26 September 2003U. Buy -- SEES 2003 Sidestepping verification complexity with supervisory control Ugo Buy Department of Computer Science Houshang Darabi Department of Mechanical and Industrial Engineering University of Illinois at Chicago

26 September 2003U. Buy -- SEES Outline Background P-invariant-based mutex enforcement Net unfolding Assessment

26 September 2003U. Buy -- SEES Acknowledgements Panos Antsaklis, Michael Lemmon, Univ. of Notre Dame Starthis Corporation, Rosemont, Illinois NIST/ATP program Graduate students Bharat Sundararaman and Vikram Venepally

26 September 2003U. Buy -- SEES Background Supervisory control methods for discrete event systems (DES) —Enforcing concurrency and real-time properties of embedded systems —Model DES with Finite Automata (FA) or Petri nets —Add controller that enforces desired properties to system model Supervisory control vs. verification —Potential benefits of supervisory control —Likely obstacles to widespread applicability

26 September 2003U. Buy -- SEES Definitions Discrete Event System (DES) is characterized by: 1.Discrete state set 2.Event-driven state transitions Supervisory controller of a DES: —Given controlled system (a DES) and correctness property, —supervisor restricts DES behaviors in such a way that combined system will satisfy the property Observable and controllable events

26 September 2003U. Buy -- SEES Why Supervisory Control? Some SC methods for DES are much more tractable than verification algorithms Promising methods: 1.P-invariant-based supervisors (mutex properties) 2.Unfolding of Petri nets (deadlock, RT deadlines) Caveat: —System must be sufficiently observable, controllable to permit supervisor definition

26 September 2003U. Buy -- SEES Why Petri nets? 1.Support tractable supervisory control algorithms P-invariants and net unfoldings Automata-based supervisors usually intractable 2.Widely used in some embedded applications Sequential Function Charts (SFCs) widely used in manufacturing applications —Part of IEC standard —Supported by Matlab, RSLogix 5000

26 September 2003U. Buy -- SEES Petri nets Ordinary Petri net: Bipartite, directed graph N=(P,T,F,m 0 ) With: node sets P and T, arc set F, and initial marking m 0 Supervisory control problem: Given controlled net N and property P, generate subnet S (supervisor) that restricts N behaviors to satisfy P

26 September 2003U. Buy -- SEES Enforcing Mutex Constraints Exploit property of Petri net P-invariants —Place subset such that weighted sum of tokens in subset is constant in all reachable net markings —Computed by finding integer solutions x to invariant equation involving incidence matrix D of Petri net: x·D = 0

26 September 2003U. Buy -- SEES Examples of P-invariants t1t2 t3 t4t5 p2 p1 p3 p4 p5 p6 p7 P-invariants: { p 1, p 4 } { p 2, p 5, p 7 } { p 1, p 2, p 4, p 5, p 7 } … (unit coefficients)

26 September 2003U. Buy -- SEES P-invariant based supervisors Method (Yamalidou et al. 96) 1.Specify mutex properties as linear inequalities on reachable markings of controlled net l 1,1 ·m 1 + l 1,2 ·m 2 + l 1,3 ·m 3 + … <= b 1 l 2,1 ·m 1 + l 2,2 ·m 2 + l 2,3 ·m 3 + … <= b 2 … l k,1 ·m 1 + l k,2 ·m 2 + l k,3 ·m 3 + … <= b k 2.Treat constraints matrix as invariant equation, find Petri net (controller) satisfying P-invariant

26 September 2003U. Buy -- SEES Supervisor synthesis Supervisor net defined by simple matrix multiplication D C = – L ·D —L is matrix of mutex constraints —D is incidence matrix of controlled net Supervisor net will have k places, zero transitions —k is number of mutex constraints Supervisor will be maximally permissive

26 September 2003U. Buy -- SEES Example of supervisor generation The readers and writers example without mutex: Mutex constraints: p 6 + p 9 + p 10 <≤ 1 p 7 + p 9 + p 10 <≤ 1 p 8 + p 9 + p 10 <≤ 1

26 September 2003U. Buy -- SEES Example (cont’d) The readers and writers example with supervisor:

26 September 2003U. Buy -- SEES Advantages of Mutex Supervisors Complexity proportional to D (aka controlled system) and L (constraints) —Overall complexity polynomial for broad class of mutex constraints Supervisors generated are small (no transitions) Maximally permissive supervisors

26 September 2003U. Buy -- SEES Limitations of Mutex Supervisors Cannot guarantee net liveness (e.g., freedom from deadlock) Open issues: —Integration with other supervisors —Priorities on mutex enforcement policy —Empirical evaluation of constraint size

26 September 2003U. Buy -- SEES Unfolding Petri nets Transform net into acyclic net capturing repetitive bevahiors of original net Unfolding appeal: —Capture causal relationship on transition firing —Identify choice points —Identify fundamental execution paths History of net unfolding —McMillan 92, Esparza et al. 02, He and Lemmon 02, Semenov and Yakovlev 96 (time Petri nets)

26 September 2003U. Buy -- SEES Net unfolding: Definitions Node x in net N precedes node y if there is path from x to y in N —Write x<y Node x in conflict with y if N contains paths diverging immediately after a place p and leading to x and y —Write x#y Node x in self-conflict if N contains paths diverging immediately after a place p and leading to x —Write x#x

26 September 2003U. Buy -- SEES Unfolding untimed nets Given net N, unfolding of N is a net U subject such that: 1.Nodes in U are mapped to nodes in N 2.Each place in U has at most one input transition 3.Net U is acyclic 4.No U node is in self conflict 5.Completeness property: Every reachable marking of N is in U

26 September 2003U. Buy -- SEES Example of unfolding The original net: t1t2 t8 t7 t3t4 t5 t6 p2 p1 p3 p4 p5 p6 p7p8 p9

26 September 2003U. Buy -- SEES Example of unfolding t1 t2 t7 t3t4 t5t6 p2p1p3 p4 p5 p6 p7 p9 p2’ p9’ p5’ p9”p9’” t5’t6’ p8p7’p8’ t3’t4’ p1’ p3’p2’’ t8 The unfolded net:

26 September 2003U. Buy -- SEES Applications of unfolding Enforcing freedom from deadlock (He and Lemmon 02) —Deadlocks detected directly in unfolding —Eliminate deadlocks by dynamically disabling transition that causes deadlock Enforcing compliance with real-time deadlines (Buy and Darabi 03) —Latency of transition t: upper bound on the delay between the firing of t and the time when a target transition can be fired

26 September 2003U. Buy -- SEES A New Programming Paradigm? 1.Design/Code concurrent system without paying attention to correctness properties 2.Submit system description and property specification to supervisor generator 3.Generator adds supervisor to original system 4.Allegedly, a very long shot…

26 September 2003U. Buy -- SEES Future work 1.Integration of supervisors for different properties 2.Refine properties enforced 3.System, property specifications