CS 367: Model-Based Reasoning Lecture 7 (02/05/2002)

1. CS 367: Model-Based ReasoningLecture 7 (02/05/2002) Gautam Biswas

2. Today’s Lecture • Last Lecture: • Diagnoser Automata • Notion of Diagnosability (Sampath paper) • Supervisory Control • Feedback control with supervisors: Complete and Partial Observation • Specifications on Controlled Systems • Today’s Lecture: • Discussion of HW problems • Diagnosability and I-Diagnosability • Specifications on Controlled Systems • Controllability Theorem

3. Diagnoser Automata G Gobs Gdiag

4. Diagnosability

5. Diagnosability • Definition: (informal) Let s be any trace generated by the system that ends in a failure event from set Efiand t is a sufficiently long continuation of s Diagnosability implies that every trace that belongs to the language that produces the same record of observable events as st should contain in it a failure event from Efi Along every continuation t of s one can detect the failure of type Fi with finite delay, specifically in atmost ni transitions of the system after s Alternately, diagnosability requires that every failure event leads to observations distinct enough to enable unique identification of failure type with a finite delay Diagnosability must hold for all traces in L(G) that contain a failure event Relaxed definition: I-diagnosability – diagnosability condition holds only for those in which a failure is followed by certain indicator events associated with every failure type

6. G S(s) s s S Assume all events are observable: s all events executed by G so far and S has seen them all How is control achieved? Controllable events of G can be dynamically enabled or disabled by S Formally, a supervisor is a function For each generated by G (supervised by S) is the set of enabled events that G can execute at it current state G cannot execute event unless it belons to S(s) Feedback Loop for Supervisory Control DES

7. Control under Partial Observation G SP[P(s)] P S Because of P supervisor cannot distinguish between s1 and s2, i.e., Control action under partial supervision SP: P-supervisor Control Action can change only after occurrence of an observable event; but this action happens before an unobservable event occurs

8. Specifications of Controlled System • Feedback supervisor S (SP) introduced to eliminate “illegal” traces in G. • Legal behavior of L(G) is La, where a – admissible Partially observable, replace S by SP

9. Specifications of Controlled System • La (or Lam) obtained after accounting for all specifications of system; Lam when L(G) has blocking states • These specifications are themselves described by one or more (possible marked) languages, Ks,i, i=1,…..,m • If specification language Ks,i is not given as subset of L(G) (or Lm(G)), then we take

10. offho OFFHOOK offho onho INIT con10 con20 onho Example: Plain Old Telephone System (POTS) Events that define call processing features: * phone i off hook * phone i on hook * request connection from user i to user j * establish connection between users i and j * forwarding calls from user i to j to k * connection cannot be established because of screening list of user j Consider 3 user telephone system Complete system model G is the shuffle of individual models Livelock occurs when: user 1 forwards his calls to user 2, user2 to user 3, and user 3 to user 1 No one can call user 0 successfully if user 0 has picked up the handset Spec lang Ks La = L(G)Ks

11. Modifying Automata to Account for Illegal Behavior • Illegal States in G: delete these states from G (remove state, transitions, and perform Ac operation) • State Splitting: If spec requires remembering how state in G reached in order to determine what future behavior is legal, then split state • Event Alternance: spec requires alternation of two events, build two state automata to capture this; parallel composition with G

12. Modifying Automata to Account for Illegal Behavior • Illegal Substring: Remove all strings of L(G) that contain

13. Controllability • Nonblocking Controllability Theorem (NCT) Consider a DES G where Euc E is the set of uncontrollable events. Consider also the language K  Lm(G), where K   There exits a nonblocking supervisor S for G such that Lm(S/G) = K ( L(S/G) = K) iff the following two conditions hold: 1. [controllability] 2. [Lm(G)-closure]