Feedback Control Logic for Forbidden-State Problems of Marked Graphs: Application to a Real Manufacturing System

Transcription

1 18 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL 48, NO 1, JANUARY 2003 Feedback Control Logic for Forbidden-State Problems of Marked Graphs: Application to a Real Manufacturing System Asma Ghaffari, Nidhal Rezg, Xiaolan Xie Abstract This paper addresses the forbidden-state problem of general marked graphs with uncontrollable transitions The models need not to be safe nor cyclic Control requirements are expressed as the conjunction of general mutual exclusion constraints (GMEC) of markings of so-called critical places Structural properties such as influence paths influence zones are proposed to perform the worst-case analysis for each GMEC specification with any given initial marking when only uncontrollable transitions are allowed Efficient solutions are proposed for the determination of the maximal uncontrollably reachable marking of any critical place, this for many possible, more or less general, configurations of the net structure, even for the case of overlapping paths of critical places Besides, we demonstrate that these results can be easily extended to unbounded nets when critical places have negative weights For the most general case, when analytical solution is not available, a linear programming approach is proposed The great advantage of the proposed approach over existing methods is emphasized by using it to solve the supervisory control problem of the automated manufacturing system of Atelier Inter-établissements de Productique Rhône Alpes Ouest (AIP-RAO), Lyon, France Index Terms Manufacturing systems, marked graphs, state feedback, supervisory control, uncontrollable transition I INTRODUCTION REAL-LIFE discrete-event systems (DES) are becoming more more complex highly automated making it tricky the realization of an efficient realistic control system There have been many attempts to solve the control problem for DES Given a discrete-event model of the plant a specification of the desired behavior, the objective is to synthesize appropriate controller that will act in closed-loop with the plant according to the desired behavior The existence the characterization of the maximally permissive control was proved by Ramadge Wonham [16], [18] Finite-state machines formal languages are the modeling framework considered in this study the control action is achieved by event feedback The main limitations of such an approach is the lack of structure in controlled automata the large number of states of the related state transition structures For instance, the real application dealt with in this paper represents a relatively small production cell However, the related control problem would re- Manuscript received November 8, 2001; revised May 28, 2002 Recommended by Associate Editor L Dai The authors are with the MACSI Team of INRIA Lorraine LGIPM of Université de Metz, ISGMP, Metz 57000, France ( ghaffari@loriafr; nerzg@loriafr; xie@loriafr) Digital Object Identifier /TAC Fig 1 Example quire huge processing time memory if addressed with the Ramadge Wonham approach Indeed, the system is made up of six workstations set out around a central-loop conveyor Each workstation has five areas, three of them can contain up to five pallets The centralized supervision is made possible by means of actuators proximity switches Control specifications consist in forbidding pallets collision, workload balancing of machines limiting the work in process The size of the related automaton model is beyond the practical limit of any available software tools supporting Ramadge Wonham s approach Petri nets have been proposed as an alternative modeling formalism for DES control In [13], Li Wonham have presented an algorithm that calculates the optimal solution for nets whose uncontrollable subnets are loop-free The controller has to solve on-line at each step linear integer programs The approach will be all the more difficult to apply to systems such as the one described over because of its computational complexity To face this difficulty, another common approach is Petri net based, look for a set of places called monitors that control the evolution of the system The controller is computed implemented once for all the control actions are easily rapidly determined online [6] [8], [13], [14] Unfortunately, there are cases where optimum PN-based controllers are not possible [1] Consider the example of Fig 1 Only transitions are controllable The constraint to enforce is to keep the marking of the place less than three tokens with having each initially three tokens It can be easily shown that there does not exist optimal monitor-based controllers Such situations motivated many researchers to explore other ways for the design of the feedback control Of particular interest are approaches based on the structural analysis of the plant Petri net model as it is the case in this paper Holloway Krogh gave a computational efficient solution for the for /03$ IEEE

2 GHAFFARI et al: FEEDBACK CONTROL LOGIC FOR FORBIDDEN-STATE PROBLEMS 19 bidden-state problem of marked graphs, which are safe, cyclic live [10] Structural analysis of the net leads to the identification of the influence paths of each so-called forbidden place predicates on its marking These predicates are then evaluated on-line in order to determine the control to apply, ie, the controllable transitions to disable A similar approach based on influencing zone was developed by Boel et al [3] for state machines More general forbidden conditions are considered In [2] as well, the concept of influencing zone was used together with the min plus algebra to calculate the state feedback control for nets that involve choice places or synchronization but the uncontrolled net is assumed to be noncyclic The work in [11] is a generalization of all these approaches The class of nets they considered covers state machines marked graphs markings are not necessarily safe or live Forbidden conditions are similar to those considered in [10] Unfortunately, the computational complexity of approaches proposed in [2] [11] is very high their application to real-time control is difficult if not impossible An alternative approach is proposed by Chen [4], [5] for enforcing linear constraints for general Petri nets Each linear constraint, where is a vector of nonnegative integers, impose an upper limit to the weighted sum of markings The author introduced the concept of so-called S-decreases, weighting vectors such that the weighted sum of markings never increases by any transition firing For live nets whose uncontrollable subnets are generalized marked graphs, it is shown that each constraint can be imposed through the set of all minimal S-decreases supported by [5] A maximally permissive control is derived on-line by the evaluation of simple predicates for each reached marking Unfortunately, the number of minimal S-decreases is exponential in the size of the net which makes the approach impractical Further, the approach cannot take into account weighting vectors with negative weights In this paper, we follow the approach of [10] [2] to address the forbidden-state problem of general live marked graphs with uncontrollable transitions general mutual exclusion constraints (GMECs) defined on some so-called critical places are used to express the control requirement to define the set of forbidden markings Structural properties such as influence paths influence zones are used for the worst-case analysis of each GMEC specification for any given initial marking when only uncontrollable transitions are allowed A simple analytical solution is obtained for the case of GMEC specifications of single critical place Relationship of multiple critical places is characterized by strong independence, weak independence dependence We prove that the worst-case marking of any GMEC specification with strongly or weakly independent critical places corresponds to individual worst marking of each critical place Analytical results are also obtained for the case of two dependent critical places For more general case, a linear programming approach is proposed for the worst-case analysis Application to a real automated manufacturing system is presented The main contributions of this paper can be summarized as follows It significantly extends the analytical results of [10] provides simple analytical results for nontrivial cases of the forbidden-state problem of live marked graphs More specifically, contributions motivations of this paper with regard to [10] include the following i) It considers general live marked graphs instead of safe marked graphs Both bounded unbounded nets are considered Petri net models of most manufacturing systems including the one considered in this paper are not safe ii) It introduces GMEC specifications of negative weightings As will be shown in Section X, GMEC specifications with negative weightings are necessary to represent constraints such as the workload balancing of two machines the production ratio of two different product types iii) It significantly extends analytical results of [10] to general live marked graphs for GMEC specifications with negative weightings The concept of strongly weakly independent critical places extends the results of [10] to critical places with possibly overlapping influence paths to cyclic uncontrollable nets Results of [10] are special cases of Theorem 4 for safe marked graph for GMEC specifications of totally independent critical places, ie, critical places with separate zones The concept of critical paths turns out to be very important from a practical point of view Control specifications such as work in process in a production line need the concept of critical paths iv) It proposes an efficient implementation of the proposed optimal control policy a polynomial linear programming approach for general case where analytical solutions are not available v) It efficiently solves the supervisory control problem of the real manufacturing system of Atelier Inter-établissements de Productique Rhône Alpes Ouest (AIP-RAO), Lyon, France, briefly described in this introduction Clearly, the proposed control logic having these interesting features will ensure an applicability for many real nontrivial control problems its use will be of great practical interest The rest of the paper is organized as follows Section II reviews some definitions related to Petri nets Section III introduces the forbidden-state problem considered in this paper Nonnegative GMEC specifications are considered in Sections IV VI Section IV derives the control policy for the case of GMEC specifications of single critical place Section V addresses the case of GMEC specifications of independent critical places Supervisory control of GMEC specifications of two dependent critical places is considered in Section VI Section VII introduces the concept of critical paths extends results of Sections IV VI Enforcement of GMEC with negative weightings is addressed in Section VIII Section IX proposes a linear programming approach for the most general case In Section X, we solve the supervisory control problem of the automated manufacturing system of AIP-RAO II PETRI NETS This section is a brief presentation of some definitions used in this paper The reader is referred to [15] for more comprehensive presentation A Petri net is a bipartite graph

3 20 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL 48, NO 1, JANUARY 2003, where is a set of places; is a set of transitions;, is the pre-incidence function that defines weighted arcs from places to transitions;, where is the set of nonnegative integers, is the postincidence function that defines weighted arcs from transitions to places The set of input (respectively, output) transitions of a place is denoted by (respectively, ) Similarly, the set of input (respectively, output) places of a transition is denoted by (resp ) A Petri net is said ordinary if the weight associated to each arc connecting places transitions is equal to one A net is pure if no place is both input place output place of the same transition A pure Petri net can be represented by the so-called incidence matrix defined as A marking of a Petri net is a mapping that assigns to each place a nonnegative integer number of so-called tokens The marking of a place at marking is denoted by A Petri net a net with initial marking A transition is enabled at a marking if only if, which will be denoted as An enabled transition may fire yielding a new marking such that, this will be denoted by A marking is reachable from a marking if there exists a firing sequence transforming into This is denoted as The set of all reachable markings from in is denoted as Any marking reachable from by firing a sequence satisfies the following state equation:, where is a vector of nonnegative integers, called the occurrence vector whose th entry denotes the number of occurrences of transition in A nonnegative integer vector such that is called a -invariant Similarly, a nonnegative integer vector such that is called a -invariant Two transitions are said to be in conflict if A Petri net is persistent if, for any reachable marking, an enabled transition can be disabled only by its own firing A transition is said to be live if, for any, there exists a sequence of transitions fireable from which contains A Petri net is said to be live if all transitions are live A Petri net is deadlock-free if at least one transition is enabled at every reachable marking A place is bounded if there exists a constant such that for all A Petri net is bounded if all the places are bounded A Petri net is said to be reversible if, for any in, is reachable from III FORBIDDEN STATE PROBLEM OF MARKED GRAPHS This section defines the forbidden-state problem for marked graphs under consideration A marked graph is an ordinary Petri net in which each place has exactly one input transition one output transition Marked graphs are also persistent nets It is assumed that the set of transitions is partitioned into two disjoint subsets, the set of controllable transitions (represented by rectangles) the set of uncontrollable transitions (represented by bars) The supervisor can prevent a controllable transition from firing while it cannot prevent an uncontrollable transition from firing The set of markings reachable from an initial marking by firing only uncontrollable transitions is denoted as A directed path of a Petri net is an alternative sequence of places transitions that joins two distinct nodes (places or transitions) It is elementary if no node appears more than once in the sequence A circuit is a directed path from one transition back to it It is elementary if no node appears more than once For a directed path elementary or not, we define the path marking as the sum of the markings of places in, ie, where a place may appear several times The following property of marked graphs will be extensively used in this paper Property 1: The marking content in any circuit is invariant, ie,, The marking content of any directed path can only be modified by its extreme transitions, ie, with Proof: Trivial; see [15] Assumption 1: The marked graph is live, ie, every circuit contains at least one token Given a plant Petri net model, the forbidden-state problem is characterized by a set of forbidden states In this work, it is assumed that the set of forbidden states can be specified by the conjunction of safety conditions modeled by GMECs Each is characterized by a vector of integers : a constant A state satisfies the GMEC constraint if Otherwise, it is forbidden by the GMEC constraint The set of forbidden states defined by the conjunction of GMEC specification is defined as follows Assumption 2: Let be the set of GMEC specifications A marking is forbidden if it is forbidden by at least one GMEC, ie,, for some Due to uncontrollable transitions, not all markings that are not forbidden can be considered as legal As the controller cannot prevent an uncontrollable firing sequence, it is necessary to consider dangerous markings from which forbidden ones can be reached by firing only uncontrollable transitions The controller must disable a controllable transition if its firing yields dangerous markings In order to check whether a marking is dangerous, a worse-case analysis is performed for each GMEC specification to verify whether a forbidden marking can be reached by firing uncontrollable transitions This approach is summarized by the following maximally permissive control policy Theorem 1: A controllable transition is not prevented from firing at a reachable marking if only if for all GMEC specification where is the marking obtained by firing at Clearly the applicability of the control policy strongly depends on the computational efficiency of the worst-case analysis In the remaining part of this paper, structural properties are used to derive analytical solutions for efficient worst-case anal-

4 GHAFFARI et al: FEEDBACK CONTROL LOGIC FOR FORBIDDEN-STATE PROBLEMS 21 ysis The structural properties include: critical places, influence paths, influence zones A critical place is a place such that for at least one GMEC specification Influence paths can uncontrollably feed with tokens the critical places are defined as follows Definition 1: An influence path of a critical place is an elementary path joining to such that is a controllable transition all other transitions in the path are uncontrollable Clearly, the marking of is influenced by the path or more precisely by the firing of uncontrollable transition of the path Let be the set of all the influence paths of Let be the set of all elementary circuits without controllable transitions containing Definition 2: The influence zone of a critical place is the subnet containing all nodes for which there exists a directed path from to without controllable transitions except eventually Clearly, the influence zone contains all places whose marking may influence the worst case analysis of critical place Of course, the influence zone covers both Let be two critical places are said strongly independent if there is no directed path of uncontrollable transitions joining to conversely, ie, They are weakly independent if there does not exist any influence path or any elementary circuit without controllable transitions containing both places, ie, Otherwise, they are said dependent Note that the independence of two places does not imply the independence of their influence zones In Fig 2, places are strongly independent; places are weakly independent; places are dependent IV NONNEGATIVE GMEC WITH SINGLE CRITICAL PLACE For simplicity, we first address in Sections IV VI the control synthesis for enforcing GMEC specifications of nonnegative integers, ie, the following Assumption 3: Each vector associated with any GMEC is a vector of nonnegative integers, ie, As will be shown in our application example of Section IX, not all real-life linear specifications can be expressed by nonnegative GMECs The relaxation of Assumption 3 will be addressed in Section VII This section considers the case of a unique critical place for each GMEC specification As a result, the worst-case analysis consists in computing, for each given marking, the maximum number of tokens the critical place can obtain by firing uncontrollable transitions A Maximal Uncontrollably Reachable Marking Let denote the maximal marking of a critical place reachable from a given marking by firing only uncontrollable transitions This marking will be called maximal uncontrollably reachable marking Theorem 2: For any critical place Fig 2 Strongly independent, weakly independent dependent places Further, there exists a sequence of uncontrollable transitions belonging to the influence zone, except the transition, such that Proof: Since only markings reachable by uncontrollable transitions are concerned, all controllable transitions are disabled in the computation of From Property 1 Let be a marking having the maximal number of tokens in among all markings reachable from by firing uncontrollable transitions except Let be the sequence of transitions such that From Property 1,, Assume that Consider another marked graph derived from by 1) removing all places transitions not belonging to the influence zone, except transition, 2) connecting to each controllable transition belonging to with a new place The marking is such that,,, for all new places Clearly, is strongly connected Each circuit in corresponds to either an influence path (plus a new place), or a circuit, or a circuit without controllable transitions not containing Furthermore,,or, or This implies that the net is live [15] there exists a sequence of transitions not containing such that Note that, does not contain controllable transitions, since is connected to each of them by a new empty place As a result, is also fireable from in the net leads to a marking such that This contradicts the fact that is maximal By contradiction, we have

5 22 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL 48, NO 1, JANUARY 2003 B Computation of the Maximal Uncontrollably Reachable Marking This subsection addresses the computation of the maximal uncontrollably reachable marking its updating when a transition fires In order to compute, let us introduce a marking distance matrix defined as follows: if otherwise for all transitions all critical place where is the set of directed paths from to consisting of uncontrollable transitions except indicates the maximum number of tokens place can receive without firing transition As a result From Property 1, each elementary circuit is -invariant its token content does not change by transition firing As a result This term, denoted as, is the structural bound of place when only cycles in are considered,, Lemma 1: For a reachable marking for any critical place where is the structural bound of given by From [15], is equal to the minimal of token contents of all elementary circuits containing including circuits with controllable transitions As a result, Proof: From Theorem 2 From the definition of, Hence, As, the combination of the above equations concludes the proof The marking distance matrix structural bounds are computed by a shortest path approach as follows First, we derive from the subnet corresponding to the influence zone a directed graph, where transitions st for the nodes of the graph places for the arcs The current marking of each place is the weight of its corresponding arc The problem is then reduced to the computation of the shortest paths, for all pairs of nodes, which is a polynomial problem in the number of the graph nodes [9] By definition, if is an uncontrollable transitions, otherwise Structural bounds can be computed similarly by starting with the whole marked graph instead of the influence zone The computation of in real-time is further simplified by the following theorem that provides a simple updating procedure of the marking distance matrix Theorem 3: At the firing of a transition transforming a marking into, the marking distance matrix is transformed as follows 1 Proof: Trivial from the definition of if if otherwise Property V NONNEGATIVE GMEC WITH INDEPENDENT CRITICAL PLACES This section considers the case of nonnegative GMEC specifications of independent critical places The main result of this section is that the worst case for each GMEC specification is the worst case for each critical place there exists a marking such that each critical place of the GMEC specification contains the maximum number of tokens it can have by firing uncontrollable transitions A Strongly Independent Critical Places Theorem 4: Let be a set of strongly independent critical places of a live marked graph For any reachable marking, there exists a marking such that, for all Proof: Only the case of two critical places is proved The case for critical places is similar omitted According to Theorem 2, there exists two sequences, for, 2, of uncontrollable transitions belonging to, except transition, such that Since are strongly independent critical places, either transition or is controllable In both cases, does not appear in sequence, ie, Similarly, Since a marked graph is also a persistent net, according to [12, Lemma 31] there exists a sequence fireable at such that, Clearly, is a sequence, of uncontrollable transitions not containing Let be the resulting marking Since, This, together with the definition of, implies Similarly, B Weakly Independent Critical Places Theorem 5: Let be a set of weakly independent critical places of a live marked graph For any reachable marking, there exists a marking such that, Lemma 2: There exists a critical place such that, for all Proof (By Contradiction): The Lemma clearly holds if at least one transition is controllable Otherwise, assume that the Lemma does not hold For each critical place, there exists another critical place such that As a result, there exists a

6 GHAFFARI et al: FEEDBACK CONTROL LOGIC FOR FORBIDDEN-STATE PROBLEMS 23 subset of critical places such that Let for be the shortest path from to, ie, The concatenation of these paths forms a nonelementary circuit of uncontrollable transitions containing all critical places, for Hence, On the other h, from the weak independence, no elementary circuit of uncontrollable transitions contain more than one critical place As a result, the circuit can be decomposed into circuits, each containing one critical place, ie, From the definition of, Hence, which leads to a contradiction concludes the proof Lemma 3: There exists a sequence of uncontrollable transitions such that,, for all transitions where From the aforementioned definition, it is obvious that,,,,, Proof: From the properties of the marked graph (see [15]), the Lemma holds if the occurrence vector satisfies the state equation, ie,, for all places The state equation clearly holds if or Otherwise, both belong to Fig 3 Two wealdy independent critical places q, q with a path from q to q path of, the remaining parts of both paths form a circuit of uncontrollable transitions containing but not Since, wehave, then As a result,, If no path from to exists, the Since proof is completed Otherwise (Fig 3), we need to prove that Let be the path of uncontrollable transitions from to such that Since there does not exist any circuit of uncontrollable transitions containing both, paths form a circuit of uncontrollable transitions which can be decomposed into a circuit containing but not a circuit containing but not Consequently, the circuit marking invariance leads to This imply that Lemma 4:,, for all critical places such that where is the marking defined in Lemma 3 Proof: Two cases are considered: Consider first the case Since for all controllable transitions, the marking of each influence path is invariant, From Lemma 1, Since, From Lemma 2, As a result,, Consider now the case In this case, there exists a path of uncontrollable transitions from to such that Let us first prove that, or, equivalently,, for all influence path from to Clearly, paths has common transitions because, otherwise, forms an influence path containing both contradicts the weak dependence Let be the common transition closest to on path The part of from to the part of from to forms an influence Proof of Theorem 5: From Lemma 2 3, there exists a marking such that for some critical place fulfilling conditions of Lemma 1 From Lemma 4, the remaining critical places has the property where is similar notation as but for net derived from net by transforming into a controllable transition Clearly The marking of remains invariant by uncontrollable transitions in Repeating the above process for net for remaining critical places leads to a marking such that, C Computation of the Control Policy According to Theorems 4 5, the worst-case marking of a GMEC specification with independent critical places is such that each critical place has tokens The following theorem provides the maximal permissive policy for the case of independent critical places for each GMEC specification

7 24 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL 48, NO 1, JANUARY 2003 Theorem 6: If the critical places are independent for each GMEC specification, a controllable transition is not prevented from firing at a reachable marking if only if for all GMEC specification where is such that, is the set of critical places where if expression is true 0, otherwise Proof: The proof of this theorem is obvious except for the expression of From Lemma 1 If,, If,,, since is controllable The expression of is then obvious The following algorithm formalizes the control computation for the case of GMEC specifications with independent critical places Results of Section IV-B are used for efficient control policy implementation Control Algorithm 1: Let be the set of nonnegative GMEC with independent critical places defining the forbidden-state problem the marked graph model the set of critical places 1 Initialization: Set compute,,, using the shortest path approach of Section IV-B 2 Determine the maximally uncontrollable marking using Lemma 1 3 Determine the set of controllable transitions to disable using Theorem 6 4 At the occurrence of a transition, update the distance matrix using Theorem 3 5 Go to step 2 VI NONNEGATIVE GMEC WITH TWO DEPENDENT CRITICAL PLACES Two critical places are said dependent if they belong to the same influence path or the same elementary circuit of uncontrollable transitions Both places compete for tokens that can be dispatched to either of them but not both As a result, it is not possible to have the maximum number of tokens in both places simultaneously In this case, the worst-case analysis for a GMEC specification strongly depends on the cost structure related to the weighting vector Theorem 7: For any GMEC specification with two critical places such that, there exists a Fig 4 Case where q 2 Z(q ) q 62 Z(q ) worst marking such that Proof (By Contradiction): Let be any worst marking with the largest number of tokens in Assume, by contradiction, that Let be the sequence of transitions from to If, from Lemma 3, there exists a sequence of uncontrollable transitions such that,, for all transitions Further, Hence which imply that This contradicts the definition of concludes the proof If, consider the occurrence vector of uncontrollable transitions such that, where is the shortest marking path from to Clearly, corresponds to a sequence of uncontrollable transitions firable at Let be the resulting marking Since all circuits are marked, As a result, which implies This contradicts the definition of concludes the proof In the rest of this section, we limit ourselves to worst markings such that The maximal marking of depends on whether its influence zone contains place Case 1), ie, there is no path of uncontrollable transitions from to (see Fig 4) The marking of the shortest path between may eventually not be enough to obtain, in which case tokens in are conveyed to The number of tokens needed is, which is exactly the number of times transition fires, while does not fire The maximum number of tokens that can be kept in is with The firing sequence can be obtained by applying Lemma 3 first to obtain tokens in then to obtain tokens in When (see Fig 5), two cases can be distinguished, according to whether there is enough tokens in the shortest path joining to to have tokens in

8 GHAFFARI et al: FEEDBACK CONTROL LOGIC FOR FORBIDDEN-STATE PROBLEMS 25 Fig 6 Critical path its equivalent place Fig 5 Case where q 2 Z(q ) q 2 Z(q ) Case 2) There are not enough tokens in the shortest path joining to to have tokens in Similar to Case 1), should fire times should not fire because, for each firing of, should fire one more time this cannot increase the number of tokens in The maximum number of tokens that can be kept in is Fig 7 Two strongly independent critical paths The firing sequence can be constructed as in Case 1) Case 3) There are enough tokens in the shortest path joining to to have tokens in No tokens are needed from However, may be brought to fire so that the number of tokens in is maximal The worst-case marking is such that where The firing sequence can be obtained by applying Lemma 3 first to obtain tokens in then to obtain tokens in Finally, the implementation of the maximally permissive control policy in this case is similar to that in the case of independent critical places but additional influence paths from to from to Of course, the results can be easily extended to GMEC specifications where critical places can be grouped into mutually independent subsets each containing no more than two critical places VII CRITICAL PATHS Although analytical results for GMEC with more than two dependent critical places are not available, special cases of dependent places of practical interest can still be solved analytically This section presents the concept of critical paths extends analytical results of Sections II VI A critical path is an elementary path such that transitions are uncontrollable transitions, for all place in for all GMEC specifications The key to the worst-case analysis of a critical path is its equivalent place defined as follows (Fig 6) Lemma 5: For any critical path in a marked graph, assume that a fictitious place such that is added to the marked graph Then, for all reachable markings Proof: It is clear that adding to the marked graph leads to a new marked graph For any reachable marking of the new marked graph such that, from Property 1, This concludes the proof Since both are only input places of transition, Lemma 5 implies that place is redundant its introduction does not change the set of reachable markings of the marked graph However, it simplifies the worst case analysis of critical path as for all reachable markings As a result, the worst case analysis of a GMEC of form can be replaced by an equivalent GMEC of form In particular, for any GMEC with only a single critical path Let denote the maximal marking of a critical path reachable from the given marking by firing only uncontrollable transitions Lemma 5 implies the following Theorem 8: For any critical path in a marked graph any reachable marking, Further, the concept of independent critical places can be extended to critical paths Let be two critical paths are said strongly (respectively, weakly) independent if their equivalent places are strongly (respectively, weakly) independent Fig 7 is an example of two strongly independent paths Note that places of independent paths are not necessarily independent From results of Section V, the following holds true Theorem 9: Let be a set of strongly or weakly independent critical paths of a live marked graph For any reachable marking, there exists a marking such that, for all, where is the equivalent place of path This implies that the worst case for any nonnegative GMEC specification of independent critical paths is the worst case for

9 26 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL 48, NO 1, JANUARY 2003 each critical path Results of Section VI can be used for any GMEC of two dependent critical paths VIII ENFORCING GENERAL GMEC SPECIFICATIONS This section considers the control synthesis for enforcing general GMEC specifications in which is not necessarily nonnegative, ie, Assumption 3 is relaxed The basic idea is to transform a general GMEC specification into an equivalent nonnegative GMEC then apply the previous analytical results for controller design Consider first the case of bounded marked graph, ie, every place belongs to a circuit or equivalently there is no transition without input places For any GMEC specification such that for some place, it is always possible to find an equivalent GMEC such that To this end, let us introduce the dual place of place such that,, where is the structural bound of given by can also be given by, where is any cycle containing, if it exists The GMEC such that,,,, is equivalent to GMEC From the aforementioned GMEC transformation, boundedness is only needed for critical places such that for some GMEC specification Boundedness allows the definition of the dual places transformation of general GMEC specifications into nonnegative GMECs As a result, boundedness assumption can be replaced by the following Assumption 3 : Every critical place such that for some GMEC specification is bounded, ie, belongs to a circuit This constraint can be further relaxed What is really important is that the marking of any critical place keeps bounded starting from any legal marking This is expressed as follows, Assumption 3 : For every critical place such that for some GMEC specification,, where where is the submatrix of the incidence matrix corresponding to uncontrollable transitions Clearly, it holds if all places are bounded for all marking fulfilling GMEC specifications every critical place is controlled by at least one controllable transition, ie, there exists a directed path from to Under assumption 3 or assumption 3, any GMEC specification can be transformed into an equivalent nonnegative GMEC specification by using (respectively, ) to define dual places when assumption 3 (respectively, 3 ) applies As a result, all analytical results still apply for unbounded nets under Assumptions 1 2 assumption 3 or 3 The weakest assumption that we propose is the following one Assumption 3 : Every critical place such that either belongs to a circuit or is controlled by a controllable transition, ie, there exists an influence path from a controllable transition to place Under this assumption, the maximal marking a critical place can uncontrollably reach is finite for any finite marking The dual place can still be defined as follows:,, Any GMEC specification can be transformed into an equivalent nonnegative GMEC specification by using to define dual places Of course, should be updated whenever a transition fires All analytical results except Theorem 3 on the updating of distance matrix still hold As a result, the distance matrix should be recomputed whenever a transition fires When a GMEC specification does not fulfill assumption 3, there exists a critical place such that the number of tokens in can grow uncontrollably without limit Such a GMEC specification is of little practical interest assumption 3 is not at all restrictive from a practical point of view IX LINEAR PROGRAMMING APPROACH FOR GENERAL CASE For more general GMEC specifications, it seems difficult to extend the analytical results based on influence zones Yet the complexity of the worst-case analysis can be reduced thanks to properties of marked graphs Given the problem addressed here, we advocate the use of the linear programming In fact, since we are dealing with marked graphs, many interesting properties of this class can be exploited to make the resolution with a linear program more advantageous The worst case analysis of a GMEC specification can be modeled as the maximization problem of the product such that, where is a sequence of uncontrollable transitions If max, then the controllable transition leading to is disabled It is known that the state equation is a necessary sufficient condition for the reachability in live marked graphs [15] The worst-case analysis is reduced to the resolution of the following linear integer program: subject to: for all GMEC where is the submatrix of the incidence matrix corresponding to uncontrollable transitions Another interesting result for marked graphs is useful to justify the use of linear programming In fact, in [15], it was shown that the incidence matrix of a marked graph has the property of unimodilarity, ie, the determinant of any submatrix is in the set of integers This powerful result allows the relaxation of integrity constraint transforming the linear integer program into defined as follows: is a linear real programming problem that can be efficiently solved in polynomial time, which is more convenient practical for online calculations Theorem 10: Under Assumption 1, a controllable transition t is not prevented from firing at a reachable marking if

10 GHAFFARI et al: FEEDBACK CONTROL LOGIC FOR FORBIDDEN-STATE PROBLEMS 27 Fig 8 The automated manufacturing system of AIP-RAO Fig 10 Petri net model of a workstation i Fig 9 Architecture of a workstation i only if for all GMEC specification where is the marking obtained by firing at X A MANUFACTURING APPLICATION In this section, the proposed control method is applied to the manufacturing system example presented in [17] It concerns the automated manufacturing system of AIP-RAO The system consists of six workstations including one load/unload station (Fig 8) set out around a central-loop conveyor A workstation consists into five areas (see Fig 9): the input area, the supplying operating area that contains one single machine, the output line, a section of the central conveyor, the convergence area We denote by,, the respective capacities of conveyors,, The convergence area cannot contain more than one pallet Note that all these conveyors are always running A local programmable logic controller controls regulates the load of each conveyor by comming the actuators,, It also comms a proximity switch,, to direct products inside the workstation A centralized supervisor controls the whole system by means of actuators the proximity switch Products are held by pallets, which are carried through the system s workstations by the central loop conveyor When the sensor, at the entrance of a workstation, detects a pallet in the zone, the actuator is activated to block it, a read/write system is activated to read on the label of the product the next operation in its production plan If the operation can be performed in the workstation there is still an empty place on the supplying conveyor, the proximity switch directs the pallet into the workstation; otherwise, the pallet is carried by toward the next workstation In the load/unload station, pallets on are unloaded by robot, while robot loads on pallets from an input buffer Inside each workstation, the machine performs one product at a time delivers it to the line, it is then conveyed again to the central loop through the area Clearly, if there is no control, two pallets can run into collision in the convergence area Machines can perform the same operation at the same speed Machine can perform the same operation as but at half of the speed of The loads of two similar machines have to be balanced The Petri net model of the whole system is the concatenation of the workstations models (Fig 10) the load/unload station s model (Fig 11) by means of places, Places,,,,,,,,,, limit conveyors capacities Places limit the machines capacities The marking of place ( wp sts for work-in-process ), in the load/unload station, is the number of loaded pallets in the process The wp needs to be limited according to system evaluation performance, not to create deadlock situations The interpretation of the other nodes of the submodels is straightforward Transitions,,, corresponding to the entrance of respectively,, are controllable, since the supervisor can only act upon actuators, the proximity switch All other transitions are uncontrollable The load/unload station model is similar except one additional controllable transition corresponding to the loading activity According to the system s description, the control specifications can be expressed in terms of GMEC The local specification consisting in forbidding the collision of two pallets in the

11 28 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL 48, NO 1, JANUARY 2003 is disabled at a marking iff ; is disabled at a marking iff Each specification (2) concerns two strongly independent critical paths Specification (2) is equivalent to the following GMEC specifications: Using dual places for the critical path s places 2 2 Fig 11 Petri net model of the load/unload workstation area of each workstation the load/unload station is equivalent to the following system of inequalities: The workload balancing of two similar machines is equivalent to (2), as shown at the bottom of the page, where are processing times of machines of workstations is a constant This specification concerns two pairs of workstations The work in process limitation is equivalent to the constraint where is a constant determined by an evaluation of the system performance These control specifications are expressed as GMECs Note that places, do not belong to the set of critical places of the previous GMECs Neither do they belong to any critical place s influence zone Hence, we can just consider, for each station, the subnet obtained by removing places The resulting subnet is a live marked graph, each place is bounded The proposed method is then applicable Let us first define the control policy with respect to specifications (1) Each constraint (1) concerns two critical places with disjoint influence zones According to Theorem 4, the worst-case marking reachable from a given marking is such that which implies that or As a result iff (1) (3) where are the dual paths, ie, the paths containing the dual places Consider the GMEC specification 2 According to Theorem 9, the worst-case marking from is such that which imply that It follows that, with respect to GMEC 2, is disabled at a marking iff or, equivalently Similarly, with respect to GMEC 2, is disabled at a marking iff Specification (3) concerns a single critical place The worst-case marking obtained from a given is such that Immediately, is disabled at a marking iff To summarize, the maximal permissive control policy is as follows Disable if Disable if Disable if with, Disable if with, Disable if with, Disable if with, Disable if is the current marking (2)

12 GHAFFARI et al: FEEDBACK CONTROL LOGIC FOR FORBIDDEN-STATE PROBLEMS 29 XI CONCLUSION An efficient method is proposed in this paper to solve the forbidden-state problem for live bounded marked graphs with uncontrollable transitions GMECs By defining influence zones for critical places, ie, places concerned by the GMECs, the maximal marking a place can uncontrollably reach is defined computed Based on this fundamental result, analytical solutions are obtained computationally efficient control policies are proposed for GMEC specifications of strongly or weakly independent critical places the case of two dependent critical places These results are also extended for sets of paths of critical places A linear programming solution is proposed for control synthesis of general GMEC specifications The proposed approach is applied to a real automated manufacturing system Future research concerns the extension of the influence zones approach to other classes of Petri nets Another challenging issue is the supervisory control under the constraints of unobservable transitions liveness constraint ACKNOWLEDGMENT The authors would like to thank the anonymous referees for their helpful comments on earlier versions of this paper REFERENCES [1] F Basile, P Chiacchio, A Giua, Supervisory control of Petri nets based on suboptimal monitor places, in Proc WODES 98, Cagliari, Italy, 1998, pp [2] R K Boel, B Bordbar, G Stremersch, A min-plus polynomial approach to forbidden-state control for general Petri nets, in Proc WODES 98, Cagliari, Italy, 1998, pp [3] R K Boel, L Ben-Naoum, V V Breusegem, On forbidden-state problems for a class of controlled Petri nets, IEEE Trans Automat Contr, vol 40, pp , Oct 1995 [4] H Chen, Control synthesis of Petri nets based on S-decreases, Discrete Event Dyna Syst, vol 10, no 3, pp , 2000 [5], Net structure control logic synthesis of controlled Petri nets, IEEE Trans Automat Contr, vol 43, pp , Oct 1998 [6] A Giua, F DiCesare, M Silva, Petri net supervisors for generalized mutual exclusion constraints, in Proc IEEE Int Conf Systems, Man, Cybernetics, 1992, pp [7], Generalized mutual exclusion constraints on nets with uncontrollable transitions, in Proc 12th IFAC World Congr, Sidney, Australia, 1993, pp I: [8] A Ghaffari, N Rezg, X Xie, Live maximally permissive controller synthesis using the theory of regions, presented at the Symp Supervisory Control DES, Paris, France, July 23, 2002 [9] M Gondran M Minoux, Graphes et Algorithmes Paris, France: Eyrolles, 1985 [10] L E Holloway B H Krogh, Synthesis of feedback control logic for a class of controlled Petri nets, IEEE Trans Automat Contr, vol 35, pp , May 1990 [11] L E Holloway, X Guan, L Zhang, A generalization of state avoidance policies for controlled Petri nets, IEEE Trans Automat Contr, vol 41, pp , June 1996 [12] L H Lweber E L Robertson, Properties of conflict-free persistent Petri nets, J Assoc Comput Mach, vol 25, no 3, pp , July 1978 [13] Y Li W M Wonham, Control of vector discrete-event systems II Controller synthesis, IEEE Trans Automat Contr, vol 39, pp , Mar 1994 [14] J O Moody P Antsaklis, Petri net supervisors for DES with uncontrollable unobservable transitions, IEEE Trans Automat Contr, vol 45, pp , Mar 2000 [15] T Murata, Petri nets: properties, analysis application, Proc IEEE, vol 44, pp , Apr 1989 [16] P J Ramadge W M Wonham, Supervisory control of a class of discrete-event processes, SIAM J Control Optim, vol 25, no 1, pp , 1987 [17] N Rezg E Niel, Extension of the supervision concept to the monitoring of DES, in Proc ETFA 96, vol 1, Kauaï, Hawaii, 1996, pp [18] W M Wonham P J Ramadge, On the supremal controllable sublanguage of a given language, SIAM J Control Optim, vol 25, no 3, pp , 1987 Asma Ghaffari was born in Tunis, Tunisia, in 1975 She received the BS degree in industrial engineering from the Ecole Nationale d Ingénieurs de Tunis the MSc degree in industrial engineering from the Université de Sciences et Technologies de Lille, France, in , respectively She received the PhD degree from the French National Institute for Research in Computer Science Control (INRIA), Metz, France, in December 2002 Her research interests include modeling arid control of discrete-event systems Nidhal Rezg received the BS degree in electrical engineering from the Ecole Nationale d Ingénieurs de Tunis, Tunisia, the MS PhD degrees in industrial automation from the Institut National des Sciences Appliqúes of Lyon, France, in 1991, 1992, 1996, respectively He is currently an Associate Professor at the Université de Metz, France, is conducting research at the Laboratory of Industrial Engineering Manufacturing Production (LGIPM) the Modeling Analysis Control of Industrial Systems (MACSI) team of the French National Institute for Research in Computer Science Control (INRIA), Metz, France His research interests modeling, analysis, simulation, maintenance, scheduling, control of discrete-event systems with applications to manufacturing systems Xiaolan Xie received the PhD degree from the University of Nancy I, Nancy, France, the Habilitation á Diriger des Recherches degree from University of Metz, Metz, France, in , respectively He was a Senior Research Scientist at the Institut National de Recherche en Informatique et en Automatique (INRIA), Metz, France, from 1990 to 1999 Since 1999, he has been a Full Professor at the Ecole Nationale d Ingénieurs de Metz (ENIM), Metz, France His research interests include modeling, performance evaluation, management, design of manufacturing systems He is a coauthor of three books on Petri nets has authored/coauthored over 40 journal papers in related fields He has served as a Guest Editor of a 2001 Special Issue of the International Journal of Production Research on Modeling, Specification, Analysis of Manufacturing Systems, a 2001 Special Issue of the IEEE TRANSACTIONS ON ROBOTICS AND AUTOMATION on Semiconductor Manufacturing Systems He is an Associate Editor of the IEEE TRANSACTIONS ON ROBOTICS AND AUTOMATION