Minimal Communication in a Distributed Discrete-Event System

Transcription

1 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 48, NO. 6, JUNE Minimal Communication in a Distributed Discrete-Event System Karen Rudie, Senior Member, IEEE, Stéphane Lafortune, Fellow, IEEE, and Feng Lin, Member, IEEE Abstract This paper deals with distributed discrete-event systems, in which agents (or local sites) are required to communicate in order to perform some specified tasks. Associated with each agent is a finite-state automaton that captures the required tasks to be performed at that site. The problem considered is that each agent must be able to distinguish between the states of its automaton. To help it disambiguate states, an agent uses a combination of direct observation (obtained from sensor readings available to that agent) and communicated information (obtained from sensor readings available to another agent). Since communication may be costly, a strategy to minimize communication between sites is developed. The complexity of the solution reflects the interdependence of the agents communication protocols. That is, the decision to communicate the occurrence of an event relies on which event sequences are indistinguishable to an agent, which, in turn, is a result of what has already been communicated to that agent. I. INTRODUCTION EXISTING work on decentralized control of discrete-event systems (DESs) focuses on problems where decentralized agents each control and observe some events in a system and must together achieve some prescribed goal [15], [4], [19], [7]. In this model it is assumed that agents make independent observations and control decisions, with no communication between agents. Here, we examine models for decentralized DESs that incorporate explicitly in the model a degree of communication between agents. In particular, we are interested in investigating problems where some degree of communication must take place for the problem to be solved and we would like to characterize the minimal degree of communication needed for the distributed agents to achieve the global prescribed goal. Synthesis problems for decentralized control plus communication have only recently been investigated for DESs. Such problem formulations are important because of the pervasiveness of computer networks and capture real-life problems in which a centralized Manuscript received June 25, 2001; revised August 30, Recommended by Associate Editor R. S. Sreenivas. This work was supported in part by the Natural Sciences and Engineering Research Council of Canada (NSERC) under Grant , by the Department of Defense Research and Engineering (DDR&E) Multidisciplinary University Research Initiative (MURI) on Low Energy Electronics Design for Mobile Platforms, managed by the Army Research Office (ARO) under grant ARO DAAH , by the National Science Foundation under Grants CCR and Grant INT , and by the National Aeronautics and Space Administration under Grant NAG K. Rudie is with the Department of Electrical and Computer Engineering, Queen s University, Kingston, ON K7L 3N6, Canada ( rudie@ee. queensu.ca). S. Lafortune is with the Department of Electrical Engineering and Computer Science, University of Michigan, Ann Arbor, MI USA. F. Lin is with the Department of Electrical and Computer Engineering, Wayne State University, Detroit, MI USA. Digital Object Identifier /TAC controller is implemented by several independent components that communicate with each other via a network. Some proposed models can be found in [1], [2], [10] [12], [18], and [20]. Work on diagnostics (i.e., monitoring) with communication can be found in [17] and [5]. The setting considered is that of distributed monitoring and control systems in industrial automation where agents (or local sites) are cooperating in order to perform a given system-level function such as failure detection and identification or supervisory control. Agents make local observations based on their own sensors; there may be common observations in that some sensors may report to more than one site. We are interested in situations where the agents are not able to perform the desired system-level function without communicating with each other; in other words, their own local observations do not provide sufficient information to accomplish the required task. Thus, the agents need to communicate during the operation of the automated system. The problem of interest is how to minimize the communication required between the agents in order to correctly implement the given system-level function. We assume that if the agents were to exchange all of their (local) observations, then they would be able to perform the system-level function. However, this solution is not optimal in the sense that there may be unnecessary communications between the agents. For various reasons, communication may be costly. For example, in some applications it may be desirable to save bandwidth for absolutely necessary communication or, in wireless networks, it may be crucial to save battery power. In order to tackle the types of problems described above, we proceed as follows. For simplicity, we consider the case of two agents. We formulate our problem in a DES framework, where each agent has associated with it a finite-state automaton. This automaton encodes the solution to some monitoring or supervisory control problem to be implemented by the agent. Namely, with each state of the automaton is associated a function that describes the tasks to be performed by the local agent. Therefore, at any time, each agent must know unambiguously the state of its automaton to correctly implement the desired system-level function. However, the state transitions of the automaton are due to both local and remote observations; remote observations require communication from the other agent. Moreover, each agent must also know when it is supposed to communicate a local observation to the other agent, if this observation is required by the other agent. These facets of the problem make it both interesting and difficult to solve. We provide an algorithm that finds a minimal communication strategy between the two agents. A communication strategy is a set of functions, one for each agent, that determines if an observation made by an /03$ IEEE

2 958 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 48, NO. 6, JUNE 2003 agent should be communicated or not to the other agent. The minimality property of our algorithm is to be interpreted as follows: if any of the observations that is supposed to be communicated according to the communication strategy is not communicated, then the agents will not be able to continue correctly implementing the desired system-level function. Such solutions are not unique. Some of the parameters of our algorithm can be tuned to synthesize different minimal (incomparable) communication strategies. It should be noted that our solution is minimal among all solutions that satisfy a property termed implementability (defined in Section III) that depends on the state sets of the given automata. Our work aims at understanding and addressing problems of decentralized implementations with communication that arise in: 1) supervisory control of DESs (in the framework initiated by Ramadge and Wonham [9]) and 2) failure diagnosis of DESs (in the frameworks proposed in [16] and [8]). The former problem is difficult because control affects information and vice versa. In particular, producing a control solution means determining when controllers communicate and what information they exchange in each communication; however, the information that controllers exchange may depend on what control protocol they are using. Since both the type of control algorithm and the communication protocol are free parameters of the algorithm, it is not obvious at the outset how to separate control from communication to produce a solution. Moreover, the algorithm may need to account for nonnegligible time delays in message communication. For example, suppose a controller s decision to disable an event depends on it being able to distinguish the sequence from the sequence and suppose that the controller cannot observe directly. A communication from another controller indicating that has occurred will not help in decision-making if the message transmission could be delayed so that it is not received until after is observed by the first controller even if the message was sent before actually occurred. Finally, in developing algorithms that solve distributed supervisory control problems, the term minimal communication must be formalized. Is it best to have a protocol where, in the worst case, the number of messages sent is less than the number of messages sent in any other protocol, even if, on average, the number of messages sent is greater than the average of some other protocol? For supervisory control problems, where legal behavior is represented by a formal language (which captures some set of event sequences), the control-versus-communication problem reduces to How to achieve more (in terms of language inclusion) while communicating less (in terms of message passing)? That is, in having distributed agents inhibit the plant s behavior through event disablement, the goal is to generate as many of the legal sequences as possible while disallowing any illegal sequences to be generated, and subject to as little communication as possible. A tradeoff between control and communication seems likely. In general, one would expect that the more we require our controllers to communicate, the more they can collectively achieve. However, if communication is costly, a compromise must be made between control and communication. The preceding discussion on supervisory control problems raises challenging issues regarding control and communication in problems with decentralized information. The work presented here is a first step toward making inroads into this important research area. For this first step, we assume communication is reliable and without delay. Our contribution is twofold: 1) we provide a framework and define concepts for analyzing such problems in the context of DESs, and 2) we provide an algorithm that minimizes the communication required between two sites to ensure state disambiguation. A preliminary and partial version of this paper appeared as [13]. II. PROBLEM SETTING This work draws, in part, from the supervisory control framework for DESs developed by Ramadge and Wonham [9] and, in part, on standard automata theory [6]. A brief review of the relevant concepts is given in this section. Readers unfamiliar with the notation and definitions may refer to [9] or to [3, Chs. 2 and 3]. The key tie between the work presented in this paper and that of the discrete-event control approach is that, as in standard discrete-event control theory, we assume that process behavior is typified by event sequences and that, therefore, the system or process under consideration can be modeled by an automaton often a finite-state automaton. In standard DES control, a typical problem proceeds as follows: one first models the uncontrolled plant behavior by an automaton; then one describes desirable behavior, usually as a formal language or a pair of formal languages; then one tries to find conditions under which a supervisor could be found that would enable and disable plant events to yield the desired behavior. Controllers are also typically modeled by automata, where the interpretation is that they are devices (hardware or software or human) which make observations of event sequences possibly only partial observations if some events are not accessible via sensors and then based on their observations, disable various subsets of events throughout the event evolution of the plant. In this paper, we do not solve the more difficult problem of ensuring that appropriate supervisory control is exercised in the face of partial observation and using minimal communication between distributed supervisors. Instead, we abstract away the issue of means of control and assume that for whatever control objective must be met, the agents responsible for the objective must be able to distinguish certain states for decision making. In other words, the control decision might be when to enable and disable which events, but the control goal might also instead relate to diagnosing a system failure. We do not specify how an agent would make whatever control decisions it needs to make once it can determine which state or subset of states it is in. For supervisory control problems, this would require determining a minimal communication scheme that relates to the property of co-observability shown in [15] to be necessary for decentralized control. We use the term agent to mean a process of interest whose behavior is described by sequences of events or actions. In practice, an agent could be, for example, a wireless device, a microcontroller, a robot, a piece of machinery, a piece of hardware or software, or even a human operator. What we have in mind for

3 RUDIE et al.: MINIMAL COMMUNICATION IN A DISTRIBUTED DISCRETE-EVENT SYSTEM 959 supervisory control is that the agents of interest are supervisors or controllers that make control decisions or that do diagnostics. Associated with an agent ( ) is a (finite-state) automaton where is an alphabet of event labels, is a set of states, is the initial state, and is the transition function. (Note that here is assumed to be a defined over its entire domain. This is in contrast to the definition of automata usually used in the DESs literature). For the case where is finite, can be represented by a directed graph whose nodes are states and whose edges are transitions defined by. Sometimes, it is more convenient to specify by a set of transitions: Transition. The objective of Agent is defined as a state feedback mapping, where is some set, which we will not specify. In other words, we do not commit ourselves to a specific type of objective (such as supervisory control or diagnosis). We will assume that each agent only observes directly the occurrence of some subset of events in. To conveniently describe what sequence of events an agent sees, we use a mapping called a natural projection. The projection is defined recursively as follows:, if and if, and, i.e., erases all events which are not in the local event set. Given any language, the notation stands for the language. For an agent, which observes only the events in, the natural projection is interpreted as the agent s view of the strings in. In order for the tasks described by the map to be performed correctly, i.e., for the agent to know unambiguously what action to perform at any given time, we assume that event sequences that are indistinguishable to an agent must lead to the same state in. The assumption is that if each agent had only direct observations (and was not given information from the other agent), then they would not be able to disambiguate states. In other words, one of the agents, say Agent, might observe two sequences and as identical [i.e., ], but. In that case, Agent might not be able to perform the necessary control or monitoring task since upon observing, the agent would not know if or had occurred and since each leads to a different state, the values of the control function (which is a function on states of ) for each might differ. The idea then is to allow the agents to communicate with each other so that each helps the other to disambiguate states. Some subtlety arises from the fact that once information is communicated from Agent 2 to Agent 1, Agent 1 will find fewer pairs of sequences indistinguishable than it did when it only had direct observations to rely on; while that is a good thing, at the same time, Agent 1 s decision to communicate to Agent 2 must be the same for pairs of sequences that it (Agent 1) finds indistinguishable and that situation is now different than it was when nothing was communicated to Agent 1. In other words, it seems unlikely that one could independently find a communication scheme that prescribed a procedure for Agent 1 and then separately find a procedure for Agent 2 without some kind of iteration. In this paper, we assume that and are given. We make this assumption because factoring out the issue of how to construct a suitable and allows us to focus on the following fundamental issues that arise when considering any DES problem in which multiple agents need to communicate with each other: 1) if an agent cannot distinguish several possible situations, it must make the same communication decision in all those situations; 2) in satisfying 1), the agent may need to send seemingly extraneous communications, i.e., communications that the other agent does not require; and 3) the extraneous communications may render some communications of the other agent redundant. Therefore, the problem of minimizing communication even given a fixed and is a difficult problem. A solution to this problem provides insight into how to inject communication into a DES. Although a method for producing and is beyond the scope of this paper, one can imagine the following possibilities for generating a suitable and. One might solve a supervisory control problem where each agent has limited and prescribed controllable events under the assumption (to be relaxed by minimizing communication) that all observable events are communicated. The modular supervisors thus derived would yield a possible and. As a second possibility, one might solve the standard decentralized supervisory control problem, yielding fully decentralized supervisors (for a co-observable plant) and then explore scenarios in which some reconfiguration takes place either because some sensors now fail or are relocated, which now makes communication between the original supervisors necessary. The decentralized supervisors play the role of and. Finally, situations similar to the above two possibilities could apply to failure diagnosis problems where instead of separate controllable event sets, agents have separate failure event sets to diagnose. III. MINIMAL COMMUNICATION BETWEEN TWO AGENTS In this section, we consider the problem of minimizing communications between two agents. We are given two agents and their respective objectives and we know that if they exchange all the information (i.e., occurrences of events) that they observe, then they will be able to achieve their objectives. In practice, however, exchanging all the information will be uneconomical and unnecessary. Our goal is, therefore, to develop an algorithm to find the minimal set of communications needed, in the sense that if any one event occurrence is not communicated from an agent to the other, the agents will not be able to achieve their objectives. A. Desirable Properties of Solutions In this section, we identify characteristics of a desirable solution. Informally, an agent must be able to identify which state it is in, the essence of what we will term a valid solution. Additionally, an agent must make consistent communication decisions in the sense that if the agent cannot distinguish between two sequences of events, then it must make the same communication decision after the occurrence of either of those sequences, a requirement which we will call feasibility. Finally, for our results

4 960 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 48, NO. 6, JUNE 2003 to be synthesized using finite-state automata, we will restrict our attention to solutions that possess a property which makes them implementable. Formally, we define the observations of each agent and the communications between two agents as follows. Each agent can observe the occurrences of events in,, via the natural projection trary pair will be feasible based on the information available to the agents. To guarantee feasibility, it is required that any two sequences of events that are indistinguishable to an agent must be followed by the same communication. Namely, and must be compatible with the and that are built from them. Formally, is feasible with respect to if Each agent can also communicate some occurrences of events to the other agent via a communication mapping and where describes communications from Agent to Agent and. For a string of (observable) events, is the set of events that will be communicated from Agent to Agent. That is, if event may occur after sequence and if is an element of, then upon its occurrence after, event will be communicated. The domain of cannot be since we want to allow the communications from Agent to Agent to depend on prior communications from Agent to Agent. Ideally, one would want the domain of to be the set of possible strings in that Agent can differentiate (based on direct observations and communications from Agent ). However, the set of distinct possible strings seen by Agent itself depends on, which, in turn, depends on. Therefore, to break this circular dependence, we choose the domain of to be. Given that Agent does not necessarily distinguish between all strings in we will need a condition (termed feasibility, defined below) that guarantees that can be performed by Agent. We assume that there is no delay or loss in communication and observation. We also assume that if an event needs to be communicated, then it will be communicated immediately upon its observation. Given and, we can define the information mapping as follows:, is the empty string if otherwise. In other words, after the occurrence of, the next event is known to Agent 1 if and only if it is either directly observed by Agent 1 or communicated by Agent 2 to Agent 1. The mapping is defined similarly. Clearly, from this definition, is a mapping from to. This definition shows how to derive from for the given. We denote this operation by where and is the natural projection onto. The projection onto the set of events observed by Agent 1 or Agent 2 is used because, as noted earlier, the mappings and take sequences of events in as inputs. To check feasibility, we first calculate and then check if the above condition holds. Recall that an automaton is associated with each agent ( ). Since we assume that by communicating all the occurrences of observable events the two agents are able to achieve their objectives, we require that all the events unobservable to either agent form self-loops in Our goal is to find minimal communications between two agents to ensure their ability to achieve their objectives. Therefore, if two sequences of events look the same to Agent, then they must lead to the same state in : When a communication scheme gives rise to, that satisfy condition (1), we say that is valid with respect to. The above properties of validity and feasibility arise directly from the objectives imposed upon the agents and from the information available to them. They serve to precisely characterize the solutions we are aiming for. In order to address the issue of minimizing communication between the agents, we impose a structural requirement on communication maps that we call implementability based on. For this purpose, we form the product of and : where where is defined in the standard manner. Namely (1) is the Cartesian product of the two state sets,, and is defined by Before discussing how to find minimal communications (in a sense to be made precise later), we note that not any arbi- and is the accessible part of the automaton [3], meaning that all unreachable states have been removed.

5 RUDIE et al.: MINIMAL COMMUNICATION IN A DISTRIBUTED DISCRETE-EVENT SYSTEM 961 To guarantee that is implementable based on, it is required that any two strings leading to the same state in (and hence in both and ) must be followed by the same communication. Formally, is said to be implementable with respect to if to be the set of transitions in whose event labels will be communicated from Agent 2 to Agent 1. The sets and will be used to construct communication maps denoted by and. To describe this construction, we must consider how Agent 1 can track the state of during the operation of the system in order to know when to send an event from a transition in. Since Agent 1 sees only the events in (via direct observation) and the events in the transitions in (via communication from Agent 2), all the other transitions in should be replaced by the empty string, from the point of view of Agent 1. We call the resulting transition function. The resulting automaton Intuitively, implementability based on means that we do not wish to consider communication mappings that would be based on finer state-space structures than that of. If one wishes to use a finer state-space structure than that of, then one should modify the original and, accordingly. Building on the aforementioned discussion, we can formally define the problem solved in this paper. First, we define what it means for a communication scheme to be minimal, a notion that in turn requires some ordering on communication maps to be defined. These definitions are as follows. A communication scheme communicates strictly less than, denoted by,if A communication pair is minimal if there is no that communicates strictly less than. Problem Statement: Given,,,, find a minimal pair of communication maps that is valid with respect to subject to the following constraints: i) is feasible w.r.t. ; ii) is implementable w.r.t. ; Constraint i) cannot be relaxed since feasibility is necessary to make the problem well-posed, as explained earlier in this section. Constraint ii), on the other hand, restricts the range of solutions for the desired communication maps. B. Solution Approach Our solution technique for finding a minimal communication pair that is valid, feasible and implementable is as follows. We start with and specify in a set of occurrences of events that will be communicated from Agent to Agent. In other words is the set of transitions in whose event labels will be communicated from Agent 1 to Agent 2. Obviously for such transitions. Similarly, we specify is a nondeterministic finite-state automaton (NFA). We transform into a reachable deterministic finite-state automaton (DFA) in the usual way [6] and denote We drop the arguments to when they are understood. The automaton captures the information of available to Agent 1 in a nondeterministic structure. That is, if there is an -transition from state to state in this means that if were to reach state, then Agent 1 would not be able to determine whether had then moved to state. The automaton captures the same information in a deterministic structure. That is, if is a state of and, then this means that it is possible for to be in a state ( ) and for Agent 1 to not know whether is in that state or in any other state ( ). Since some transitions are replaced by in the process of constructing, not all events are defined in every state of.to define as a total function, we add self-loops for all transitions that are not defined and denote the resulting automaton by The automata, and are similarly defined by interchanging 1 and 2 in the previous expressions. Since captures the complete state-space structure relevant for solving our problem, we would like Agent 1 to base its desired actions (for control or monitoring) and its required communications (to Agent 2) on [or ]. In view of the previous observations about the structure of, we introduce two intermediate conditions that will be used to prove our main results. The first condition (correctness) deals with the desired actions of Agent 1 while the second condition (consistency) deals with the required communications from Agent 1 to Agent 2. Roughly speaking, these conditions further characterize the properties of validity (cf. correctness) and feasibility (cf. consistency) in terms of the structure of, as imposed by the requirement of implementability. 1) Correctness: While Agent 1 need not know what state of Agent 2 is in, it should always know what state of Agent 1 is in. Formally, consider any state in. The state is a subset of states in :. In order for Agent 1 to achieve its objective defined by the state feedback map, it is required that all the pairs in have the same first component. When this requirement

6 962 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 48, NO. 6, JUNE 2003 is satisfied, we say that unique feedback mapping as is correct. In that case, a can be defined Since all the unobservable events ( form self-loops in This mapping will achieve the objective defined by. 2) Consistency: In order for communication from Agent 1 to Agent 2 to be well defined, Agent 1 must have enough information about the state of to either know to communicate an event occurrence or to know not to communicate it. Formally, for all, for all Moreover, the assumption of consistency of to define the mapping. Therefore can be invoked For implementability, it suffices to note that When this requirement is satisfied, we say that is consistent. In that case, a well-defined mapping, which prescribes communication, can be defined from as follows: The communication mapping based on can now be defined as Note that the notion of consistency is a prerequisite for the definitions of and used in (2) and (3). We show that the communication scheme resulting from (2) and (3) is feasible and implementable. Theorem 1: If and are both consistent, then the resulting is feasible with respect to and implementable with respect to. That is, for and (2) (3) since unobservable events only appear in self-loops in since the procedure that converts a nondeterministic automaton into an equivalent deterministic one at most amalgamates states; it doesn't split states, i.e., sequences that lead to the same state in still lead to the same state in Let us now consider how to satisfy the correctness condition, which will lead us to the validity requirement. Intuitively, in order for Agent 1 to distinguish the states in, Agent 2 must communicate to Agent 1 the occurrences of events not in and not forming self-loops in. In other words, we define and Transition Proof: For feasibility, let us prove only, as the dual result for and is analogous. Since by construction all the transitions in that are not self-loops are either observable by Agent 1 ( ) or communicated by Agent 2 ( ), it is clear that Lemma 1: If, then is correct, that is, all the pairs in a state of have the same first component. Proof: Shown in [14]. Needless to say, all the aforementioned discussions are equally valid if we exchange Agent 1 and Agent 2. If both and are consistent, then, as mentioned earlier, we can derive a communication scheme as follows: where and are given by (2).

7 RUDIE et al.: MINIMAL COMMUNICATION IN A DISTRIBUTED DISCRETE-EVENT SYSTEM 963 If and are both correct and consistent, then the resulting is valid with respect to ( ), as we now show. Theorem 2: Let and be correct and consistent. Then, the resulting communication scheme is valid with respect to ( ). That is Proof: We prove the result for only since is similar. Note that consistency is needed in the theorem statement so that is well defined, which, in turn, makes it possible to refer to the defined in (3). Since by construction all the transitions in that are not self-loops are either observable by Agent 1 ( ) or communicated by Agent 2 ( ), for all, Let Let By construction of, we know that and. Since is correct, all the pairs in have the same first component, i.e.,. Therefore C. Algorithm and Results In view of the results in Section III-B, our approach will be to find and that are correct and consistent and where the communication scheme derived from and is minimal among all valid, feasible and implementable solutions. The first result, presented in Theorem 3, will guarantee that and are valid, feasible and implementable. The second result, presented in Theorem 4, will establish the desired minimality property of the communication scheme. By Lemma 1, correctness can be guaranteed if we let and. Therefore, we will initially take and. We will then add communications to and to make both and consistent. For minimality, we should add as few communications to and as possible. To this end, we develop a procedure that computes minimal additional communications needed to make consistent given that Agent 1 already communicates to Agent 2 and Agent 2 already communicates to Agent 1. The procedure will return, the minimal additional communications needed to resolve the communication inconsistency. Fig. 1. Illustration of Lemma 2. Function : Input: Transition Output: 1) ; 2) Transition ; 3) For all Transition do If, then Transition Transition ; else Transition Transition ; 4) Transition ; 5) ; 6) ; 7) For all do If, then ; 8) If, then, go to 7); else return. We similarly define the function by interchanging 1 and 2 everywhere in the aforementioned function. To characterize the function, we have the following lemma. The lemma says that a transition must be communicated if there is a chain of strings that look alike (each to its neighbor in the chain) and that leads to a transition that is communicated. A picture of this concept can be seen in Fig. 1; this figure illustrates why iterations are needed at step 7) of the function. It is useful to recall that the transition function of is total in reading the statement of Lemma 2. Lemma 2: if and only if where is the state space of. Proof: Shown in [14]. Intuitively, the more Agent 2 communicates to Agent 1, the less communication inconsistency there is in Agent 1 and, hence, the fewer additional communications are needed to resolve the communication inconsistency. This can be stated in the following proposition.

8 964 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 48, NO. 6, JUNE 2003 Proposition 1: is a monotonic function with respect to its second argument: Similarly, is also monotonic in the second argument Proof: Let us denote the set of all possible finite sequences of transitions of as Transition For a sequence of transitions in, we define its projection recursively as if otherwise It is clear from this definition that if, then for all We now prove. If, then by Lemma 2 where is the state space of. Let. Since,, and since contains only reachable states, there exist pairs of sequences of transitions in, and, ending in and respectively, such that. Since, for,, and will end in the same state in as well; let us denote these states by,. [This is because by construction captures the set of projected strings. So, if two strings have the same projection, they will lead to the same state in.] Hence where is the state space of. This implies that (by Lemma 2). Now, we can proceed to present our main algorithm to find minimal communications between two agents. In the main algorithm, there is asymmetry between Agent 1 and Agent 2 that can be explained as follows. Once there is some inconsistency in Agent 1 (resulting from two strings and that are indistinguishable to Agent 1 and that lead to different communication decisions), you can resolve the problem either by a) having Agent 1 communicate more to Agent 2 (so that if some event were going to be communicated by Agent 1 upon Agent 1 s deducing that has occurred, then that same event would have to be communicated upon Agent 1 s assuming that has occurred), or by b) having Agent 2 communicate earlier to Agent 1 so that Agent 1 would not find and indistinguishable (by the time either or has occurred). Consequently, the strategy we use can be informally described as follows. 1) Each agent communicates those events necessary to ensure correctness. 2) Then, Agent 1 communicates events necessary to be consistent. 3) Then, given those communications added by Agent 1, Agent 2 adds communication to resolve its communication inconsistencies. 4) Now, we go back and try to remove some communication by Agent 1, given that Agent 2 s communications in step 3) may render strings distinguishable that had previously been indistinguishable by Agent 1 and that had hence caused a communication inconsistency in step 2). However, we only remove those communications by Agent 1 that will not lead to new communication inconsistencies by Agent 2. Step 6) of Main checks if removing some communications from Agent 1 leads to inconsistencies for either Agent 1 (secondnd conjunct in line 2, step 6 of Main) or for Agent 2 (first conjunct in line 2, step 6) of Main). Again, the asymmetry in the conjuncts reflects the fact that removing a communication from Agent 1 to Agent 2 renders Agent 2 communication-inconsistent if Agent 2 would now need more communication than it did when what it got from Agent 1 was. On the other hand, removing a communication from Agent 1 to Agent 2 renders Agent 1 itself communication-inconsistent if based on this smaller set of communications, Agent 1 would still need more communication [i.e., ]. Finally, once the sets of communications are identified, a communication scheme can be constructed [steps 8 10)] using the strategy described in Section III-B [cf. (2) and (3)]. Main: Input: and Output:,,,, and 1) ; 2) Transition ; Transition ; 3) ; 4) ;

9 RUDIE et al.: MINIMAL COMMUNICATION IN A DISTRIBUTED DISCRETE-EVENT SYSTEM 965 5) ; 6) For all such that do If, then ; 7) Pick such that and for all, Proposition 2: satisfies the conjuncts in step 6) of the Main algorithm, namely 8) 9) (i.e., is a minimal element in the range that satisfies the two conditions of step 6); Proof: The first condition is satisfied because of step 4) of the algorithm. The second condition is satisfied because (by Lemma 3) (by Proposition 1) Moreover, no smaller than will satisfy the condition in step 6). Proposition 3: For all 10) Apply (2) and (3) and define and according to Proof: We prove this by contradiction and (by Lemma 4) (by Step 5 of the algorithm) 11) End. We show in Sections III-C-1 and III-C-2 that the Main algorithm produces a communication scheme that is valid, feasible, implementable and minimal. An interesting feature of this algorithm is that it is possible to obtain a solution pair by fixing, as described in step 4), and then just searching for in a certain range. Note that only becomes fixed after one iteration of the functions and [as per steps 3) and 4)]. Moreover, no further iterations on are needed. Finally, what we prove is that the solution space for is then delimited by and computed in steps 3) 5). That is, in searching for a minimal pair, one does not have to keep iterating on both of these sets, a fact which may not be obvious a priori, given the asymmetry of the algorithm. 1) Solution Is Valid, Feasible, and Implementable: We start with the following two lemmas. Lemma 3: For any disjoint sets (4) which is a contradiction. Let us now prove the correctness and consistency of the and obtained by the Main algorithm. Lemma 5: The and obtained from the Main algorithm are correct and consistent. Proof: The correctness follows from Lemma 1. For consistency, we must show that We proceed as follows. By Lemma 3 Proof: Shown in [14]. Lemma 4: For any disjoint sets Proof: Shown in [14]. Similar results can be obtained for. Next, we use the previous lemmas to show that in step 6), there indeed exists an,, such that ; in particular. Therefore, by Step 7) of functions and, and are consistent. Theorem 3: The pair produced by Main is valid, feasible, and implementable. Proof: Follows directly from Theorems 1 and 2 and Lemma 5. 2) Solution Is Minimal: In this section, we show that, in addition to being valid, feasible and implementable, the solution produced by Main is also minimal.

10 966 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 48, NO. 6, JUNE 2003 Theorem 4: The produced by Main is a minimal pair of communication maps among all pairs of communication maps that are valid with respect to, feasible with respect to and implementable with respect to. Proof: We proceed by contradiction. Suppose that there is a that is feasible with respect to and implementable with respect to and. Then, we show that is not valid with respect to, i.e.,, we show that we get a contradiction. Be- If cause That is, since, then two sequences that are indistinguishable to Agent 2 according to the scheme will also be indistinguishable according to the scheme. Therefore (6) where. Let be the first instance when and are different, namely, for all prefixes of, and. Let feasibility of respect to (6) implementability of with respect to with Part I: If the difference is in communication from Agent 2 to Agent 1, that is.. implementability of with respect to then clearly There are two cases. Case 1 : In this case, let and. Since,, that is. However, on the other hand, implies that, that is. Therefore, is not a valid communication scheme. Case 2 : In this case, we have, from steps 6) and 7) of the Main algorithm feasibility of respect to (6) with Since,wehave, a contradiction. This completes Part I. Part II: If the difference is in communication from Agent 1 to Agent 2, that is then (7) Therefore By Lemma 2 (5) There are two cases. Case 3 : This case is analogous to Case 1. Case 4 : By Step 7) of the Main algorithm, is a minimal such that. In other words, removing any element from will violate one of the following two conditions: where is the state space of. Let. Since,, and since contains only states reachable from the initial state, there exist pairs of strings and in, ending in and respectively, such that and. Visually, this is depicted in Fig. 1. If, then implies and by the same argument as in Case 1, we get that is not valid. Case 4(a): Suppose that (C1) is violated after removing, that is, for, Since by Proposition 1. (8)

11 RUDIE et al.: MINIMAL COMMUNICATION IN A DISTRIBUTED DISCRETE-EVENT SYSTEM 967 is always true, (8) implies that there exists that such, we show that we get a contradiction. Be- If cause (13) Let be a string such that. Then Therefore feasibility of respect to (13) with We will use a strategy similar to Case 2 to prove the result, but we work with instead of. Before doing so, let us first denote the communication scheme obtained by and by. We will first show that This is true because and is the same as except at any string such that. However, for such strings, implementability of with respect to implies that (9) (10) Since, and (11) By the definition of, is implementable. By implementability of Therefore, by (10), (11), and (12) Thus, we have proven that Now, Lemma 2 that (12) implies by.. implementability of with respect to implementability of with respect to feasibility of respect to (13) with (14) Since, we have. By (9),. Hence,, a contradiction. Case 4(b): If (C1) is not violated but (C2) is violated after removing from, then intuitively is added not for the consistency of Agent 2 but for the consistency of Agent 1. The resulting situation is more complicated because unlike, which can be explicitly expressed as, there is no explicit expression for (since it is the result of choosing some in the range of and ). To characterize, we draw upon an intermediate result about equivalence classes induced by a relation on transitions. The equivalence relation groups transitions into batches, where any two transitions in one batch are chained together as in Lemma 2 and Fig. 1. More precisely, we define an equivalence relation ( ) on Transition as follows: if and only if where is the state space of. Let. Since,, and since contains only states reachable from the initial state, there exist pairs of strings and in, ending in and, respectively, such that and. If, then implies and by the same argument as in Case 1, we get that is not valid. where is the state space of. We denote the equivalence class of by. By Lemma 2, if and only if We proceed to prove the following claim, which says informally that either an equivalence class is communicated because some

12 968 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 48, NO. 6, JUNE 2003 element in it is needed for the other agent to know which state that agent is in (i.e., some element in the class belongs to ) or because its removal would violate (C1). Claim 1: For every equivalence class of, one of the following must be true: a) ; b). Proof of Claim 1: Assume that neither a) nor b) is true. We will show that then and would satisfy (C1) and (C2), which would contradict the minimality of produced by the Main algorithm. To see that (C1) is satisfied for and, consider the following. Since b) is false, it is not the case that This implies that In particular, for This means that (C1) is satisfied for and. We prove that (C2) is satisfied for and by contradiction. If (C2) is not satisfied for and, then Case 2: Let. Since we have However,, which means that. Since cannot contain, it must be the case that, which contradicts the assumption at the outset that a) is not true. Thus, for both Cases 1 and 2, we have obtained contradictions, which means that (C2) is satisfied for and. We have therefore shown that and satisfy (C1) and (C2). As stated at the beginning of the proof, this means that and are not a minimal pair satisfying the conjuncts in step 6) of the Main algorithm, which is a contradiction to step 7) of Main. Consequently, it is not possible for both a) and b) to be false. Now we can proceed to show that if the removal of from violates (C2), then, contradiction results. Consider the equivalence class of. By claim 1, one of the following must be true: a) ; b) If a) is true, then This scenario is analogous to Case 2 with 1 and 2 interchanged. [Compare with (5).] If b) is true, then there exists where is the state space of. By rearranging terms, we get We treat the two conjuncts in the preceding expression. Case 1: If [which means that ], then since, we have. This, in turn, implies that, which contradicts the assumption that the, resulting from the Main algorithm satisfy (C2). such that. Let,, be strings that end in ( ). Since, by feasibility and implementability of,, [by the same reasoning as that used in (7) and (14)]. Denote by the set and the communication scheme obtained using and by. Since (C1) is violated for, the rest of the proof is similar to Case 4(a) (with 1 and 2 interchanged). In particular, because,. D. Strategy for Implementation The algorithm in Section III-C does not prescribe a unique set that satisfies the conditions in step 6) of the Main algorithm. Moreover, steps 6) and 7) of Main suggest that all sets in the range that satisfy the two conditions of step 6) be generated and then a minimal one chosen. In fact, by taking advantage of the partition induced by the equivalence relation defined in

13 RUDIE et al.: MINIMAL COMMUNICATION IN A DISTRIBUTED DISCRETE-EVENT SYSTEM 969 the proof of Theorem 4, we develop a method for generating one set that obviates the need to check all sets in the range. The strategy draws on the following three intermediate results. Lemma 6: Suppose that. Then Proof: Shown in [14]. Lemma 7: Transition such that Proof: Shown in [14]. Lemma 8: Suppose that and are not in and. Then, for any output by the Main algorithm,. Proof: Shown in [14]. The previous three lemmas lead to the following method for generating an that, together with the prescribed by Main, will yield a minimal solution to the communication problem. First partition into the equivalence classes induced by the equivalence relation defined in the proof of Theorem 4. Note that these are disjoint sets. By Lemma 6, none of these equivalence classes overlap with. From Lemma 7, we can conclude that if (C2) were violated by any solution there would be an equivalence class with one element of the class in and one element not in. By Lemma 8, either all the elements in a given equivalence class are in or none of them are. Consequently, if is expanded to include a minimal set of cells from the above partition that satisfies (C1), then the resulting set will satisfy both (C1) and (C2) (and, thus, be a legitimate choice of a set at step 7) that satisfies the conditions of step 6) of Main). To expand in a systematic way that may avoid having to test all subsets of cells from the partition, add a single cell (i.e., only one equivalence class) and check if (C1) is satisfied. If it is, then a minimal set has been found. If not, repeat for each of the other single cells. If no single equivalence class added to yields a solution, try a pair of equivalence classes, and so on. IV. EXAMPLES We illustrate the mechanics of the algorithms and some of the characteristics of the results in Section III with several examples. In all the examples in this section, when the sets of observable events are not explicitly listed, an event labeled indicates that Agent observes the event. Also, to forge a stronger tie between the sets of transitions listed and the visual representations of finite-state automata shown in the figures, we represent a transition triple of the form by the notation. A. Example Where Endpoints of Range Are Equal Consider the finite-state automata and given in Fig. 2. For this example, we go through each step of the Main algorithm. Fig. 2. Finite-state automata of agents in example of Section IV-A. Step 1) We start the Main algorithm by constructing the Cartesian product, displayed in Fig. 3. Step 2) Step 3) Here, we perform the function. First, to create (steps 2) 4) of function ), we start with and replace the event labels of the transitions that are not in and not in with. This yields a nondeterministic finite automaton (NFA) (not shown due to space limitations). The NFA is converted into a deterministic finite automaton (DFA) that is equivalent, displayed in Fig. 4. Using, we compute in steps 6) 8) of function. This will be [step 3) of the Main algorithm]. We illustrate how elements get added to in step 7) of. In the first pass through step 7), is just equal to. So, a quick way to compute step 7 is to consider each that appears in the form as an element of. In this example, the candidates for are and

14 970 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 48, NO. 6, JUNE 2003 Fig. 3. Cartesian product R 2 R. Fig. 4. ~R (C ). We now look at all (i.e., all states in the DFA ) where appears as an element of. There is only one such state:. Since but, we add to. The idea behind step 8) (of the function ) is that if an element is added to, it then serves as a candidate in the next iteration of step 7) (of the function). In this particular case, nothing will get added to in the second iteration of step 7). [We will illustrate later on, in a different call to what happens when more than one iteration of step 7) increases the set ]. We proceed in a manner similar to that for for,, and to obtain the following : Step 4) In this step, we compute. To get we will do the same type of computation that

15 RUDIE et al.: MINIMAL COMMUNICATION IN A DISTRIBUTED DISCRETE-EVENT SYSTEM 971 Fig. 5. ~ R (C [ N ). we did in step 3) to get. The NFA [step 4) of ] can be constructed by replacing all transitions that are labeled by events which are not in and that are not in with. Using the NFA to DFA conversion, we get, a deterministic version of, shown in Fig. 5. To compute, we consider the elements of and first add elements to where the state from which the transition exits is grouped (in a state in ) with an exiting state of an element of. For instance, and are grouped together in and since is an element of, according to step 7) of function, we must add to. Also, since and are grouped together in and is an element of, we must also add to. So, the first iteration of step 7) (of function ) yields Next, is set to and step 7) is performed again. This time, though, we see that is in (namely, in ) and since and are grouped together in a state in, we must also add to. Similar reasoning leads us to add to. No further iterations are required and so the final, namely,is Step 5) In essence, now, we repeat step 3) but this time using, in addition to, as input. This means that the may now have fewer transitions than that of. This would yield an NFA, which can be converted to a DFA, shown in Fig. 6. Since all the states of that appear in grouped states in Fig. 4 also appear in those same grouped states in Fig. 6, the computations for will yield the same result as those for and, hence Steps 6) and 7) From Proposition 2, we know that satisfies the conditions in step 6) of the Main algorithm. Since the preceding computations show that, we know that for this example, will satisfy the conditions in step 6) of the Main algorithm and, therefore Steps 8) and 9) Now that we know which communications must be sent, we compute the final and which will yield the communication protocol. The automaton was already computed in step 5) (and is shown in Fig. 6). Moreover, in this example, since, was already computed in step 4) and is shown in Fig. 5. So that the transition functions are total, and not partial, functions, we add self-loops to each state, for each event not defined at that state, in Figs. 6 and 5, to yield and, respectively (not shown). The communication scheme (namely, the protocol for communication that each agent uses) is completely determined by the and that result from our algorithm. In particular, according to (2), an event is communicated from Agent 1 to Agent 2 at state of if and only if there is a state (from )in such that is in the set

16 972 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 48, NO. 6, JUNE 2003 Fig. 6. ~ R (C [ N ). of communications. So, for example, since and since, we get i.e., event is communicated by Agent 1 when Agent 1 is in the initial state. On the other hand, since there is no triple or in either or, event is not communicated by Agent 1 at Agent 1 s initial state. We can apply the dual to (2) to determine. We represent and thus computed by putting boxes around the event label of a communicated transition in and. We display these updated versions of and in Figs. 7 and 8. The communication mappings and can now be inferred from and (or their corresponding diagrams, Figs. 7 and 8). We can deduce, for example, that, which means that is communicated by Agent 1 to Agent 2 after Agent 1 sees ; this can be seen from Fig. 7 where the event exiting state is in a box. Similarly, we know that, which means that Agent 2 communicates after seeing. The reason seeing is in quotation marks is because the event is not directly observed by Agent 2; rather, has been communicated to Agent 2. It is worth noting that the sequence that Agent 2 sees would not be the first three s to occur in the system. This is because if we look at Fig. 7, we see that the first (that exits the initial state) is not communicated to Agent 2. It is only subsequent occurrences of (exiting from state ) that are communicated. So, when the first occurs, Agent 2 remains at its initial state of, while the second brings Agent 2 to state. B. Example Where Lower Bound of Range Works The example in Section IV-A illustrates a case where the range between and is empty, i.e., when. In that scenario, step 7) of the Main algorithm is vacuous and the choice for is immediate. In this section, we have a case where and where.in other words, the determined at step 5) of the Main algorithm satisfies the two conditions in step 6). We do not illustrate all the steps of the computations, as we did in Section IV-A; rather, we display the and given at the outset and then list,,,, and so that, if desired, the interested reader may verify our results. The finite-state automata for Agents 1 and 2 are given in Fig. 9. By performing the computations detailed in the Main algorithm, it can be determined that

17 RUDIE et al.: MINIMAL COMMUNICATION IN A DISTRIBUTED DISCRETE-EVENT SYSTEM 973 Fig. 7. R. show the inputs of and and the outputs of transitions communicated. The finite-state automata for Agents 1 and 2 are given in Fig. 10. The relevant,,, and sets are given as Fig. 8. R. C. Example Where Only Upper Bound of Range Works The example in Section IV-B illustrates a case where the lower bound of the range between and works. In this section, we provide an example where no contained in satisfies the conditions in step 6) of the Main algorithm. Consequently, is the only that works. Again, to avoid too many tedious (and nonillustrative) computations, we do not display all the results of the steps of the algorithm but only In this example, since does not work and since has two elements, the two proper subsets of must each be checked [and it can be shown that the conditions of step 6) of the Main algorithm are not satisfied for either set] before concluding that is actually a minimal (in this case, the minimum) set in the range that works. D. Example Where Solution Is Inside Range An example where a minimal solution for is a strict subset of and a strict superset of can be obtained by combining the examples in Sections IV-B and IV-C. For brevity, the example is not presented here; however, it can be found in [14].

18 974 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 48, NO. 6, JUNE 2003 Fig. 9. Fig. 10. Finite-state automata of agents in example of Section IV-B. Finite-state automata of agents in example of Section IV-C. V. CONCLUSION We have developed a communication scheme for distributed agents in a DES where, to perform some control or monitoring task, each agent must be able to distinguish between some of its states. Subtleties arise because the decision to communicate an event relies on what sequences are indistinguishable to an agent, which, in turn, is a result of what has already been communicated to that agent. Our primary contribution is an algorithm which produces sets of communications for each agent such that the pair of sets is minimal, in the sense that no other pair of sets that is strictly smaller than ours will solve the problem. To this end, we have introduced the notions of validity, feasibility, and implementability as useful properties for describing communicating discrete-event processes and their associated communication schemes. The notion of implementability is essential for proving our main result in that the restriction of communication solutions to being implementable with respect to some given fixed initial pair of finite-state automata makes it possible to produce a finite realization of the communication scheme. In other words, it may be possible to come up with a communication scheme that communicates strictly less than that produced by our algorithm but then such a scheme would have to use different transition structures for and than those given at the outset of the problem. This suggests a generalization of the problem considered in this paper to one where the transition structures of the original and would become parameters in the communication problem and the original specifications would have to be given in terms of, say, languages instead of automata. This is an interesting, but challenging, avenue for future research. The algorithm presented in this paper has computational time-complexity that is, in the worst case, exponential in the size of the state sets of the given and since it involves creating deterministic automata from nondeterministic ones. Such transformations are known to be of exponential complexity. Based on known results on synthesis problems for partially observed discrete-event systems, we suspect that exponential complexity is a feature that is inherent to such problems. It may be possible, however, to develop polynomial-time algorithms that yield approximate or suboptimal solutions. It may be of interest to extend the results given in this paper to the case where agents are not required to distinguish each state from every other state but only to distinguish certain states from certain other states. One can imagine that for certain partitions on the state space, our algorithm could be applied with minimal modification. In such a scenario, the definition of validity would reflect that an agent must always know which equivalence class (on states) it is in (as opposed to which exact state it is in). The communication sets and needed to satisfy correctness would have to change to reflect the requirement that transitions are placed in the sets if the equivalence classes of the first arguments of the state labels differ (as opposed to if the first arguments themselves differ). Future work could include applying this algorithm to the problem of distributed supervisory control, where agents in a discrete-event system must each make decisions about disabling events to ensure that some specification (given as a formal language or set of languages) is met. This problem is significantly more complicated than the problem considered in this paper for the following reason. In the work of Section III, we assume that we have been given the finite-state automata and that capture the behavior of the two agents. In the corresponding decentralized supervisory control problem, one would be required to find a pair of supervisors/agents and a communication protocol that the supervisors will follow.

19 RUDIE et al.: MINIMAL COMMUNICATION IN A DISTRIBUTED DISCRETE-EVENT SYSTEM 975 However, where a supervisor communicates is related to the state-transition structure of the supervisor. However, the state-transition structure of each supervisor is now one of the variables of the algorithm. This highlights the inseparable link between control and communication. Finally, to port the results to application domains, the issue of latency or delays in communication would need to be addressed. Our algorithm works under the assumption that messages sent are received immediately, with no delay. In practice, there may be a nonnegligible time delay between when a message is sent and when it is received. If other events can occur during that time interval, the system may evolve to a state from which our solution will not work. Different state-transition structures have different degrees of robustness to this type of delay. One would expect that part of the investigation into the effects of latency would involve characterizing the relationship between different types of transition structures and robustness to delay. ACKNOWLEDGMENT The authors would like to thank A. Overkamp, D. Teneketzis, and G. Barrett for earlier collaborative interactions that helped to hone their ideas about the subtle issues that arise when jointly tackling control and communication. They also thank the anonymous reviewers whose helpful comments on earlier drafts improved the clarity of this paper. REFERENCES [1] G. Barrett, Modeling, analysis and control of centralized and decentralized logical discrete-event systems, Ph.D. dissertation, Dept. Elect. Eng. Comp. Sci., Univ. of Michigan, Ann Arbor, MI, [2] G. Barrett and S. Lafortune, Decentralized supervisory control with communicating controllers, IEEE Trans Automat. Contr., vol. 45, pp , Sept [3] C. Cassandras and S. Lafortune, Introduction to Discrete Event Systems. Boston, MA: Kluwer, [4] R. Cieslak, C. Desclaux, A. S. Fawaz, and P. Varaiya, Supervisory control of discrete-event processes with partial observations, IEEE Trans. Automat. Contr., vol. 33, pp , Mar [5] R. Debouk, S. Lafortune, and D. Teneketzis, Coordinated decentralized protocols for failure diagnosis of discrete event systems, Discrete Event Dyna. Syst.: Theory Applicat., vol. 10, pp , [6] J. E. Hopcroft and J. D. Ullman, Introduction to Automata Theory, Languages, and Computation. Reading, MA: Addison-Wesley, [7] K. Inan, An algebraic approach to supervisory control, Math Control, Sig., Syst., vol. 5, no. 2, pp , [8] F. Lin, Diagnosability of discrete event systems and its applications, Discrete Event Dyna. Syst.: Theory Applicat., vol. 4, no. 2, pp , [9] P. J. G. Ramadge and W. M. Wonham, The control of discrete event systems, Proc. IEEE, vol. 77, no. 1, pp , Jan [10] S. L. Ricker, Knowledge and communication in decentralized discreteevent control, Ph.D. dissertation, Dept. Comput. Info. Sci., Queen s Univ., Kingston, ON, Canada, [11] S. L. Ricker and K. Rudie, Incorporating communication and knowledge into decentralized discrete-event systems, in Proc. Conf. Decision Control, Phoenix, AZ, Dec. 1999, pp [12], Know means no: Incorporating knowledge into decentralized discrete-event control, IEEE Trans Automat. Contr., vol. 45, pp , Sept [13] K. Rudie, S. Lafortune, and F. Lin, Minimal communication in a distributed discrete-event control system, in Proc. Amer. Control Conf., San Diego, CA, June 1999, pp [14], Minimal communication in a distributed discrete-event system, College Eng., Univ Michigan, Ann Arbor, MI, Control Group Rep. No CGR-00-06, [15] K. Rudie and W. M. Wonham, Think globally, act locally: Decentralized supervisory control, IEEE Trans Automat. Contr., vol. 37, pp , Nov [16] M. Sampath, R. Sengupta, S. Lafortune, K. Sinnamohideen, and D. Teneketzis, Diagnosability of discrete event systems, IEEE Trans. Automat. Contr., vol. 40, pp , Sept [17] R. Sengupta, Diagnosis and communication in distributed systems, in Proc. Int. Workshop Discrete Event Syst. (WODES98), Cagliari, Italy, Aug. 1998, pp [18] J. H. van Schuppen, Decentralized supervisory control with information structures, in Proc. Int. Workshop Discrete Event Systems (WODES98), Cagliari, Italy, Aug. 1998, pp [19] Y. Willner and M. Heymann, Supervisory control of concurrent discrete-event systems, Int. J. Control, vol. 54, no. 5, pp , [20] K. C. Wong and J. H. van Schuppen, Decentralized supervisory control of discrete-event systems with communication, in Proc. Int. Workshop Discrete Event Systems (WODES96), Edinburgh, U.K., Aug. 1996, pp Karen Rudie (S 84 M 85 SM 03) received the B.Sc. degree in mathematics and engineering from Queen s University, Kingston, ON, Canada, and the M.A.Sc. and Ph.D. degrees in electrical engineering from University of Toronto, Toronto, ON, Canada, in 1985, 1988, and 1992, respectively. From 1992 to 1993, she was a Postdoctoral Researcher at the Institute for Mathematics and its Applications, Minneapolis, Minnesota. Since 1993, she has been with the Department of Electrical and Computer Engineering at Queen s University, where she is currently an Associate Professor. Her research interests include control of discrete-event systems and hybrid systems. Dr. Rudie has served as an Associate Editor for IEEE TRANSACTIONS ON AUTOMATIC CONTROL ( ), the Journal of Discrete Event Dynamic Systems: Theory and Applications (since 2000), and IEEE Control Systems Magazine (since 2003). Stéphane Lafortune (S 78 M 80 SM 97 F 99) received the B.Eng. degree from École Polytechnique de Montreal, Montreal, QC, Canada, the M.Eng. degree from McGill University, Montreal, QC, Canada, and the Ph.D. degree from the University of California at Berkeley, all in electrical engineering, in in 1980, 1982, and 1986, respectively. Since September 1986, he has been with the University of Michigan, Ann Arbor, where he is a Professor of Electrical Engineering and Computer Science. His research interests are in discrete-event systems, including modeling, analysis, control, diagnostics, and optimization. He coauthored, with C. Cassandras, the textbook Introduction to Discrete Event Systems (Norwell, MA: Kluwer, 1999). Recent publications, as well as executables of the software package UMDES-LIB, are available at Feng Lin (S 86 M 87) received the B.Eng. degree in electrical engineering from Shanghai Jiao-Tong University, Shanghai, China, and the M.A.Sc. and Ph.D. degrees in electrical engineering from the University of Toronto, Toronto, ON, Canada, in 1982, 1984, and 1988, respectively. From 1987 to 1988, he was a Postdoctoral Fellow at Harvard University, Cambridge, MA. Since 1988, he has been with the Department of Electrical and Computer Engineering, Wayne State University, Detroit, MI, where he is currently a Professor. His research interests include discrete-event systems, hybrid systems, robust control, and image processing. Dr. Lin coauthored a paper, with S. L. Chung and S. Lafortune, that received the George Axelby Outstanding Paper Award from the IEEE Control Systems Society. He is also a recipient of a Research Initiation Award from the National Science Foundation, an Outstanding Teaching Award from Wayne State University, a Faculty Research Award from ANR Pipeline Company, and a Research Award from Ford Motor Company. He was an Associate Editor of the IEEE TRANSACTIONS ON AUTOMATIC CONTROL.