Supervisory Control Synthesis Research Articles

Offline supervisory control synthesis: taxonomy and recent developments

This paper surveys recent advances in supervisory control theory since its 30th anniversary in 2017. We performed a systematic literature search and selected 272 relevant papers, with a focus on automata-based approaches. These were fitted into coherent narratives, based in part on a taxonomy of supervisor synthesis methods. The obtained papers show the fast and vast progress of the field, where recent research covers a wide range of new synthesis optimization techniques, different aspects such as fault tolerance, security, and timing, and new and diverse application domains. This survey refrains from in-depth descriptions of techniques, instead focusing on high-level contributions of recent works, how they relate to each other, and future directions for research.

Supervisory Control for Dynamic Feature Configuration in Product Lines

In this paper a framework for engineering supervisory controllers for product lines with dynamic feature configuration is proposed. The variability in valid configurations is described by a feature model. Behavior of system components is achieved using (extended) finite automata and both behavioral and dynamic configuration constraints are expressed by means of requirements as is common in supervisory control theory. Supervisory controller synthesis is applied to compute a behavioral model in which the requirements are adhered to. For the challenges that arise in this setting, multiple solutions are discussed. The solutions are exemplified in the CIF toolset using a model of a coffee machine. A use case of the much larger Body Comfort System product line is performed to showcase feasibility for industrial-sized systems.

Supervisory Control Synthesis of Timed Automata Using Forcible Events

Supervisory Control Synthesis of Timed Automata Using Forcible Events

Synthesis and Implementation of Distributed Supervisory Controllers With Communication Delays

In literature, extensive research has been done with respect to synthesis of supervisory controllers. Such synthesized supervisors can be distributed for implementation on multiple physical controllers. This paper discusses a method for distributing a synthesized supervisory controller. In this method, dependency structure matrices are used to distribute a system, the supervisor is then distributed accordingly, using existing localization theory. The existence of communication delays between supervisory controllers is unavoidable in a distributed application. The influence of these delays on the behavior of a supervisor is therefore studied using delay robustness theory. This paper introduces the use of mutex algorithms to make the distributed supervisor delay-robust. A case study is used to demonstrate the method and hardware in the loop testing is used to validate the resulting distributed supervisor.

Synthesis-based engineering of supervisory controllers for ROS-based applications

An ever-increasing number of robotic applications is being created based on the functionalities and the communication facilities offered by the Robotic Operating System (ROS). When applications involve contact with humans, such as in some transportation tasks, a robot supervisory controller shall guarantee that in every possible circumstance safety and task requirements are satisfied. There is no framework provided by ROS to specify supervisory controllers with formal guarantees about the satisfaction of requirements. This is problematic when the complexity of the controller increases, and it is not viable to test every possible scenario during the validation stage of the robotic application. This paper presents novel work that aims at enabling supervisory controller synthesis for ROS-based applications by (a) proposing a novel mapping between concepts from supervisory control theory and ROS, (b) demonstrating that a supervisory control modeling language exists that can be used to describe plant models and to specify requirements and (c) presenting generic finite-state automata models of ROS components, regarded as plant models, which are input for the synthesis procedure. The approach is demonstrated by synthesizing the controller to coordinate state-of-the-art mobile robot navigation modules. Simulations and real-life experiments show that the generated supervisory controller guarantees the correctness of the model with respect to the requirements and that the execution time of a control loop, including the binding code between the supervisory controller and ROS, is on average short enough to be deployed in high-level control loops. The paper is accompanied by a public code repository that contains the implementation of all methods presented in the paper including simulation environments to ease the replication of the results presented.

Supervisory Controller Synthesis for Nonterminating Processes Is an Obliging Game

In this article, we present a new algorithm to solve the supervisory control problem over nonterminating processes modeled as <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\omega$</tex-math></inline-formula> -regular automata. A solution to this problem was obtained by Thistle in 1995, which uses complex manipulations of automata. We show a new solution to the problem through a reduction to <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">obliging games</i> , which, in turn, can be reduced to <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\omega$</tex-math></inline-formula> -regular reactive synthesis. Therefore, our reduction results in a symbolic algorithm based on manipulating sets of states.

Discrete-Event Modeling and Supervisory Control Synthesis to Maintain the Safety in a Gas Transmission System

Discrete-Event Modeling and Supervisory Control Synthesis to Maintain the Safety in a Gas Transmission System

Partial-Order Reduction for Supervisory Controller Synthesis

A key challenge in the synthesis and subsequent analysis of supervisory controllers is the impact of state-space explosion caused by concurrency. The main bottleneck is often the memory needed to store the composition of plant and requirement automata and the resulting supervisor. Partial-order reduction (POR) is a well-established technique that alleviates this issue in the field of model checking. It does so by exploiting redundancy in the model with respect to the properties of interest. For controller synthesis, the functional properties of interest are nonblockingness, controllability, and least-restrictiveness, but also performance properties, such as throughput and latency are of interest. We propose an on-the-fly POR on the input model that preserves both functional and performance properties in the synthesized supervisory controller. This improves the scalability of the synthesis (and any subsequent performance analysis). Synthesis experiments show the effectiveness of the POR on a set of realistic manufacturing system models.

Lessons learned in the application of formal methods to the design of a storm surge barrier control system∗

The Maeslantkering is a key flood defense infrastructural system in the Netherlands. This movable barrier protects the city and harbor of Rotterdam, without impacting ship traffic under normal circumstances. Its control system, which operates completely autonomously, must be guaranteed to work correctly even under extreme weather conditions, although it closes only sporadically. During its development in the 1990’s, the formal methods Z and Spin were used to increase reliability. As the availability of industrial expert knowledge on these formal methods declines, maintaining the specifications defined back then has become cumbersome. In the quest for an alternative mathematically rigorous approach, this paper reports on an experience in applying supervisory control synthesis. This formal method was recently applied successfully to other types of infrastructural systems like waterway locks, bridges, and tunnels, with the purpose to ensure safe behavior by coordinating hardware components. Here, we show that it can also be used to coordinate several (controller) software systems. Additionally, we compare the lessons learned from the originally used formal methods and link Z to supervisory control synthesis.

Supervisory control with absent-state explanations for coloured finite automata

Nonblockingness in supervisory control synthesis guarantees that from every reachable state in the system, some marked (final) state is reachable. Situations, where nonblockingness of multiple sets of marked states (multiple tasks) is imposed, are common. Especially for composite systems, the marking of each subsystem usually has an individual meaning. To deal with these situations, multitasking supervisory control can be used.Currently, in multitasking supervisory control, there is no requirement-feedback when the synthesized supervisor shows unexpected or undesired behaviour (caused by wrong modelling of requirements for example). In this paper a framework is proposed to generate a cause for the absence of a state for multitasking supervisory control. In particular, we propose a pre-synthesis transformation that ensures that the influence of the requirements on the absence of a state is visible in the cause.

Supervisory controller synthesis and implementation for safety PLCs

The development of supervisory controllers for cyber-physical systems is a laborious and error-prone process. Supervisor synthesis enables control designers to automatically synthesize a correct-by-construction supervisor from a model of the plant combined with a model of the control requirements. From the supervisor model, controller code can be generated which is suitable for the implementation on a programmable logic controller (PLC). Supervisors for industrial systems that operate in close proximity to humans have to adhere to strict safety standards. To achieve these standards, safety PLCs (SPLCs) are used. For SPLC implementation, the supervisor has to be split into a regular part and a safety part. In previous work, a method is proposed to automatically split a supervisor model for this purpose. The method assumes that the provided plant model is a collection of finite automata. In this paper, the extension to extended finite automata is described. Additionally, guidelines are provided for modeling the plant and the requirements to achieve a favorable splitting. A case study on a rotating bridge is elaborated which has been used to validate the method. The case study spans all development steps, including the implementation of the resulting supervisor to control the real bridge.

Control synthesis for multiple mobile robot systems

This work continues our study on the control synthesis for multiple mobile robot systems (MMRS). We assume a hybrid approach that comprises the supervisory control level, based on a discrete event model of MMRS, and the robot control level, based on a continuous time model of the robot motion. Our objective is to further develop the control concept towards its implementation in a real-world application – a testbed for a fleet of six laboratory robots. In the first part of the paper, we develop a methodology of the supervisory control synthesis, that employs the Petri net formalism and formally ensures the required logics of MMRS operation, as well as propose a relevant architecture of the supervisor. The second part is focused on the low-level robot control and control procedures enabling modification of the robot motion according to the supervisor’s decisions. A simulation case is presented that illustrates the operation of the system.

Supervisory control synthesis for large-scale systems with isomorphisms

The complexity of the design of supervisory controllers for today’s high-tech systems is ever increasing with the rise in demands for higher safety and functionality. Supervisory control synthesis enables the design engineer to automatically generate a supervisory controller from a model of the plant and a model of the controller requirements. Although supervisory control theory is an active research area, the number of industrial applications remains relatively low. One of the main reasons for this is the lack of guidelines for practical applications of supervisory control theory, especially in case of large-scale systems with numerous components and complex dependencies. In this paper, guidelines are given for the process of obtaining and validating a supervisory controller, more specifically for large-scale systems with isomorphisms. Systems with isomorphisms are systems with a high degree of symmetry and repetitiveness in their components, such as manufacturing lines with parallel processing lines or infrastructural systems with repeating modules. This paper shows how coordination between the steps in obtaining a supervisory controller for a large-scale system improves the efficiency of the process and quality of the end result, and how the isomorphism of components in the system can be exploited in these steps. This process is demonstrated in this paper by a case study related to the Eerste Heinenoordtunnel, a road tunnel in the Netherlands. The case study shows the steps of modeling the plant and the controller requirements, performing model reduction based on isomorphisms in the system, synthesizing the supervisory controller, and validating the controller by means of simulation.

A Field-Sensitive Security Monitor for Object-Oriented Programs

In this paper, we propose a sound method to synthesize a permissive monitor using boolean supervisory controller synthesis that observes a Java program at certain checkpoints, predicts information flow violations and applies suitable countermeasures to prevent violations. We introduce an approach for modeling heap and information flow via heap. To improve permissiveness, we train the monitor and remove false positives by executing the program along with its executable model. If a security violation is detected, the user can define sound countermeasures, including declassification to apply in checkpoints. We prove that the monitored program ensures localized delimited release in case of declassifying information and termination-insensitive noninterference in case of no declassification. We implement a tool to automate the whole process and generate a monitor. Our method is evaluated by applying it on the Droidbench benchmark and one real-life Android application.

Synthesized fault-tolerant supervisory controllers, with an application to a rotating bridge

Designing supervisory controllers for high-tech systems is a laborious and error-prone process. Model-driven software engineering methods can help in increasing the quality and productivity by automation of various steps in the design process. Supervisory control synthesis (SCS) is such a method. SCS is a formal method that can be used to synthesize a supervisor for a system from the uncontrolled plant model and the requirements model. Subsequently, this supervisor can be used to generate controller code. While SCS is an active research topic, reports on industrial applications are rare. One of the main reasons for this is that until recently synthesis techniques were unable to scale to industrial-size problems. Due to advances in computation power, memory availability, and synthesis algorithms, synthesis techniques have matured to a point where they are capable of being applied to industrial-size problems. This paper presents a method for modeling, synthesis, validation, code generation, and implementation of fault-tolerant supervisory controllers. To illustrate this method, a case is described where a supervisory controller for a movable bridge has been synthesized, validated, implemented, and tested. With this case study, it is shown that synthesis techniques have reached a critical point where they are powerful enough to be applied in practice.

Synthesis-Based Engineering of Supervisory Controllers for Autonomous Robotic Navigation

When mobile robots are employed in transportation tasks involving contact with humans, their control software shall guarantee that in every possible circumstance safety and, in general, task requirements are guaranteed. When control models are manually translated into an executable implementation, it becomes cumbersome to provide such guarantees. Model-driven engineering approaches provide an answer to such a problem. Domain specific models are automatically translated into an executable implementation. Some model-driven engineering approaches exist that are specific to robotics. However, formal guarantees on correctness of the model and the generated implementation with respect to the requirements are, often, not provided. This paper investigates how a general purpose modelling language for supervisory controller synthesis can be used to formally model plants and requirements for a robotic navigation task and can generate an executable implementation that can be integrated into a leading middleware for robotic applications. The starting point is the modelling of the interface provided by existing navigation components available in the targeted middleware. We demonstrate, with simulations and real-life experiments, that the generated supervisory controller is suitable for real-time deployment and guarantees correctness of the model with respect to the requirements of the navigation task at hand. Results on the reaction time of the supervisory controller show that such reaction time is about twenty times smaller than the one of the same supervisory controller implemented with a conventional framework.

A Discrete-Event Supervisory Control for the AC Microgrid

Based on Supervisory Control Theory, this paper introduces a systematic and bottom-up approach to the development and synthesis of a microgrid supervisory control (SC) to formalize a discrete power management strategy. The proposed approach is general, transparent, and rigorous. The envisioned strategy is applied to the islanded mode of operation of an AC microgrid, which includes a battery energy storage system, a solar photovoltaic unit, and a conventional rotating generator as distributed energy resources. The SC is nonblocking and maximally permissive, i.e., it enables transitions among all possible discrete operational scenarios of the microgrid and identifies those that must be avoided. The proposed supervisory control is implemented in an industrial-grade PLCnext hardware platform; the supervisory control performance is evaluated through case studies conducted in a RTDS-based real-time hardware-in-the-loop environment.

Structuring Multilevel Discrete-Event Systems With Dependence Structure Matrices

Despite the correct-by-construction property, one of the major drawbacks of supervisory control synthesis is state-space explosion. Several approaches have been proposed to overcome this computational difficulty, such as modular, hierarchical, decentralized, and multilevel supervisory control synthesis. Unfortunately, the modeler needs to provide additional information about the system's structure or controller's structure as input for most of these nonmonolithic synthesis procedures. Multilevel synthesis assumes that the system is provided in a tree-structured format, which may resemble a system decomposition. In this paper, we present a systematic approach to transform a set of plant models and a set of requirement models provided as extended finite automata into a tree-structured multilevel discrete-event system to which multilevel supervisory control synthesis can be applied. By analyzing the dependencies between the plants and the requirements using dependence structure matrix techniques, a multilevel clustering can be calculated. With the modeling framework of extended finite automata, plant models and requirements depend on each other when they share events or variables. We report on experimental results of applying the algorithm's implementation on several models available in the literature to assess the applicability of the proposed method. The benefit of multilevel synthesis based on the calculated clustering is significant for most large-scale systems.

Quantifying model quality for supervisory control synthesis - an experimental study

Abstract Supervisory control synthesis is a model-based engineering method to design supervisory controllers for high-tech and cyber-physical systems. Recent advances in synthesis techniques and modelling formalisms allow for synthesis of supervisors for large-scale industrial applications. Yet, the synthesis results depends on the quality and validity of the models used as input. Other model-based techniques such as simulation, testing, and verification provide complementary support in the design process to increase the quality and validity of the models. In this paper, we propose, in addition to the other supporting techniques, eleven modeling aspects to assess the model quality in the context of supervisory control synthesis. Examples of modeling aspects are the interdependency between component models, whether independent subsystems are modeled, and whether the model is annotated with comments. For each modeling aspect, we discuss its importance and describe how it can be quantified. We report on an experiment where 21 models of automated guided vehicles, created by students during a course on Supervisory Control Theory, are evaluated with the proposed modeling aspects. This experiment demonstrates the applicability of the modeling aspects.

Transformational Supervisor Synthesis for Evolving Systems

Abstract Supervisory controller synthesis is a means to compute correct-by-construction controllers for discrete event systems. As these systems and their requirements evolve over time, an updated supervisor needs to be computed each time an adaptation takes place. We consider the case that a supervisor has been synthesized for a given model, after which this model is (slightly) adapted. We investigate how we can make use of the previous synthesis result, in order to more efficiently compute the supervisor for the adapted model. We show how model deltas can be used to describe the difference between pairs of models. Using the model deltas, a notion of atomic model adaptations is introduced. For these atomic adaptations, algorithms are provided to compute the supervisor for the adapted model in a transformational manner from the previous synthesis result, rather than performing a completely new synthesis. These atomic model adaptations can be iterated over, to transformationally compute a supervisor for model deltas containing a number of atomic model adaptations. The efficiency of this method is evaluated by means of some experiments.