Supervisory Control of Semiauto-nomous Mobile Sensor Networks: A Petri Net Design Approach Florin MOLDOVEANU, Dan FLOROIAN, Dan PUIU Abstract: In semiautonomous mobile sensor networks, since human operators may be involved in the control loop, particular improper actions may cause accidents and result in catastrophes. For such systems, this paper proposes a command filtering framework to accept or reject the human-issued commands so that undesirable executions are never performed. In the present approach, Petri nets are used to model the operated behaviors and to synthesize the command filters for supervision. Also the command filter could be implemented using agent technology by associating an filter agent for every robot. An application to a mobile wireless surveillance system is provided to show the feasibility of the developed approach. It is believed that the technique presented in this paper could be further applied to large-scale wireless mobile sensor networks. Key words: agent, command filters, mobile robots, mobile sensor networks, Petri nets, supervisory control, wireless sensor networks ■ 1 Introduction Sensor networks (SNs) have recently received significant attention in the areas of networking, embedded systems, pervasive computing, and multiagent systems due to its wide array of real-world applications (e.g. disaster relief, environment monitoring) [10]. In the last few years, there has been an increasing emphasis on a developing wide-area distributed wireless sensor networks (WSNs) with self-organization capabilities to cope with sensor failures, changing environmental conditions, and different environmental sensing applications [1, 7,16]. In particular, mobile sensor networks (MSNs) hold out the hope Dr. Florin Moldoveanu, dr. Dan Floroian, dr. Dan Puiu, all; Tran-silvania University of Brasov, Faculty of Electrical Engineering and Computer Science, Department of Automation to support self-configuration mechanisms, guaranteeing adaptability, scalability, and optimal performance, since the best network configuration is usually time varying and context dependent. Mobile sensors can physically change the network topology, reacting to the events of the environment or to changes in the mission planning. References [3, 10] points out the advantages of sensor mobility and several algorithms for network self-organization after the occurrence of predetermined events are also proposed. Petriu et al. [13] have studied the networks of autonomous robotic sensor agents for active investigation of complex environments. However, most of the MSN literature focuses on a sensory system of fully-autonomous mobile robots without human intervention. In real applications, human operators may use semiautonomous robots, as shown in Figure 1 (a) [9], to 1) further investigate conditions if several static sensors launch an alert, 2) maintain network coverage for both sensing and communication, 3) charge the static sensors, or 4) repair, replace, or remove the static sensors. For such "human-in-the-loop" systems, human errors have a significant influence on system reliability, at times more than technological failures. Research results indicate that the vast majority of industrial accidents are attributed to human errors. However, the literature classifies human errors and provides few solutions for reducing or eliminating that possibility. Lee and Hsu [5] proposes (for the first time using Petri nets (PNs)) a technique to design supervisory agents for preventing abnormal human operations from being carried out. This supervisory approach was also applied to human-computer interactive systems [6]. PN has been developed into a powerful tool for modeling, analysis, control, optimization, and implementation of various engineering systems [8, 11, 18]. Lee and Chung [4] proposed a Figure 1. (a) Human-involved MSNs. such MSN systems PN-based localization scheme on a discrete event control framework for indoor service robots. In practical applications, some requirements (typically for safety considerations) have to be obeyed for the overall system operations. Therefore, a supervisory framework is needed to facilitate the human control so as to guarantee that undesirable executions never occur. From the high-level point of view, an human-in-the-loop system is inherently a discrete-event system (DES), i.e., a dynamic system with state changes driven by occurrences of individual events. Supervisory control theory provides a suitable framework for analyzing DES [14]. Figure 1(b) adopts the supervisory framework [5, 6], to an MSN system composed of several static sensors and semiauto-nomous mobile robots regulated by human operators through a wireless network. According to the status feedback from both the sensors and robots, the supervisors provide permitted commands for human operators by disabling the actions which violate specifications. The human operator can then trigger only limited commands based on the observed status. However, the supervision is from an active viewpoint to enable or disable the commands in advance and leads to limited human actions. In addition, the MSN system requires a fast sampling rate with low-latency communication to provide supervisors with an up-to-date status to make the decision. Furthermore, each supervisor and the MSN system is based upon a (b) Applied supervisory framework for client/server architecture with centralized communication, which is not an ideal topology for distributed sensor network systems. In this paper, instead of using a clientserver architecture, distributed peer-to-peer (P2P) communication between mobile robots is applied [9]. The advantages of P2P include increased scalability (capacity scales with popularity), robustness (no single point of failure), fault tolerance, resilience to attack, and better support and management in distributed cooperative environments. Moreover, from a passive point of view, a command filter [8] is proposed to avoid improper control actions from being carried out as the robot receives the human commands. As shown in Figure 2 [9], the human operator sends command requests to the mobile robot through a wireless network. Inside the robotic computer, the command filter acquires the sy- stem status via distributed P2P communication and makes the decision to accept or reject the commands so as to meet the specifications, e.g., the collision avoidance among robots. The role of a command filter is to interact with the human operator and the mobile robot so that the closed human-in-the-loop system satisfies the requirements and guarantees that undesirable executions never occur. In such a scenario agents could be used for modeling both the robots and the sensors and could interact with others to obtain perfect behaviors. Also with an user interface program, agents could also interact with human operators. Human operator could influent the decision process of the agents. There are also special agents for network integration [15]. Supervisory (centralized) - control techniques have been studied to overcome the inherent limitations of decentralized approaches, including lack of the ability to provide fast and globally optimal solutions. Some significant results in a supervisory control have been obtained using PNs. In this paper, PNs are used in designing the command filters, yielding a compact and graphical model for the MSN. Basically, the PN design of the filters is identical to the design of the supervisors in [5] and [6], except for the implementation framework as shown in Figures 1(b) and 2. To demonstrate the feasibility of the proposed filtering framework, an application to a mobile wireless surveillance system is illustrated in this paper. Du- Figure 2. Command filtering framework for MSNs ring system operation, our approach ensures that remote commands from the human operator meet the given collision-avoidance requirements. Note that the research work presented in this paper is conducted in an office-like environment. The organization of the paper is as follows. Section 2 briefly introduces the PN-based modeling scheme. Next, a systematical design procedure of the command filter synthesis is described in Section 3. Then, in Section 4, an example of a mobile wireless surveillance system is illustrated to show the feasibility. Finally, Section 5 gives the conclusions. ■ 2 Petri Net - Based System Modeling Most existing methods for supervisory control system design are based on automata models. However, these methods often involve exhaustive searches of overall system behavior and result in state-space explosion problems. One way of dealing with these problems is to model the DES with PNs. PN modeling normally has more compact syntactical representation than the automata approach. Also, from a semnatic point of view, the effect of the state-space explosion problem can be reduced using the structural analysis to investigate the system properties. In addition, PN has an appealing graphical representation with a powerful algebraic formulation and is better suited for modeling systems with parallel and concurrent activities. This section first introduces the basic PN concept, and then shows the modeling of human-involved MSNs. 2.1 Basic Concepts of PN A PN is identified as a particular kind of bipartite directed graph populated by three types of objects. They are places, transitions, and directed arcs connecting places and transitions. In order to study dynamic behavior of the modeled system, in terms of its states and their changes, each place may potentially hold either none or a positive number of tokens, pictured by small solid dots. The presence or absence of a token in a place can indicate whether a condition associated with this place is true or false, for instance. For a place representing the availability of resources, the number of tokens in this place indicates the number of available resources. At any given time instance, the distribution of tokens on places, called PN marking, defines the current state of the modeled system. Formally, a PN can be defined as [12]: G = (P,T, I, O, Mo), (1) where: P = [pi,pi,^,pm} is a finite set of places, where m > 0; T = [ti,ti,K,t„} is a finite set of transitions with P U T , and p IT = 0 , where n > 0; I:(PXT) ^N is an input function that defines a set of directed arcs from P to T, where N = [0,1,2,k}; O :(T X P) ^ N is an output function which defines a set of directed arcs from T to P; M0 : P ^ N is the initial marking. By changing distribution of tokens on places, which may reflect the occurrence of events or execution of operations, for instance, one can study dynamic behavior of the modeled system. The following rules are used to govern the flow of tokens: Enabling Rule: A transition t is said to be enabled if each input place p of t contains at least the number of tokens equal to the weight of the directed arc connecting p to t. Firing Rule: a) An enabled t transition may or may not fire depending on the additional interpretation, and b) A firing of an enabled transition t removes from each input place p the number of tokens equal to the weight of the directed arc connecting p to t. It also deposits in each output place p the number of tokens equal to the weight of the directed arc connecting t to p. As a mathematical tool, a PN model can be described by a set of linear algebraic equations, or other mathematical models reflecting the behavior of the system. This opens a possibility for the formal analysis of the model. This allows one to perform a formal check of the properties related to the behavior of the underlying system, e.g., precedence relations amongst events, concurrent operations, appropriate synchronization, freedom from deadlock, repetitive activities, and mutual exclusion of shared resources, to mention some. Some important PN properties include a boundedness (no capacity overflow), liveness (freedom from deadlock), conservativeness (conservation of nonconsumable resources), and reversibility (cyclic behavior). The concept of liveness is closely related to the complete absence of deadlocks. A PN is said to be live if, no matter what marking has been reached from the initial marking, it is possible to ultimately fire any transition of the net by progressing through further firing sequences. This means that a live PN guarantees deadlock-free operation regardless of the firing sequence. Validation methods of these properties include reachability analysis, invariant analysis, reduction method, siphons/traps-based approach, and simulation [12, 18]. 2.2 Modeling of Semiautonomous MSNs PNs have been used to model, analyze, and synthesize control laws for DES. Zhou and DiCesare [17], moreover, addressing the shared resource problem recognized that mutual exclusion theory plays a key role in synthesizing a bounded, live, and reversible PN. In mutual exclusion theory, parallel mutual exclusion consists of a place marked initially with one token to model a single shared resource, and a set of pairs of transitions. Each pair of transitions models a unique operation which requires the use of the shared resource. In this paper, we adopt mutual exclusion theory to build the PN specification model. Moreover, in semiautonomous MSNs, human behavior can be modeled using the command/response concept. As shown in Figure 3, each human operation is modeled as a task with a start transition, end transition, progressive place and completed pla- Figure 3. Modeling of human behavior using the command/response concept ce. Transitions drawn with dark symbols are events controllable by the remotely located human through the network. Note that the start transition is a controllable event as "command" input, while the end transition is an uncontrollable event as "response" output. On the other hand, nonhuman actions can be simply modeled as a single event transition. ■ 3 Petri Net-Based Command Filter Design 3.1 Specification Types The objective of a command filter is to ensure the reaction of human-issued commands contained within the set of admissible states, called the specification. In this paper, two main types of specifications are considered and described as follows: 1. Collision-avoidance movements: This specification presents the physical constraints of the limited resources, such as the rooms and hallways. Each room limits the number of mobile robots that enter or stay avoid collisions. 2. Deadlock-free operations: This specification ensures that a given command will not lead the system to a deadlock state at which no further action is possible. This specification can be preserved by deadlock avoidance policies. The liveness of a PN is closely related to the complete absence of deadlocks. A PN is said to be live if, no matter what marking has been reached from the initial marking, it is possible to ultimately fire any transition of the net by progressing through further firing sequences. This means that a live PN guarantees deadlock-free operation regardless of the firing sequence. During the system operation, the proposed command filter enforces these specifications by accepting or rejecting human-issued commands. 3.2 Synthesis of Command Filters Definition 3.1: Considering two Petri nets Gl = (Pi,Ti,/j,Oj,Mqi) and G2 = (P2,T2,/2,02,M02), the synchronous composition of two marked Petri nets Gj and G2 is a net G = (P,T,/,O,M0): G = G1 ® G2 , (2) where: P = P1 U P2 ; T = T1 U T2 ; /(p, t) = /i (p, t) if (3i e {1,2}), [p e Pi A t e Ti ], else /(p, t) = 0; 0(p, t) = Oi (p, t); if (3i e {1,2}), [p e Pi A t e Ti ], else 0(p, t) = 0; M0(p) = M01(p) if pe P1, else M0(p) = M02(p). In this paper, an agent that specifies which events are to be accepted or rejected when the system is in a given state is called a command filter. For a system with plant model G and specification model H, the filter can be obtained by synchronous composition of the plant and specification models: F = G ® H, (3) where the transitions of H are a subset of the transitions of G, i.e., Th c Tg . Note that F obtained through the above construction, in the general case, does not represent a proper filter, since it may contain deadlock states from which a final state cannot be reached. Thus, the behavior of F should be further refined and restricted by PN analysis. The design procedure of PN-based command filters consists of the following steps: Step 1) Construct the PN model of the human commands and system responses. Step 2) Model the required specifications. Step 3) Compose the system and specification models to sy- nthesize the preliminary command filter. Step 4) Analyze and verify the properties of the composed model. Step 5) Refine the model to obtain a deadlock-free, bounded, and reversible model according to the defined specifications. 3.3 Implementation Using Agent Technology Agent technology is a new and important technique in recent novel researches of artificial intelligence. Using agent technology leads to a number of advantages such as scalability, event-driven actions, task-orientation, and adaptivity [2]. The concept of an agent as a computing entity is very dependent on the application domain in which it operates. As a result, there exist many definitions and theories on what actually constitutes an agent and the sufficient and necessary conditions for agency. Wooldridge and Jennings [15] depicts an agent as a computer system that is situated in some environment and is capable of autonomous actions in this environment to meet its design objectives. Agents are similar to software objects but they must run continuo-sly and autonomously. The distributed multiagent coordination system is defined as the agents that share the desired tasks in a cooperative point of view and are autonomously executing at different sites. This properties confere inteligence to the agents and togheter they are able to execute tasks that individualy they don't have skills. For command filtering this represent a very important quality that make agent technology very useful for desired task. For our purposes, we have adopted the description of an agent as a software program with the capabilities of sensing, computing, and networking associated with the specific function of command filtering for the MSN systems. A filtering agent is implemented to aquire the system status by autonomously sensing and the P2P (peer to peer) networking abilities, after which computing is performed to accept or reject the associated commands so that desired specifications are satisfied. This implementation is made in JADE [19] because this development tools is very versatile and could be very well integrated with others development tools (like Pro-tege-2000 and Java [20]). Also JADE is an open source FIPA (Foundation for Intelligent Physical Agents) compliant Java based software framework for the implementation of multiagent systems. It simplifies the implementation of agent communities by offering runtime and agent programming libraries, as well as tools to manage platform execution and monitoring and debugging activities. These supporting tools are themselves FIPA agents. JADE offers simultaneously middleware for FIPA compliant multiagent systems, supporting application agents whenever they need to exploit some feature covered by the FIPA standard (message passing, agent life cycle, etc), and a Java framework for developing FIPA compliant agent applications, making FIPA standard assets available to the programmer through Java object-oriented abstractions. The general management console for a JADE agent platform (RMA), like in Figure 4, acquires the information about the platform and executes the GUI (Graphic User Interface) commands to modify the status of the platform (creating new agents, shutting down containers, etc) through the AMS (Agent Management System). The agent platform can be split between several hosts (provided that there is no firewall between them). Agents are implemented as one Java thread and Java events are used for effective and lightweight communication between agents on the same host. Parallel tasks can be still executed by one agent, and JADE schedules these tasks in a more efficient (and even simpler for the skilled programmer) way than the Java Virtual Machine does for threads. Several Java Virtual Machines (VM), called containers in JADE, can coexist in the same agent platform even though they are not running in the same host as the RMA agent. This means that a RMA can be used to manage a set of VMs distributed across various hosts. Each container provides a complete run time JADlKMtiDlrAs^nl MlHferirfnil UJI I h Adtofii looh tlamali PldHoinn Hw^r E) B ^ % ffl"« f D AqgnlPIjITüms B nhV^botsjvd« IC«JUAD£ 8 IPSBTJAM 8 logwjAOE a nM>3eDä3S_^ 8 Fi05a_vM KBWJADE 8 senpj-i^ss^vaa.imy*« 8 i099m)E B SenR3-1iS{b(n!_v39^lOmjACie a SerH53.3at»SS_v3S l