Partially-observed Discrete-event Systems Research Articles

A Uniform Framework for Diagnosis of Discrete-Event Systems With Unreliable Sensors Using Linear Temporal Logic

In this paper, we investigate the diagnosability verification problem of partially-observed discrete-event systems (DES) subject to unreliable sensors. In this setting, upon the occurrence of each event, the sensor reading may be non-deterministic due to measurement noises or possible sensor failures. Existing works on this topic mainly consider specific types of unreliable sensors such as the cases of intermittent sensors failures, permanent sensor failures or their combinations. In this work, we propose a novel <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">uniform framework</i> for diagnosability of DES subject to, not only sensor failures, but also a very general class of unreliable sensors. Our approach is to use linear temporal logic (LTL) with semantics on infinite traces to describe the possible behaviors of the sensors. A new notion of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\varphi$</tex-math></inline-formula> -diagnosability is proposed as the necessary and sufficient condition for the existence of a diagnoser when the behaviors of sensors satisfy the LTL formula <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\varphi$</tex-math></inline-formula> . Effective approach is provided to verify this notion. We show that, our new notion of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\varphi$</tex-math></inline-formula> -diagnosability subsumes all existing notions of robust diagnosability of DES subject to sensor failures. Furthermore, the proposed framework is user-friendly and flexible since it supports an arbitrary user-defined unreliable sensor type based on the specific scenario of the application. As examples, we provide two new notions of diagnosability, which have never been investigated in the literature, using our uniform framework.

A Unified Framework for Verification of Observational Properties for Partially-Observed Discrete-Event Systems

A Unified Framework for Verification of Observational Properties for Partially-Observed Discrete-Event Systems

Secure Your Intention: On Notions of Pre-Opacity in Discrete-Event Systems

This paper investigates an important information-flow security property called opacity in partially-observed discrete-event systems. We consider the presence of a passive intruder (eavesdropper) that knows the dynamic model of the system and can use the generated information-flow to infer some “secret” of the system. A system is said to be opaque if it always holds the plausible deniability for its secret. Existing notions of opacity only consider secret either as currently visiting some secret states or as having visited some secret states in the past. In this paper, we investigate information-flow security from a new angle by considering the secret of the system as the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">intention</i> to execute some particular behavior of importance in the future. To this end, we propose a new class of opacity called <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pre-opacity</i> that characterizes whether or not the intruder can predict the visit of secret states a certain number of steps ahead before the system actually does so. Depending the prediction task of the intruder, we propose two specific kinds of pre-opacity called <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><inline-formula><tex-math notation="LaTeX">$K$</tex-math></inline-formula>-step instant pre-opacity</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><inline-formula><tex-math notation="LaTeX">$K$</tex-math></inline-formula>-step trajectory pre-opacity</i> to specify this concept. For each notion of pre-opacity, we provide a necessary and sufficient condition as well as an effective verification algorithm. The complexity for the verification of pre-opacity is exponential in the size of the system as we show that pre-opacity is inherently PSPACE-hard. Finally, we generalize our setting to the case where the secret intention of the system is modeled as executing a particular sequence of events rather than visiting a secret state.

Verification and enforcement of current-state opacity based on a state space approach

In this study, the current-state opacity verification and enforcement problems in the context of partially-observed discrete event systems are investigated based on an algebraic state space approach. Current-state opacity is defined as a measure of whether a system can protect current vital information from exposure. If given systems are not current-state opaque, it is necessary to synthesize a supervisor to restrict systems’ behavior and enforce the property. In this paper, the algebraic-state-space-based approach to these problems provides a novel perspective to the literature. Firstly, an equivalent algebraic structure of a partially-observed finite automaton is established with the help of the semi-tensor product, where the complexity of an observable structure matrix is O(|X|2|Eo|) (X is the set of states and Eo is the set of observable events). And then, using the breadth-first search method, an algorithm to ascertain the state estimate is proposed based on the observable structure matrix, the complexity of which is O(|X|3|Eo|). For the verification of current-state opacity, it is carried out by determining whether or not there exists a leaking state estimate in the set of secret-related state estimates. In the worst case, this process would be done in O(2|X|). For the enforcement of opacity, the algebraic expression of a controlled system is also constructed, under which, the breadth-first search approach can still be applied to ascertain state estimates under each control profile. How to obtain all permissive control profiles is summarized as Algorithm 2, the complexity of which is O(2|E|×|X|3×|Eo|+2|X|).

Revisiting State Estimation and Weak Detectability of Discrete-Event Systems

In this paper, we revisit state estimation and weak detectability verification for discrete event systems (DES) from a span-new perspective. Specifically, using the semi-tensor product (STP) technique, we construct two new matrix-based information structures called a current-state estimator (C-estimator) and an initial-state estimator (I-estimator) for computing three fundamental types of state estimates, namely, current-state estimate (CSE), initial-state estimate (ISE), and delayed-state estimate (DSE). The complexity of building C-estimator and I-estimator is polynomial time with respect to the size of a plant. A notion of weak delayed detectability is introduced, which captures that, after observing a <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$k_{1}$ </tex-math></inline-formula> -length sequence/string, whether or not one can always accurately determine the state of a plant at this moment after at most <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$k_{2}$ </tex-math></inline-formula> steps of delays for some trajectories. Further, using the proposed C-estimator and I-estimator, we discuss the different types of detectability verification problems, including, but not restricted to, weak current-state detectability (C-detectability), weak initial-state detectability (I-detectability), and weak delayed detectability. Accordingly, several necessary and sufficient criteria are derived for verifying the aforementioned different types of detectability. Our approaches are numerically tractable and only involve some basic matrix manipulations. Finally, some examples are given to illustrate the obtained results. Note to Practitioners—State estimation is one of the most fundamental problems in many practical engineering systems. For instance, one needs to infer the state of a manufacturing system before a failure occurs. For a communication system, can we guarantee that whether important information remains secret to outsiders for security requirements? Finding an alternative and efficient approach to capture the state of a plant based on imperfect observations is still crucial for engineers. To solve these problems, in this paper we develop a novel methodology to tackle simultaneously three fundamental categories of state estimation for practical engineering systems that are inherently abstracted as partially-observed discrete-event systems. Our approaches are technically quite different from the existing ones. The novel results obtained in this paper are all of matrix-based characterization, which can be implemented algorithmically by means of the user-friendly STP software package. We believe that the alternative methodology provides an innovative insight for engineers in the field of automatic control.

I-S detectability of partially-observed discrete event systems: a novel matrix-based method

The state estimation problem is always considered to be critical in discrete event systems (DESs). In this paper, two methods are proposed for investigating the initial state estimation problem: one is the matrix-based dimension reduction tracking observation system, and the other is the matrix-based reversal observation system. In our paper, the initial state estimation is treated as the initial-state detectability (I-S detectability). Using the Boolean semi-tensor product method of matrices, the corresponding algebraic forms of the partially-observed DES are separately constructed, where the corresponding computational complexity is reduced to some degree. Based on the newly defined state transition output-event observation matrix, necessary and sufficient criteria are established to determine the I-S detectability of the addressed system. Illustrative examples are also given to show feasibility of the derived results.

Strong fault prognosability of partially-observed discrete event systems

Strong fault prognosability of partially-observed discrete event systems

Selection of a stealthy and harmful attack function in discrete event systems

In this paper we consider the problem of joint state estimation under attack in partially-observed discrete event systems. An operator observes the evolution of the plant to evaluate its current states. The attacker may tamper with the sensor readings received by the operator inserting dummy events or erasing real events that have occurred in the plant with the goal of preventing the operator from computing the correct state estimation. An attack function is said to be harmful if the state estimation consistent with the correct observation and the state estimation consistent with the corrupted observation satisfy a given misleading relation. On the basis of an automaton called joint estimator, we show how to compute a supremal stealthy joint subestimator that allows the attacker to remain stealthy, no matter what the future evolution of the plant is. Finally, we show how to select a stealthy and harmful attack function based on such a subestimator.

Attackable detectability of partially-observed discrete-event systems under sensor attack

This paper focuses on the problem of the detectability in the setting of partially-observed discrete event systems subject to sensor attackers. We assume the attacker can arbitrarily alter sensor readings after intercepting them from a target system, aiming to trick a given supervisor to issue improper control commands, which may lead the system not be strongly or weakly detectable. The definitions of attackable strong detectability and attackable weak detectability are presented. Necessary and sufficient conditions for two types of detectability are then presented respectively based on the observer construction.

Three kinds of coprognosability for partially-observed discrete event systems via a matrix approach

Due to the important application in security and safety analysis, fault prognosis of discrete event systems (DESs) plays a more vital role in study of Cyber–physical systems. In this work, we study the problem of decentralized fault prognosis in the context of partially-observed DESs. Different from existing results, we establish algebraic structures of given systems under decentralized agents by semi-tensor product rather than observers or verifiers based on formal language methods. The structure matrices of decentralized partially-observed DESs are polynomial in the size of a given system and linear about the number of agents. Besides, combining the formal method and algebraic state space approach, we discuss three kinds of coprognosability, called (M,K)-disjunctive-coprognosability aiming at disjunctive architectures, (M,K)-conjunctive-coprognosability for conjunctive architectures and (M,K)-strongly-coprognosability focusing on general structures, respectively. Here, (M,K) is the performance bound of a given prognostic system. In order to take both fault prediction and isolation into consideration, the decentralized prognoser is required to issue the “j” alarm for the jth type of fault and “0” means no fault alarm. Meanwhile, we propose a polynomial-time algorithm to verify each kind of coprognosability based on the structure matrix approach and show that each verification is not separate.

Joint State Estimation Under Attack of Discrete Event Systems

The problem of state estimation in the setting of partially-observed discrete event systems subject to cyber attacks is considered. An operator observes a plant through a natural projection that hides the occurrence of certain events. The objective of the operator is that of estimating the current state of the system. The observation is corrupted by an attacker which can tamper with the readings of a set of sensors thus inserting some fake events or erasing some observations. The aim of the attacker is that of altering the state estimation of the operator. An automaton, called joint estimator, is defined to describe the set of all possible attacks. In more details, an unbounded joint estimator is obtained by concurrent composition of two state observers, the attacker observer and the operator observer. The joint estimator shows, for each possible corrupted observation, the joint state estimation, i.e., the set of states consistent with the uncorrupted observation and the set of states consistent with the corrupted observation. Such a structure can be used to establish if an attack function is harmful w.r.t. a misleading relation. Our approach is also extended to the case in which the attacker may insert at most n events between two consecutive observations.

An improved approach for verifying delayed detectability of discrete-event systems

In this paper, we investigate state estimation and detection problems with information delays in the context of partially-observed discrete-event systems. Specifically, we study the verification of an important detectability property called delayed detectability which is related to the state estimation problem with information delayed. Particularly, it requires that the state of the system after k1 observations can always be detected within another k2 observation delay; delayed detectability is, therefore, referred to as (k1,k2)-detectability. In this paper, we provide a new verification algorithm for checking this property. The idea is to use the reversed dynamic of the system to efficiently estimate the delayed-state information. To this end, a new information structure called the two-way verifier is proposed. We show that our result improves the complexity of existing verification algorithms for the property. We also illustrate our result by simple examples.

A general approach for optimizing dynamic sensor activation for discrete event systems

We study the problem of dynamic sensor activation for centralized partially-observed discrete event systems. The sensors can be turned on/off online dynamically according to a sensor activation policy in order to satisfy some observation property. We consider a general class of properties, called Information-State-based (or IS-based) properties, which include, but are not limited to, observability, K-diagnosability, predictability, and opacity. We define a new Most Permissive Observer (MPO) that generalizes previous versions of this structure. Based on the generalized MPO, we first synthesize a logical minimal or maximal sensor activation policy based on a set inclusion criterion. Then we study the synthesis of optimal solutions for a given quantitative objective function that considers numerical activation costs and switching costs. Our results generalize previous works on dynamic sensor activation for enforcement of specific properties.

Online monitoring for diagnosis of violations of constraints in Petri net models

Abstract Fault diagnosis in partially-observed discrete-event systems requires modelling faults as unobservable events within the system. Representing faults as events is not always realistic. For example, some classes of fault are in form of violations of constraints such as service-level agreement (SLA) and Quality of Service (QoS). To model such faults, we need to modify the plant model which is not always acceptable. Firstly, this may make the models large. Secondly, adding extra transitions is not always preferable from engineers’ prospective as every modification of the constraint will modify the model of the plant. This paper applies integer Fourier-Motzkin elimination (IFME) approach to address this issue. Since the constraints and their violations can be written as inequalities, we show that starting from a Petri net two sets of inequalities (diagnoser) are obtained. These sets are used to judge whether an observed sequence may satisfy (violate) these inequalities. The correctness of the proposed approach has also been proved.

Computing observers from observation policies in discrete-event systems

This paper considers partially-observed discrete-event systems modeled by finite-state automata. The observation of event occurrences is associated with the transitions of the automaton model. That is, whether or not an event occurrence is observed is state-dependent, i.e., it depends on the transition in which the event label appears. This is in contrast to the case when observations are static and an event is either observed or not observed at every state in which it can occur. We refer to the set of transitions whose associated events are observed as an observation policy. Given an automaton model and an observation policy, we consider the problem of computing a deterministic generator of the language of event sequences that are observed using the automaton model and observation policy (i.e., an observer). Such a generator is useful, e.g., in problems of sensor activation for providing a deterministic mapping from event observations to sensor activation decisions when the decision to activate an event’s sensor is initially modeled as an observation policy. We propose an abstraction of the automaton model that may be used to represent an observer in certain cases. We illustrate cases where this abstraction accurately represents an observer when there is no ambiguity as to which event occurrences are observed following two observationally-identical strings. For the most general case considered, we demonstrate that verifying if the case holds is PSPACE-complete.

Trajectory detectability of discrete-event systems

We investigate the trajectory estimation problem for partially-observed discrete event systems. In some applications, only knowing the current state of the system may be insufficient, and knowing which trajectory the system takes to reach the current state could be important. This requires more precise knowledge about the system. In this paper, a language-based framework is proposed in order to tackle this problem. Two new notions of detectability, called trajectory detectability and periodic trajectory detectability, are proposed to capture different requirements in the aforementioned trajectory estimation problem. Effective verification algorithms are also provided. Our results extend the theory on detectability of discrete event systems from state estimation problem to trajectory estimation problem.

Synthesis of Maximally-Permissive Supervisors for the Range Control Problem

We investigate the supervisor synthesis problem for centralized partially-observed discrete event systems subject to safety specifications. It is well known that this problem does not have a unique supremal solution in general. Instead, there may be several incomparable locally maximal solutions. One then needs a mechanism to select one locally maximal solution. Our approach in this paper is to consider a lower bound specification on the controlled behavior, in addition to the upper bound for the safety specification. This leads to a generalized supervisory control problem called the range control problem . While the upper bound captures the (prefix-closed) legal behavior, the lower bound captures the (prefix-closed) minimum required behavior. We provide a synthesis algorithm that solves this problem by effectively constructing a maximally-permissive safe supervisor that contains the required lower bound behavior. This is the first algorithm with such properties, as previous works solve either the maximally-permissive safety problem (with no lower bound), or the lower bound containment problem (without maximal permissiveness).

A new approach for the verification of infinite-step and [formula omitted]-step opacity using two-way observers

In the context of security analysis for information flow properties, where a potentially malicious observer (intruder) tracks the observed behavior of a given system, infinite-step opacity (respectively, K-step opacity) holds if the intruder can never determine for sure that the system was in a secret state for any instant within infinite steps (respectively, K steps) prior to that particular instant. We present new algorithms for the verification of the properties of infinite-step opacity and K-step opacity for partially-observed discrete event systems modeled as finite-state automata. Our new algorithms are based on a novel separation principle for state estimates that characterizes the information dependence in opacity verification problems, and they have lower computational complexity than previously-proposed ones in the literature. Specifically, we propose a new information structure, called the two-way observer, that is used for the verification of infinite-step and K-step opacity. Based on the two-way observer, a new upper bound for the delay in K-step opacity is derived, which also improves previously-known results.

Initial-state detectability of stochastic discrete-event systems with probabilistic sensor failures

Initial-state estimation is an important problem in discrete-event systems. In this problem, the initial-state of the system is unknown and one wants to determine the initial-state of the system based on its observation. In this paper, we investigate the problem of initial-state detection of partially-observed discrete-event systems in the stochastic setting. We consider two sources of randomness in this problem: stochastic dynamic of the system and probabilistic sensor failures. Specifically, we model a stochastic discrete-event system by a probabilistic finite-state automaton and we use a probabilistic projection function as the observation model. The notion of stochastic initial-state detectability (SI-detectability) is introduced in order to capture whether or not the probability of detecting the initial-state converges to one even in the presence of potential sensor failures. An approach for the verification of SI-detectability is proposed. We also investigate the complexity of the SI-detectability verification problem and we show that this problem is PSPACE-complete.

Reliable Decentralized Fault Prognosis of Discrete-Event Systems

We investigate the problem of reliable decentralized fault prognosis of partially-observed discrete-event systems. In this problem, ${n}$ local prognosers are deployed to send their local prognostic decisions to a coordinator that calculates the final prognostic decision. However, only ${k}~ {(1\leq k\leq n)}$ local prognostic decisions are guaranteed to be available to the coordinator due to possible failures or communication losses of at most ${n-k}$ local prognosers. We propose the notion of ${k}$ -reliable decentralized prognoser in order to address this reliability issue. A necessary and sufficient condition for the existence of a ${k}$ -reliable decentralized prognoser, which predicts faults prior to their occurrences, is presented. This condition is termed as ${k}$ -reliable coprognosability. A polynomial-time algorithm for the verification of ${k}$ -reliable coprognosability is presented. We also demonstrate how to compute the ${k}$ -reliable reactive bound prior to any occurrence of faults.