Michel Michel Reniers

CIF 3 : model-based engineering of supervisory controllers

The engineering of supervisory controllers for large and complex cyber-physical systems requires dedicated engineering support. The Compositional Interchange Format language and toolset have been developed for this purpose. We highlight a model-based engineering framework for the engineering of supervisory controllers and explain how the CIF language and accompanying tools can be used for typical activities in that framework such as modeling, supervisory control synthesis, simulation-based validation, verification, and visualization, real-time testing, and code generation. We mention a number of case studies for which this approach was used in the recent past. We discuss future developments on the level of language and tools as well as research results that may be integrated in the longer term.

Verifying Performance of Supervised Plants

Supervisory control theory deals with synthesis of models of supervisory controllers that ensure safe and nonblocking behavior, based on discrete-event models of the uncontrolled system and the control requirements. Extensions, like optimal supervision, additionally ascertain that given performance requirements are met by the controller as well. Unfortunately, ensuring optimality during supervisor synthesis proved to be computationally challenging. Therefore, we propose to separate supervisor synthesis and ensuring performance. To handle the stochastic behavior efficiently, we treat the Markovian delays syntactically and we employ existing synthesis tools for non-stochastic plants. To this end, we develop a process theory that can specify control loops of nondeterministic stochastic systems with state-based observations. After obtaining the model of the supervised system, we verify that the supervised system adheres to the given performance requirements by deriving the underlying Markov process and feeding it to a stochastic model checker. We illustrate the approach by estimating performance and reliability measures for the printing process of a high-tech Océ printer.

Formalizing a domain specific language using SOS: an industrial case study

This paper describes the process of formalizing an existing, industrial domain specific language (DSL) that is based on the task-resource paradigm. Initially, the semantics of this DSL is defined informally and implicitly through an interpreter. The formalization starts by projecting the existing concrete syntax onto a formal abstract syntax that defines the language operators and process terms. Next, we define the dynamic operational semantics at the level of individual syntactical notions, using structural operational semantics (SOS) as a formal meta-language. Here, the impact of the formalization process on the DSL is considered in terms of disambiguation of underlying (semantic) language design decisions.

Folk theorems on the correspondence between state-based and event-based systems

Kripke Structures and Labelled Transition Systems are the two most prominent semantic models used in concurrency theory. Both models are commonly believed to be equi-expressive. One can find many ad-hoc embeddings of one of these models into the other. We build upon the seminal work of De Nicola and Vaandrager that firmly established the correspondence between stuttering equivalence in Kripke Structures and divergence-sensitive branching bisimulation in Labelled Transition Systems. We show that their embeddings can also be used for a range of other equivalences of interest, such as strong bisimilarity, simulation equivalence, and trace equivalence. Furthermore, we extend the results by De Nicola and Vaandrager by showing that there are additional translations that allow one to use minimisation techniques in one semantic domain to obtain minimal representatives in the other semantic domain for these equivalences.

Results on Embeddings Between State-Based and Event-Based Systems

Kripke Structures (KSs) and Labelled Transition Systems (LTSs) are the two most prominent semantic models used in concurrency theory. Both models are commonly believed to be equi-expressive. One can find manyad hoc embeddings of one of these models into the other. We build upon the seminal work of De Nicola and Vaandrager that firmly established the correspondence between stuttering equivalence in KSs and divergence-sensitive branching bisimulation in LTSs. We show that their embeddings can also be used for a range of other equivalences of interest, such as strong bisimilarity, simulation equivalence and trace equivalence. Furthermore, we extend the results by De Nicola and Vaandrager by showing that there are additional translations that allow one to use minimization techniques in one semantic domain to obtain minimal representatives in the other semantic domain for these equivalences.

Towards the removal of synchronous behavior of events in automata

In this paper an algorithm is proposed which removes the synchronous behavior of events in automata. This is done such that a modular implementation is possible in any sequential programming language. The goal is to find automata which resemble the original automata, but do not contain synchronizing events. Moreover, these new automata, when put in parallel, must behave the same as the original system. The algorithm imposes three steps to end up with a transformed automata network. The final result yields automata which have exactly one edge for each event and each event is unique to a certain automaton. The placement of events in the final result is based on a partitioning of events. To shown applicability of the algorithm, it has been applied to a large industrial-sized system. For this system a controller is made, based on the automata model of the requirements and specifications.

Extending a Synthesis-Centric Model-Based Systems Engineering Framework with Stochastic Model Checking

We propose to integrate performance evaluation with supervisory control synthesis to bring higher confidence in the control design. Supervisory control theory deals with automatic synthesis of supervisory controllers that ensure safe behavior of the supervised system, based on the models of the uncontrolled system and the (safety) control requirements. For the purpose of performance evaluation, we turn to stochastic model checking of continuous-time Markov chains, which requires an extension of the model of the uncontrolled system with Markovian delays. We cast our proposal as an extension of a model-based systems engineering framework that relies on supervisor synthesis. We treat the Markovian delays syntactically, exploiting their equivalent interleaving behavior with uniquely-named uncontrollable transitions. In this way, we can employ already available synthesis tools, while preserving the stochastic behavior. To this end, we develop model transformation tools to extract the underlying Markov process from the stochastic discrete-event model of the supervised system. We illustrate the approach by modeling a pipeless plant that employs automated guided vehicles instead of fixed piping in order to ensure greater flexibility of the plant. The control problem that we solve is safe high-level movement coordination of the vehicles, ensured by the supervisory controller. We show how to seamlessly introduce stochastic behavior in the supervised system and we evaluate several performance and reliability aspects of the plant. We implement the framework by interfacing two state-of-the-art tools: Supremica for supervisory controller synthesis and MRMC for Markovian model checking. To this end, we improve previous attempts by providing support for data-based observers, which greatly improve the modeling capabilities of the framework.

An integrated state- and event-based framework for verifying liveness in supervised systems

Supervisory control theory deals with synthesis of discrete-event supervisory controllers that ensure safe (and nonblocking) behavior of the supervised system. However, the synthesized supervisor comes with no guarantees regarding desired functionality beyond nonblocking behavior. This typically occurs when the control requirements imposed on the system are too strict, or the model of the system needs to be refined. To provide concise and useful feedback to the modeler, we propose an integrated state- and event-based systems engineering framework using state-of-the-art tools: Supremica for supervisor synthesis and mCRL2 for verification. Stating properties in terms of both states and transitions is important in the domain of supervisor synthesis as many control and liveness requirements involve combined state- and event-based specifications. However, many of the available verification tools either focus on state-based or event-based properties. We seek to remedy this situation by providing verification patterns that typically occur in industrial application of supervisory control. We illustrate the framework by revisiting an industrial case study of coordinating maintenance procedures of a high-tech Oce printer, for which we verify the functionality of the solution.

Linearization of CIF through SOS

Linearization is the procedure of rewriting a process term into a linear form, which consist only of basic operators of the process language. This procedure is interesting both from a theoretical and a practical point of view. In particular, a linearization algorithm is needed for the Compositional Interchange Format (CIF), an automaton based modeling language. The problem of devising efficient linearization algorithms is not trivial, and has been already addressed in literature. However, the linearization algorithms obtained are the result of an inventive process, and the proof of correctness comes as an afterthought. Furthermore, the semantic specification of the language does not play an important role on the design of the algorithm. In this work we present a method for obtaining an efficient linearization algorithm, through a step-wise refinement of the SOS rules of CIF. As a result, we show how the semantic specification of the language can guide the implementation of such a procedure, yielding a simple proof of correctness.

Why is my supervisor empty? Finding causes for the unreachability of states in synthesized supervisors

Although supervisory control synthesis has been around for many years, adoption is still low. A weak point of synthesis is the absence of a reporting mechanism. When an empty or unexpected supervisor is returned, it is very difficult to explain why this is the case. It is desired to return an explanation for a question, like, “Why is my supervisor empty?”. In general, the information needed to provide such an explanation is not present in the synthesized result. In this paper, causes (explanations) are generated for questions regarding the absence of behavior in the synthesized system. To this end, it is first investigated what information is needed and how it should be stored. Based on these findings, information of the influence of each requirement is encoded in the supervisor. This is done by annotating colors. The resulting so-called colored predicates can be used after synthesis to derive a cause for a given question.