Scheduling of Event-Triggered Networked Control Systems using Timed Game Automata

A timed automaton (TA) [31] is a finite automaton (namely, a directed graph containing finitely many nodes and finitely many labeled edges) extended with real-valued variables, which is usually employed to model real-time systems. The real-valued variables model logical clocks, that are initialized to zero when the system is started and thereafter increase synchronously at the same rate. We shall refer to these variables as simply “clocks”. Clock constraints are used to restrict the behavior of the automaton. An edge transition can be taken when the edge is enabled. Edges are enabled if the values of the clocks satisfy the guard conditions associated with the edge. Additionally, some clocks may be reset to zero when an edge is taken. Originally, Büchi and Muller accepting conditions are used to enforce progress properties [31]. A simplified version called timed safety automata [38] uses local invariant conditions to specify progress properties. In this work, we focus on timed safety automata and refer them as timed automata for simplicity.

We define $C$ as the set of finitely many clocks, $\mathsf{Act}$ as the set of finitely many actions and $\mathbb{N}_{0}$ as the set of natural numbers including zero $\{0,1,\dots\}$. A clock constraint is a conjunctive formula of atomic constraints of the form $x\bowtie n$ or $x-y\bowtie n$ for $x,y\in C$, $\bowtie\in\{\leq,<,=,>,\geq\}$ and $n\in\mathbb{N}_{0}$. Clock constraints will be used as guards on edges and location invariants. We use $\mathcal{B}(C)$ to denote the set of clock constraints.

Sometimes we write $\ell\rTo^{g,a,\mathbf{r}}\ell^{\prime}$ when $(\ell,g,a,\mathbf{r},\ell^{\prime})\in E$. Furthermore we write $\ell\rTo\ell^{\prime}$ to denote the existence of an edge from $\ell$ to $\ell^{\prime}$ with arbitrary labels.

The semantics of a TA are defined as a transition system where a state consists of the current location and the current value of clocks. There are two types of transitions between states depending on whether the automaton: delays for some time (a delay transition), or takes an enabled edge (a discrete transition).

To keep track of clock values, we use functions known as clock assignments $u:C\to\mathbb{R}_{\geq 0}$ and we employ $u\vDash g$ ($u$ satisfies $g$) to denote that the clock values of $u$ satisfy the guard $g$. For $d\in\mathbb{R}_{\geq 0}$, let $u+d$ denote the clock assignment that maps all $c\in C$ to $u(c)+d$. For a set of clocks $\mathbf{c}\subseteq C$, let $u[\mathbf{c}]$ denote the clock assignment that maps all clocks in $\mathbf{c}$ to 0 and agrees with $u$ for the rest of clocks in $C\setminus\mathbf{c}$.

We denote by $\mathsf{Runs}(\mathsf{TA})$ the set of runs of timed automaton $\mathsf{TA}$ starting from the initial state $(\ell_{0},u_{0})$ where $u_{0}$ is a clock assignment that maps all $c\in C$ to 0. Additionally, if $\rho$ is a finite run, the last state of the run is denoted by $\mathit{last}(\rho)$.

The set of actions Act (cf. Definition 1) is assumed to consists of symbols for input actions $a?$, output actions $a!$ and internal actions $\ast$. Synchronous communication between different TA is done by hand-shake synchronization using input and output actions.

To model concurrent systems, several TAs can be extended with parallel composition that takes into account the synchronous communication. Parallel composition of TAs is also called network of timed automata (NTA). Essentially the parallel composition of a set of TAs is the product of the TAs. Building the product timed automaton is an entirely syntactical but computationally expensive operation. The reader is referred to [47, Sec. 5] for an example on the composition of two TAs.

The semantics of an NTA are defined as a transition system where a state consists of a vector of current locations and the current value of clocks in all TAs [48].

A timed game automaton is a timed automaton in which the set of actions is partitioned into controllable and uncontrollable actions. The former are actions that can be triggered by the controller, whereas the latter only by the environment/opponent.

Similar to TA, TGA can also be extended with parallel composition (essentially the synchronized cartesian product of TGA). The parallel composition of TGAs is called a “network of timed game automata” (NTGA) which is formally defined as:

In the parallel composition of TGAs, a pair of input and output actions is denoted as a single action. Thus the sets $\mathsf{Act}_{c}$ and $\mathsf{Act}_{u}$ do not contain any input and output actions. A synchronizing action should be defined as an element of $\mathsf{Act}_{c}$ if it is controllable and an element of $\mathsf{Act}_{u}$ if it is not controllable. In Definition 4, let us remark that both $\mathsf{Act}_{c}$ and $\mathsf{Act}_{u}$ do not contain synchronizing actions for simplicity. Any controllable synchronizing action is denoted by $\ast$, whereas any uncontrollable synchronizing action is denoted by $\circledast$.

Given an NTGA, we are interested in solving the following safety objective: is it possible to find a strategy for the triggering of controllable actions guaranteeing that a set of pre-specified bad states are never reached regardless of what and when uncontrollable actions take place? More formally given an NTGA and a set of bad states $\mathcal{A}$, we seek to construct a strategy $f$ such that the NTGA supervised by $f$ constantly avoids $\mathcal{A}$.

A strategy [26] is a function that during the course of a game constantly gives information about what the controller should do in order to win the game. At any given situation, the strategy could suggest the controller to either “take a particular controllable action” or “do nothing at this point in time”, i.e. delay, which will be denoted by the symbol (controllable action) $\lambda$.

A strategy $f$ over $\mathsf{TGA}$ is called state-based or memoryless whenever $\mathit{last}(\rho)=\mathit{last}(\rho^{\prime})$ implies $f(\rho)=f(\rho^{\prime})$, for each $\rho,\rho^{\prime}\in\mathsf{Runs}(\mathsf{TA})$. The restricted behavior of an NTGA controlled with some strategy $f$ is defined by the notion of outcome [28].

A strategy $f$ is winning from a state if all maximal runs [29, p. 70] in the outcome originated from that state are winning. A state is winning if there exists a winning strategy $f$ from that state. The winning states can be computed by using backward algorithms [28, 26] or on-the-fly algorithms [29]. Software tools are also available that solve safety control problems, e.g. the implementation from Verimag [30] or UPPAAL-Tiga [29], which implement the backward and on-the-fly algorithms respectively.

We consider linear-time-invariant (LTI) systems of the form

where $A$ and $B$ are matrices of appropriate dimensions. We assume the existence of linear state-feedback laws $\upsilon(t)=K\xi(t)$ rendering the closed-loop system globally asymptotically stable, where $K$ is a matrix of appropriate dimensions.

Assume a sample-and-hold implementation of the control law is in place keeping the input signal constant between update times, i.e.

where $t_{0},t_{1},\dots$ is a divergent sequence of update times. For simplicity of presentation, we ignore the presence of delays between reading the state and updating the actuators. The interested reader is referred to [12] for more details, including accounting for delays.

In event-triggered implementations, the sequence of update times is decided on run-time based on the state of the plant [12]. Let $\xi(t)$ represent the solution of (1)-(2). We define an auxiliary variable $e(t)$ representing the difference between the sampled state $\xi(t_{k})$ and the current state $\xi(t)$ of the system:

The event-triggering approach in [12], proposes the following sampling triggering law:

where $\sigma\in]0,\bar{\sigma}[\subset\mathbb{R}^{+}$ is the triggering coefficient, which establishes a trade off between quality of control (convergence rate to the equilibrium) and the amount of transmissions triggered. The inter-sample time of the state $x$, denoted by $\tau_{\sigma}(x)$, is defined as the time between consecutive updates when the sampled state is $x$:

In [27], the authors propose an approach to characterize the sampling behavior of LTI systems with event-triggered implementation as TAs. The approach abstracts the spatial and temporal dependencies of the original system. The following definitions summarize the approach.

Each location $\mathcal{R}_{s}^{\sigma}$ of this TA, is associated with a set of possible states $x$ of the system (1). We abuse slightly notation denoting both the location and the associated region with the same symbol $\mathcal{R}_{s}^{\sigma}$. The suggestion in [27] is to partition the state space of the control system in conic regions pointed at the origin, each of which would be associated to a location of the TA. The TA has one clock variable $c$ that represents the time elapsed since the last update. According to [12], given a fixed sampled state, the inter-sample time is uniquely defined, i.e. it is deterministic. In general, when the sampled state is different, the inter-sample time is also different. The notation $\text{\@text@baccent{$\tau$}}_{s}^{\sigma}$ and $\bar{\tau}_{s}^{\sigma}$ represents the lower and upper bounds of the inter-sample time for sampled states in $\mathcal{R}_{s}^{\sigma}$. In [27] it is shown formally that the TA abstracts the timing behavior of the event-triggered system, implying that:

From Definition 7 it is also trivial to see that if $\xi(t)=x\in\mathcal{R}_{s}^{\sigma}$ then $\xi(t+\tau_{\sigma}(x))\in\mathcal{R}_{j}^{\sigma}$, with $\mathcal{R}_{j}^{\sigma}$ being one of the end locations in the set of edges with starting location $\mathcal{R}_{s}^{\sigma}$. The outgoing edges of $\mathcal{R}_{s}^{\sigma}$ are enabled if the time elapsed since the last update is between $\text{\@text@baccent{$\tau$}}_{s}^{\sigma}$ and $\bar{\tau}_{s}^{\sigma}$. Only one action denoted by $\ast$ is present in this model, and since taking any edge is interpreted as updating the input value, all edges are labeled with action $\ast$ and reset the clock variable. Note that the system may remain in location $\mathcal{R}_{s}^{\sigma}$ for at most $\bar{\tau}_{s}^{\sigma}$ time units, as a triggering event is guaranteed to happen before that instant. A graphical representation of a simple TA of the form of those from Definition 7 is shown in Fig. 2.

In what follows, we describe the procedure employed to construct an NTGA from a given set of event-based NCSs. We start constructing a TGA associated with the shared communication network. Next, for each event-triggered control loop, we generate a TGA as a modification of the TA described in Section 2.4. Finally, the NTGA is obtained by taking the parallel composition of the TGA associated with the network and with all control loops.

We are interested in finding a strategy such that the trajectories of the NTGA never enter the states corresponding to a conflict. Recall that a conflict corresponds to the following situation: a control loop is requesting updates when the communication network is busy. In our NTGA model, conflicts are captured by the active location of $\mathsf{TGA}^{\mathit{net}}$ becoming $\mathit{Bad}$. Thus the set of states we aim at avoiding $\mathcal{A}$ contains all states such that the location of $\mathsf{TGA}^{\mathit{net}}$ is $\mathit{Bad}$, i.e.

If we allow the scheduler to force earlier controller updates, nothing prevents the scheduler from always using such type of updates and never employ the event-triggering mechanism. In this section, we discuss an approach to prevent the undesired schedule by limiting the consecutive earlier updates. In this approach, once a pre-specified limit has been reached, the scheduler is forced to use an event-triggering mechanism.

For this purpose we employ global integer variables, which are an extended feature of UPPAAL-Tiga modeling language to ease the modeling task but not part of the standard definition of TGA (cf. Definition 3). We define a global integer constant $\mathtt{earMax}$ representing the maximum consecutive earlier updates, and a global integer variable $\mathtt{earNum}$ to be used as a counter of consecutive earlier updates. A variable is global if it can be accessed by all TGAs. Finally, the resulting TGA is defined as follows.

There are two differences between Definition 10 and Definition 9. First, in the edges from $\mathcal{R}_{s}^{\sigma_{j}}$ to $\mathit{Ear}_{s}$, we add condition $\mathtt{earNum}<\mathtt{earMax}$ to the guard and add statement $\mathtt{earNum}:=\mathtt{earNum}+1$ to the reset. The additional condition is used to guarantee that the counter of consecutive earlier updates is always smaller than or equal to its maximum. The statement on the reset is used to increase the counter variable by one, once an earlier update happens. Recall that an earlier update happens when one of these edges is taken (cf. Section 3.1.2). Second, in the edges from $\mathcal{R}_{s}^{\sigma_{j}}$ to $\mathcal{R}_{t}$, we add the statement $\mathtt{earNum}:=0$ to the reset. Recall that taking these edges represents the event-triggering mechanism is used (cf. Section 3.1.2). Thus the counter of consecutive earlier updates is reset to zero. Notice that the variable $\mathtt{earNum}$ takes values in $\{0,1,\dots,\mathtt{earMax}\}$.

After these modifications, the NTGA associated to the set of NCSs becomes $\mathsf{TGA}^{\mathit{NCSs}}:=\mathsf{TGA}^{\mathit{net}}\mid\mathsf{TGA}^{\mathit{clim1}}\mid\dots\mid\mathsf{TGA}^{\mathit{climN}}$ where $\mathsf{TGA}^{\mathit{climi}}$ represents the TGA associated with the $i$-th control loop for $i\in\{1,\dots,N\}$. In this new NTGA, the state of $\mathsf{TGA}^{\mathit{NCSs}}$ is described by a $(2N+3)$-tuple $(\ell_{\mathit{net}},\ell_{1},\dots,\ell_{N},u_{\mathit{net}},u_{1},\dots,u_{N},\mathtt{earNum})$ which includes the additional counter $\mathtt{earNum}$. It follows that the bad states $\mathcal{A}$ are now given by

Formally, a scheduler implements a strategy $f$, see Definition 5, for the NTGA $\mathsf{TGA}^{\mathit{NCSs}}$. The strategy $f$ is applied to $\mathsf{TGA}^{\mathit{NCSs}}$ providing, based on the run $\rho$ of $\mathsf{TGA}^{\mathit{NCSs}}$ up to that time instant the controllable action $f(\rho)$ that guarantees the satisfaction of the desired specification.

This means in practice that after each discrete transition of the NTGA, i.e. every time a transmission is placed on the network, first the strategy chooses a triggering coefficient. Then the strategy decides which control loop is updated and also its update mechanism: early or event triggered. After such a transition, and possibly after some time elapses, the environment chooses the conic region containing the next sampled state, which results in a discrete transition of the NTGA, and the procedure is repeated.

Note that this kind of scheduler is a centralized scheduler that needs to have a perfect overview of the transmissions placed on the network, and the control loop responsible for it. Furthermore, given that the locations of $\mathsf{TGA}^{\mathit{NCSs}}$ are related to the actual sampled states transmitted through the network, the scheduler also needs to be able to read the content of the transmitted data.

In this experiment, the minimum channel occupancy time is $\Delta=0.005$, the number of conic regions is $q=200$ and there is one triggering coefficient $\sigma_{1}=0.05$. The input value can be updated 0.005 time units before the lower bound in all regions, i.e. $\text{\@text@baccent{$d$}}_{s}=\text{\@text@baccent{$\tau$}}_{s}-0.005$ and $\bar{d}_{s}=\text{\@text@baccent{$\tau$}}_{s}$ for all $s\in\{1,\dots,q\}$. The maximum consecutive earlier triggering is $\mathtt{earMax}=4$.

We create a model in UPPAAL-Tiga according to Definition 10: the TGA for (5), (6) and the shared communication network are denoted $\mathtt{tgaT}$, $\mathtt{tgaH}$ and $\mathtt{net}$, respectively. The specification is given by

control: A[] not( net.Bad )

A strategy is generated with UPPAAL-Tiga to satisfy this specification. To illustrate the type of strategies synthesized, we show in the following a fragment of the strategy generated by UPPAAL-Tiga for the situation in which the locations of $\mathtt{tgaT}$, $\mathtt{tgaH}$ and $\mathtt{net}$ are $\mathcal{R}_{1}^{\sigma_{1}}$, $\mathcal{R}_{1}^{\sigma_{1}}$ and $\mathit{Idle}$, respectively.

State: ( tgaT.R1a1 tgaH.R1a1 net.Idle )
  earNum=3
When you are in (25<=tgaH.c && tgaT.c<65 && tgaH.c-tgaT.c<=-35)
  || (85<tgaT.c && 25<=tgaH.c && tgaT.c<105 && tgaH.c<=30)
  || (38<tgaT.c && 25<=tgaH.c && tgaT.c-tgaH.c<=30 && tgaH.c<=30)
  || (25<=tgaH.c && tgaT.c<31 && tgaH.c-tgaT.c<=-5)
  || (25<=tgaH.c && tgaT.c-tgaH.c<=-5 && tgaH.c<=30),
take transition tgaH.R1a1->tgaH.Ear1
  { c >= 25 && c <= 30 && earNum < earMax, up!, 1 }
  net.Idle->net.InUse { 1, up?, c := 0 }
When you are in (105<=tgaT.c && tgaT.c <=111 && tgaH.c<25),
take transition tgaT.R1a1->tgaT.Ear1
  { c >= 105 && c <= 111 && earNum < earMax, up!, 1 }
  net.Idle->net.InUse { 1, up?, c := 0 }

As shown above, two different conditions, based on the clock values of $\mathtt{tgaT}$, clock values of $\mathtt{tgaH}$ and the difference of clock values in $\mathtt{tgaT}$ and $\mathtt{tgaH}$, can be appreciated: if the first one is satisfied, an early update is forced for $\mathtt{tgaH}$ where the inter-sample time is between 25 and 30; if the second condition is satisfied, an early update is forced for $\mathtt{tgaT}$ where the inter-sample time is between 105 and 111. If none of the conditions are satisfied, no early update is forced, i.e. the strategy is to let time elapses for both loops.

The strategy generated by UPPAAL-Tiga was applied to the two NCSs (5)-(6), with both systems initialized at the state $[1,100]^{T}$, corresponding to $\mathcal{R}_{1}$ in both of the timing abstractions for the systems. The network status is shown in Fig. 6 (top), where long and short bars represent event-triggered and earlier update mechanisms, respectively. Note that while either of the control loops may exhibit an arbitrary number of consecutive triggerings, the maximum number of consecutive earlier triggerings is respected to be below 4 as this counter is a shared (global) one that is reset to zero whenever any of the two loops run in event-triggered fashion. During the time horizon of 10, the input of (5) is updated 63 times consisting of 50 earlier updates and 13 event-triggering mechanisms. For (6), the input is updated 152 times consisting of 121 earlier updates and 31 event-triggering mechanisms. The state and input trajectories are shown in Fig. 7.

In this experiment, the minimum channel occupancy time is $\Delta=0.005$, the number of conic regions is $q=200$ and there are three triggering coefficients $\sigma_{1}=0.01$, $\sigma_{2}=0.03$ and $\sigma_{3}=0.09$.

We create again a model in UPPAAL-Tiga according to Definition 9: the TGA for (5), (6) and the shared communication network are denoted $\mathtt{tgaT}$, $\mathtt{tgaH}$ and $\mathtt{net}$, respectively. The specification is the same as in Section 4.1 and again we generate a strategy using UPPAAL-Tiga. The following is a fragment of the strategy generated by UPPAAL-Tiga when the location of $\mathtt{tgaT}$, $\mathtt{tgaH}$ and $\mathtt{net}$ is $\mathcal{R}_{37}$, $\mathcal{R}_{38}^{\sigma_{1}}$ and $\mathit{Idle}$, respectively.