linear time-invariant MIMO control loops and used pure online optimization 29,30 or a combination of pre-calculated sets and (reduced) online optimization 31,32 to obtain the scaling factor. This specific "Kapasouris-Tan type" error governor has been applied to various examples featuring exclusively input constraints, e.g., airplanes, 29,30 helicopter, 31 aerodynamic actuator, 33 throttle valve, 34 rockets, 35,36 platooning of vehicles, 37 and proportional-integral-derivative (PID) controlled single-input single-output (SISO) systems. 38 The Kapasouris-Tan type error governor has been extended to control loops with input constraints and a linear parameter varying controller 39 or an online parameter estimation adapting both the controller and governor. 40 Furthermore, Ozgoli et al. 41,42 calculated the scaling factor for a Kapasouris-Tan type governor, enforcing input constraints, via fuzzy logic instead of optimization to reduce the computational costs. Similar to MPC, the design and real-time implementation of a Kapasouris-Tan type error governor for a high-dimension MIMO system running at high loop rates, such as the METIS-SCAO system, is challenging. Also, it does not take the spatio-temporal characteristics of M4 into account, because local constraint violations results in a global scaling of the relevant M4 segment's control error.
The main contribution of this conceptual study is the presentation of an error-governor-based strategy to consider M4's constraints, defined in a Cartesian world, in the modal METIS-SCAO controller (see Fig. 2). This strategy modifies the modal control error before it is fed into the SCAO controller taking the spatio-temporal and segmented characteristics of M4 into account, hence, it will be referred to as the spatio-temporal error governor (STEG) hereafter. Additionally, we introduce and verify (via simulations) three different algorithms realizing the STEG. Moreover, the STEG features the following characteristics, among others: add-on to the previously designed METIS-SCAO controller, application of estimated SCAO models, no trade-off between performance and constraint compliance, parallelization through segment-wise algorithm evaluation, and algorithms with different characteristics (e.g., computational costs, impact on the SCAO performance). Section 2 briefly introduces the METIS-SCAO system, its components, as well as the reasoning and objectives for the STEG. Subsequently, in Sec. 3, the STEG's working principle and three different algorithms are presented. Section 4 verifies the functionality of the introduced STEG algorithms via standalone and closed loop simulations of the METIS-SCAO system. We summarize in Sec. 5 the presented results and provide directions for future work.

System Description and Objectives
In this section, we briefly introduce the METIS-SCAO system (see Sec For all spatio-temporal signals in this and the following sections regular italic or Fraktur symbols correspond to their representation in Cartesian or modal coordinates, i.e., M4's eigenmodes or tip-tilt, 44,45 respectively (cf., Table 1). Additionally, all wavefront-related and modal signals in the METIS-SCAO controller are calculated considering the ELT's optical layout shown in Fig. 1(b) and the associated optical projections (for detailed information see Ref. 46).

METIS-SCAO System
The METIS-SCAO system depicted in Fig. 2(a) is a cascaded control loop, featuring local control systems for the active mirrors M4 and M5 and rejecting arbitrary wavefront disturbances d to fully exploit the ELT's spatial resolution capability. Using the infrared wavefront sensor of METIS, the wavefront y wf is measured, which is the superposition of the disturbance d (caused by, e.g., atmosphere and wind-induced vibrations) and the correctionsỹ M4∕M5 of the active mirrors M4 and M5. Subsequently, the SCAO controller computes the modal control inputs u M4∕M5 for M4 and M5 at a loop rate up to 1 kHz to reduce the control error e wf ¼ r wf − y wf between the reference and measured wavefront. The reference wavefront r wf is always piece-wise constant and typically zero. Moreover, the correctionsỹ M4∕M5 of the active mirrors result from projecting their doubled mirror shapes 2y M4∕M5 according to the ELT's optical layout [see Fig. 1 METIS's wavefront sensor is an infrared pyramid sensor measuring the incoming wavefront at a rate between 100 Hz and 1 kHz. The tip-tilt mirror M5 is a flat monolithic mirror sized ≈ 2.2 m × 2.7 m providing exclusively slow and large tip-tilt corrections. M5 is actuated by three piezo-electric drives, its tip-tilt position is controlled via a local control system also damping M5's eigenmodes, and its mirror tile is made of silicon carbide. 2

Deformable Mirror M4
The deformable mirror M4 pictured in Fig. 3 is a flat annular mirror composed of six identical independent plate segments. Its reflective annulus has an inner diameter of ≈0.5 m, an outer diameter of ≈2.5 m, and is coated with a thin aluminum layer. 2 Each M4 segment shown in Fig. 4 is flat, uniformly 1.95-mm thick, and made of a glass ceramic. All segments are elastically supported at their outer curved edges via flat springs directly attached to them (see Figs. 3 and 4). These flat springs themselves are clamped to the  support structure (dark gray with green lines in Fig. 3), which in turn is attached to M4's powered mount. Consequently, the springs impede in-plane translations and rotations of the M4 segments while enabling out-of-plane movements on the other hand. Since the M4 segments hover ≈100 μm above the support structure during operation, all other edges of the M4 segments are free and hence M4 consists of six independent annular sectors. 2 The segments can adopt arbitrary mechanical out-of-plane deformations with amplitudes up to AE40 μm and high spatial frequencies utilizing 892 non-contacting voice coil actuators and collocated capacitive sensors per segment. The actuator-sensor pairs are arranged in a triangular grid across each segment as sketched in Fig. 4 and are spaced ≈31;5 mm apart. 2 We conducted a modal analysis of M4 and presented the obtained eigenmodes m k ðr; θÞ of an M4 segment in a previous paper (see also Fig. 5). 47 Due to the finite number of M4 actuators, the modal METIS-SCAO controller can use up to 540 linear independent modes (calculated via a finite element analysis) per segment to correct wavefront disturbances. Among other, the Petersen-Middleton theorem for multidimensional sampling considering M4's actuator pattern was used to determine the reduced set of applicable M4 modes. A detailed description of all methods and characteristics for determining the reduced modal set will be presented in future publications. Accordingly, the modal basis utilized in the METIS-SCAO controller is the union of the segments' modal bases totalling 3240 modes.
M4's shape is controlled via a local control system using the discrete actuator-sensor pairs. Therefore, the spatio-temporal dynamics of the locally controlled M4 segments, modally transformed with their eigenmodes m k , are identical and decoupled MIMO system. The diagonal elements of these MIMO systems are E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 0 1 ; 1 1 6 ; 4 7 2 with the Laplace transform Lf·g, the Laplace variable s, an angular frequency ω ¼ 2953 rad s , a damping factor η ¼ 0.65, a time delay T d ¼ 250 μs, and the modal index k (cf., Ref. 43). All other elements of this transfer matrix of an M4 segment are zero. To prevent any damage to M4 during operation and windup phenomena due to internal checks of M4, the following (mechatronic) constraints are imposed to M4 at all times and also on the full mirror: 1. absolute shape y M4 ∈ L d ¼ ½−40;40 μm (named displacement constraint, subscript d), 2. time-discrete change of shape y M4 ðtÞ − y M4 ðt − 1Þ ∈ L c ¼ ½−10;10 μm ms (named change constraint, subscript c), 3. IAS ∈ L ias ¼ ½−5;5 μm (named IAS constraint, subscript ias).
As the M4 segments are independent, the displacement and change constraints apply to each segment as well as M4 as a whole. Furthermore, the IAS is the stroke or shape difference between neighboring actuators of an M4 segment. Moreover, any violation of these constraints, defined in Cartesian coordinates, depends on all eigenmodes of the respective M4 segment, used in the modal METIS-SCAO controller. Acting as an additional protective mechanism besides the STEG, the aforementioned constraints are rechecked in M4's local control system.
It is worth noting that this paper is a conceptual study and the presented values of the constraints L d , L c , and L ias are tentative data. Additionally, the constraints to be fulfilled or their combination will likely change in the further course of the ELT project, for instance, the IAS will be replaced by the closely related applied forces of M4's actuators in the near future. The STEG and its corresponding algorithms can be easily adapted to accommodate force instead of IAS constraints.

METIS-SCAO Control Concept
Our overarching goal for the METIS-SCAO system is the development of a SCAO controller providing the best wavefront correction to fully exploit the ELT's spatial resolution capability. Since, e.g., METIS-SCAO system features non-negligible spatio-temporal dynamics of M4 and M5 as well as a high number of degrees of freedom (cf., Secs. 2.2 and 4.2), we use the METIS-SCAO controller shown in Fig. 2(b). This SCAO controller was extensively explained in Ref. 43 and it is the outer controller for the cascaded SCAO control loop. The numeric evaluation of the SCAO controller is partitioned among the real-time computers of the ELT (e.g., T tt and K tt;s ) and METIS (e.g., E tt , K hm , and G).
First, in the SCAO controller, the wavefront error e wf is split into its tip-tilt e tt and higher modal (tip-tilt free) e hm components via linear transformations (red blocks). Based on M4's current tip-tilt correctionỹ M4;tt and the error e tt , a modal main-secondary control, featuring decoupled I and PI controllers, computes the tip-tilt control inputs u M5 and u M4;tt , represented in M4's eigenmodes via T tt , for the active mirrors (blue blocks, the main-secondary control has been usually referred to as master-slave control in the past.) In parallel, the modal control input u hm for M4 correcting the higher modal errors e hm is calculated via the STEG G and decoupled modal PI controllers (green blocks).
The STEG is located in the controller branch responsible for the higher modal error e hm and modifies just this error. Moreover, the STEG takes into account M4's tip-tilt command u M4;tt in addition to its shape y M4 and sends a freeze command to M4's tip-tilt controller K tt;m if the STEG is active. Hence, the STEG manipulates the tip-tilt main-secondary control as little as possible while enforcing the constraints of M4 and complies with all technical requirements for the METIS-SCAO control. Additionally, the tip-tilt controllers K tt;m and K tt;s feature integrator and output clipping to prevent excessive control inputs.
Since the M4 segments are independent, the STEG's calculations are performed per segment. Therefore, the higher modal control input u hm may contain a synthetic and quasi-static tip-tilt component if the STEG was active, which is gradually shifted to the main-secondary control via the bleed-off e tt;bo . Furthermore, the STEG is a central component of the METIS-SCAO system and all components of the SCAO controller are numerically evaluated at a loop rate ≤1 kHz.

Reasoning and Objectives
The goal for this conceptual study is the consideration of M4's constraints in the modal METIS-SCAO controller to prevent any damage to M4 during operation and windup phenomena due to internal checks of M4. Moreover, the corresponding strategy shall be a modular add-on to the previously developed SCAO controller (cf., Sec. 2.3) and shall not require a permanent trade-off between control performance and constraint compliance. In the following, we will summarize the reasons to use the STEG (cf., Sec. 1).
We dismissed an anti-windup for the METIS-SCAO controller, because these strategies focus on input constraints, whereas M4's constraints are output constraints, and strongly dependent on the used controller (e.g., modification of controller states). Furthermore, we opted against LQ controllers since they incorporate soft constraints resulting in a permanently reduced METIS-SCAO performance. Moreover, we decided to not use MPC, as the design and real-time implementation of any variant of MPC is challenging for the METIS-SCAO system, being a highdimension MIMO system running at high loop rate. Additionally, MPC is a fully integrated and non-modular control architecture. Since the METIS-SCAO system rejects arbitrary disturbances and its reference is always piece-wise constant, a reference governor is inapplicable.
An error governor is a promising concept to consider M4's constraint, because it is an disentangled add-on to the pre-existing controller and requires no trade-off between performance and constraint fulfillment, for example. Nevertheless, the well-known Kapasouris-Tan type error governor features several drawbacks. First and similar to MPC, the design and real-time implementation of the required online optimization and evaluation of high-dimensional sets and control loop models is challenging. Moreover, a scalar scaling of the control error is detrimental in general, as a potential local constraint violations results in a global scaling of the relevant M4 segment's control error and hence a serve global modification of the segment's shape. Extending this type of error governor to a element-wise modification of the control error would increase the associated numeric workload tremendously. Furthermore, the Kapasouris-Tan type governor requires a precise model of the control loop and its state information. To circumvent the aforementioned disadvantages and exploit the general advantages of the error governor, we developed the STEG being presented subsequently.

Algorithms for the STEG
Before we present the working principle (see Sec. 3.2) and three different algorithms (see Secs. 3.3 to 3.5) of the STEG in detail, we introduce the common notation and terms in Sec. 3.1. Finally, in Sec. 3.6, we summarize the advantages of the STEG and the characteristics of its respective algorithms.
All following variables, definitions, equations, and algorithms apply to one M4 segment since all segments are independent and the STEG's calculations are performed per segment. Furthermore, all modal or Cartesian variables introduced until this point refer hereafter only to the M4 segment under consideration.

Notation
We refer to the area of an M4 segment as S M4 ⊂ R 2 , which is most easily expressed in polar coordinates. The generalized coordinates of an M4 segment are named x ¼ fx 1 ; x 2 g ∈ S M4 . Moreover, M is the linear transformation of M4's shape from its Cartesian to modal (using M4's eigenmodes m k ) representation and M −1 is its inverse. Furthermore, A −1 is the linear transformation from the modal coordinates of M4's shape to the corresponding IAS. We specify the saturation of f, an arbitrary matrix or function, with respect to a convex set L ¼ ½l l ; l u ⊆ R of constraints as E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 0 2 ; 1 1 6 ; 1 6 2 sat L ðfÞ ¼ minðmaxðf; l l Þ; l u Þ; (2) where max and min are the element-or point-wise extremes.
To reduce the computational costs of the STEG, we establish the operators S M4 , S OL , and S OL;c approximating the dynamical behavior of M4 or the interconnection of M4 and K hm . S M4 calculates an upper approximation of the M4 segment's most extreme shape following the current time step t based on the current and past shapes y M4 ðtÞ; y M4 ðt − 1Þ; : : : and tip-tilt control inputs u M4;tt ðtÞ; u M4;tt ðt − 1Þ; : : : , i.e., it is an estimate of M4's dynamic behavior [see, e.g., Eq. (11a)].
Using S M4 , we can define the auxiliary variables c and o E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 0 4 ; 1 1 6 ; 6 4 4 which are the applied change and the pre-existing offset of the M4 segment's shape at an arbitrary time step t, respectively. Note that we drop the time index in the application of the approximating operators for better readability and the scaling factors 1 2 or 2 are due to M4's reflective properties. For the same reason, we name past changes cðt − 1Þ; cðt − 2Þ; : : : (relative to the current time step t) as c p . The offset o is not just the shape y M4 , because the STEG is disentangled from the tip-tilt control and M4's tip-tilt control input must be considered.
The We assume that all approximating operators perform a linear combination of their respective inputs, i.e., they are some modified linear difference equations. Additionally S M4 includes some linear transformations to merge the different modal spaces used, i.e., M4's eigenmodes and tip-tilt. Hence, for the operators which are used in two of the three STEG algorithms. These assumptions are not restricting, because the operators are just approximations and even nonlinear systems may be considered through constantly updating the approximating operators.

Working Principle
The STEG consists of two consecutive steps. At first, the STEG checks for violations of M4's constraints using the approximating operators, the higher modal control error e hm , M4's shape y M4 , and M4's tip-tilt control input u M4;tt . If no (upcoming) violation is detected, the STEG just feeds the control error e hm through [i.e., e hm ðtÞ ¼ e ∼ hm ðtÞ] and the SCAO performance is not impaired. Otherwise, the STEG modifies the control error such that all constraints of M4 will be fulfilled using again the approximating operators and the STEG's input signals. The secondary objective for the modification of the control error is that the measured e hm and the modified error e hm match as closely as possible. Hereafter, the STEG's first step is named constraint check, whereas the second is called error modification.
In the following three sections, we will present different algorithms realizing the twostep STEG procedure. These algorithms feature varying computational costs, implementation efforts, and differences between measured and modified control error (resulting in different performances of the METIS-SCAO system). Furthermore, the two step procedure itself reduces the computational costs of the STEG in general since violations of M4's constraints are rare events.

Optimization-Based Algorithm
To establish a reference case for all algorithms implementing the STEG, we present the socalled optimization-based algorithm in this section. The STEG's constraint check is done by testing the extreme mirror shape and shape change, estimated via the approximating operators, on the M4 segment S M4 (see Sec. 3.3.1). Subsequently, an optimization problem is solved to obtain the modified control errorẽ hm ensuring the fulfillment of all M4's constraints (see Sec. 3.3.2).

Constraint check
The algorithm's first step at each time step t is to check whether M4's constraints will be satisfied on the segment S M4 , if the current control error e hm is passed to the modal controller K hm . For this purpose, the sets E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 0 9 a ; 1 1 6 ; 5 4 5 E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 0 9 b ; 1 1 6 ; 4 8 8 E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 0 9 c ; 1 1 6 ; 4 5 4 are evaluated featuring the set of all IAS S ias and using Eqs. (3) and (4), as well as the approximating operators. Each set corresponds to all (spatial) coordinates, which will likely violate one of M4's constraints in the future. Combining these sets, we obtain E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 1 0 ; 1 1 6 ; 3 9 4 If V ¼ ∅, the algorithm outputsẽ hm ðtÞ ¼ e hm ðtÞ and skips the optimization-based error modification. Otherwise, the error modification is executed.
Remarks. It is worth noting that the check in Eq. (9) is purely spatial, because the temporal dynamics of the METIS-SCAO system are taken into account via the approximating operators. The computational costs of Eq. (9) are usually considerably smaller than predicting the full spatio-temporal behavior of the METIS-SCAO system and checking it for violations of M4's constraints.
The approximating operators for the METIS-SCAO system running at the loop rate ¼ 1 kHz used in this paper are where k M4 ¼ 1.141 is the coefficient associated to M4's dynamic (and its overshooting), k C ≤ 1 (typically = 1) is the coefficient linked to the controller K hm , and E tt is the linear operator extracting the tip-tilt component of a given signal. We derived the approximating operators in Eq. (11) by simplifying and estimating the dynamics of the SCAO system assuming that 1. the velocity of an M4 segment is always rather small (with respect to the loop rate = 1 kHz), 2. the individual controllers (K hm , etc.) do not aim for an instantaneous correction of their respective control errors, 3. the individual controllers (K hm , etc.) do not introduce excessive additional overshooting and oscillations.
It is worth noting that the METIS-SCAO system fulfills all aforementioned assumptions and the operators presented in Eq. (11) provide sufficiently detailed, simple, and conservative approximations of the METIS-SCAO system.

Error modification
Following a constraint check providing a non-empty set of violations V, an optimization problem is solved to obtain the modified control errorẽ hm such that 1. all constraints of M4 will be fulfilled on the M4 segment S M4 , 2. the difference between the required 1 2 M −1 e hm and modified 1 2 M −1ẽ hm change (represented in Cartesian coordinates) is minimized.
The corresponding quadratic problem (QP) at the current time step t is E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 1 2 a ; 1 1 6 ; 5 3 6ẽ hm ↢ arg min subject to Eqs. (3) and (4), and E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 1 2 b ; 1 1 6 ; 4 7 9 E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 1 2 d ; 1 1 6 ; 3 9 0 It is a constrained convex QP and can be efficiently solved via many optimization methods (e.g., interior-point and active set). Note again that the constraints of the QP in Eqs. (12b)-(12d) are purely spatial, significantly reducing the computational costs compared to a QP featuring full spatio-temporal checks for M4's constraint.
Both optimal and sub-optimal solutions of the QP in Eq. (12) will be used as outputs of the optimization-based algorithm since both groups satisfy M4's constraints. Sub-optimal solutions occur when the optimization method cannot satisfy the specified optimality tolerances. If the optimization fails and does not provide an optimal or sub-optimal solution, the algorithm outputs e hm ðtÞ ¼ 0 and we name the algorithm's status "failed." Remarks. Instead of assessing the change difference Δc for the QP objective function Eq. (12a), the deviation between measured e hm and modifiedẽ hm control error can be used for this purpose. However, the error-based objective function kẽ hm − e hm k 2 2 requires an additional transformation increasing the consumption of computer resources. Since e hm ≈ M −1 e hm and e hm ≈ M −1ẽ hm for the METIS-SCAO system, both objective functions for the QP in Eq. (12) are very similar and provide closely matching optimization results.
For the METIS-SCAO system, Eq. (12) features 540 optimization variables and ≈39;000 constraints for one M4 segment. The ≈39;000 constraints consist of ≈5000 IAS constraints as well as displacement and change constraints on ≈17;000 discretization points of the M4's segment S M4 , providing a reasonable Cartesian spatial resolution of ≈7 mm.
To further reduce the computational costs of the QP in Eq. (12), optimization methods with loose optimality tolerances or highly efficient implementations can be used. Since the optimization-based algorithm is the reference case for the other STEG algorithms presented, we use an interior-point method with rather tight tolerances in this paper, typically providing the optimal solution of Eq. (12).

Iterative Heuristic Algorithm
Since a real-time implementation of the optimization-based STEG algorithm is challenging for the METIS-SCAO controller, we present the optimization-free so-called iterative heuristic algorithm. This algorithm conducts the STEG's constraint check by testing M4's extreme shape and shape change on subsets of its segment area S M4 (see Sec. 3.4.1). Afterwards, the error modification is implemented using a set-based iterative procedure (see Sec. 3.4.2).

Constraint check
The algorithm's first step at each time step t is to check, similar to Sec. 3.3.1, whether M4's constraints will be satisfied on subsets of S M4 . Hence, the reduced sets of coordinates likely violating one of M4's constraint in the future are E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 1 3 a ; 1 1 6 ; 5 8 4 where S r;d ⊆ S M4 , S r;c ⊆ S M4 , as well as S r;ias ⊆ S ias are the reduced sets for the check and s ⋆ ∈ R ≥1 are safety factors. Combining these sets, we obtain E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 1 4 ; 1 1 6 ; 4 4 8 If V r ¼ ∅, the algorithm outputsẽ hm ðtÞ ¼ e hm ðtÞ and skips the error modification. Otherwise, the iterative error modification is executed.
Remarks. In general and especially in the case of the METIS-SCAO system, it is sufficient to conduct the constraint check in Eq. (13) on the reduced sets S r;⋆ ⊆ S M4 . By applying the reduced check in Eq. (13) instead of Eq. (9) to the METIS-SCAO system about 50% computation time can be saved. We obtained the reduced sets S r;⋆ by computing several extrema of each M4's eigenmode m k and combining them. The reason for this is that the chances of a constraint violation are particularly high at the locations of the eigenmodes' extrema. Of course, other procedures may be used to calculate the reduced sets S r;⋆ . The safety factors s ⋆ are usually slightly larger than 1 and are intended to tune or improve the detection reliability for constraint violations in Eq. (13). Their respective values strongly depend on the procedure used to obtain the sets S r;⋆ and the desired detection reliability. However, safety factors s ⋆ > 1 may result in false positive violation detections, resulting in a prematurely terminated error modification and no error modification. We tested both checks in Eqs. (9) and (13) with 50,000 random offsets o and control errors e hm , whose elements were normally distributed and featured decreasing amplitudes for increasing modal indices. By specifying a desired error rate for undetected constraint violations ≤1 × 10 −4 , we obtained the safety factors s d ¼ 1.006, s c ¼ 1.005, and s ias ¼ 1.197 for the METIS-SCAO system.

Error modification
If the previous constraint check for the time step t provides a non-empty set V r , a set-based iterative modification of the measured error e hm ðtÞ is performed to obtain the modified error e hm ðtÞ meeting all constraints of M4. The iterative error modification is subdivided into three steps, which are described below: initialization, iterative modification, and scaling fallback.
Constraint violations usually occur just at one or a few small areas of an M4 segment. Therefore, it is reasonable to just modify the measured error e hm or, more specifically, its corresponding change 1 2 M −1 e hm in these small areas such that M4's constraints will fulfilled. This is the basic idea for the presented set-based iterative modification. Iterative modification. After the initialization, the initial change c 0 is repeatedly updated to obtain the modified errorẽ hm ðtÞ, which will not cause any violations of M4's constraints. This iteration comprises Eqs. (16) and (17) featuring the index k ¼ 1; : : : ; N max and terminal index N max . Hence, the initial change c 0 could also be considered as some special ansatz shape used to determine the errorẽ hm .

Initialization. At first, an initial guess for the set-based iterative modification is
At the beginning of the k'th step of the iterative modification, a constraint check is done on the full segment area S M4 E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 1 6 a ; 1 1 6 ; 4 2 6 (16a) using the latest modified change c k−1 . The subsets V k;⋆ and V k;⋆ contain all points x ∈ S M4 violating the corresponding upper and lower limits of L ⋆ , respectively.
the iteration breaks and the iterative heuristic STEG algorithms outputsẽ hm ðtÞ ¼ 2c k−1 . Otherwise, the k'th iteration step is continued and finalized with the sequence of equations E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 1 7 a ; 1 1 6 ; 2 8 2  Here, Δ d;c ∈ R >0 is the modification step for displacement and change violations, Δ ias ∈ R >0 is the modification step for IAS violations, P ias is the IAS projection operator assigning a small surrounding area to each actuator location, and L im ⊊ R is the limiting set for c k . The application of the operator P ias is necessary to guarantee a sufficient influence of each IAS violation to c k and c k . Furthermore, the saturation of c k via the chosen set L im in Eq. (17e) prevents excessive and unreasonable spikes.
It is worth noting that M −1 c k ≠ c k in general, because c k is usually not continuously partially differentiable due to Eq. (17e) (see also Fig. 6). Moreover, this is the reason for applying repetitive modal forward and backward transformations in Eqs. (16) and (17). A modification of Eq. (17), which is beneficial for a significantly reduced number of M4's eigenmodes, is to skip Eqs. (17c) and (17d) if E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 1 8 ; 1 1 6 ; 6 7 5 where F ðVÞ is the operator calculating the area of the set V and k F ∈ ½0;1 is the relative area threshold. Figure 6 shows an example application and the intermediate results of the presented iterative error modification in Eqs. (15)- (17). In this example, the first five eigenmodes m 1;: : : ;5 of M4 are used and a single area with a displacement violation exists. The iterative heuristic STEG algorithms successfully terminates during iteration step k ¼ 3, because V 3 ¼ ∅, and outputs e hm ðtÞ ¼ 2c 2 . Fig. 6 Iterative modification of the iterative heuristic STEG algorithm for an example featuring a small area with displacement violation. Each lower subplot already displays the violation area, which will be determined in the next iteration step. ---: border of the area V k;d .
Scaling fallback. In the rare case that the iterative modification conventionally ends after the final iteration N max and consequently provides no reasonable outputẽ hm ðtÞ for the STEG, the fallback step is executed as explained below. The scaling fallback, as its name already implies, calculates the modified control errorẽ hm ðtÞ by scaling the measured error e hm ðtÞ. The scalar scaling factor k s is determined via explicit equations, unlike in the optimization-based Kapasouris-Tan type error governor.
To calculate the scaling factor k s for the fallback at the current time step t, we first calculate the auxiliary shapes E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 1 9 a ; 1 1 6 ; 6 2 9 using Eqs. (3) and (4), and the approximating operators. In Eq. (19) O ⋆ corresponds to the approximated behavior of M4 without the influence of the control error e hm and C ⋆ to the respective influence of e hm , both defined in Cartesian coordinates on M4's segment area S M4 . Subsequently, the intermediate scaling factors k ⋆ ∈ R and k ⋆ ∈ R for the upper and lower limits of each violation type are computed E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 2 0 a ; 1 1 6 ; 3 7 8 E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 2 0 b ; 1 1 6 ; 3 2 0 with max x 1 x 2 and min x 1 x 2 providing the global maximum and minimum of their corresponding input, respectively. Based on the intermediate scaling factors, the overall scaling factor E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 2 1 ; 1 1 6 ; 2 7 0 k s ¼ maxðfk d ; k d ; k c ; k c ; k ias ; k ias ; 1gÞ; (21) for the fallback at the time step t is calculated. The basic idea for this derivation of the scaling factor k s is that Eq.
and E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 2 3 ; 1 1 6 ; finalizing the scaling fallback at the current time step t. If the algorithm ends with the upper case of Eq. (22) active, we call its status "failed." Remarks. In the iterative heuristic STEG algorithm, neither the difference between the measured e hm and modifiedẽ hm control error nor the change difference Δc are considered explicitly. Nevertheless, the presented algorithm can provide a nearly optimal change difference Δc with respect to Eq. (12a) (see Sec. 4.1), depending on the selected tuning parameters (Δ d;c , Δ ias , P ias , L im , k F ). The search for a suitable parameter configuration for the iterative-heuristic STEG algorithm is usually done through parameter simulation studies to benchmark and adjust the overall behavior of the algorithm. Furthermore, the algorithm's overall behavior and a proper setting of its tuning parameters strongly depends on the number of applicable M4's eigenmodes m k . Besides the parallel evaluation of the STEG for all M4 segments, the modification of the control error for one segment can be performed independently with different parameter settings in parallel and the first reasonable result is output by the STEG.

Scaling Heuristic Algorithm
To reduce the computational costs of the STEG algorithm as compared to the iterative heuristic algorithm (described in Sec. 3.4), we present the scaling heuristic algorithm. This algorithm is a heavily streamlined version of the iterative heuristic algorithm using its reduced constraint check and the scaling-based error modification.

Constraint check
The constraint check conducted by the scaling heuristic algorithm at each time step t is identical to the check described in Sec. 3.4.1 [cf. Eqs. (13) and (14)], because this approach is very computationally efficient. If the constraint check provides V r ¼ V r;d ∪ V r;c ∪ V r;ias ¼ ∅, the algorithm outputsẽ hm ðtÞ ¼ e hm ðtÞ and skips the error modification described in the next paragraph.

Error modification
If a potential violation of M4's constraints is detected at a time step t, the error modification to obtainẽ hm ðtÞ is realized as the scaling fallback step of the iterative heuristic algorithm [cf., Eqs. (19)- (22)]. This approach features low computational costs since no optimizations or iterations take place. Furthermore, an additional constraint check on the full segment area S M4 is not necessary, because Eqs. (21) and (22) contain an implicit check.
Remarks. The scaling error modification is linked with the working principle of the Kapasouris-Tan type error governor, but does not solve an online optimization. As it scales the control error, the scaling heuristic algorithm does not consider the spatio-temporal characteristics of M4 usually resulting in considerably higher change differences Δc (see Sec. 4.1) compared to the other algorithms.

Characteristics of the STEG
The STEG in general provides the following benefits for the METIS-SCAO system: 6. No state observer for the SCAO system required. 7. Consideration of the spatio-temporal characteristics of M4. 8. Computational parallelization through segment-wise STEG evaluation.
In particular, the benefits no. 4 to 8 distinguish STEG and the Kapasouris-Tan type error governor.
Moreover, the computational costs and implementation effort of the presented STEG algorithms vary significantly. Regarding both categories, the optimization-based algorithm is very costly (especially for the METIS-SCAO system, cf., Sec. 3.3.2), whereas the iterative heuristic algorithm is moderately complex and the scaling heuristic algorithm is inexpensive. Furthermore, the optimization-based algorithm will usually provide the smallest change differences Δc, whereas the scaling heuristic will typically provide the highest differences (cf., Sec. 4). Additionally, the presented STEG algorithms can be easily adapted to accommodate constraints other than the ones considered in this paper, such as limited forces of M4's actuators.
Since the STEG algorithms operate independently on each M4 segment, their activity might generate some synthetic tip-tilt in the control input u hm that is gradually shifted to the mainsecondary control of the METIS-SCAO controller via the tip-tilt bleed-off e tt;bo (see Fig. 2 and Sec. 2.3). Depending on the actual use case of the STEG, other combinations of the presented constraint checks and error modifications may be beneficial (e.g., check on full segment and scaling-based modification).

Simulations of the STEG Algorithms
In the following section we verify the functionality of the introduced STEG algorithms via standalone simulations (see Sec. 4.1) and closed loop simulations of the METIS-SCAO system (see Sec. 4.2). Since this paper is a conceptual study, the STEG algorithms will not be compared with alternative frameworks enforcing constraints. For the same reason, we will not derive any recommendations to implement a specific STEG algorithm on the METIS real-time computer. These aspects are currently under investigation using detailed simulations and the corresponding results will be presented in future publications.

Standalone Simulations
The purpose of the standalone simulations is to obtain a comprehensive overview of the algorithms' behavior. In the standalone simulations, the STEG algorithms are supplied with 20,000 random offsets o and errors e hm for an M4 segment and subsequently the results of the algorithms are compared. The elements of the offsets o and errors e hm are normally distributed and feature progressively smaller standard deviations for increasing modal indices k. Moreover, the offsets o are modified to meet the displacement and IAS constraints of M4 before they are fed into the simulation. The synthetically generated offsets o and errors e hm are not associated with some specific observation conditions at the ELT site, because no representative information on operating conditions resulting in guaranteed violations of M4's constraints is available. Additionally, these synthetically generated offsets and errors encompass all combinations and highly variable constraint violations corresponding to th aforementioned simulation goal. Additionally, the STEG algorithms use 540 M4's eigenmodes m k for the segment under investigation and are implemented in MATLAB except for the optimization in Eq. (12) solved by Gurobi. 48,49 Table 2 reports the 5%, 50%, and 95% percentiles of the relative objective functions kΔck 2 2 [cf., Eq. (12a)], referring to the optimization-based algorithm, obtained in the standalone simulations. The objective function kΔck 2 2 is a good indicator for difference between the measured e hm and modifiedẽ hm control error, and hence Table 2 indicate the relative impact of the STEG algorithms on the SCAO performance (see also Sec. 4.2). Furthermore, the standalone simulations revealed that the iterative heuristic algorithm typically completes its computations ≫10 times faster and the scaling heuristic algorithm ≫100 times faster than the optimization-based STEG algorithm on the same computer.
The obtained results highlight the importance to consider M4's spatio-temporal characteristics, because the scaling heuristic algorithm applies a global error modification, whereas the other algorithms modify the control error just locally. Moreover, the standalone simulations indicated that the optimization-based algorithm will introduce the lowest degradation of SCAO performance if active, while the scaling-heuristic algorithms will introduce the highest degradation (see also Sec. 4.2). Furthermore, the simulation results of the iterative heuristic algorithm strongly depend on the tuning parameters (Δ d;c , Δ ias , P ias , L im , and k F ), which we selected to provide a good compromise between the computation time and objective function kΔck 2 2 .

Closed Loop Simulations
In the closed loop simulations, the functionality of the STEG and its algorithms within a METISlike SCAO system (cf., Fig. 2 and Sec. 2) is verified. These simulations are conducted in a modified version of the AO simulation tool COMPASS, 50 extended by the METIS-SCAO controller described in Sec. 2.3 and the full STEG for all M4 segments. In particular, the SCAO controller and the STEG are implemented in MATLAB and Gurobi. 48,49 In Ref. 43, we presented similar closed loop simulations without constraints characterizing the general behavior of the METIS-SCAO system. The closed loop simulations features a round 37 m pupil with a round 11 m central obstruction as well as six equally spaced spiders of 0.5 m width. Furthermore, atmospheric and synthetic wavefront disturbances are present. The atmospheric disturbances are represented by a 35-layer model, corresponding to medium observation condition at the ELT site and resulting in no violations of M4's constraints. To push M4 toward and beyond its constraints, the synthetic disturbances are applied in the simulations, which correspond to erroneous wavefront reconstructions (e.g., piston) or mechanical shocks of the ELT and METIS (e.g., tip and defocus) defined in Zernike modes (cf., Refs. 44 and 45) over the entire pupil. The disturbed wavefront is sensed and reconstructed at the wavelength ¼ 2.2 μm with a normally distributed error featuring rms ¼ 150 nm. Moreover, all communication and computation delays of the METIS-SCAO system account for a total time delay ¼ 2 ms.
We designed the transfer functions of the modal controllers K hm , K tt;m , and K tt;s within the METIS-SCAO controller (cf., Fig. 2) for the closed loop simulations as E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 2 4 a ; 1 1 6 ; 2 6 6 E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 2 4 b ; 1 1 6 ; 2 1 2 where z is the discrete-time variable and k is the modal index. Moreover, we model M5, including its local control system, as a decoupled tip-tilt actuator using the modal transfer functions E Q -T A R G E T ; t e m p : i n t r a l i n k -; e 0 2 5 ; 1 1 6 ; 1 6 7 with the angular frequency ω ¼ 62.8 rad s and internal time delay T d ¼ 250 μs included in the overall delay of 2 ms (cf., Ref. 43). Furthermore, we represent M4 using its modal model described in Sec. 2.2 and limit M4's tip-tilt to AE2 as via integrator and output clipping of M4's tip-tilt controller K tt;m . All components of the simulations are evaluated at 10 kHz except the METIS-SCAO controller running at 1 kHz.  Figures 7 and 8 show the results of the closed loop simulations. We split the simulations into two batches with IAS constraint disabled (see Fig. 7) and enabled (see Fig. 8), because not all constraints of M4 can be tested in one simulation setup using the low-order disturbances motivated above. Moreover, the depicted results adopt the operators' coefficient k C ¼ 0.6 since the STEG would limit the actual change of M4's shape very conservatively for k C ¼ 1 and k C ¼ 0.6 is an adequate choice for all reasonably tuned controllers K hm . The STEG status for the entire mirror M4 is obtained as follows from the algorithm states for the individual M4 segments: 1. "fail": at least one algorithm instance ended with the status "failed," 2. "on": at least one algorithm instance performed an error modification, but no instance ended with the status "failed," 3. "off": no algorithm instance performed an error modification.
The simulation results show that the STEG and its algorithms are working as intended by successfully enforcing M4's constraints, preventing any windup phenomena and not impairing the SCAO performance if all constraints of M4 are inactive (cf., Sec. 2.4). Furthermore, the wavefront error e wf and the SCAO performance with active constraints degrades significantly for all STEG algorithms due to the synthetic disturbances. In particular, the scaling heuristic algorithm causes the highest performance degradation, whereas the impact of the iterative heuristic algorithm is marginally worse than that of the optimization-based one (cf., Sec. 4.1).
Some violations of M4's constraint are perceptible, caused by a high velocity of M4 and the violated assumptions used to derive the STEG's approximating operators. However, all STEG algorithms recover from the constraint violations caused by the applied synthetic disturbances. Additionally, the used approximating operators can be selected differently to better represent the METIS-SCAO system for such rare circumstances. Fig. 7 Results of the closed loop simulations with enabled M4's constraints except the IAS constraint. Note that no synthetic tip-tilt is calculated if the STEG is on. The most extreme modal amplitudes of the normalized synthetic disturbances are inscribed in the corresponding plot. Blue lines: optimization-based algorithm; red lines: iterative heuristic algorithm; green lines: scaling heuristic algorithm; dash-dotted lines: M4's constraints. For tip-tilt plots: tip is solid, tilt is dashed, and arcsec stands for arcsecond. Fig. 7 presents a much higher and quasi-static extreme displacement of M4 for the optimization-based and iterative heuristic algorithms compared to the scaling heuristic algorithm. This quasi-static displacement appears on the non-illuminated outer region of M4 after the STEG was active and results in high values of the extreme IAS. Since the IAS constraint is disabled in the corresponding batch of simulations and no other constraint is violated, the quasistatic extreme displacement persists on the non-illuminated M4 region in contrast to the simulations with an enabled IAS constraint.

Moreover,
Furthermore, all STEG algorithms properly cooperate with the tip-tilt limits imposed on the tip-tilt controller K tt;m . Additionally, only the scaling heuristic algorithm finished with the status "failed" in the simulations, i.e., the upper case of Eq. (22) was activated, and generated significant amounts of synthetic tip-tilt in the (tip-tilt free) control input u hm . It is also worth mentioning that for the tip-tilt disturbances in Fig. 8, the iterative heuristic algorithm is inactive sooner than the optimization-based algorithm due to the iterative non-optimal error modification.
Combining the depicted results and the previous discussion, the STEG and all three algorithms presented successfully enforce M4's constraints and are applicable to the METIS-SCAO controller. A recommendation whether and which STEG algorithm should be implemented on the METIS real-time computer depends on trade-off analysis (e.g., computational costs, impact on SCAO performance for active constraints) currently in progress.

Conclusion
In this paper, we presented the STEG and three corresponding algorithms to consider M4's constraints, restricting its absolute shape, temporal change of shape, and IAS, in the modal METIS-SCAO controller. The STEG modifies the control error before it is fed into the SCAO controller to enforce M4's constraints considering the spatio-temporal and segmented characteristics of M4. The three STEG algorithms, based on either an optimization, an iterative error modification, or a scaling of the control error, feature different characteristics such as computational costs. Following the presentation of the STEG and its algorithms, we successfully verified the functionality of the algorithms via standalone and closed loop simulations of the METIS-SCAO system. These simulations showed that all STEG algorithms work as intended and successfully enforce M4's constraints, with the algorithms impacting SCAO performance for active constraints to varying levels.
The STEG is a modular add-on to the previously designed METIS-SCAO controller and requires no permanent trade-off between performance and constraint compliance. Furthermore, the STEG algorithms apply numerically cheap approximating operators instead of detailed models of the METIS-SCAO system and does not require a state observer for the SCAO system. Moreover, the STEG considers the spatio-temporal characteristics of M4 and its evaluation can be easily parallelized through the segment-wise execution of the algorithms. Due to the aforementioned benefits, the availability of three different algorithms and the positive simulation results, the STEG and its algorithms are applicable to for the METIS-SCAO controller.
To further reduce the computational costs of the optimization-based STEG algorithm and since sub-optimal solutions of the associated QP provide reasonable STEG outputs, we will study the effects of loose optimality tolerances and different optimization methods. Additionally, we want to improve the determination procedure for the reduced subsets of an M4 segment, used for the constraint checks within the iterative and scaling heuristic STEG algorithms. Finally, we will search and investigate extensions to the iterative and scaling heuristic algorithms adapting the algorithms' tuning parameters and/or reduced sets during operation to improve their numerical performance.