Centrum voor Wiskunde en Informtic REPORTRAPPORT Supervisory control for nondeterministic systems A. Overkmp Deprtment of Opertions Reserch, Sttistics, nd System Theory BS-R9411 1994
Supervisory Control for Nondeterministic Systems Ard Overkmp CWI P.O. Box 94079, 1090 GB Amsterdm, The Netherlnds Astrct In this pper we present the rst results of our ttempt to set up supervisory theory for nondeterministic discrete event systems. The supervisory control prolem for nondeterministic systems is specied nd motivted. A necessry nd sucient condition for the existence of supervisor is derived. Also n lgorithm is presented tht will utomticlly generte supervisor. The results re extended to del with uncontrollle events. AMS Suject Clssiction (1991): 68Q75, 93B25 Keywords & Phrses: Nondeterministic Discrete Event Systems, Filure Semntics, Supervisory Control. 1. Introduction Up till now discrete event systems hve een mostly modelled s deterministic systems. The current stte nd the next event uniquely determine the next stte. Deterministic systems re eectively descried y the lnguge they cn generte. Conditions under which supervisor exists nd the ehvior of the controlled system re lso stted in lnguge context. But in cse of prtil oservtion (nd prtil speciction) systems re more ppropritely modelled s nondeterministic systems. It is not sucient to descrie nondeterministic systems only y the lnguge they generte. The locking properties of the systems re lso importnt [5]. Consider the following exmple. Given two systems, A nd B (Fig. 1, ). A is nondeterministic nd B is its deterministic equivlent. The lnguges tht the systems cn generte re the sme, ut when connected to system C, (Fig. 1 c) AjjC cn dedlock ut BjjC cn not (Fig. 1 d, e). ^ c?? : A? c ^ : B? c: C ^? d: AjjC? e: BjjC Figure 1: Illustrtion of the dierence etween nondeterministic nd deterministic system. The prolem tht we re trying to solve in this pper is the following. Given nondeterministic system nd nondeterministic speciction, nd supervisor such tht the controlled system ehves ccording to the speciction. Here 'ehves like' mens tht the controlled system my only do wht the speciction llows, nd tht it my only lock n event if the speciction cn lso lock tht event. A new spect in this setup is tht the speciction my lso e nondeterministic. This gives the possiility to specify tht some nondeterminism is still llowed in the controlled system. In Section 3 n lterntive for lnguge semntics will e introduced: filure semntics [1, 4]. It is commonly used semntics in computer science. We will use it to stte necessry nd sucient conditions for the existence of supervisor such tht the controlled system ehves ccording to the
2 speciction. An lgorithm to utomticlly generte supervisor will e presented. In Section 5 these results will e extended to del with uncontrollle events. 2. Nottion nd Definitions Definition 2.1 (Finite Stte Mchine) A (nondeterministic) nite stte mchine (FSM) is four tuple (Q; ; ; Q 0 ) where, Q is the stte spce, is the set of event lels, : Q! 2 Q is the trnsition function, nd Q 0 Q is the nonempty set of initil sttes. The domin of the trnsition function cn e extended in nturl wy to strings nd sets of sttes. Let A = (Q ; ; ; A 0 ) e FSM, A Q, q 2 Q, 2, nd s 2. We dene { (q ; ") = q, { (q ; s) = ( (q ; s); ), { (A; s) = S q2a (q; s). For nottionl convenience we will use the stte mchine itself s n rgument insted of the initil sttes. (A; s) = (A 0 ; s). For deterministic nite stte mchine (DFSM) (q; s) is lwys singleton set. In this cse we will write q 0 = (q; s) insted of fq 0 g = (q; s). Also, we will simply write the initil stte insted of singleton set contining the initil stte. A useful function is the out-function, which descries the outgoing rcs of stte. out(q) = f 2 j (q; ) 6= ;g: The set of trces, or lnguge, generted y FSM is dened s L(A) = fs 2 j (A; s) 6= ;g. A lnguge is prex closed if sv 2 L ) s 2 L. All lnguges generted y FSM re prex closed. Control will not e enforced y control mp s in the Rmdge-Wonhm pproch, ut y synchroniztion on common events. The controlled system (i.e. the synchronous composition of the plnt nd the supervisor) cn only execute those events tht oth the supervisor nd the plnt cn execute. Definition 2.2 (Synchronous Composition) Let A = (Q ; ; ; A 0 ) nd B = (Q ; ; ; B 0 ). The synchronous composition of A nd B is AjjB = (Q Q ; ; ; A 0 B 0 ) where ((q ; q ); ) = (q ; ) (q ; ). Note tht for Q Q ; Q Q : ; Q = Q ; = ;. The next lemm is direct result from the denition. Lemm 2.3 For FSMs A; B, nd s 2 ; 1. (q ; q ) 2 (AjjB; s), q 2 (A; s) ^ q 2 (B; s) : 2. For (q ; q ) 2 (AjjB; s) out((q ; q )) = out(q ) \ out(q ) : 3. L(AjjB) = L(A) \ L(B) : 3. Filure Semntics In the introduction we lredy rgued tht the lnguge lone does not provide enough informtion for nondeterministic systems. The locking properties of the systems re lso importnt. In computer science filure semntics is introduced to del with such prolems. In filure semntics system is not only descried y the trces it cn generte ut lso y the set of events tht it cn lock fter trce (fil to execute). We will not elorte on it here. The reder is referred to [1, 4] for more informtion. We will only dene wht we need nd show tht it ts our interests. First, let us dene wht we men y locking. In the speciction it my e stted tht fter certin trces the system is llowed to lock, ut fter other trces it my not. So we hve to dene nonlockingness with respect to n lredy executed trce.
3 Definition 3.1 (Blocking) Let A e FSM nd s 2 L(A); A is nonlocking fter s if 8q 2 (A; s) out(q ) 6= ;. A FSM A is nonlocking if it is nonlocking fter ll s 2 L(A). As stted in the introduction, the controlled system my only do wht the speciction llows nd it my only lock n event if the speciction cn lso lock tht event. Becuse the speciction is nondeterministic it is possile tht sometimes n event is locked in one rnch of nondeterministic choice nd llowed in nother rnch. So, the controlled system hs the choice to either lock or execute tht event. Becuse of this freedom the system does not hve to e equivlent to the speciction. It only hs to reduce (implement) it [2, 3]. Definition 3.2 (Reduction) Let A; B e FSMs; A reduces B (A < B) if i) L(A) L(B), nd ii) 8s 2 L(A); 8q 2 (A; s); 9q 2 (B; s) s.t. out(q ) out(q ). Here, point i sttes tht system A my only do wht system B llows, nd point ii sttes tht A my only lock wht B cn lso lock. The reduction reltion gurntees tht the controlled system does not lock in n environment if the speciction does not lock in the sme environment. This is formlly stted in Theorem 3.3. Theorem 3.3 Let A; B e FSMs such tht L(A) L(B). For ll FSM C nd s 2, BjjC nonlocking fter s implies AjjC nonlocking fter s, if nd only if A < B. Proof (if prt) if A < B then 8q 2 (A; s) 9q 2 (B; s) s.t. out(q ) out(q ). If BjjC is nonlocking fter s then, y Lemm 2.3, 8q c 2 (C; s) out(q ) \ out(q c ) 6= ;. Then lso AjjC is nonlocking fter s ecuse out(q ) \ out(q c ) out(q ) \ out(q c ) 6= ;. (only if prt). We will prove tht if A does not reduce B then there exists FSM C nd string s such tht BjjC is nonlocking fter s, ut AjjC cn lock fter s. If not A < B then 9s 2 L(A); 9q 2 (A; s) s.t. 8q 2 (B; s) out(q ) 6 out(q ). Let C e DFSM such tht q c = (C; s) with out(q c ) =? out(q ). Then 8q 2 (B; s) out(q ) \ out(q c ) = out(q ) \ (? out(q )) = out(q )? out(q ) 6= ;. But out(q ) \ out(q c ) = out(q ) \ (? out(q )) = ;. 2 4. Controller Synthesis In this section we will rst stte under wht condition there exists supervisor such tht the controlled system reduces the speciction. We will cll this condition reduciility. Then, n lgorithm will e presented tht genertes such supervisor. In the following G will denote n uncontrolled system nd E speciction. Definition 4.1 (Reduciility) Let G; E e FSMs. A lnguge K is reducile (w.r.t. G; E) if 8s 2 K; 8q g 2 (G; s); 9q e 2 (E; s) s.t. out(q e ) out(q g ) \ f 2 js 2 Kg: Lemm 4.2 Let G; E e FSMs. Let S e DFSM such tht L(S) is reducile. Then GjjS < E. Proof (Point i of the denition of reduction) If s 2 L(S) \ L(G) then (G; s) is not empty. So, y the denition of reduciility, there exists q e 2 (E; s). Hence s 2 L(E), nd L(GjjS) L(E). (Point ii of the denition of reduction). For s 2 L(GjjS) let (q g ; q s ) 2 (GjjS; s), then, y Lemm 2.3, q g 2 (G; s) nd q s = (S; s). Becuse S is deterministic f 2 js 2 L(S)g = out(q s ). Then, y reduciility of L(S), we know 9q e 2 (E; s) such tht out(q e ) out(q g ) \ out(q s ). Hence lso, y Lemm 2.3, out(q e ) out((q g ; q s )). 2 Theorem 4.3 Let G; E e FSMs. There exists supervisor S such tht GjjS < E if nd only if there exists nonempty, prex closed, nd reducile lnguge K.
4 Proof (if prt) Let S K e deterministic stte mchine generting K. The proof follows directly from Lemm 4.2. (only if prt). Let K = L(SjjG). Then K is nonempty nd prex closed. We will prove tht K is reducile. 8s 2 K; s 2 L(SjjG), so (SjjG; s) 6= ;. Then, y lemm 2.3, (G; s) 6= ; nd (S; s) 6= ;. Thus 8s 2 K; 8q g 2 (G; s) 9q s s.t. (q g ; q s ) 2 (GjjS; s). By the denition of reduction 9q e 2 (E; s) s.t. out(q e ) out((q g ; q s )). By lemm 2.3 out((q g ; q s )) out(q g ). And y construction of K out((q g ; q s )) f 2 js 2 Kg. So, out(q e ) out(q g ) \ f 2 js 2 Kg. 2 Algorithm 4.4 The following lgorithm will construct supervisor (if it exists) such tht the controlled system reduces the speciction. 1. Generte deterministic stte mchine R 0 = (Q 0 r ; ; 0 r ; R0 0), where Q 0 r = 2 Qg 2 Qe ; R 0 0 = (G 0 ; E 0 ) ; 0 (g (G; ); r ((G; E); ) = e (E; )) ; if g (G; ) 6= ; ^ e (E; ) 6= ; ; empty ; otherwise : 2. Construct R i+1 from R i y removing ll rechle sttes q i r = (G; E) i (including its in- nd out-going trnsitions) from the stte spce of R i tht do not stisfy the following condition, 8q g 2 G 9q e 2 E s.t. out(q e ) out(q g ) \ out(q i r) : 3. Repet the previous step until ll rechle sttes stisfy the condition or until there re no more rechle sttes left. Let R e the lst R i. Theorem 4.5 Let G nd E e FSMs. Then Algorithm 4.4 produces DFSM R in nite numer of steps. If the stte spce of R is nonempty then GjjR < E. If the initil stte is removed from R then no supervisor exists such tht the controlled system reduces the speciction. Proof (The lgorithm stops in nite numer of steps) If in one step of the lgorithm no stte is removed, then the lgorithm stops ecuse ll sttes stisfy the condition. If in every step t lest one stte is removed from the stte spce then the lgorithm will eventully hlt ecuse the stte spce is nite. (The lgorithm returns correct solution). We will proof tht when the lgorithm nds solution then L(R) is reducile. And thus, y Lemm 4.2, GjjR < E. Let s 2 L(R) nd q r = (G; E) = (R; s). Then G = (G; s), E = (E; s), nd ecuse R is deterministic out(q r ) = f 2 js 2 L(R)g. Then, y step 3 of the lgorithm, 8q g 2 (G; s) 9q e 2 (E; s) s.t. out(q e ) out(q g )\out(q r ) = out(q g )\f 2 js 2 L(R)g. (The lgorithm nds solution if one exists). Assume there exists nonempty, prex closed, nd reducile lnguge K. First, we will prove tht K 0 = K \ L(G) is lso nonempty, prex closed nd reducile. Then we will prove tht K 0 L(R). Thus the lgorithm will return nonempty solution. Becuse " 2 K nd " 2 L(G), K \ L(G) 6= ;. Becuse K nd L(G) re prex closed, sv 2 K \ L(G) ) s 2 K ^ s 2 L(G) ) s 2 K \ L(G). So K 0 is prex closed. By reduciility of K, 8s 2 K \ L(G); 8q g 2 (G; s); 9q e 2 (E; s) s.t. out(q e ) out(q g ) \ f 2 js 2 Kg = out(q g ) \ f 2 js 2 K \ L(G)g. So K 0 is lso reducile. Now, we will prove y induction on the numer of steps of the lgorithm tht K 0 L(R i ) for ll i. So, lso K 0 L(R). Initil step: 8s 2 K 0 ; s 2 L(G). Then, y reduciility, (E; s) 6= ;. So s 2 L(E), nd K 0 L(G) \ L(E) = L(R 0 ).
5 Inductive hypothesis: K 0 L(R i ). Let s 2 K 0 nd q i r = (R i ; s). By the hypothesis, s 2 K 0 ) s 2 L(R i ) ) (R i ; s) = R i(q i r ; ) 6= ; ) 2 out(qr). i So, f 2 js 2 K 0 g out(qr). i By reduciility, 8q g 2 G; 9q e 2 E s.t. out(q e ) out(q g )\f 2 js 2 K 0 g out(q g )\out(qr). i So, q i r will not e removed from R i. Hence, s 2 L(R i+1 ) nd K 0 L(R i+1 ). 2 From the lst prt of the proof it cn e deduced tht the lgorithm genertes the lest restrictive supervisor. (The supreml element with respect to lnguge inclusion). 5. Uncontrollle Events Sometimes system cn generte events tht cn not e locked y supervisor (e.g. mchine rekdown). Rmdge nd Wonhm showed tht in the presence of these uncontrollle events we need the condition of controllility to gurntee the existence of supervisor. We will show tht for nondeterministic systems the sme condition is needed. Recll from [6] the denition of controllility. Let G e FSM, u. A prex closed lnguge K is controllle (w.r.t G; u ) if K u \ L(G) K. Note tht this is equivlent to: 8s 2 K, 8q g 2 (G; s) out(q g ) \ u f 2 js 2 Kg. Rmdge nd Wonhm clled supervisor tht lwys ccepts n uncontrollle event complete. We hve to dpt the denition of completeness to del with nondeterministic systems nd control y synchroniztion. Definition 5.1 (Completeness) A supervisor S is complete (w.r.t FSM G) if 8s 2 L(SjjG); 8q s 2 (S; s); 8q g 2 (G; s); out(q g ) \ u out(q s ) : Theorem 5.2 Let G nd E e FSMs. There exists supervisor S such tht GjjS < E, nd S complete w.r.t G if nd only if there exists nonempty, prex closed, reducile nd controllle lnguge K. Proof (if prt) Let S K e DFSM generting K. Then, y lemm 4.2, GjjS K < E. 8s 2 L(S K jjg), let q s = (S K ; s). Then, y controllility of L(S K ), 8q g 2 (G; s) out(q g ) \ u f 2 js 2 L(S K )g = out(q s ). so S K is complete. (only if prt). Tke K = L(SjjG), then y the proof of Theorem 4.3 (only if prt) K is reducile. 8s 2 L(SjjG); 8q s 2 (S; s); 8q g 2 (G; s) out(q g ) \ u out(q s ) ) out(q g ) \ u out(q s ) \ out(q g ) = out((q g ; q s )) f 2 js 2 L(S)g. So, L(SjjG) is controllle. 2 Algorithm 5.3 This lgorithm constructs complete supervisor (if it exists) such tht the controlled system reduces the speciction. The lgorithm is the sme s Algorithm 4.4, except tht the following is dded to step 2. 2. : : : Also, remove those sttes q i r = (G; E) i tht do not stisfy the following condition, 8q g 2 G out(q g ) \ u out(q i r) : Theorem 5.4 Let G nd E e FSMs. Then Algorithm 5.3 produces DFSM R in nite numer of steps. If the stte spce of R is nonempty then GjjR < E nd R is complete. If the initil stte is removed from R then no complete supervisor exists such tht the controlled system reduces the speciction. Proof The proof goes long the sme lines s the proof of Theorem 4.5. The following hs to e dded to the dierent steps of the proof.
6 (The lgorithm returns correct solution). 8s 2 L(RjjG), let q r = (G; E) = (R; s). Then, y step 3 of the lgorithm, 8q g 2 G = (G; s); out(q g ) \ u out(q r ). Hence R is complete. (The lgorithm nds solution if one exists). After the sentence tht strts with 'By reduciility': Also, y controllility, 8s 2 K 0 ; 8q g 2 G; out(q g ) \ u f 2 js 2 K 0 g out(q i r). So, q i r will not e removed from R i : : : 2 6. Conclusions In cse of systems tht re prtilly oserved or prtilly specied one hs to relize tht the ehviour of system depends on the nondeterministic properties of tht system. This pper hs een n ttempt to set up supervisory theory for nondeterministic systems. A condition (reduciility) is found for the existence of supervisor such tht the controlled system ehves like the speciction. An lgorithm is descried which synthesizes deterministic lest restrictive supervisor. These results re extended to del with uncontrollle events. Wht remins to e done is to nlyze the consequences of these results for systems with prtil speciction nd prtil oservtion. References 1..C.M Beten nd W.P. Weijlnd. Process lger. Cmridge University Press, Cmridge, 1990. 2. E. Brinksm, G. Scollo nd C. Steenergen. LOTOS specictions, their implementtions, nd their tests. Proc. of IFIP Workshop 'Protocol Speciction, Testing nd Veriction VI', pges 349{360, 1987. 3. S.D. Brooks, C.A.R. Hore, nd A.W. Roscoe. A theory for communicting sequentil processes. ournl of the ACM, 31:560{599, 1984. 4. R.. vn Gldeek. The liner time - rnching time spectrum. Proc. CONCUR '90, Amsterdm, Lecture Notes in Computer Science 458, pges 278{297, 1990. 5. M. Heymnn. Concurrency nd discrete event control. IEEE Control Systems Mgzine, 10:103{ 112, 1990. 6. P..G. Rmdge nd W.M. Wonhm. The control of discrete event systems. Proc. of the IEEE, 77:81{98, 1989.