1. 26 September 2003U. Buy -- SEES 2003 Sidestepping verification complexity with supervisory control Ugo Buy Department of Computer Science Houshang Darabi Department of Mechanical and Industrial Engineering University of Illinois at Chicago

2. 26 September 2003U. Buy -- SEES 20032 Outline Background P-invariant-based mutex enforcement Net unfolding Assessment

3. 26 September 2003U. Buy -- SEES 20033 Acknowledgements Panos Antsaklis, Michael Lemmon, Univ. of Notre Dame Starthis Corporation, Rosemont, Illinois NIST/ATP program Graduate students Bharat Sundararaman and Vikram Venepally

4. 26 September 2003U. Buy -- SEES 20034 Background Supervisory control methods for discrete event systems (DES) —Enforcing concurrency and real-time properties of embedded systems —Model DES with Finite Automata (FA) or Petri nets —Add controller that enforces desired properties to system model Supervisory control vs. verification —Potential benefits of supervisory control —Likely obstacles to widespread applicability

5. 26 September 2003U. Buy -- SEES 20035 Definitions Discrete Event System (DES) is characterized by: 1.Discrete state set 2.Event-driven state transitions Supervisory controller of a DES: —Given controlled system (a DES) and correctness property, —supervisor restricts DES behaviors in such a way that combined system will satisfy the property Observable and controllable events

6. 26 September 2003U. Buy -- SEES 20036 Why Supervisory Control? Some SC methods for DES are much more tractable than verification algorithms Promising methods: 1.P-invariant-based supervisors (mutex properties) 2.Unfolding of Petri nets (deadlock, RT deadlines) Caveat: —System must be sufficiently observable, controllable to permit supervisor definition

7. 26 September 2003U. Buy -- SEES 20037 Why Petri nets? 1.Support tractable supervisory control algorithms P-invariants and net unfoldings Automata-based supervisors usually intractable 2.Widely used in some embedded applications Sequential Function Charts (SFCs) widely used in manufacturing applications —Part of IEC 61131 standard —Supported by Matlab, RSLogix 5000

8. 26 September 2003U. Buy -- SEES 20038 Petri nets Ordinary Petri net: Bipartite, directed graph N=(P,T,F,m 0 ) With: node sets P and T, arc set F, and initial marking m 0 Supervisory control problem: Given controlled net N and property P, generate subnet S (supervisor) that restricts N behaviors to satisfy P

9. 26 September 2003U. Buy -- SEES 20039 Enforcing Mutex Constraints Exploit property of Petri net P-invariants —Place subset such that weighted sum of tokens in subset is constant in all reachable net markings —Computed by finding integer solutions x to invariant equation involving incidence matrix D of Petri net: x·D = 0

10. 26 September 2003U. Buy -- SEES 200310 Examples of P-invariants t1t2 t3 t4t5 p2 p1 p3 p4 p5 p6 p7 P-invariants: { p 1, p 4 } { p 2, p 5, p 7 } { p 1, p 2, p 4, p 5, p 7 } … (unit coefficients)

11. 26 September 2003U. Buy -- SEES 200311 P-invariant based supervisors Method (Yamalidou et al. 96) 1.Specify mutex properties as linear inequalities on reachable markings of controlled net l 1,1 ·m 1 + l 1,2 ·m 2 + l 1,3 ·m 3 + … <= b 1 l 2,1 ·m 1 + l 2,2 ·m 2 + l 2,3 ·m 3 + … <= b 2 … l k,1 ·m 1 + l k,2 ·m 2 + l k,3 ·m 3 + … <= b k 2.Treat constraints matrix as invariant equation, find Petri net (controller) satisfying P-invariant

12. 26 September 2003U. Buy -- SEES 200312 Supervisor synthesis Supervisor net defined by simple matrix multiplication D C = – L ·D —L is matrix of mutex constraints —D is incidence matrix of controlled net Supervisor net will have k places, zero transitions —k is number of mutex constraints Supervisor will be maximally permissive

13. 26 September 2003U. Buy -- SEES 200313 Example of supervisor generation The readers and writers example without mutex: Mutex constraints: p 6 + p 9 + p 10 <≤ 1 p 7 + p 9 + p 10 <≤ 1 p 8 + p 9 + p 10 <≤ 1

14. 26 September 2003U. Buy -- SEES 200314 Example (cont’d) The readers and writers example with supervisor:

15. 26 September 2003U. Buy -- SEES 200315 Advantages of Mutex Supervisors Complexity proportional to D (aka controlled system) and L (constraints) —Overall complexity polynomial for broad class of mutex constraints Supervisors generated are small (no transitions) Maximally permissive supervisors

16. 26 September 2003U. Buy -- SEES 200316 Limitations of Mutex Supervisors Cannot guarantee net liveness (e.g., freedom from deadlock) Open issues: —Integration with other supervisors —Priorities on mutex enforcement policy —Empirical evaluation of constraint size

17. 26 September 2003U. Buy -- SEES 200317 Unfolding Petri nets Transform net into acyclic net capturing repetitive bevahiors of original net Unfolding appeal: —Capture causal relationship on transition firing —Identify choice points —Identify fundamental execution paths History of net unfolding —McMillan 92, Esparza et al. 02, He and Lemmon 02, Semenov and Yakovlev 96 (time Petri nets)

18. 26 September 2003U. Buy -- SEES 200318 Net unfolding: Definitions Node x in net N precedes node y if there is path from x to y in N —Write x<y Node x in conflict with y if N contains paths diverging immediately after a place p and leading to x and y —Write x#y Node x in self-conflict if N contains paths diverging immediately after a place p and leading to x —Write x#x

19. 26 September 2003U. Buy -- SEES 200319 Unfolding untimed nets Given net N, unfolding of N is a net U subject such that: 1.Nodes in U are mapped to nodes in N 2.Each place in U has at most one input transition 3.Net U is acyclic 4.No U node is in self conflict 5.Completeness property: Every reachable marking of N is in U

20. 26 September 2003U. Buy -- SEES 200320 Example of unfolding The original net: t1t2 t8 t7 t3t4 t5 t6 p2 p1 p3 p4 p5 p6 p7p8 p9

21. 26 September 2003U. Buy -- SEES 200321 Example of unfolding t1 t2 t7 t3t4 t5t6 p2p1p3 p4 p5 p6 p7 p9 p2’ p9’ p5’ p9”p9’” t5’t6’ p8p7’p8’ t3’t4’ p1’ p3’p2’’ t8 The unfolded net:

22. 26 September 2003U. Buy -- SEES 200322 Applications of unfolding Enforcing freedom from deadlock (He and Lemmon 02) —Deadlocks detected directly in unfolding —Eliminate deadlocks by dynamically disabling transition that causes deadlock Enforcing compliance with real-time deadlines (Buy and Darabi 03) —Latency of transition t: upper bound on the delay between the firing of t and the time when a target transition can be fired

23. 26 September 2003U. Buy -- SEES 200323 A New Programming Paradigm? 1.Design/Code concurrent system without paying attention to correctness properties 2.Submit system description and property specification to supervisor generator 3.Generator adds supervisor to original system 4.Allegedly, a very long shot…

24. 26 September 2003U. Buy -- SEES 200324 Future work 1.Integration of supervisors for different properties 2.Refine properties enforced 3.System, property specifications