Discrete Event Systems Research Articles

Modeling and State Estimation for Supervisory Control of Networked Timed Discrete-Event Systems and Their Application in Supervisor Synthesis

This paper considers modeling and state estimation of timed discrete-event systems (TDESs) with communication delays and losses. In the previous framework, the specified closed-loop system language may contain physically impossible strings, i.e., strings never occur in practice. To exclude these physically impossible strings, this paper presents a new modeling framework for supervisory control of networked TDESs. Specifically, we first analyze how to model and update the observation channel and the control channel under communication delays and losses. We then construct an automaton that explicitly describes the interaction process between the plant and the supervisor over the observation channel and the control channel so that the language of the closed-loop system can be specified. Compared with the existing work, the proposed framework can model the “dynamics” of the closed-loop system more accurately. Under the proposed framework, we further estimate states of the closed-loop system under communication delays and losses. The state estimation is implemented on-the-fly and bases on only the information of observations and controls in history. As an application of the proposed modeling and state estimation approaches, we finally extend the existing approaches to find all the admissible and safe supervisors of networked TDESs.

Robust predictability in discrete event systems under sensor attacks

The problem of robust predictability against sensor attacks is investigated. The objective of a diagnoser is to predict the occurrence of a critical event of a discrete event system (DES) under partial observation. An attacker may rewrite the diagnoser observation by inserting fake events or erasing real events. Two novel structures, namely, real diagnoser and the fake diagnoser, are constructed based on the diagnoser of the system. We compute the hybrid diagnoser as the parallel composition of the real diagnoser and the fake diagnoser. The hybrid diagnoser can be used to verify if a critical event of the system is robustly predictable when an attacker tampers with the diagnoser observation.

State-Based Differential Privacy Verification and Enforcement for Probabilistic Automata

Roughly speaking, differential privacy is a privacy-preserving strategy that guarantees attackers to be unlikely to infer, from the previous system output, the dataset from which an output is derived. This work introduces differential privacy to discrete event systems modeled by probabilistic automata to protect the state information pertaining to system resource configurations. State differential privacy is defined to protect the initial state of a discrete event system, which represents its initial resource configuration. Step-based state differential privacy verification is proposed in the framework of probabilistic automata, such that an attacker is unlikely to determine the initial state from which a system evolves, within a finite step of observations, if two systems with two different initial states satisfy state differential privacy. Specifically, the probability distributions of generating observations within a finite step from the two different initial states are approximate. If the two systems do not satisfy state differential privacy, a control specification is proposed, such that state differential privacy is enforced via supervisory control that is maximally permissive. Experimental studies are given to illustrate that the proposed method can effectively verify state differential privacy and enforce privacy protection in the probabilistic automata framework.

Feedback control laws to ensure generalized mutual exclusion constraints in a network of partially observable timed event graphs

This paper deals with the control problem of partially-observable Discrete Event Systems (DESs) which are modelled by Networks of Timed Event Graphs (NTEGs) and subject to Generalized Mutual Exclusion Constraints (GMECs). A new mathematical methodology based on the use of Min-Plus formalisms to synthesize control laws that guarantee the concerned constraints is suggested. For this, the dynamic behavior of the NTEGs is described by linear equations in Min-Plus algebra and the GMECs are represented by weighted inequalities in Min-Plus algebra too. Sufficient conditions are supplied to verify the existence of feedback gains guaranteeing the satisfaction of GMECs. Eventually, to verify the analytical results, it is important to examine a real case study of manufacturing systems.

Verification of Current-State Opacity in Discrete Event Systems by Using Basis Coverability Graphs

A new approach to the verification of current-state opacity for discrete event systems is proposed in this paper, which is modeled with unbounded Petri nets. The concept of opacity verification is first extended from bounded Petri nets to unbounded Petri nets. In this model, all transitions and partial places are assumed to be unobservable, i.e., only the number of tokens in the observable places can be measured. In this work, a novel basis coverability graph is constructed by using partial markings and quasi-observable transitions. By this graph, this research finds that an unbounded net system is current-state opaque if, for an arbitrary partial marking, there always exists at least one regular marking in the result of current-state estimation with respect to the partial marking not belonging to the given secret. Finally, a sufficient and necessary condition is proposed for the verification of current-state opacity. A manufacturing system example is presented to illustrate that the concept of current-state opacity can be verified for unbounded net systems.

Self-Learning Fuzzy Automaton With Input and Output Fuzzy Sets for System Modelling

Fuzzy Automaton plays a key role in modeling a system as a fuzzy discrete event system and determining the model's properties such as observability and predictability. We recently developed online supervised learning algorithms for the fuzzy automaton to learn its event transition matrix under three different conditions tied to availability of pre- and post-event states, which are the first and only studies in the current literature. In this paper, we first eliminate, in a theoretical manner, the restriction in our prior studies that the individual pre- and post-event states must be identical. We then tackle a more realistic and general condition-learning the transition matrix when neither pre-event nor post-event state is known, which covers the previous three conditions as special cases. The only information assumes to be available is values of the variables and they are only known to be vaguely related to the states. We link the variables to the states through (Gaussian) fuzzy sets owing to the conceptual relationship between a fuzzy set and a fuzzy state. The resulting innovative model is called the Fuzzy Automaton with Input and Output Fuzzy Sets. Stochastic-gradient-descent-based algorithms are derived for the model to iteratively learn online the transition matrix and all the parameters of the fuzzy sets simultaneously. Another significant extension is that unlike our previous models, the new model is capable of determining an individual post-event state even if it is associated with two or more variables, expanding model's utility. It is the first fuzzy discrete event system model that is capable of learning solely based on sensor data without relying on any <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">subjective</i> input from humans, removing a significant bottleneck for real-world applications. Computer simulation results are furnished to exhibit learning performance of this new model. This model will be valuable for solving practical problems in healthcare and various industries, and we discuss in detail its potential in modeling of disease treatment decision-making.

On Securing Cryptographic ICs against Scan-based Attacks: A Hamming Weight Distribution Perspective

Scan chain-based Design for Testability is the industry standard in use for testing manufacturing defects in the semiconductor industry to ensure the structural and functional correctness of chips. Fault coverage is significantly enhanced due to the higher observability and controllability of the internal latches. These ensuing benefits to testing, if misused, expose vulnerabilities that can be detrimental to the security aspects, especially in the context of crypto-chips that contain a secret key. Hence, it remains of paramount importance for a chip designer to secure crypto-chips against various scan attacks. A countermeasure is proposed in this article that preserves the secrecy of an embedded key in a cryptographic integrated circuit running an Advanced Encryption Standard (AES) implementation. A novel design involving a hardware unit is illustrated that circumvents differential scan attacks by essentially performing bit flips deterministically, using a pre-computed mask value. This helps secure the chip while retaining full testability. The controller logic directly depends on a mask determination algorithm that can defend against any scan attack with 𝒪 theoretical complexity. Security analysis of our proposed defense procedure is performed in the framework of Discrete Event Systems (DES). The sequential scan circuit of an AES cryptosystem is modeled as a DES using Finite State Automata. A security notion, Opacity , is used to quantify and formally verify the security aspects of our controlled system, which shows that the entropy of the secret key is preserved. A case study is performed that shows to mitigate state-of-the-art differential scan attacks successfully at a nominal extra overhead of 1.78%.

LDES: detector design for version number attack detection using linear temporal logic based on discrete event system

The Internet Engineering Task Force (IETF) has defined routing protocols for low power and lossy networks (RPL) for constrained devices. RPL constructs DODAGs (destination oriented directed acyclic graphs), to optimize routing. RPL ensures acyclic topology with the DODAG version number. However, the control message’s DODAG version number is not authenticated. So, RPL is vulnerable to network resource attack known as DODAG Version Number (DVN) attack. DVN attack creates a packet delay, packet loss, cyclic topology, etc., in the network. This paper proposes a method for detecting DODAG version number attacks. Several existing schemes to defend against the DVN, such as cryptographic techniques, trust-based, threshold-based and mitigation are computationally intensive or require protocol modification. DVN does not change the packet format or sequence of packets, but can still perform attacks and hence fall under the category of stealthy attacks, which are difficult to detect using traditional intrusion detection system’s (IDS). Discrete-event system (DES) based IDS have been applied in the literature for stealthy attacks that achieve low overhead, low false alarm rate, etc. However, the construction of DES-based IDS for network protocol may lead to errors, as modelling is manual. The resulting IDS, therefore, is unable to guarantee its correctness. This paper proposes linear temporal logic (LTL) based DES paradigm to detect DVN. LTL-based paradigm facilitates formal verification of the DES-based IDS, and hence the correctness of the scheme is ascertained. The proposed technique is simulated using the Contiki cooja simulator. When the percentage of spiteful nodes in the network increases, the true positive rate, and packet delivery rate drops, while the false positive rate and control message overhead increase. The memory requirement for sending the packets and verifying the nodes is minimal. The LTL-based IDS has been formally verified using NuSMV to ensure the correctness of the framework.

Assessment of initial-state-opacity in live and bounded labeled Petri net systems via optimization techniques

Opacity is a property of discrete event systems (DES) that is related to the possibility of hiding a secret to external observers, the so called intruders. If the secret is the system initial state, then the related opacity problem is referred to as Initial State Opacity (ISO). This paper gives a necessary and sufficient condition to check ISO in DES modeled as bounded and live labeled Petri nets (PNs). The proposed approach relies on both the algebraic representation of labeled PNs dynamic, and on their structural representation in terms of minimal support T-invariants. The proposed necessary and sufficient condition enables ISO assessment by means of the solution of Integer Linear Programming problems, which can be efficiently solved nowadays by means of off-the-shelf optimization tools.

Modeling and Simulation of Crude Oil Sea–River Transshipment System in China’s Yangtze River Basin

China’s Yangtze River Basin has an increasingly strong demand for crude oil. As a seaborne import port for crude oil, Ningbo-Zhoushan Port is under pressure to undertake the transshipment of crude oil to various oil terminals in the Yangtze River Basin. To alleviate the stress of crude oil transportation in Ningbo-Zhoushan Port, the port operator proposed the crude oil sea–river transshipment scheme in Nantong Port. Therefore, this paper aims to verify the feasibility of this scheme. We used the discrete event system modeling and entity relationship diagram method to construct the hierarchical and concept models of the Yangtze River Basin’s crude oil sea–river transportation system. Furthermore, we developed corresponding simulation modules on the Witness platform and carried out a simulation experiment of the crude oil sea–river transfer scheme. In the experiment, we analyzed the influence of the transshipment ratio on berth utilization, waiting time, and sailing time of other ports by adjusting the parameter of the transshipment ratio. The experimental results show that when the transshipment rate reaches 100%, the utilization rates of loading and unloading berth in Nantong Port are 4% and 13%, respectively, which evidences that Nantong Port has transshipment potential. At the same time, the simulation experiment’s statistical indicators, such as the utilization rate of oil berths, the queuing time of oil tankers, and the sailing time, not only confirm the feasibility of the crude oil sea–river transshipment scheme of Nantong Port but also confirm that the scheme is helpful to improve crude oil transportation efficiency. The simulation results benefit the port operation decision, and the established model and simulation module can be encapsulated and reused.

Polynomial-time verification for bisimilarity control of partially observed nondeterministic discrete event systems with deterministic specifications

We consider a bisimilarity control problem for partially observed nondeterministic discrete event systems. It requires us to synthesize a supervisor that works under partial observation so that the supervised system is bisimilar to the specification. The computational complexity of verifying the known necessary and sufficient condition for the existence of such a supervisor is exponential in the numbers of states of the system and the specification. We show that, in a special case where the specification is deterministic, the existence of a supervisor that solves the bisimilarity control problem is polynomially verified.

A State Space Approach to Decentralized Fault SE-Coprognosability of Partially Observed Discrete Event Systems.

The problem of fault prognosis in the context of discrete event systems (DESs) is a crucial subject to study the security and maintenance of cyber-physical systems. In this article, the decentralized fault prognosis of partially observed DESs is analyzed with a universal state-estimate-based protocol. It follows (M,K) as the performance bound of any expected decentralized prognosers, where any fault can be predicted K steps before its occurrence and the fault is guaranteed to occur within M steps once a corresponding fault alarm is issued. To determine whether expected decentralized prognosers exist, the notion of state-estimate-coprognosability (SE-coprognosability) under the case of one fault type is proposed. Compared with existing other kinds of coprognosability, SE-coprognosability is a more generalized concept. Meanwhile, combining the formal method and algebraic state space approach, a novel state estimation algorithm is presented and based on which, the verification of SE-coprognosability is also solved.

A Hybrid Systems-Based Hierarchical Control Architecture for Heterogeneous Field Robot Teams.

Field robot systems have recently been applied in a wide range of research fields. Further automation, development, and activation of such systems require cooperation among heterogeneous robots. Classical control theory is inefficient in managing large-scale complex dynamic systems. Therefore, a discrete-event system based on the supervisory control theory must be introduced to overcome this limitation. In this article, we propose a hybrid system-based hierarchical control architecture using a supervisory control-based high-level controller and a traditional control-based low-level controller. The hybrid system and its dynamics are modeled through a formal method, called hybrid automata, and the behavior specifications are designed to express the control objectives for cooperation. In addition, modular supervisors that are more scalable and maintainable than a centralized supervisory controller were synthesized. The proposed hybrid system and hierarchical control architecture were implemented, validated, and evaluated for performance through a physics-based simulator and field tests. The experimental results confirmed that the robot team satisfied the given specifications and presented systematic results, validating the efficiency of the proposed control architecture.

Verification and enforcement of current-state opacity based on a state space approach

In this study, the current-state opacity verification and enforcement problems in the context of partially-observed discrete event systems are investigated based on an algebraic state space approach. Current-state opacity is defined as a measure of whether a system can protect current vital information from exposure. If given systems are not current-state opaque, it is necessary to synthesize a supervisor to restrict systems’ behavior and enforce the property. In this paper, the algebraic-state-space-based approach to these problems provides a novel perspective to the literature. Firstly, an equivalent algebraic structure of a partially-observed finite automaton is established with the help of the semi-tensor product, where the complexity of an observable structure matrix is O(|X|2|Eo|) (X is the set of states and Eo is the set of observable events). And then, using the breadth-first search method, an algorithm to ascertain the state estimate is proposed based on the observable structure matrix, the complexity of which is O(|X|3|Eo|). For the verification of current-state opacity, it is carried out by determining whether or not there exists a leaking state estimate in the set of secret-related state estimates. In the worst case, this process would be done in O(2|X|). For the enforcement of opacity, the algebraic expression of a controlled system is also constructed, under which, the breadth-first search approach can still be applied to ascertain state estimates under each control profile. How to obtain all permissive control profiles is summarized as Algorithm 2, the complexity of which is O(2|E|×|X|3×|Eo|+2|X|).

Event-Based Automaton Model for identification of discrete-event systems for fault detection

Fault diagnosis is a crucial task to guarantee reliability, and reduce losses and production cost in industrial systems. In the traditional techniques for designing a fault diagnoser, it is necessary to obtain the complete model of the system, including its post-fault behavior. However, in general, industrial systems are large and composed of several subsystems which makes their modeling a laborious and time-consuming task. In addition, only predefined faults can be detected using the traditional fault diagnosis approach. In order to circumvent these problems, black-box identification techniques have been proposed in the literature to obtain an automaton that models the fault-free behavior of the system from the observation of the input and output signals of the system controller. Then, this model is used in a fault detection algorithm, and, after detection, the fault is isolated offline based on a comparison between the identified model and the sequence of observed signals. In all these approaches, it is assumed that the system has the same initial status of inputs and outputs of the controller. In practice, however, the system may start the execution of tasks with different input and output controller signal values. In this work, we present a new identification model, called Event-Based Automaton Model (EBAM). Differently from the other models proposed in the literature, the EBAM can be used to represent the fault-free system behavior when the tasks executed by the system start with different controller input and output values. A practical example, consisting of a plant simulated by using a 3D simulation software controlled by a Programmable Logic Controller, is used to illustrate the identification method and to show the efficiency of the fault detection algorithm based on the identified EBAM.

Dynamic Timed Automata for Reconfigurable System Modeling and Verification

Modern discrete-event systems (DESs) are often characterized by their dynamic structures enabling highly flexible behaviors that can respond in real time to volatile environments. On the other hand, timed automata (TA) are powerful tools used to design various DESs. However, they lack the ability to naturally describe dynamic-structure reconfigurable systems. Indeed, TA are characterized by their rigid structures, which cannot handle the complexity of dynamic structures. To overcome this limitation, we propose an extension to TA, called dynamic timed automata (DTA), enabling the modeling and verification of reconfigurable systems. Additionally, we present a new algorithm that transforms DTA into semantic-equivalent TA while preserving their behavior. We demonstrate the usefulness and applicability of this new modeling and verification technique using an illustrative example.

Synthesis of optimal covert sensor–actuator attackers for discrete-event systems

This work introduces an approach for the synthesis of optimal covert sensor–actuator attackers in the context of discrete-event systems (DES). Building upon existing works on optimal supervisor synthesis, on one hand, and the base model construction in the transformation of covert sensor–actuator attacker synthesis to supervisor synthesis, on the other hand, we show how the optimal covert sensor–actuator attacker synthesis problem could be transformed to the optimal supervisor synthesis problem, thus generalizing its logic counterpart. We consider several different types of optimization objectives, such as (1) minimization of attack energy cost, and (2) minimization of time cost to cause damage infliction; for the latter one, asynchronous event firings and concurrent event firings at the plant are both considered. We provide the necessary and sufficient conditions for the existence of an optimal attacker for both the energy minimization case and damage infliction time minimization case. Thus, this work may potentially provide a unified approach for the optimal synthesis of covert sensor–actuator attackers in different setups.

A model-based deep reinforcement learning approach to the nonblocking coordination of modular supervisors of discrete event systems

Modular supervisory control may lead to conflicts among the modular supervisors for large-scale discrete event systems. The existing methods for ensuring nonblocking control of modular supervisors either exploit favorable structures in the system model to guarantee the nonblocking property of modular supervisors or employ hierarchical model abstraction methods for reducing the computational complexity of designing a nonblocking coordinator. The nonblocking modular control problem is, in general, NP-hard. This study integrates supervisory control theory and a model-based deep reinforcement learning method to synthesize a nonblocking coordinator for the modular supervisors. The deep reinforcement learning method significantly reduces the computational complexity by avoiding the computation of synchronization of multiple modular supervisors and the plant models. The supervisory control function is approximated by the deep neural network instead of a large-sized finite automaton. Furthermore, the proposed model-based deep reinforcement learning method is more efficient than the standard deep Q network algorithm.

Detection of Actuator Enablement Attacks by Petri Nets in Supervisory Control Systems

The feedback control system with network-connected components is vulnerable to cyberattacks. We study a problem of attack detection in supervisory control of discrete-event systems. The scenario of a system subjected to actuator enablement attacks is considered in this article. We also consider that some unsafe places that should be protected from an attacker exist in the system, and some controllable events that are disabled by a supervisor might be re-enabled by an attacker. This article proposes a defense strategy to detect actuator enablement attacks and disable all controllable events after detecting an attack. We design algorithmic procedures to determine whether the system can be protected against damage caused by actuator enablement attacks, where the damage is predefined as a set of “unsafe” places. In this way, the system property is called “AE-safe controllability”. The safe controllability can be verified by using a basis diagnoser or a basis verifier. Finally, we explain the approach with a cargo system example.

Scheduling of Resource Allocation Systems with Timed Petri Nets: A Survey

Resource allocation systems (RASs) belong to a kind of discrete event system commonly seen in the industry. In such systems, available resources are allocated to concurrently running processes to optimize some performance criteria. Search strategies in the reachability graph (RG) of a timed Petri net (PN) attracted much attention in the past decades to cope with RAS scheduling problems (RSPs), since PNs are very suitable to model and analyze RASs and their RGs fully reflect systems’ behavior. However, there has been no existing related survey and review paper till now. In this work, we present a tutorial and comprehensive literature survey of RG-based RSP methods. Many state-of-the-art RG-based RAS scheduling strategies are reviewed and summarized. First, we present a framework of RSPs and classify RSPs and their PNs in terms of resource usage and net structures. The differences and relations among the PNs are also given. Then, we introduce timed PN construction methods for RSPs and scheduling objectives and search strategies for RG-based RSPs. Next, we summarize different heuristic functions adopted in a frequently used A * search to solve RG-based RSPs. Finally, we discuss some important future research directions and open issues.