Pub Date : 2016-05-01DOI: 10.1109/WODES.2016.7497833
J. Komenda, Tomas Masopust, J. H. Schuppen
Control of a multilevel system is developed for a discrete-event system (DES) structured by an engineering model. In a multilevel system, each subsystem has a set of children at the next-lower level and a unique parent at the next-higher level. A coordinated multilevel DES is defined by the condition that a parent also is involved in the interaction of each tuple of its children. Control synthesis is carried out per subsystem. If the specification language is conditionally decomposable, conditionally controllable, and conditionally normal then there exists a set of supervisors such that the closed-loop system of the multilevel system meets the specification. The complexity gain is considerable. The examples of an MRI scanner and of a vehicle system illustrate the approach.
{"title":"Control of an engineering-structured multilevel discrete-event system","authors":"J. Komenda, Tomas Masopust, J. H. Schuppen","doi":"10.1109/WODES.2016.7497833","DOIUrl":"https://doi.org/10.1109/WODES.2016.7497833","url":null,"abstract":"Control of a multilevel system is developed for a discrete-event system (DES) structured by an engineering model. In a multilevel system, each subsystem has a set of children at the next-lower level and a unique parent at the next-higher level. A coordinated multilevel DES is defined by the condition that a parent also is involved in the interaction of each tuple of its children. Control synthesis is carried out per subsystem. If the specification language is conditionally decomposable, conditionally controllable, and conditionally normal then there exists a set of supervisors such that the closed-loop system of the multilevel system meets the specification. The complexity gain is considerable. The examples of an MRI scanner and of a vehicle system illustrate the approach.","PeriodicalId":268613,"journal":{"name":"2016 13th International Workshop on Discrete Event Systems (WODES)","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116870852","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2016-05-01DOI: 10.1109/WODES.2016.7497864
M. Yeddes
In computer security, opacity is widely used and considered as a general language-theoretic scheme of many security properties of systems. A secret behaviour of a system is opaque if a passive attacker can never deduce its occurrence from the system observation. In [9], instead of considering the case of static observability where the set of observable events is fixed off-line or dynamic observability where the set of observable events changes over time depending on the history of the trace, we have introduced Orwellian partial observability where unobservable events are not revealed provided that downgrading events never occurs in the future of the trace. We show in the previous paper verifying opacity for regular secret is opaque for a regular language L w.r.t. an Orwellian projection is PSPACE-complete while it has been proved undecidable even for a regular language L w.r.t. a general Orwellian observation function. In this paper, we address two problems of opacification of a regular secret φ for a regular language L w.r.t. an Orwellian projection πo,d: Given L and a secret φ ∈ L, the first problem consists in computing some minimal regular super-language M of L, if it exists, such that φ is opaque for M w.r.t. πo,d and the second consists to compute the supremal sub-language M' of L such that φ is opaque for M' w.r.t. πo,d. We derive both language-theoretic characterizations and algorithms to solve the two problems.
{"title":"Enforcing opacity with Orwellian observation","authors":"M. Yeddes","doi":"10.1109/WODES.2016.7497864","DOIUrl":"https://doi.org/10.1109/WODES.2016.7497864","url":null,"abstract":"In computer security, opacity is widely used and considered as a general language-theoretic scheme of many security properties of systems. A secret behaviour of a system is opaque if a passive attacker can never deduce its occurrence from the system observation. In [9], instead of considering the case of static observability where the set of observable events is fixed off-line or dynamic observability where the set of observable events changes over time depending on the history of the trace, we have introduced Orwellian partial observability where unobservable events are not revealed provided that downgrading events never occurs in the future of the trace. We show in the previous paper verifying opacity for regular secret is opaque for a regular language L w.r.t. an Orwellian projection is PSPACE-complete while it has been proved undecidable even for a regular language L w.r.t. a general Orwellian observation function. In this paper, we address two problems of opacification of a regular secret φ for a regular language L w.r.t. an Orwellian projection πo,d: Given L and a secret φ ∈ L, the first problem consists in computing some minimal regular super-language M of L, if it exists, such that φ is opaque for M w.r.t. πo,d and the second consists to compute the supremal sub-language M' of L such that φ is opaque for M' w.r.t. πo,d. We derive both language-theoretic characterizations and algorithms to solve the two problems.","PeriodicalId":268613,"journal":{"name":"2016 13th International Workshop on Discrete Event Systems (WODES)","volume":"22 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115507119","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2016-05-01DOI: 10.1109/WODES.2016.7497861
Kamel Barkaoui, A. Hicheur, Ahmed Kheldoun, Ding Liu
Given the constant pressure to improve healthcare efficiency, home care appears as a unique solution for providing personalized healthcare service and home assistance for a growing number of elderly and chronic patients. Home care plans define the health cares or supportive cares delivered by the different home care professionals for a given patient. The management of these plans is challenging since they are inherently flexible, context dependent and cooperative processes involving repetitive activities with complex temporal expressions. In this paper, we propose a formal method based time recursive ECATNets for modelling and analyzing home care plans. The choice of this formalism relies on its ability in modelling flexible and distributed home care processes, with complex temporal constraints. Moreover, since time recursive ECATNets semantics are expressed in terms of conditional rewriting logic, we can use the Real Time MAUDE TCTL model checker to verify temporal properties of home care plan processes.
在不断提高医疗效率的压力下,居家护理成为为越来越多的老年人和慢性病患者提供个性化医疗服务和家庭辅助的独特解决方案。家庭护理计划定义了由不同的家庭护理专业人员为特定患者提供的保健护理或支持性护理。这些计划的管理是具有挑战性的,因为它们本质上是灵活的,依赖于上下文和合作过程,涉及具有复杂时间表达式的重复活动。在本文中,我们提出了一种基于时间递归ECATNets的形式化方法来建模和分析家庭护理计划。这种形式主义的选择依赖于其建模灵活和分布式家庭护理过程的能力,具有复杂的时间限制。此外,由于时间递归ECATNets语义是用条件重写逻辑表示的,我们可以使用Real time MAUDE TCTL模型检查器来验证家庭护理计划过程的时间属性。
{"title":"Modelling and analyzing home care plans using high-level Petri nets","authors":"Kamel Barkaoui, A. Hicheur, Ahmed Kheldoun, Ding Liu","doi":"10.1109/WODES.2016.7497861","DOIUrl":"https://doi.org/10.1109/WODES.2016.7497861","url":null,"abstract":"Given the constant pressure to improve healthcare efficiency, home care appears as a unique solution for providing personalized healthcare service and home assistance for a growing number of elderly and chronic patients. Home care plans define the health cares or supportive cares delivered by the different home care professionals for a given patient. The management of these plans is challenging since they are inherently flexible, context dependent and cooperative processes involving repetitive activities with complex temporal expressions. In this paper, we propose a formal method based time recursive ECATNets for modelling and analyzing home care plans. The choice of this formalism relies on its ability in modelling flexible and distributed home care processes, with complex temporal constraints. Moreover, since time recursive ECATNets semantics are expressed in terms of conditional rewriting logic, we can use the Real Time MAUDE TCTL model checker to verify temporal properties of home care plan processes.","PeriodicalId":268613,"journal":{"name":"2016 13th International Workshop on Discrete Event Systems (WODES)","volume":"33 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123167874","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2016-05-01DOI: 10.1109/WODES.2016.7497868
L. Xia
The variance criterion is an uncommon while important criterion in Markov decision processes. The non-Markovian property caused by the nonlinear (quadratic) structure of variance function makes the traditional MDP approaches invalid for this problem. In this paper, we study the optimization of parametric policies of MDPs under the variance criterion, where the optimization parameters are the probabilities of selecting actions at each state. With the basic idea of sensitivity-based optimization, we derive a difference formula and a derivative formula of the reward variance with respect to the system parameter. The variance difference formula is fundamental for this problem and it partly handles the difficulty of nonlinear property of variance function through a nonnegative term. With these sensitivity formulas, we prove that the optimal policy with the minimal variance can be found in the deterministic policy space. A necessary condition of the optimal policy is also derived. Compared with the counterpart of gradient-based approaches in the literature, our approach can provide a clear viewpoint for this variance optimization problem.
{"title":"Optimization of parametric policies of Markov decision processes under a variance criterion","authors":"L. Xia","doi":"10.1109/WODES.2016.7497868","DOIUrl":"https://doi.org/10.1109/WODES.2016.7497868","url":null,"abstract":"The variance criterion is an uncommon while important criterion in Markov decision processes. The non-Markovian property caused by the nonlinear (quadratic) structure of variance function makes the traditional MDP approaches invalid for this problem. In this paper, we study the optimization of parametric policies of MDPs under the variance criterion, where the optimization parameters are the probabilities of selecting actions at each state. With the basic idea of sensitivity-based optimization, we derive a difference formula and a derivative formula of the reward variance with respect to the system parameter. The variance difference formula is fundamental for this problem and it partly handles the difficulty of nonlinear property of variance function through a nonnegative term. With these sensitivity formulas, we prove that the optimal policy with the minimal variance can be found in the deterministic policy space. A necessary condition of the optimal policy is also derived. Compared with the counterpart of gradient-based approaches in the literature, our approach can provide a clear viewpoint for this variance optimization problem.","PeriodicalId":268613,"journal":{"name":"2016 13th International Workshop on Discrete Event Systems (WODES)","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129872714","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2016-05-01DOI: 10.1109/WODES.2016.7497821
Kaushik Mallik, Anne-Kathrin Schmuck
In this paper we consider a supervisory control problem (SCP) consisting of a regular plant language and a deterministic context free specification language, where the latter can be decomposed into a regular and a deterministic context free part. For this setup we give an implementable algorithm calculating two separate controllers for each part of the specification. We show under which conditions the parallel composition of these controllers solves the original SCP. The latter is done by reducing the problem to a special case of hierarchical decentralized control and using existing results from the literature.
{"title":"Supervisory controller synthesis for decomposable deterministic context free specification languages","authors":"Kaushik Mallik, Anne-Kathrin Schmuck","doi":"10.1109/WODES.2016.7497821","DOIUrl":"https://doi.org/10.1109/WODES.2016.7497821","url":null,"abstract":"In this paper we consider a supervisory control problem (SCP) consisting of a regular plant language and a deterministic context free specification language, where the latter can be decomposed into a regular and a deterministic context free part. For this setup we give an implementable algorithm calculating two separate controllers for each part of the specification. We show under which conditions the parallel composition of these controllers solves the original SCP. The latter is done by reducing the problem to a special case of hierarchical decentralized control and using existing results from the literature.","PeriodicalId":268613,"journal":{"name":"2016 13th International Workshop on Discrete Event Systems (WODES)","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129235548","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2016-05-01DOI: 10.1109/WODES.2016.7497818
Xiang Yin, S. Lafortune
The notion of maximal permissiveness plays an important role in synthesis problems in the supervisory control framework. It is well known that the supervisor synthesis problem has a unique supremal solution when all the events are observable. However, under the partial observation setting, no supremal solution exists in general and there may exist several locally maximal solutions. In this paper, we tackle the supervisory control problem under partial observation from a new angle. First, we propose an approach to verify whether a given supervisor is maximal or not. If a supervisor is not maximal, then we provide an algorithm that synthesizes a new supervisor that is strictly more permissive than the given one. To the best of our knowledge, both the verification of maximality and the synthesis of a larger solution were previously open problems; our algorithms are the first ones of their kind.
{"title":"On maximal permissiveness in partially-observed discrete event systems: Verification and synthesis","authors":"Xiang Yin, S. Lafortune","doi":"10.1109/WODES.2016.7497818","DOIUrl":"https://doi.org/10.1109/WODES.2016.7497818","url":null,"abstract":"The notion of maximal permissiveness plays an important role in synthesis problems in the supervisory control framework. It is well known that the supervisor synthesis problem has a unique supremal solution when all the events are observable. However, under the partial observation setting, no supremal solution exists in general and there may exist several locally maximal solutions. In this paper, we tackle the supervisory control problem under partial observation from a new angle. First, we propose an approach to verify whether a given supervisor is maximal or not. If a supervisor is not maximal, then we provide an algorithm that synthesizes a new supervisor that is strictly more permissive than the given one. To the best of our knowledge, both the verification of maximality and the synthesis of a larger solution were previously open problems; our algorithms are the first ones of their kind.","PeriodicalId":268613,"journal":{"name":"2016 13th International Workshop on Discrete Event Systems (WODES)","volume":"71 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126842906","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2016-05-01DOI: 10.1109/WODES.2016.7497863
L. K. Carvalho, Yi-Chin Wu, R. Kwong, S. Lafortune
The deployment of control systems with network-connected components nowadays has made feedback control systems vulnerable to attacks over the network. This paper considers the problem of intrusion detection and prevention in supervisory control systems, where the attacker has the ability to enable vulnerable actuator events that are disabled by the supervisor. We present a mathematical model for the system under such actuator enablement attacks and propose a defense strategy that detects attacks online and disables all controllable events after an attack is detected. We develop an algorithm for verifying whether the system can prevent damage from attacks with the proposed defense strategy, where damage is modeled as the reachability of a pre-defined set of “unsafe” states. The technical condition of interest that is necessary and sufficient in this context is characterized; it is termed “AE-safe controllability”. Finally, we illustrate the methodology with a traffic system example.
{"title":"Detection and prevention of actuator enablement attacks in supervisory control systems","authors":"L. K. Carvalho, Yi-Chin Wu, R. Kwong, S. Lafortune","doi":"10.1109/WODES.2016.7497863","DOIUrl":"https://doi.org/10.1109/WODES.2016.7497863","url":null,"abstract":"The deployment of control systems with network-connected components nowadays has made feedback control systems vulnerable to attacks over the network. This paper considers the problem of intrusion detection and prevention in supervisory control systems, where the attacker has the ability to enable vulnerable actuator events that are disabled by the supervisor. We present a mathematical model for the system under such actuator enablement attacks and propose a defense strategy that detects attacks online and disables all controllable events after an attack is detected. We develop an algorithm for verifying whether the system can prevent damage from attacks with the proposed defense strategy, where damage is modeled as the reachability of a pre-defined set of “unsafe” states. The technical condition of interest that is necessary and sufficient in this context is characterized; it is termed “AE-safe controllability”. Finally, we illustrate the methodology with a traffic system example.","PeriodicalId":268613,"journal":{"name":"2016 13th International Workshop on Discrete Event Systems (WODES)","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128788211","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2016-05-01DOI: 10.1109/WODES.2016.7497892
F. Basile, P. Chiacchio, J. Coppola
In a previous paper we presented an approach to identify a faulty model for timed discrete event systems when the nominal model is known, given a set of observed timed sequences. The approach works with Time Petri net models and is based on the formulation of a Mixed-Integer Linear Programming Problem derived from a set of logical predicates. The faulty behavior is modeled by adding fault transitions. In this paper we extend this approach by allowing that two transitions may share the same event label. The nominal model is a deterministic labeled Time Petri net system. The identification problem can still be solved via a Mixed-Integer Linear Programming Problem but the constraint set previously determined is modified.
{"title":"Faulty model identification in deterministic labeled Time Petri nets","authors":"F. Basile, P. Chiacchio, J. Coppola","doi":"10.1109/WODES.2016.7497892","DOIUrl":"https://doi.org/10.1109/WODES.2016.7497892","url":null,"abstract":"In a previous paper we presented an approach to identify a faulty model for timed discrete event systems when the nominal model is known, given a set of observed timed sequences. The approach works with Time Petri net models and is based on the formulation of a Mixed-Integer Linear Programming Problem derived from a set of logical predicates. The faulty behavior is modeled by adding fault transitions. In this paper we extend this approach by allowing that two transitions may share the same event label. The nominal model is a deterministic labeled Time Petri net system. The identification problem can still be solved via a Mixed-Integer Linear Programming Problem but the constraint set previously determined is modified.","PeriodicalId":268613,"journal":{"name":"2016 13th International Workshop on Discrete Event Systems (WODES)","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130712725","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2016-05-01DOI: 10.1109/WODES.2016.7497824
G. Cavone, M. Dotoli, C. Seatzu
In this paper we show how timed Petri nets can be efficiently used to solve problems related to resource planning in intermodal freight transport terminals. In particular, the tackled issues regard the strategic planning of the number of facilities used to transfer the intermodal transport units and the capacity/frequency of the transportation means. A real case study is considered, namely a rail-road terminal located in southern Italy. Monte Carlo simulations based on the timed Petri net model of the terminal are carried out considering various scenarios, including both the regular behavior based on real data, and situations of potential congestion resulting from increase in the commercial flows.
{"title":"Resource planning of intermodal terminals using timed Petri nets","authors":"G. Cavone, M. Dotoli, C. Seatzu","doi":"10.1109/WODES.2016.7497824","DOIUrl":"https://doi.org/10.1109/WODES.2016.7497824","url":null,"abstract":"In this paper we show how timed Petri nets can be efficiently used to solve problems related to resource planning in intermodal freight transport terminals. In particular, the tackled issues regard the strategic planning of the number of facilities used to transfer the intermodal transport units and the capacity/frequency of the transportation means. A real case study is considered, namely a rail-road terminal located in southern Italy. Monte Carlo simulations based on the timed Petri net model of the terminal are carried out considering various scenarios, including both the regular behavior based on real data, and situations of potential congestion resulting from increase in the commercial flows.","PeriodicalId":268613,"journal":{"name":"2016 13th International Workshop on Discrete Event Systems (WODES)","volume":"471 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133406998","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2016-05-01DOI: 10.1109/WODES.2016.7497885
R. Malik
This paper describes the implementation of explicit model checking algorithms to verify the nonblocking or nonconflicting property of discrete event systems. Explicit algorithms enumerate and store all reachable states of a synchronous composition. Three alternatives optimised for memory consumption or runtime are described and compared. The algorithms have been implemented in C++ in the discrete event systems library Waters, and experimental results show that they can explore more than 100 million states on standard computers.
{"title":"Programming a fast explicit conflict checker","authors":"R. Malik","doi":"10.1109/WODES.2016.7497885","DOIUrl":"https://doi.org/10.1109/WODES.2016.7497885","url":null,"abstract":"This paper describes the implementation of explicit model checking algorithms to verify the nonblocking or nonconflicting property of discrete event systems. Explicit algorithms enumerate and store all reachable states of a synchronous composition. Three alternatives optimised for memory consumption or runtime are described and compared. The algorithms have been implemented in C++ in the discrete event systems library Waters, and experimental results show that they can explore more than 100 million states on standard computers.","PeriodicalId":268613,"journal":{"name":"2016 13th International Workshop on Discrete Event Systems (WODES)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129079561","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}