Abstract: The architecture of the controller of the present invention is mainly composed of three portions, which are a model predictive controller, a local controller (also called stably assistant controller), and a coordinator. This modified model predictive control structure merges two control loops by a coordinator. The control mode can be switched into either of them or provide a combined control action by adjustments of the coordinator. When the system moves out the range of the database, the coordinator will automatically detect the fault and switch to the stably assistant controller to provide the basic control quality to ensure the safety.