In this section, we show the supervisor synthesis for the two examples described in the previous chapters, the tank process and the two users. For the tank process we show the synthesis of a supervisor from the total specification described earlier, as well as from a second variant of this specification. Since the specification is controllable as it is given, the synthesis is not very exciting, merely an application of the non-blocking algorithm. Therefore, we allow ourselves to manipulate the specification to make it uncontrollable. This we do by removing an uncontrollable transition. Such manipulations are perfectly valid, as long as they maintain the refinement property. Thus, we can mark additional states, forbid states, remove transitions and even synchronize with other automata. All of these operations preserve the refinement property.
For the two-user problem, we synthesize three supervisors, one for each additional sub-specification. Thus, each supervisor will also enforce the sub-specification “before” it. In the third case, where all specifications are to be guaranteed, it turns out that no useful supervisor exists; the initial state becomes forbidden. We show how the result can still be useful in supplying information concerning how the process can be “rebuilt” to allow all specifications to be fulfilled simultaneously.
Note that for all specifications we have forbidden the uncontrollable states, just as mentioned above. This is a prerequisite for our supervisor algorithm, though it was not shown when generating the respective S0 specifications in the previous chapter.
However, examining S0 reveals that some states are blocking. From the states q14, q17 and q19 the marked initial state cannot be reached. Thus, the trimming algorithm will forbid these states, and its result is shown in Figure 23. Giving this automaton to the extension algorithm will do nothing, since the E1 events are controllable. Thus, the supervisor can control the closed-loop system not to go to the blocking states from q24, q27 and q29.
This is not terribly exciting. A single application of the trimming algorithm and we are done. To make things a little more thrilling let us remove an uncontrollable transition from S0. Obviously, this would immediately create an uncontrollable state that the extension algorithm would have to process. For the algorithm to be able to do that we must mark that state as forbidden, since this is the way that uncontrollable states are designated to the algorithm.
Figure 23. Result of trimming the specification for the tank process.
In Figure 24 an uncontrollable transition labeled by t0 has been removed from state q22 and this state has been forbidden. Note that we are at full liberty to do this. Before subjecting our specifications to the supervisor algorithm, we can manipulate them however we please, as long as we are sure to preserve the refinement property. We can mark additional states or forbid states. For instance, it may be interesting to guarantee that a certain state is never reached, although it is allowed by the partial specification. This we can guarantee by forbidding it. We could also remove a set of transitions if we, for some reason, decide to dislike that particular set. In this latter case, though, we must be careful to forbid any states that become uncontrollable due to our manipulation[1]. These manipulations preserve refinement by guaranteeing that the result is a sub-automaton of the total specification. However, this can be relaxed. Synchronizing the total specification with any automaton preserves the refinement property relative the plant. Thus, synchronous composition with any automaton is a valid manipulation. This can be done to introduce forbidden traces, for instance. Note though that this manipulation must also be done carefully, forbidding any uncontrollable states that may arise.
The reason why we would want to manipulate the total specification may be obvious, obscure or downright false, but that is not the issue. The important thing is that we can do it as long as we do it properly.
In this case, we remove an uncontrollable transition, and we forbid the uncontrollable state.
The added forbidden state does not affect the trimming, so that the result after the trimming algorithm is the same as for the non-manipulated specification. On the other hand, now the extension algorithm must do some work. Since the forbidden (and uncontrollable) state q22 is reached via an uncontrollable transition from q23, this state must also be forbidden. Furthermore, since this state is now forbidden and it is reached by an uncontrollable transition from q30, this state must also be forbidden. In this way the forbidden state-space is extended with states that reach the originally forbidden state q22 via traces of uncontrollable events.
From q28 a controllable transition V21 leads to q30 so the “backtracking” ends here. From q28 the supervisor can control the closed-loop system not to enter q30 and thus avoid q22. Note that this is a safety precaution. If the system were allowed to go to q30 it is not necessarily so that it would inevitably reach q22. There are two transitions on the way that could take the system to q10 or q3, and thus to a safe state. The problem is that we (and the supervisor) have no control over the uncontrollable events, so we cannot say if it would be safe to allow q30. To be on the safe side, we instead regard q30 as equally unsafe and hence undesired as q22[2].
Forbidding q23 and q30 does not impair the trimness, so that applying Algorithm II results in no change. We already know that this automaton is controllable so a new run through Algorithm III does nothing, as well. The result is the supervisor in Figure 24, or rather its purged counterpart. Notice that in q28 the supervisor waits for t0 before issuing the V21 command. Likewise, in q24, q27 and q29 it waits for t0 before turning on the heater (this is the same as before).
Figure 24. Supervisor generated from the modified total specification for the tank process. From q22 an uncontrollable transition to q2 has been removed.
For the two-user problem, we will synthesize three supervisors, one for each additional sub-specification. The first two are not very exciting, this example is more illustrative as a modeling and specification exercise. Hopefully though, the descriptions will aid in understanding the procedures. The third is more interesting for several reasons. First, it needs several iterations through the supervisor synthesis algorithm. Second, the result is the degenerate supervisor represented by the null automaton. Though this supervisor is formally correct and fulfills the specification, it only does this at the expense of allowing nothing at all. This is not very useful, and taken to mean that a supervisor does not exist for the given specification and plant. Third, although the algorithms forbid the initial state, they also return a subset of states that are closed, in the sense that they reach each other and only reach its surroundings by controllable events. This tells us that if we alter the plant[3] we could control it according to the given specifications. Altering the plant basically means rebuilding the physical process.
The first sub-specification is static, merely specifying the UU and the initial state II as forbidden and marked, respectively.
The initial supervisor candidate S0
for the static specification is shown in Figure 25. This could be regarded as
. Obviously,
a static specification cannot introduce any uncontrollable states, only explicitly
forbidden ones.
Figure 25. The total specification for the static sub-specification of the two-user problem.
The trimming algorithm forbids nothing, since all non-forbidden states already can reach the marked initial state. Likewise, the extension algorithm does not extend the forbidden state-space since the b1 and b2 events are controllable. Thus, the supervisor is synthesized simply by purging the automaton of Figure 25. This supervisor will keep the closed-loop system away from the UU state while always guaranteeing that the system can return to II. Exactly as specified.
The supervisor is not necessarily fair, though. In the RR state, where both users have requested the resource, there is no differentiating between which one of the users that came first. Hence, fairness cannot be guaranteed.
The second specification requires us to control the system so that it is fair, the user that requests the resource first should also be the user that gets access to the resource first. In addition, the static sub-specification should also be fulfilled. The total specifications for these two sub-specifications are given Figure 26. In this case, there are uncontrollable transitions. For instance, in UU the plant can execute both c1 and c2, whereas the total specification S0 of Figure 26 can only execute either, but not both. Hence, all states with UU as partial state are uncontrollable. However, these states are also forbidden explicitly, so this poses no additional problem.
S0 of Figure 27 is our initial supervisor candidate. Though it is controllable, since all uncontrollable states are already forbidden and all forbidden states are reached via controllable transitions, it is blocking. Certain states cannot reach any of the marked states, and so S0 must be trimmed. Note that we will be using Algorithm II.
Letting the trimming algorithm go through the “from” states in order, it looks at IR4A and finds that this state re4aches both a forbidden state IU0F and a non-forbidden non-marked state RR5A. Thus, nothing can be said of IR4A at this moment. The same holds for IR4B.
Figure 27. The total specification S0 of the two-user problem.
The next state IU0A, though, reaches a marked state and is thus added to the set of marked states. Forbidden “from” states are skipped. Continuing, both RR2B and RR5A are found to only reach forbidden states, and so they are forbidden. The state UI0B also reaches a marked state and is thus marked. The result of the trimming algorithm after its first iteration is shown in Figure 28. When all non-forbidden states have been examined, the trimming algorithm iterates and goes through the same operations. Now IR4A is forbidden, since it only reaches forbidden states, while RI1A is marked. This continues until no more states are marked. The result of the trimming algorithm is shown in Figure 29. As can be seen, all states are either marked or forbidden. Note that it is not always guaranteed that Algorithm II denotes a state either marked or forbidden. Some states may not pass either test.
The extension algorithm is applied nest. This algorithm extends the forbidden state-space with all states that uncontrollably led to already forbidden states. Unfortunately, this will forbid the initial state resulting in the null automaton.
Figure 28. The sub-automaton of S0 resulting from one iteration of the trimming algorithm
Figure 29. The result, S1, from the trimming algorithm.
The extension algorithm examines all non-forbidden states ands checks whether there exists an uncontrollable transition to a forbidden state. In that case, the state is also forbidden. This algorithm also iterates until no more states are forbidden. During its first iteration, the extension algorithm finds an uncontrollable transition labeled by a2 that takes the initial state II0A to the forbidden state IR4A. Thus, the initial state is forbidden, and the algorithm could terminate. The null automaton will be the result, meaning that no supervisor exists that can fulfill the three sub-specifications simultaneously.
However, algorithms are usually very “stupid” doing only what they have been “told”, and since a test for termination when the initial state is forbidden is not included in the algorithm, it goes on. Its result is shown in Figure 30.
Figure 30. The result of applying the extension algorithm to S1.
As can be seen a number of states remain non-forbidden, but of these, none are the initially marked states. In addition, none of these reaches only forbidden states. This set of states form a closed group reaching each other and able to not enter into the “outside”, since only controllable transitions reach there. Thus, feeding the result in Figure 30 to the trimming algorithm will give the same automaton back. Only a single pass will be made with no new transitions added to the marked ones, since all other have been forbidden.
It is interesting to interpret this result. No usable supervisor exists given the three sub-specifications and the plant. However, something does exist. There is a loop in the system, which forms a closed controllable unit. The matrix of Figure 30 is depicted in Figure 31, where the closed loop has been emphasized. What this loop tells us, is that if we started the system in one of the loop-states then it could be controlled to stay within the loop. Only controllable transitions leave that loop. We can also note that all plant events are present in the loop, and present once only. Thus, the loop describes a sequence of requesting, getting access to and releasing the resource that lets both users use the resource in accordance with all specifications.
Figure 31. The result from the supervisor algorithm, given the three sub-specifications and the two-user plant.
The reason that there does not exist a supervisor with the given plant is that we do not have any control over the initial request order. The loop that exists requires, for instance, an initial state where User1 has already requested the resource. Then, it is not granted access until User2 has requested access, and User2, in turn, is not granted access until User1 has used the resource, released it and requested it again. This guarantees an ordered flow of the events that fulfills all specifications.
What this means is that if we choose another initial state then the process could be controlled satisfactorily. Choosing another initial state can be interpreted as rebuilding the process.
[1] Even this is not necessary. If we compared the manipulated specification to the plant, we could algorithmically determine the uncontrollable states. However, as explained above, we perform the comparison while synchronizing with the plant to generate the total specification. The comparison is an expensive operation, essentially the same as synchronizing, that we want to avoid as far as possible.
[2] There are other interpretations of uncontrollable events where allowing states like q30 could be possible, so called, preemptive uncontrollable events, see Klein (1996).
[3] or the specification, but then the shown result would no longer be valid. An entirely different supervisor would (probably) result.