Design of a Live and Maximally Permissive Petri Net Controller Using the Theory of Regions

Transcription

1 IEEE TRANSACTIONS ON ROBOTICS AND AUTOMATION, VOL. 19, NO. 1, FEBRUARY [5] H. Cho and S. I. Marcus, Supremal and maximal sublanguages arising in supervisor synthesis problems with partial observations, Math. Syst. Theory, vol. 22, pp , [6] R. Cieslak, C. Desclaux, A. S. Fawaz, and P. Varaiya, Supervisory control of discrete-event processes with partial observations, IEEE Trans. Automat. Contr., vol. 33, pp , Mar [7] A. Haji-Valizadeh and K. A. Loparo, Minimizing the cardinality of an events set for supervisors of discrete-event dynamical systems, IEEE Trans. Automat. Contr., vol. 41, pp , Nov [8] F. Lin and W. A. Wonham, On observability of discrete event systems, Inform. Sci., vol. 44, no. 3, pp , [9] P. J. Ramadge and W. M. Wonham, Supervisory control of a class of discrete event processes, SIAM J. Control Optim., vol. 25, no. 1, pp , [10] A. F. Vaz and W. M. Wonham, On supervisor reduction in discreteevent systems, Int. J. Control, vol. 44, no. 2, pp , Fig. 11. Megacontroller dynamics. small enough such that during any interval [t; t +1t], at most, one of the following events might happen. 1) Plant Event: which includes all enabled events in 6, at time t. 2) Sensory Network Event: which is any uncontrollable change of sensory network, i.e., N = (d1; d2;...; dn)! N = (d1; d2;...; dn) where di = di = di if di = I di = I or U if di = U 8 i di = U or W if di = W and N is different from N only by one element, say i, i.e., dk 6= dk dk = dk if k = i if k 6= i Now the megacontroller must select an appropriate state from set R(IM). The selected state is shown by OM in Fig. 11. If jr(im)j > 1, then a decision rule is required to select the optimal OM. This problem can be addressed in the context of dynamic optimization, which is not discussed here. Having OM, the megacontroller updates the states of the controller and the sensory network. V. CONCLUSION In this paper, we developed a theoretical framework for control switching of discrete event systems. A megacontroller structure was developed using a combined state and event reduction technique. This structure was applied to monitoring the switching between different control policies for a given discrete event system. REFERENCES [1] T. O. Boucher, Computer Automation in Manufacturing: An Introduction. London, U.K.: Chapman & Hall, [2] B. A. Brandin, The real-time supervisory control of an experimental manufacturing cell, IEEE Trans. Robot. Automat., vol. 12, pp. 1 14, Feb [3] A. L. Buczak, H. Darabi, and M. A. Jafari, Study of genetic algorithm convergence for sensor network optimization problem, Inform. Sci., vol. 133, no. 3 4, pp , [4] C. G. Cassandras and S. Lafortune, Introduction to Discrete Event Systems. Norwell, MA: Kluwer, : ; Design of a Live and Maximally Permissive Petri Net Controller Using the Theory of Regions Asma Ghaffari, Nidhal Rezg, and Xiaolan Xie Abstract This paper addresses the forbidden state problem of Petri nets (PN) with liveness requirement and uncontrollable transitions. The proposed approach computes a maximally permissive PN controller, whenever such a controller exists. The first step, based on a Ramadge Wonham-like reasoning, determines the legal and live maximal behavior the controlled PN should have. In the second step, the theory of regions is used to design control places to add to the original model to realize the desired behavior. Furthermore, necessary and sufficient conditions for the existence of control places realizing the maximum permissive control are given. A parameterized manufacturing application of significant state space is used to show the efficiency of the proposed approach. Index Terms Controllability, Petri nets (PN), supervisory control, theory of regions. I. INTRODUCTION The pioneering work of Ramadge and Wonham [9] on the existence and synthesis of controller for discrete event systems (DES) used finite state automata and formal languages to model the plant. Although the Ramadge Wonham approach is very general, the lack of structure in controlled automata models limit the possibilities of developing computationally efficient algorithms for analysis and synthesis. Petri nets (PNs) have been proposed as an alternative modeling formalism for DES control [7]. Structure properties of PN models have been successfully exploited for design of efficient supervisors of some supervisory control problems. The forbidden state problem of PNs addressed in this paper is a supervisory control problem for which, under appropriate conditions, efficient solutions exist. Restrictive conditions include 1) the set L of legal markings can be expressed by a set of linear inequality constraints also called general mutual exclusion constraints (GMECs), and 2) L is Manuscript received November 29, 2001; revised April 17, 2002 and June 13, This paper was recommended for publication by Associate Editor S. Reveliotis and Editor N. Viswanadham upon evaluation of the reviewers comments. The authors are with INRIA Lorraine/MACSI Team, Metz Cedex, France ( ghaffari@loria.fr; nrezg@loria.fr; xie@loria.fr). Digital Object Identifier /TRA X/03$ IEEE

2 138 IEEE TRANSACTIONS ON ROBOTICS AND AUTOMATION, VOL. 19, NO. 1, FEBRUARY 2003 controllable, i.e., from any marking m 2 L no forbidden marking is reachable by firing only uncontrollable transitions. It was shown that under these two conditions, the maximally permissive control can be realized by simply adding a set of so-called control places to the plant PN model [3]. Otherwise, general forbidden marking constraints may be enforced by a PN-based controller only if the PN model of the system is safe [2], [3]. This paper is part of a joint research action called MARS of INRIA (France). The purpose here is to demonstrate the usefulness of the theory of regions [1], developed by partners of the MARS action, for supervisory controller design. Given a bounded PN model of the plant, the proposed method computes a PN model which corresponds to the behavior of the closed-loop system. The controller design is subject to constraints including a liveness requirement, maximal permissiveness with respect to given forbidden state specifications, and the presence of uncontrollable transitions. The proposed approach can be considered as a combination of the Ramadge Wonham approach and the theory of regions. It first determines the automation model of the closed-loop system using a Ramadge Wonham-like approach. It then uses the theory of regions to design the PN controller, which is a set of control places, whenever a PN controller exists. Compared with the existing PN-based supervisory control approaches, the contributions of the paper can be summarized as follows. 1) The proposed approach is general, thanks to the use of a Ramadge Wonham-like method for the computation of closed-loop behavior. In fact, it considers a general set of forbidden states in addition to the liveness requirement and the presence of uncontrollable transitions. 2) It establishes necessary and sufficient conditions for the existence of control places realizing the maximum permissive control determined by the Ramadge Wonham-like approach. This is a first satisfactory answer to the long-standing problem about the existence of a PN controller. Of course, our conditions are based on the state space. A challenging issue is the identification of structure-based conditions to this problem. 3) The proposed approach allows a compact PN representation of the maximum permissive control policy. Although this approach suffers the usual state explosion problem in the design phase, the resulting PN controller is expected to be compact and can be efficiently used in real-time control. 4) Concerning the theory of regions, we provide a new interpretation which is entirely based on the basic definitions of PNs. This makes the theory of regions more accessible than its original presentation given in [1]. The rest of the paper is organized as follows. Section II provides the necessary background on PNs as well as on the supervisory control theory, and presents the algorithm for the computation of the closed-loop behavior adopted here. Section III presents a new interpretation of the theory of regions and its use for PN controller synthesis. Section IV deals with a practical application and provides some numerical performances. II. PRELIMINARIES A. PNs A PN is a bipartite graph N = (P; T; Pre; Post), where P is a set of places; T is a set of transitions; Pre: P 2 T! IN is the preincidence function that defines arcs from places to transitions; and Post: P 2 T! IN is the postincidence function that defines arcs from transitions to places. A net is said to be pure if no place is both the input place and output place of the same transition. A pure PN can be represented by the so-called incidence matrix C defined as C(p; t) = Post(p; t) 0 Pre(p; t). A marking is a mapping M : P! IN that assigns to each place an integer number of so-called tokens. A PN (N; M 0 ) is a net N with an initial marking M 0. A transition t is said enabled at a marking M iff M Pre(:; t), which will be denoted by M [t >. Any marking M reachable from an initial marking M 0 by firing a sequence = t 1 t 2 111t n satisfies the following state equation: M = M 0 + C~, where ~: T! IN is a vector of nonnegative integers, called the counting vector. The set of all reachable markings from M in N is denoted as R(N; M). The behavior of a net can be described by a so-called reachability graph in which nodes correspond to reachable markings, and there is an arc with label t from node M to node M 0 if M [t >M 0. B. Supervisory Control Problem In this paper, we are concerned with the forbidden state problem and liveness requirement. The control specifications are given as a set of forbidden markings which correspond to undesirable states because they either compromise the system safety or they yield deadlock situations. Let M F be the set of markings for which specifications do not hold or forbidden markings. The objective is to determine a convenient set of places that, once added to a given PN plant model, will prevent the whole system from reaching these states. It is assumed that transitions of the plant model can be partitioned into two disjoint subsets: T u the set of uncontrollable transitions, and T c the set of controllable transitions (T = T c [ T u ). Controllable transitions may be disabled by the supervisor, while uncontrollable transitions cannot. When the net has uncontrollable transitions, to respect the specifications, it is necessary to prevent the system from reaching a superset of the forbidden markings, containing all dangerous markings from which a forbidden one may be reached by firing a sequence of uncontrollable transitions. Let M D be the set of dangerous markings, i.e., M D = fm 2 R(N; M 0)j9M 0 2 M F ^ 2 Tu 3 ;M[ > M 0 g. Obviously M F M D. We further impose the liveness requirement in the same way as in Ramadge and Wonham s approach. That is, it is required that the so-called marked markings can always be reached by the controlled model. However, we limit ourselves to a particular case with only one marked marking, that is, the initial marking. In this case, the liveness requirement is equivalent to imposing reversibility. However, we notice that the results of this paper can be extended to a general liveness requirement. Finally, the behavior of the controlled system under both safety specification and liveness requirement can be defined as follows. Definition 1: The set M L of legal or admissible markings is the maximal set of reachable markings such that 1) M L \ M D =,2)it is possible to reach the marked marking M 0 from any legal marking without leaving the set M L, and 3) any transition t from a legal marking to a nonlegal marking is a controllable transition. Let R c be the reachability graph containing all legal markings. Clearly, M L R(N;M 0) 0 M D. It was shown in [9] that M L exists and is called the maximally permissive behavior. M L is such that, whatever the marking in M L, the system cannot be uncontrollably led outside M L. To solve the control problem, one has to identify the set of state transitions from an admissible marking to a nonadmissible marking. The control places have to prevent these transitions from happening in order to keep the state space of the controlled system in the set of legal markings. Formally, the set of state transitions the controller has to disable is =f(m; t)jm [t >M 0 ^ M 2 M L ^ M 0 =2 M Lg. To summarize: Definition 2: An optimal controller is the controller that ensures the reachability of all markings in M L and that forbids all state transitions in.

3 IEEE TRANSACTIONS ON ROBOTICS AND AUTOMATION, VOL. 19, NO. 1, FEBRUARY C. Controlled Behavior Computation Here are the different steps of the algorithm we use to generate the behavior M L. Note that the liveness enforcement is similar to the approach proposed in [8]. Step 1) Define the set of forbidden states M F. Step 2) Generate the partial reachability graph R p (N; M 0 ). Instead of generating the whole reachability graph of the plant model, successors of forbidden markings are not computed. Step 3) Identify the set M D of dangerous markings by exploring R p (N; M 0 ). In this step, markings leading to forbidden markings by firing uncontrollable transitions are identified. If the initial state M 0 itself is a dangerous marking, then there is no solution for the control problem. Step 4) Determine the behavior R c. Let R c be the reachability graph derived from R p (N; M 0 ) by removing markings in M D. To enforce the liveness of the controlled system in the reversibility sense, R c should be a strongly connected graph containing M 0.If R c is strongly connected, then go to Step 7). Otherwise, compute the strongly connected component (SCC) of graph R c that contains M 0. Step 5) Compute the set of blocking markings M b. Blocking markings are markings that uncontrollably lead, from markings in the SCC of R c, to markings outside the SCC. They are given by M b = fm 2 SCCj9M 0 =2 SCC; 9t 2 T u;m[t >M 0 g. Step 6) Remove blocking markings from R c and go to step 4). Step 7) Set R c as the legal behavior and M L the set of markings in R c. The algorithm gives the legal behavior R c, the set M L, and the set of state transitions leading outside R c. III. CONTROLLER SYNTHESIS The theory of regions was initially proposed for the synthesis of pure PNs from given finite transition systems [1]. This work was done from a pure theoretical computer scientist s point of view and terminologies used are unfamiliar to the control community. The goal of Section III-A is to give a new interpretation of the theory of regions using the basic notions of PNs. Section III-B applies the theory of regions for the design of controller places. Section III-C is an example. A. A New Interpretation of the Theory of Regions Let T be a set of transitions and G a finite oriented graph where arcs are labeled by transitions in T. Assume that there exists a node S 0 in G such that there exists a path from it to any node (see Fig. 1 for an example). The objective of the theory of regions is to find a pure PN (N; M 0), having T as its set of transitions and characterized by its incidence matrix C and its initial marking M 0, such that its reachability graph is G and the marking of the node S 0 is M 0. In the following, without confusion, we use M to denote both a reachable marking and its corresponding node in G. Consider any place p of the net (N; M 0 ) we look for. Since (N; M 0) is pure, p can be fully characterized by its corresponding incidence vector C(p; :). For any transition t that is firable at any marking M, i.e., t is the label of an outgoing arc of the node M in G M 0 (p) =M (p) +C(p; t); 8 (M; M 0 ) 2 G and M [t >M 0 (1) where M 0 is the new marking, or equivalently, the destination node of arc t. Consider now any nonoriented cycle of the reachability graph. Applying the state equation to nodes in and summing them up gives the following cycle equation: C(p; t) 1 ~[t] =0; 8 2 S (2) t2t Fig. 1. Reachability graph. where ~[t] denotes the algebraic sum of all occurrences of t in and S is the set of nonoriented cycles of the graph. ~ will be called the counting vector of. Consider now each node M of the reachability graph G. According to the definition of G, there exists a nonoriented path 0M from the initial state M 0 to M. Applying (1) along the path leads to M (p) = M 0 (p) +C(p; 1 0! ) 0 M, where 0! 0 M is the counting vector of the path 0M defined similarly as ~. There may exist several paths from M 0 to M. Under the cycle equations, the product C(p; 1 ) 0! 0 M is the same for all these paths. As a result, the path 0M can be arbitrarily chosen. The reachability of any marking M in G implies that M 0 (p) +C(p; 1 ) 0! 0 M 0; 8 M 2 G (3) which will be called the reachability condition. It is now clear that the cycle equations and the reachability conditions hold for any place p of the net (N; M 0 ). Unfortunately, these equations are not sufficient to obtain the reachability graph G. In order to obtain exactly the reachability graph G, for each pair (M; t) such that M is a reachable marking of G and t is a transition not firable at M; t, should be prevented from happening by some place p. Since the net is pure, t is prevented from happening at M by a place p iff M 0 (p) +C(p; 1 ) 1 0! 0 M + C(p; t); 01: (4) Relation (4) will be called the event separation condition of (M; t). The set of all possible pairs (M; t) where M is a reachable marking and t is not firable at M will be called the set of event separation instances. One last condition for having the same reachability graph is to ensure that the markings are different one from another. This is the so-called state separation condition and is as follows: or equivalently 8 M; M 0 2 G; 9p such that M (p) 6= M 0 (p) (5) 8 M; M 0 2 G; 9p such that C(p; 1 ) 0! 0 M 6= C(p; 1 ) 0! 0 M : (5 0 ) Theorem 1: There exists a PN (N; M 0 ) with G as its reachability graph iff there exists a set P of places (M 0 (p); C(p; :)) such that 1) each place p satisfies cycle equation (2) and reachability conditions (3), 2) the set of places P satisfies the state separation conditions (5), and 3) for each transition t not firable at a reachable marking M, there exists a place p that satisfies the event separation condition (4) of (M; t). The solution to the reachability graph of Fig. 1 is given in Fig. 2. B. Controller Synthesis In a supervisory control problem, rather than reconstruct a whole net model for the controlled system, it is sufficient to compute a convenient set of places fp cg to add to the original plant model and which will act as a controller. It follows that the synthesis principle here is a bit different. This section shows how to adopt the theory of regions to compute a PN-based controller. Given the plant model of the system to control (N; M 0 ) and the reachability graph R c, i.e., the legal behavior of the controlled system, we use the theory of regions to design the control places fp cg to add.

4 140 IEEE TRANSACTIONS ON ROBOTICS AND AUTOMATION, VOL. 19, NO. 1, FEBRUARY 2003 Fig. 2. PN synthesized from the reachability graph of Fig. 1. Consider a new control place pc. Every marking M in the legal behavior Rc must still be reachable after the addition of pc, which implies that pc has to satisfy reachability condition (3), i.e., M (pc) =M0(pc) +C(pc; 1 ) 0! 0 M 0; 8 M 2 Rc (1 0 ) where 0M is any nonoriented path in Rc from M0 to M. Similarly, each place pc should satisfies cycle equation (2) for cycles in Rc, i.e., C(pc; t) 1 0! [t] =0; 8 2 Sc (2 0 ) t2t where Sc is the set of cycles of the reachability graph Rc. Concerning the event separation instances to forbid, recall that to synthesize a PN having exactly a given reachability graph, all transitions not firable at a marking were considered in the previous subsection. For the supervisory problem under consideration, to obtain Rc from the initial reachability graph R(N; M0), only state transitions of the set from Rc to outside Rc need to be considered. Hence, the set of event separation instances is. This set is expected to be much smaller than the number of all transitions not enabled at a marking. Concerning the event separation instances to forbid, recall that to synthesize a PN having exactly a given reachability graph, all transitions not firable at a marking were considered in the previous subsection. For the supervisory problem under consideration, to obtain Rc from the initial reachability graph R(N; M0), only state transitions of the set from Rc to outside Rc need to be considered. Hence, the set of event separation instances is. This set is expected to be much smaller than the number of all transitions not enabled at a marking. Therefore, each element in will be solved by the addition of a place pc. This means that the number of new places to add is, at most, equal to (in practice, much smaller than) the number of state transitions to inhibit. Hence, each added place pc must solve at least one event separation instance (M; t) in, i.e., M0(pc) +C(pc; 1 ) 0! 0 M + C(pc; t) 01: (3 0 ) The relations (1 ) (3 ) determine the control place pc. Contrary to the PN synthesis problem, the state separation conditions are not needed for the controller synthesis, as they are already satisfied by existing places of the plant PN model. Remark 1: According to well-known results of graph theory, the cycle equations can be reduced to independent cycle equations of basis cycles [5], which can be determined in polynomial time. Clearly, the number of mutually independent cycle equations is, at most, card(t ). Remark 2: Different event separation instances may have common solutions. As a result, the number of places needed for solving all event separation instances is generally much smaller than the number of event separation instances. Algorithm 1: Given a reachability graph and a set of event separation instances with. 1. Compute a spanning tree of and its basis cycles. 2. Compute the independent cycle equation (2 ) using Gaussian elimination method. 3. Generate the reachability condition (1 ) for each marking in using the unique path from to of the spanning tree. 4. While do: 4.1 Generate the event separation condition (3 ) for any element of 4.2 Solve the set of relations (1 ) (3 ). Let be the solution if it exists. Otherwise, exit, as the maximum permissive controlled behavior cannot be enforced by adding control places to the plant PN model Eliminate from all the separation instances that can be solved by. 5. Remove redundant control places to obtain the controlled net by comparing the set of separation instances solved by each control place. The controller computed by Algorithm 1 is optimal as stated in Theorem 2. Theorem 2: The supervisory control problem can be optimally solved by adding a set of control places to the plant model, iff there exists a solution (C(pc; :); M0(pc)) satisfying (1 ) (3 ) for each event separation instance (M; t) in. Proof: (() Consider the controlled net (Nc; M0) =(N; M0)[ fpcg. Since all places in fpcg satisfy (1 ) and (2 ), all transitions in Rc are firable, and the reachability graph obtained by firing labeling transitions in Rc is still Rc, which imply that Rc R(Nc; M0). Further, each event separation instance in is solved by a control place pci, i.e., event separation condition (3 ) holds with the place pci. This implies that all transitions in are disabled in the controlled net (Nc; M0).To conclude, R(Nc; M0) = Rc. ()) Assume that the reachability graph of the controlled system R(Nc; M0) is the maximally permissive behavior. Each place of (Nc; M0) necessarily satisfies (1 ) and (2 ), and for each instance in ; tis necessarily prevented by some place pc, thus satisfying relation (3 ). Q.E.D. Concerning the complexity of the proposed controller design approach, it was established in [9] that the computation of the reachability graph Rc of the controlled system is of polynomial complexity in the number of states. We focus on the complexity of the computation of control places. Theorem 3: Algorithm 1 for the computation of control places is of polynomial complexity in the number of markings in the reachability graph Rc of the controlled system. Proof: Let us consider the complexity of each step of Algorithm 1. From the basic result of graph theory, step 1 is polynomial in the number of nodes nm in Rc [5]. The Gaussian elimination method used in step 2 is of polynomial complexity [10] in the number of basis cycle equations and hence, is polynomial in nm. The result of step 2 is a set of no more than card(t ) equations. Finding the path from M0 to any state M is linear in nm and hence, step 3 is of complexity O(n 2 M ). The

5 IEEE TRANSACTIONS ON ROBOTICS AND AUTOMATION, VOL. 19, NO. 1, FEBRUARY complexity of each iteration of step 4 depends on the resolution of the linear system defined in step 4.2, whose complexity is polynomial [10] in the number of linear relations. Since the number of linear relations is no more than card(t ) +nm +1, the complexity of each iteration of step 4.2 is polynomial in nm. As the number of event separation instances in is bounded by nm card(t ), step 4 is of polynomial complexity in nm. Checking whether a control place is redundant with respect to n other control places is of complexity n.card(). Since the number of control places generated by step 4 is, at most, card(), step 5 is of complexity (card()) 2 and hence, is complexity in nm. To summarize, Algorithm 1 is of polynomial complexity in nm. C. Example Consider the net and its reachability graph in Figs. 1 and 2. The net is not live, since in state M7 =(1; 2; 0; 0; 0; 0) no transition can fire. Let us apply Algorithm 1 to synthesize the set of control places that will avoid the reachability of M7. First, using the procedure of Section II-C, the legal behavior is a reachability graph derived from the one of Fig. 1 by removing M7. WehaveML = fm1, M2, M3, M4, M5, M6g, and =f(m5, t1)g. The single event separation condition to solve is M7(pc) =M0(pc) +2C(pc; t1) +2C(pc; t2) +C(pc; t1) 01. The reachability graph contains two cycles that have the same equation C(pc; t1) +C(pc; t2) +C(pc; t3) +C(pc; t4) =0 whereas, the reachability conditions can be expressed as follows: M0(p) 0 M1(p) =M0(p) +C(p; t1) 0 Fig. 3. Fig. 4. Production cell example. PN model of the production cell. M2(p) =M0(p) +C(p; t1) +C(p; t2) 0 M3(p) =M0(p) +C(p; t1) +C(p; t2) +C(p; t3) 0 M4(p) =M0(p) +2C(p; t1) +C(p; t2) 0 M5(p) =M0(p) +2C(p; t1) +2C(p; t2) 0 M6(p) =M0(p) +2C(p; t1) +2C(p; t2) +C(p; t3) 0: The above linear system can be solved by taking C(pc; :) = (01; 0; 0; 1) and M0(pc) = 2. The corresponding control place is an input place of t1 and an output place of t4 and initially contains two tokens. IV. PRACTICAL APPLICATION Consider the production cell shown in Fig. 3. It is composed of two robots R1 and R2, each one can hold one product at a time, and three types of machines M1 (2 units), M2 (2 units), and M3 (1 unit). There are three working processes in this cell, as shown in the table of Fig. 3, to perform three products: P1 1 and P1 2 which are variants of the same type, and P2. The net of Fig. 4 is the model of the production cell. Places p1 and p10 limits the in-process parts of each part type to three, the interpretation of the other nodes of the model is straightforward. Suppose that once the manufacturing of the products starts, no event in the working processes can be prevented from occurring, i.e., only transitions t1; t2; and t10 are controllable. The controlled system computed by the proposed methodology has 215 states. The controller consists of three control places pc1; pc2; and pc3 that are connected to the system model as shown in Fig. 5. At a first glance, it seems that the proposed controller tries to control uncontrollable transitions t4 and t9 via pc2 and pc3. A careful check proves that the controller does not disable any uncontrollable transition. Suppose that t4 is process and resource enabled, but disabled by control place pc3, i.e., M (p4) 1;M(R2) 1 and M (pc3) = 0. Then, the invariant related to R2 implies that M (p5) = 0, and since M (pc3) = 0, the invariant associated with pc3 implies that M (p9) = Fig. 5. Additional control places. 2. But then, the invariant associated with pc1 implies that M (p4) = 0, which contradicts the initial assumption that M (p4) 1. To conclude, pc3 never tries to disable the uncontrollable transition t4. Similarly, pc2 never tries to disable the uncontrollable transition t9. Note that an iterative approach was proposed in [6] to address a similar problem for deadlock prevention problems with uncontrollable transitions. The approach of [6] is as general as the one presented in this paper, but it does not ensure the maximum permissiveness. The same manufacturing example was parameterized to generate other problem instances. In each instance, we vary the number of in-process parts of each part type (marking of p1 and p10) and the number of available units of some resource types (marking of M 1; M 2; and R2). Table I summarizes results of the numerical experimentation. We give for each value of the triplet (M0(p1) = M0(p10); M0(M 1) = M0(M 2); M(R2)) the number of states NR in the original graph R(N; M0), the number of states NRc in Rc, the number of separation instances to solve Nsep, the number of synthesized control places Np, and the CPU time required by Algorithm 1 for the synthesis of control places. It is important to note that even for problems of relatively large state space and large number of event separation instances, few control places are enough to represent the optimal control policy. This is further confirmed by another numerical experience, not reported here due to the limited space, concerning the control of a railway system

6 142 IEEE TRANSACTIONS ON ROBOTICS AND AUTOMATION, VOL. 19, NO. 1, FEBRUARY 2003 TABLE I SOLUTIONS OF PARAMETERIZED PROBLEM INSTANCES [5] M. Gondran and M. Minoux, Graphes et Algorithmes. Paris, France: Editions Eyrolles, [6] M. V. Iordache, J. O. Moody, and P. J. Antsaklis, A method for the synthesis of deadlock prevention controllers in systems modeled by Petri nets, in Proc. ACC 00, Chicago, IL, June 28 30, 2000, pp [7] B. H. Krogh and L. E. Holloway, Synthesis of feedback control logic for discrete manufacturing systems, Automatica, vol. 27, no. 4, pp , [8] Y. Li and W. M. Wonham, Deadlock issues in supervisory control of discrete event systems, in Proc. Conf. Information Science Systems, 1988, pp [9] P. J. Ramadge and W. M. Wonham, The control of discrete event systems, Proc. IEEE, vol. 77, pp , [10] A. Schrijer, Theory of Linear and Integer Programming. New York: Wiley, Stable Fault Adaptation in Distributed Control of Heterarchical Manufacturing Job Shops with more than states (see [4] for its description). These experiences show that the methodology proposed in this paper is able to provide a compact PN representation of the optimal control policy for a wide range of real-life systems. Further, computation time remains reasonable for problems of large size. V. CONCLUSION In this paper, we have proposed an optimal design methodology of PN controllers for the forbidden state problem with both a liveness requirement and uncontrollable transitions. Our approach combines Ramadge Wonham s approach and the theory of regions. It uses a Ramadge Wonham-like approach to determine the automation model of the controlled system, and then it uses the theory of regions to design a PN controller that is a set of control places. A necessary and sufficient condition for the existence of such a PN controller is obtained. The proposed methodology has been applied to supervisory control of manufacturing systems. The numerical experimentation shows that the proposed approach is able to provide a compact PN representation of the optimum control policies of large systems. We are working on the improvement of the computational efficiency of the proposed method which seems to be promising. Another important issue is the impact of control specifications and system configuration on the feasibility and size of PN controllers. Apart from these issues, future research will be conducted in several directions. A natural research direction concerns the design of suboptimal PN controllers when an optimal one does not exist. The second research direction addresses the cooperation of several PN controllers. It seems that some supervisory control problems that do not have optimal PN controllers can be solved by the joint application of two or more PN controllers. REFERENCES [1] E. Badouel, L. Bernardinello, and P. Darondeau, Polynomial algorithms for the synthesis of bounded nets, in Proc. CAAP 95, 1995, Springer Verlag LNCS 915, pp [2] F. Basile, P. Chiacchio, and A. Giua, Supervisory control of Petri nets based on suboptimal monitor places, in Proc. WODES 98, Sardinia, Italy, 1998, pp [3] A. Giua, F. DiCesare, and M. Silva, Petri net supervisors for generalized mutual exclusion constraints, in Proc. 12th IFAC World Congr., Sydney, Australia, July 1993, pp. I: [4] A. Giua and C. Seatzu, Supervisory control of railway networks with Petri nets, in Proc. 40th IEEE CDC, Orlando, FL, Dec. 2001, pp Vittaldas V. Prabhu Abstract In this paper, a control theoretic model is developed for analyzing the dynamics of distributed cooperative control systems for manufacturing job shops with multiple processing steps with parallel dissimilar machines in which parts control their release times autonomously. The model allows an arbitrary number of part types to be produced using an arbitrary number of machines with an arbitrary number of alternate routings. Conditions for global stability of the resulting distributed control system with nonlinearities are shown using results from Lyapunov stability theory. System stability is found to be robust to a variety of faults and disturbances that may be encountered in a manufacturing environment as long they are bounded in the mean. Feedback enables implicit adaptation to faults in real time, which allows the flexibility in the systems to be fully utilized to compensate for faults and disturbances. Numerical simulation experiments are used to illustrate the global stability and the distributed fault adaptation capability of the system without requiring explicit notification or compensation to conditions such as machine deterioration, multiple machine failures, and network communication delays. Simulation results for job shops with 2000 parts are also presented to illustrate the scalability of the approach. Index Terms Adaptive systems, distributed control, manufacturing automation, uncertain systems. I. INTRODUCTION Heterarchical control systems are characterized by highly distributed control among a large number of loosely coupled autonomous entities that retain a minimal amount of global information, and the absence of supervisory controllers [1]. Control in heterarchical manufacturing systems is highly distributed among its entities such as part entities (workpieces), machine tools, robots, automated guided vehicles, and human operators, resulting in flat control architectures. Such heterarchical architectures tend to enhance robustness to faults by Manuscript received August 8, 2000; revised April 15, This paper was recommended for publication by Associate Editor R. Kumar and Editor N. Viswanadham upon evaluation of the reviewers comments. This work was supported in part by the National Science Foundation under Grant DMI and Grant DMI , and the Ben Franklin Technology Partnership through Pennsylvania State University s Center for Manufacturing Enterprise Integration. The author is with the Pennsylvania State University, University Park, PA USA ( prabhu@engr.psu.edu). Digital Object Identifier /TRA X/03$ IEEE