1. CS 367: Model-Based Reasoning Lecture 7 (02/05/2002) Gautam Biswas

2. Today’s Lecture Last Lecture: Diagnoser Automata Notion of Diagnosability (Sampath paper) Supervisory Control Feedback control with supervisors: Complete and Partial Observation Specifications on Controlled Systems Today’s Lecture: Discussion of HW problems Diagnosability and I-Diagnosability Specifications on Controlled Systems Controllability Theorem

3. Diagnoser Automata G G obs G diag

4. Diagnosability

5. Definition: (informal) Let s be any trace generated by the system that ends in a failure event from set E fi and t is a sufficiently long continuation of s Diagnosability Diagnosability implies that every trace that belongs to the language that produces the same record of observable events as st should contain in it a failure event from E fi Along every continuation t of s one can detect the failure of type F i with finite delay, specifically in atmost n i transitions of the system after s Alternately, diagnosability requires that every failure event leads to observations distinct enough to enable unique identification of failure type with a finite delay Diagnosability must hold for all traces in L(G) that contain a failure event Relaxed definition: I-diagnosability – diagnosability condition holds only for those in which a failure is followed by certain indicator events associated with every failure type

6. Feedback Loop for Supervisory Control DES G S s S(s) s Assume all events are observable: s all events executed by G so far and S has seen them all How is control achieved? Controllable events of G can be dynamically enabled or disabled by S Formally, a supervisor is a function For each generated by G (supervised by S) is the set of enabled events that G can execute at it current state G cannot execute event unless it belons to S(s)

7. Control under Partial Observation G S S P [P(s)] Because of P supervisor cannot distinguish between s 1 and s 2, i.e., Control action under partial supervision S P : P-supervisor Control Action can change only after occurrence of an observable event; but this action happens before an unobservable event occurs P

8. Specifications of Controlled System Feedback supervisor S (S P ) introduced to eliminate “illegal” traces in G. Legal behavior of L(G) is L a, where a – admissible Partially observable, replace S by S P

9. Specifications of Controlled System L a (or L am ) obtained after accounting for all specifications of system; L am when L(G) has blocking states These specifications are themselves described by one or more (possible marked) languages, K s,i, i=1,…..,m If specification language K s,i is not given as subset of L(G) (or L m (G)), then we take

10. Example: Plain Old Telephone System (POTS) OFFHOOK INIT offho onho con10 con20 onho No one can call user 0 successfully if user 0 has picked up the handset Events that define call processing features: * phone i off hook * phone i on hook * request connection from user i to user j * establish connection between users i and j * forwarding calls from user i to j to k * connection cannot be established because of screening list of user j Consider 3 user telephone system Complete system model G is the shuffle of individual models Livelock occurs when: user 1 forwards his calls to user 2, user2 to user 3, and user 3 to user 1 Spec lang K s L a = L(G)  K s

11. Modifying Automata to Account for Illegal Behavior Illegal States in G: delete these states from G ( remove state, transitions, and perform Ac operation ) State Splitting: If spec requires remembering how state in G reached in order to determine what future behavior is legal, then split state Event Alternance: spec requires alternation of two events, build two state automata to capture this; parallel composition with G

12. Modifying Automata to Account for Illegal Behavior Illegal Substring: Remove all strings of L(G) that contain

13. Controllability Nonblocking Controllability Theorem (NCT) Consider a DES G where E uc  E is the set of uncontrollable events. Consider also the language K  L m (G), where K   There exits a nonblocking supervisor S for G such that L m (S/G) = K (  L(S/G) = K) iff the following two conditions hold: 1. [controllability] 2. [Lm(G)-closure]