Boel, René

English

Crossref

Distributed on-line analysis of discrete event systems: a survey of some recent results

Ghent University Academic Bibliography

Distributed on-line analysis of discrete event systems:a survey of some recent resultsRené BoelSYSTeMS Research Group, Universiteit GentTechnologiepark-Zwĳnaarde 914, B-9052 Gent, Belgiumrene.boel@ugent.beAbstractOn-line supervisory control of large discrete event systems is difficult due to the exponentiallygrowing size of the state space to be enumerated in a naive analysis. This paper surveys severalattempts to reduce the computational complexity, as investigated in some recent papers by theSYSTeMS group of Ghent University. Compositionality and distributed analysis, combinedwith forward and backward generation of unfoldings of the set of feasible trajectories areproposed here as tools for resolving this problem.Keywords – Petri nets, observers, fault detection, backward search, occurrence nets1 Motivation and introductionRecent economical and technological evolutions allow the design of plants with very highperformance. The behaviour of these large man-made plants is often very complicated andsubject to unexpected malfunctions, because the system typically requires the co-operationand co-ordination of many interacting components. Supervisory control of these plants requiresaccurate estimates of the current mode of operation of the plant as a whole. In particular asupervisory agent needs to know whether some components have failed, whether assigned taskshave been executed completely, etc. in order to take the correct decisions. For basic conceptson supervisory control, the reader can consult the book by Cassandras and Lafortune [1] or thelecture notes of Wonham [2].This paper presents a survey of some recent work by the author and his doctoral students,addressing these problems. We assume that the plant evolves over time satisfying constraintsexpressed by an abstract, discrete event dynamical systems model. Different modelling paradigmsmay be used for different components, but in this paper all components are represented by Petrinets. In order to allow model based design of fault detectors, state estimators and supervisors,the model must include a description of those faults that must be reported to the supervisor(we assume that if a fault occurs it is permanent). The occurrence of a fault corresponds tothe execution of a particular event in the Petri net model such that the behaviour of the plantfollowing the fault is undesirable in some sense. Faults, and many other events that modify thestate of the plant, are unobservable to the supervisory agent However some other events areobservable, and we assume in fact that the occurrence of the observable events is always reportedcorrectly to the local control (or fault detection) agent. In other words later observable effects1of the fault allow a supervisory agent to detect that the fault happened at least for a class ofreasonable models, to be considered below.The global plant is represented in this paper by a composition of Petri net components thatinteract with each other by exchanging tokens via boundary places that connect two componentsto each other. The main difficulty is the explosion of the size of the global state space of theplant - essentially equal to the Cartesian product of the local state spaces of each component -and the ensuing inability to use enumeration in order to achieve either off-line or on-line analysis.The purpose of the analysis, as treated in this paper, is to synthesize supervisors that achievecertain global specifications, by observing some events generated by the plant, and performingon-line calculations using these observations in order to disable certain future events that mightlead to unsafe conditions..In order to make the supervisor robust against communication failures, and in order to reducethe computational complexity of the off-line and of the on-line work, the approach proposedin this paper attempts to do as much of the calculations in a local supervisory agent, using aslittle communication exchange between agents as possible. The compositional model allows usto assume that each region has a local supervisor agent that knows the local Petri net model,that observes perfectly and without delay all the local observable events, and that from time totime can exchange messages with agents supervising neighbouring components. Using all theinformation available at time θ the local supervisor must issue local decisions so that certainglobal specifications on the plant behaviour are met. In order to achieve this each agents mustuse its knowledge available at time θ in order to estimate the set of possible values of the globalstate Xθ at time θ and issue decisions that are maintaining the plant in a safe state for everysequence of events that is legal in at least one of the possible current states. This paper surveyssome work by the SYSTeMS group of Ghent University, mainly by G. Jiroveanu, showing thatsuch distributed diagnosers can be synthesized efficiently [3, 4, 5] under reasonable conditions.2 Local Observer designThis section considers one single component of a plant in isolation and shows that forwardunfolding allows the design of on-line state observers. We assume that the reader is familiarwith the Petri net notation N = (P, T , F ) where: P denotes the finite set of places, T the finiteset transitions, with marking m(p),∀p ∈ P representing the state of the plant. Given a PNsystem 〈N ,M0〉 the set of all legal traces in 〈N ,M0〉 is denoted by LN (M0) while the set ofreachable markings is denoted by RN (M0) ={M | ∃τ ∈ LN (M0) s.t. M0 τ−→M}. We assumethroughout this paper that the Petri net is such that all m(p) remain bounded for all allowabletraces of events. The occurrence of events t belonging to the subset To of observable events isreported immediately and without error to the local control agent. Other events in Tu = T \To areunobservable, and are completely silent. The occurrence of unobservable events is not reportedin any way to any agent.An observer combines at time θ the knowledge about the plant model - the constraints encodedin the Petri net - with the observed (and ordered) trace of observable events that have occurredup to time θ. Thus the observer agent knows at time θ the complete model of the plant (themodel of all components, and of their interaction) as well as the order of the occurrence of allthe observable events that were executed up to time θ. If the set of initial states X0 of the plantis known, then the observer calculates, at the time θ1 of the occurrence of the first observableevent t1 ∈ To, the set R(θ1, t1) of all allowable traces (that is: all the traces that satisfy all the2constraints expressed by the model, and that start in an initial marking in X0), consisting ofunobservable events only, except for the last event which must be t1. The set of markings thatare generated by the traces in R(θ1, t1) bring the plant into a state belonging to a new set X1 ofmarkings. The recursive operation of the observer is now obvious. Each time a new observationtn is received at time θn the observer agent combines the new information expressed by the factthat an unobservable trace, satisfying all the constraints expressed by the model and starting in astate belonging to Xn−1 has ended with te observable event tn. This way the observer calculatesa new set R(θn, tn) of possible traces, and a new set Xn of possible states. At each time theobserver enumerates all the states that the plant can be in, given the model constraints and thepast observations.Given the sets R(θn, tn) one can decide whether a fault must have occurred, by checking ifall traces in R(θn, tn) contain a fault event. A fault may have occurred if some of the tracesin R(θn, tn) contain a fault, but one must also take into account that after time θn and priorto the next occurrence of an observable event, some more faults may occur. In order to checkwhether this is possible, the observer must also calculate all the legal traces R(θn, tn). This setcontains all traces satisfying all the model constraints and starting in a state belonging to Xnand executing only unobservable events.The observer design is conceptually easy to understand provided one assumes that a set X0 ofpossible initial states is known. Prior to the execution at time θ1 of the first observed event t1the plant can be in any state that can be reached from any possible initial state by executingonly unobservable events. At the time of the first observed event all those traces of unobservableevents that lead to a state where the observed event t1 is not enabled are discarded. Thisrecursive updating provides a dynamic model of an observer automaton. The state space of theobserver automaton consists of sets of possible states of the plant; the transitions of the observerautomaton are the observable events of the plant, since the state of the observer automatonis updated each time an observable event occurs. Corresponding to the states of the observerautomaton, one can also list the set of traces in the original plant that lead to these states. Thisobserver automaton was introduced by Cieslak et al. [6]. In [7] it has been shown that the size ofthese observers is exponential in the size of the original Petri net model. Moreover in [7] it hasbeen shown that faults can be detected within a finite delay (after the occurrence of at most abounded number of events) provided that the model does not allow unobservable cycles of eventsto be executed (because these cycles could be executed an unbounded number of times withoutever generating an observable effect that would trigger an alarm in the fault detector).The preceding paragraph shows that the size of the state space of the observer automatonsuffers from combinatorial explosion for large plants consisting of many interacting components.One reason is that many events can be executed concurrently, and the set of traces enumerates allpossible orderings of these concurrent events. However this ordering is not relevant for calculatingthe set of possible future legal traces. Unfoldings of a Petri net are Petri nets that generate thesame set 〈N ,M0〉 = LN (M0) of legal traces, but such that the unfolding does not contain anycycles (all the cycles in the original net have been "unfolded", which means that the unfoldingcan be infinite), and every place in the unfolding has only one input transition (which meansthat whenever a place in the original net has k input transitions, then the unfolding contains kcopies of that place). One can show that there also exist finite prefixes of an unfolding, with thesame initial marking as the original net, that generate the same set of traces that are possiblein the original marked Petri net. If one applies this to the Petri net that contains only thosetransitions of N = (P, T , F ) that are unobservable, and that can be executed from the known3initial marking, then one obtains an efficient representation of an observer automaton, avoidingthe enumeration of all possible orderings of concurrent events [3, 5].3 Distributed Fault Detection for a plant with two componentsAnalysing large plants requires that the model be decomposed into several interacting Petri netcomponents. The extension of the above results to a compositional model is easy provided onecan observe all the interactions between the components. In our model this would mean thatcomponents interact only via observable exchange of tokens: if component a sends a token toa place in component b then component b knows exactly where and when this tokens arrived.In practice this interaction is often not observable. This implies that the initial marking of acomponent is not known, since a component may not know whether it has received a token froma neighbouring component or not. Thus the forward unfolding method of the previous paragraphis not feasible.This problem can be solved by using backward search for valid traces explaining a localobservation. Consider the time θ when the first observable event to1 is reported to the observeragent of component a. This observation requires that at some time prior to θ all the input placesof to1 contained at least one token, which in turn implies that at least one unobservable inputtransition of each of these places has been executed prior to θ, in turn requiring that the inputplaces of these transitions were marked prior to θ. Continuing this backward search for tracesthat satisfy the Petri net model constraints, and that explain the first observed event to1, oneeventually reaches a place that is marked by the known initial conditions of the component, orone reaches a boundary place where one can state as a condition that some other componentshould have sent a token to this place prior to θ.Unfortunately this backward search suffers from the same problem as the classical observerautomaton. All concurrent event orderings will be enumerated. Moreover care must be takenwhenever cycles exist in the network, and these cycles contain places and transitions that belongto different components. In [3] it is shown that one can define a backward Petri net model foreach component, and that a minimal backward unfolding (a bounded net without cycles, and noplaces with more than one output transition) can be defined explaining the observation in anefficient way, without repeating equivalent orderings of concurrent event executions.Whenever the backward search ends with a requirement that a token has been received from aneighbouring component, the set of possible traces may be too large. Indeed it is possible thatthe neighbouring agent knows that it could never have transmitted this token. Therefore thelocal fault detection agent may declare faults possible in cases where the global fault detectionagent (that would receive all observable events of all components, and that would know themodel of each component) would know that this fault cannot have occurred. The local diagnosisagent is conservative: it provides an overdiagnosis.In order to avoid this overdiagnosis each agent may exchange messages with its neighbour.Suppose that agent a thinks a fault is possible, but knows that the occurrence of this fault is onlypossible if a token was sent by component b prior to time θn. Then agent a can send a messageto agent b asking if component b could have sent this token prior to θn. If agent b responds thatthis token cannot have been sent to component a then agent a must remove all the traces thatuse this token from its set of possible explanations of the observed event. If agent b respondsthat this token transfer has indeed been possible at some time prior to θn, then agent a acceptsthe fault as possible. The response of agent b may also be that a token may have been sent by4component b provided that agent a had sent a token prior to some earlier time θ′. Both a andb may have to recalculate their set of feasible traces after a preliminary exchange of messages.This may in turn require agent b to ask if other tokens may have been sent by component ato component b, and so on. Under reasonable conditions (no unobservable cycles covering twocomponents) one can show that this round of exchanging messages between two componentsends after a finite number of messages. At the end of the communication round (assuming thatthe state of both component a and component b have not changed in the mean time) both faultdetection agents know whether a fault may have occurred in the component they supervise ifand only if a global fault detection agent would also know this. Thus the local fault diagnosis isas good as the global fault diagnosis immediately after each communication round. In betweencommunication rounds the local fault diagnosis is a pessimistic overdiagosis that may declaresome faults possible that would be excluded by a global diagnoser.4 Extensions and open problemsMany extensions of the porblem are possible (and have only partially been solved). Findinggood protocols for exchanging a finite number of messages between k > 2 agents controlling kcomponents is quite difficult. Finding conditions guaranteeing that a fault will indeed be detectedeventually is also very hard (since this detectability condition depends on the global model, andcan not be checked locally). An important extension is the use of temporal information. Veryoften faults correspond to excessive delay of an event (say a valve receives an instruction "open"but gets stuck). In [3] some methods have been developed for including in the model used bythe fault detector information on the normal delay between the enabling of an event and thecompletion of the corresponding transition . Traces may in this case become illegal becausethe delay in detecting some observable event is too long. This additional information allows formuch more accurate fault detectors, but makes the generation of minimal unfoldings much morecomplicated. Finally assigning probabilities to free choices in the plant evolution may lead topractically much more useful fault detectors, but requires a global calculation in general. Findingspecial structures where the probabilistic calculations can be done locally would be a majorimprovement.5 Bibliography[1] C. Cassandras and S. Lafortune: Introduction to Discrete Event Systems, Kluwer AcademicPublishers, 1999.[2] W. M. Wonham: Supervisory Control of Discrete Event Systems, available on-line at:http://www.control.utoronto.ca/cgi-bin/dldes.cgi[3] G. Jiroveanu: Fault Diagnosis for Large Petri Nets, Ph.D. thesis, Universiteit gent, 2006[4] G. Jiroveanu and R. Boel: Distributed diagnosis for Petri net models with unobservableinteractions via common places, Proceedings of CDC/ECC2005[5] G. Jiroveanu and R. Boel: Distributed diagnosis of large interacting systems, Proceedingsof the 16th International Workshop on Diagnosis (DX05), Monterey, Ca., 2005[6] R. Cieslak, C. Desclaux, A. Fawaz and P. Varaiya: Supervisory control of discrete-eventprocesses with partial observations, IEEE-T-AC-33, no. 3, pp.249-260, 1988[7] M. Sampath, R. Sengupta, S. Lafortune, S. Sinnamohadeen and D. Teneketzis: Diangosabilityof discrete event systems, IEEE-T-AC-40, no. 9, pp.1555-1575, 19955

https://biblio.ugent.be/publication/373210/file/1047024.pdf

Distributed on-line analysis of discrete event systems: a survey of some recent results

Abstract

Similar works

Full text

Available Versions

Crossref

Ghent University Academic Bibliography