Testing Modularity of Local Supervisors: An Approach Based on Abstractions

Patrı́cia N. Pena, José E.R. Cury and Stéphane Lafortune

Proceedings of 8th International Workshop on Discrete Event Systems - WODES’06

10-12 of July, 2006, Ann Arbor, MI, US.
 Testing Modularity of Local Supervisors: An Approach Based on
Abstractions
Patrı́cia N. Pena José E.R Cury Stéphane Lafortune
DAS - Federal University of Department of Automation and Department of Electrical Engineering
Santa Catarina, Brazil Systems (DAS) - Federal University and Computer Science (EECS)
Currently at EECS - The University of Santa Catarina, The University of Michigan,
of Michigan, Ann Arbor, MI, USA Florianópolis, SC, Brazil Ann Arbor, MI, USA
Email: [email protected] Email: [email protected] Email: [email protected]

Abstract— This paper presents an efficient way to detect plant”. The local plant of a specification is the composition
conflict in composed systems controlled by local supervisors of the subplants that are affected by the specification. The
designed using the Supervisory Control Theory of discrete advantage of this approach is that it is not necessary to
event systems. The idea is to apply the required modularity
test not over the languages implemented by the supervisors, compose the entire plant in the synthesis of the supervisors,
but over abstractions of the supervisors with some specific thereby mitigating the state explosion problem. However, as
characteristics. The concept of observer and some constraints there are multiple supervisors, there is the possibility of
on the set of relevant events are the basis for the approach. An getting into a situation of blocking when the supervisors
illustrative example is presented. are combined. In such a case, the supervisors are said to
be “conflicting”. To check if the local supervisors obtained
I. I NTRODUCTION
by modular synthesis are nonconflicting a modularity test
Discrete-Event Systems (DES) are dynamical systems is required. The condition of being nonconflicting is also
with state changes that are driven by discrete events. Some termed “modular” in [?], which is the terminology that is
examples of DES are manufacturing systems and communi- used in this paper. Two or more languages are said to be
cation networks. In the early 1980’s, Ramadge and Wonham modular if whenever they share a prefix, they also share a
started an effort to develop a control theory for DES, under word containing this prefix.
the formalism of finite state machines (FSMs) and formal Though the local modular approach has solved the prob-
languages. The resulting body of work is known as Super- lem of state explosion in the synthesis of supervisors, the
visory Control Theory [?]. Despite the significant advances verification of modularity is still problematic. To verify the
in recent years, the formal techniques are not being widely local modularity property all the local supervisors must
employed in industry. One of the main obstacles in industrial be composed and this composition may itself cause state
applications is the complexity of supervisor synthesis as it explosion. The problem of conflict occurrence is addressed
involves composition of the specifications and the global in the literature in different ways. Some authors have devel-
plant. This factor is very restrictive as it may cause state oped approaches where the supervisors are nonconflicting by
explosion in large scale systems. Several authors have tried to construction [?]. Others have solved the blocking problem
overcome this restriction by exploiting aspects of the system, by using coordinators [?], [?], [?]. Recently, there have been
such as modularity [?] [?] and symmetry [?], [?] among some works that address the problem of detecting efficiently
others. It is worthwhile mentioning references [?], [?], [?] the occurrence of conflict [?], [?] and [?].
and [?] that address the problem of controlling concurrent This paper presents an efficient way to detect the presence
(usually termed modular) systems through local supervisors. of conflict in systems controlled by local supervisors. The
However, those papers consider only prefix-closed languages. idea is to apply the modularity test not over the languages
Most large scale systems are modeled through the com- implemented by the supervisors, but over abstractions of the
position of many smaller subsystems usually representing supervisors. In the worst case, the test based on abstractions
concurrent operations and, in general, there are many spec- has the same complexity as the original one. In practice,
ifications that restrict only parts of the global plant. In we have found that the test based on abstractions leads to
many cases, the specifications only intend to synchronize computational savings.
concurrent subsystems. Modular control, introduced in [?], In Section ?? we present a review of some basic con-
is a natural solution to deal with such systems because cepts of languages and automata theory and of Supervisory
it divides the overall task into subtasks and assigns them Control of DES. Section ?? presents the main results of
to different controllers. The “local modular approach” in the paper followed by an illustrative example in Section ??.
[?], an extension of modular control, not only divides the Section ?? presents the conclusions of the paper. Due to
tasks in subtasks, but also expresses each specification (and space constraints, proofs of technical results are omitted; they
the corresponding supervisor) only in terms of its “local are available in [?].
 II. P RELIMINARIES Definition 1 [?] Let S ⊆ Σ∗ be a language, Σ′ ⊆ Σ an
In this section, we recall some concepts and notations as event set and θ : Σ∗ → Σ′∗ the natural projection of strings
well as the basic ideas behind the local modular supervisory in Σ∗ to strings in Σ′∗ . If
control approach. The paper is set in the supervisory control (∀a ∈ S)(∀b ∈ Σ′∗ ) θ(a)b ∈ θ(S) =⇒
framework of Ramadge and Wonham [?]. We refer the
reader to [?] or [?] for a detailed introduction to the theory. (∃c ∈ Σ∗ ) θ(ac) = θ(a)b and ac ∈ S
In this framework, a DES is modelled as an FSM G =
then the projection is said to have the observer property.
(Q, Σ, δ, q0 , Qm ), where Q is the set of states, Σ is the set
of events, δ is the transition function, q0 is the initial state, It is known from [?] that the time complexity of computing
and Qm is the set of marked states. Σ∗ is the set of all finite projections is at worst exponential and that the size of the
strings of elements in Σ, including the empty string ǫ. A state space of the FSM that represents the projected language
language is a subset of Σ∗ . The behavior of G, modelled as can increase exponentially with the number of states in
a language L(G) ⊆ Σ∗ , is the set of finite strings that G can the original system. However, if the projection possesses
generate. G can model a second language, Lm (G) ⊆ L(G), the observer property, it is guaranteed that the FSM that
that is the set of strings that represent completed tasks (or, represents the projection always has a number of states not
equivalently, that end in marked states). greater than that of the minimal generator for the original
The prefix closure of a language L (represented by L) is language and that it can be obtained in polynomial time [?].
the set of all prefixes of strings in L. A language is said The main theoretical result of this paper is based on natural
prefix-closed if L = L. projections that possess the observer property, as will be seen
A. Natural Projections and Observers in Section ??.
The natural projection Pi : Σ∗ → Σ∗i is a map with the B. Supervisory Control of DES
following characteristics: In order to synthesize supervisors, the models of the
Pi (ǫ) = ǫ plant and the specifications for the closed-loop behavior
 have to be obtained. The set of events used to model the
Pi (s) if s ∈ Σ∗ , σ ∈
/ Σi
Pi (sσ) = plant are divided into controllable (the ones that can be
Pi (s)σ if s ∈ Σ∗ , σ ∈ Σi .
disabled by the supervisor) and uncontrollable (the ones
In words, the projection erases the events of Σ that are not that cannot be disabled, usually representing the spontaneous
in Σi . The concept of natural projection can be extended to events of the plant). The action of the supervisor over the
languages as follows: plant is to inhibit the occurrence of controllable events in
Pi (L) = {ui ∈ Σ∗i | ui = Pi (u) for some u ∈ L}. order to achieve the desired behavior. Sometimes the desired
behavior cannot be achieved. In such cases, the supervisor
The inverse projection is, then, defined as will implement the supremal controllable sublanguage of the
desired language, named Sup C(K, Lm (G), where K is the
Pi−1 (Li ) = {u ∈ Σ∗ | Pi (u) ∈ Li }.
desired language and Lm (G) is the open-loop behavior of
Given a set of languages Li over event sets Σi , i ∈ the plant. Monolithic supervisory control of DES consists
n
{1, . . . , n} with Σ = ∪ Σi , the notion of inverse projection of obtaining one plant and one specification by the compo-
i=1
is used to give a formal definition of the synchronous product sition of all subplants and specifications, respectively, and
(or parallel composition) of languages, as follows: subsequent calculus of a unique supervisor that implements
n
Sup C(K, Lm (G)).
n
|| Li = ∩ Pi−1 (Li ).
i=1 i=1 C. Blocking and Modularity Test
The property of distributivity of projection over synchronous The concept of blocking is related to the idea of not being
product, considered in [?] and extensively used in the proofs able to reach a marked state from some state of the FSM. A
of this paper, is presented below as a proposition. FSM G is said to be nonblocking if Lm (G) = L(G). The
fundamental point is that the conjunction of two (or more)
n
Proposition 1 [?] Let Li ⊆ Σ∗i , i ∈ I = {1, . . . , n}, Σ = ∪ nonblocking machines may lead to a blocking FSM. In such
i=1 a case, we say that the two (or more) FSMs are conflicting.
Σi , Σr ⊆ Σ, PΣ→Σr : Σ∗ → Σ∗r and PΣi →(Σi ∩Σr ) : Σ∗i →
The modularity test was introduced in [?] to check if
(Σi ∩ Σr )∗ .
supervisors obtained through the modular approach are non-
n
n
PΣ→Σr || Li = || PΣi →(Σi ∩Σr ) (Li ) conflicting. Let Si be a set of languages, i = {1 . . . n}. The
i=1 i=1 modularity test consists of checking if the equality below
if Σc ⊆ Σr where Σc = ∪(Σj ∩ Σl ), ∀j, l ∈ I with j 6= l. holds:
n n
∩ Si = ∩ Si . (1)
The property of projections known as observer property i=1 i=1

will be used in this paper. It was introduced in [?] and is In words, if two or more languages share a prefix, they must
presented as a definition. also share a word containing this prefix.
 Σ Σ Σ
Σ3 Σ3 Σ3
Σ1 Σ1 Σ1 Σr
Σr Σr

Σ2 Σ2 Σ2

Σ4 Σ4 Σ4
(a) (b) (c)

Fig. 1. Venn Diagrams of the inclusion of the event sets for n = 4: (a) Σ1 , Σ2 , Σ3 , Σ4 and Σ = Σ1 ∪ Σ2 ∪ Σ3 ∪ Σ4 (b) Initial Σr = Σc = ∪(Σj ∩ Σl ),
∀j, l ∈ I = {1 . . . 4} with j 6= l; (c) Final Σr , after extending initial Σr of (b).

The modularity test in equation (??) can only be applied 2) observer property.
when all the supervisors have the same event set. In a Hereafter, we call an abstraction satisfying the observer
more general case, where the supervisors’ event sets are property an OP-abstraction. All the results presented in this
different, the modularity test need to be adapted to cope paper rely in a set Σr that contains all events that are
with this situation. The adapted modularity test, named local shared by more than one supervisor. Figure ?? presents an
modularity test by the authors in [?], is shown in equation illustration of those sets of events.
(??): In order to show equation (??), we first establish the
n n
|| Si = || Si . (2) following lemma. The proofs of Lemma ?? and Theorems
i=1 i=1 ?? and ?? are omitted in the paper, but are available in [?].
The local modularity test can be used to check the non-
conflict property in sets of supervisors obtained through any Lemma 1 Let Si ⊆ Σ∗i , s ∈ Σ∗ , t ∈ Σ∗r , the projections θi ,
method whenever their languages represent the closed-loop θ, PΣ→Σi be defined as before. Assume that Σj ∩ Σl ⊆ Σr ,
n
language of their system composed by plant+supervisor. The ∀j, l ∈ I = {1, . . . , n} with j 6= l . If θ(s)t ∈ || θi (Si ) then
test if equation (??) becomes the one in equation (??) when i=1
the event sets of all supervisors are the same. ∃ti ∈ Σ′∗
i , ∀i ∈ I, such that the following statements are
As can be seen in equation (??), to perform the test, all true:
n
supervisors have to be composed, what may lead to state i. θ(s)t ∈ || θi (PΣ→Σi s)ti
explosion. i=1
ii. θi (PΣ→Σi s)ti ∈ θi (Si )
n n
D. Notation iii. || θi (PΣ→Σi s)ti ⊆ || θi (Si ).
n
Consider the event set Σ = ∪ Σi , the languages Si ⊆ Σi i=1 i=1
i=1
and, Σr ⊆ Σ as being the set of events considered relevant Theorem ?? presents the main theoretical result of the
to the conflict. The natural projections that lead to the paper.
abstractions are named θi : Σ∗i → Σ′∗ ′
i where Σi = Σi ∩ Σr
∗ ∗ ′∗
and θ : Σ → Σr . So, we have that θi (Si ) ⊆ Σi represents Theorem 1 Using the definitions presented before, if the
the abstraction of Si . The event set Σc is the set of events natural projections θi (Si ), ∀i ∈ I, are OP-abstractions and
that are shared by any two or more supervisors, namely if Σj ∩ Σl ⊆ Σr , ∀j, l ∈ I with j 6= l, then
Σc = ∪(Σj ∩ Σl ), ∀j, l ∈ I = {1 . . . n} with j 6= l.
n n n n
III. M AIN R ESULTS || θi (Si ) = || θi (Si ) ⇐⇒ || Si = || Si .
i=1 i=1 i=1 i=1
One important outstanding problem in the application
of modular supervisory control to actual systems is the Theorem 1 shows that it is indistinctive to take the mod-
computational complexity of the modularity test in equation ularity test over the supervisors or over their abstractions.
(??). This section presents a novel modularity test performed Since the abstractions are OP-abstractions, they will have,
over abstractions of the supervisors obtained by the natural in general, state space smaller than the original supervisors.
projection of these supervisors to a subset of their events. The composition of the abstractions is not necessarily smaller
More precisely, the objective is to identify sufficient con- than the composition of the original supervisors though.
ditions for the desired abstractions, denoted by θi (Si ) for However, Theorem ?? shows that the composition of OP-
supervisor Si , so that the following property holds: abstractions will be also an OP-abstraction.
n n n n
|| θi (Si ) = || θi (Si ) ⇐⇒ || Si = || Si . (3) Theorem 2 Using the definitions presented before, if, ∀i ∈
i=1 i=1 i=1 i=1 I , the natural projections θi (Si ) are OP-abstractions and if
n

The abstractions θi (Si ), in our approach, have the charac- Σj ∩ Σl ⊆ Σr , ∀j, l ∈ I with j 6= l then θ || Si is also an
i=1
teristics listed below: OP-abstraction.
1) common events are in Σr i.e., Σc ⊆ Σr ;
 Mill 66
4 65 12
74 74

41 42 66
2 9
73
B3 73 72
6
11 12 B5 61
C1 B1 36 66 39
32 35 72

64 8
31 s ta rt

0 66
38 63 72
Robot B6 AM 30 1
30 66 7
39 14
33 30 13 30
66 39 30
21 22 65 71 66
C2 B2 34 37,39 39 66
11 5 15 10
B7 66
3
71
72
B4
71 74
72
51,53 52,54
72
C
Lathe
72 73
Fig. 4. Supervisor S1
B8

81 82

PD Thus, in order to apply the result of Theorem ??, we

propose the following procedure:
Fig. 2. Flexible Manufacturing System 1) Define as the initial set of relevant events, the set of
events that are common to more than one supervisors;
39 66
Robot AM 2) Define the initial local relevant events for each super-
30
65
visor Si as the intersection of the set obtained in Step
B7
1 with Σi ;
71 74
3) Apply the algorithm presented in [?] to each supervisor
C in order to get extensions of those initial observable
72 73 events sets, leading to OP-abstractions.
B8 All the events that are rendered observable by applying
81 82 the algorithm in [?] to a particular supervisor are necessarily
PD
not shared with any other supervisor. Thus, the algorithm can
be applied to all supervisors independently and concurrently.
Fig. 3. Diagram of the partial problem The final set of relevant events is composed of the initial set
of relevant events (obtained in Step 1) and the extensions
returned by the algorithm (Step 3) when applied to each
Theorem ?? together with Proposition ?? shows that if supervisor.
all abstractions θi (Si ) are OP-abstractions, their composition The next section presents an example where the modular-
n n
|| θi (Si ) = θ( || Si ) is also an OP-abstraction. From [?], ity test over abstractions is performed and compared with
i=1 i=1 the original modularity test. It shows a reasonable reduction
we can say that the minimum automaton that represents the
n of complexity when testing modularity over abstractions.
language θ( || Si ) has, in the worst case, the same number
i=1
of states as the minimum automaton that represents the lan- IV. E XAMPLE
n
guage || Si . Namely, the modularity test over abstractions Consider the Flexible Manufacturing System (FMS) de-
i=1
will have, in the worst case, the same size as the original scribed in [?]. It produces two types of products from raw
modularity test. blocks and raw pegs: a block with a conical pin on top (Prod-
The problem of obtaining abstractions with the observer uct A) and a block with a cylindrical painted pin (Product
property is addressed in [?] and [?]. The first paper presents B). The FMS consists of eight devices: three conveyors (C1 ,
a method to refine a causal reporter map to obtain an optimal C2 and C), a Mill, a Lathe, a Robot, a Painting Device (PD)
observer (with the smallest refinement) in polynomial time. and an Assembly Machine (AM) (Fig. ??). The devices are
This algorithm requires some relabeling of events, what is connected through buffers Bk , k = {1, . . . , 8}, each with
not permitted in natural projections. Reference [?] adapts the capacity for one part. The control problem is to give maximal
algorithm presented in [?] to deal with natural projections. It degree of freedom to the FMS while avoiding overflow or
shows that the problem of finding a minimal extension to a underflow of parts in the buffers. The liveness specifications
given initial set of relevant events (in this context, sometimes are: the supervisor should not prevent the manufacture of
referred to as observable events) to attain an OP-abstraction Product A and Product B nor should it prevent the Lathe from
is NP-hard. Nevertheless, it proposes a polynomial (with operating simultaneously with the Mill. Furthermore, the
respect to states and transitions) algorithm that returns a supervisor should not prevent the buffers Bi , i = {1, . . . , 6}
reasonable extension, not necessarily minimal, of the set of from becoming empty and the buffers B7 and B8 from
observable events, such that the required observer property becoming simultaneously empty. The controllable events are
holds. labeled by odd numbers.
 30

6
39
66
39 72
4 72
39 66
66 7 30
3 66 30 23
71 21
39 72 9
72 66
2 66 71 20
30 81
72 19 30 26 81
1 66 30 24
39
18 72 39
s ta rt

0 39
66 10 30
81
65 17 66 12
22 66
82
5 66 81
81
29 82
81
66 39 66
25 27 30 32 15
8 30
82 82 82 30
16 82
74
11 73 30 13
66 39 66
14 28
73
39

66 31 74
33
66

Fig. 6. Modularity test (S1 ||S2 )

72 81 82
71 1 2 3 4 73
s ta rt

0 5 72
74
71 39
30 5 6 30
1 3
72 7
Fig. 5. Supervisor S2 39
72

s ta rt

0 65

It turns out that the supervisors built using the local 73 74 4

modular approach [?] lead to a situation of conflict. Upon 2
inspection, it is determined that the conflict is caused by
the supervisors responsible for controlling underflow and Fig. 7. Abstraction θ1 (S1 )
overflow of buffers B7 and B8 . To illustrate the result of
this paper on an example of moderate scale, we consider 6
72 9 81

only those two supervisors, hereafter named S1 (for buffer 30 30

30
12 82
30 15
B7 ) and S2 (for buffer B8 ). The FMS is reduced to the 4 72
7
81
10 82
13
39 39 39
system shown in Fig. ??. The supervisors S1 and S2 are 72
39

71 3 5 81
presented in Figs. ?? and ??, respectively. 39 1
30 2 8 82
11
73
14 74
0 16
The local modularity test consists of checking if the
s ta rt

65

parallel composition of S1 and S2 is nonblocking. In Fig. ??

we show that it is blocking (from the rightmost state (15), it Fig. 8. Modularity test over the abstractions θ1 (S1 )||S2
is not possible to reach a marked state).
To perform the test with the abstractions, we first should
determine what are the events that must be in the relevant Notice that it was possible to detect the conflict occurrence
set Σr . As mentioned before, Σr must contain all events in a simpler (less states and transitions) modularity test.
that are common to more than one supervisors (Σc = Comparing Fig. ?? with Fig. ??, a reduction in the size of
{71, 72, 73, 74} ⊆ Σr ). It was determined that the projection the test from 34 states and 62 transitions to 17 states and 23
of S1 to the subset {30, 39, 65, 71, 72, 73, 74} is an OP- transitions can be noticed.
abstraction. This abstraction of supervisor S1 is presented
in Fig. ??. V. C ONCLUSIONS
It was not possible to find an abstraction with the required In this paper, we presented a novel modularity test based
characteristics for S2 . Fortunately, that is not a problem since on abstractions of the supervisors (obtained through natural
we can just treat S2 as an observer of itself, meaning that projections) with some specific characteristics, such as being
θ2 (S2 ) = S2 . OP-abstractions.
The modularity test over the abstractions consists of Obtaining an abstraction with the observer property is a
taking the parallel composition of θ1 (S1 ) and θ2 (S2 ) (or difficult problem, especially if the original supervisor has a
equivalently θ1 (S1 )||S2 ) and checking if it is nonblocking. large state space. However, if the supervisor is built using
Figure ?? shows the result of the test. It can be seen approaches such as the local modular control, the resulting
that it is not possible to reach a marked state from some supervisor will tend to be small. In addition, the complexity
states (for example state 15, the upper rightmost state). of obtaining the abstractions does not necessarily increase
when adding more subsystems and specifications, since they
are obtained locally.
ACKNOWLEDGMENT
The first author is supported by CNPq, and the second is
supported in part by CNPq grant 300953/93-3. The research
of the third author is supported in part by NSF grant CCR-
0325571 and by ONR grant N00014-03-1-0232.