liveness -enforcing supervision of sequential resource allocation systems
DESCRIPTION
Liveness -Enforcing Supervision of Sequential Resource Allocation Systems. Spyros Reveliotis School of Industrial & Systems Eng. Georgia Institute of Technology. Talk Outline. Problem motivation and the abstraction of the Resource Allocation System (RAS) - PowerPoint PPT PresentationTRANSCRIPT
Liveness-Enforcing Supervision of Sequential Resource Allocation Systems
Spyros ReveliotisSchool of Industrial & Systems Eng.
Georgia Institute of Technology
Talk Outline• Problem motivation and the abstraction of the
Resource Allocation System (RAS)• Formal characterization of the considered problem,
its optimal solution, and the involved complexity• The current State of Art
– Special RAS structure admitting optimal liveness-enforcing supervision of polynomial complexity w.r.t. the RAS size
– Suboptimal, polynomial-complexity liveness-enforcing supervisors for many of the remaining cases
– A generic methodology for verification and design of efficient suboptimal liveness-enforcing supervisors
A motivational example:Part flow control in an FMS
R3R2R1
J1 : R1 ® R2 ® R3 J2 : R3 ® R2 ® R1
Another example: Traffic Management in an AGV System
W1 W2
W3W4
DockingStation
Type - 1Deadlock
Type - 2Deadlock
The current state of art:Dealing with the considered problem in
the 300mm FAB
A Transportation example
Internet-based business workflow management
A modeling abstraction:Sequential Resource Allocation Systems (RAS)
• A set of (re-usable) resource types R = {Ri, i = 1,...,m}.• Finite capacity Ci for each resource type Ri.• a set of job types J = {Jj, j = 1,...,n}.• An (partially) ordered set of job stages for each job type, {pjk, k =
1,...,lj}.• A resource requirements vector for each job stage p, ap[i], i =
1,...,m.• Jobs release their currently held resources only upon allocation
of the resources requested for their next stageSequential RAS deadlock: A RAS state in which there exists a subset of jobs s.t. every job in this subset in order to proceed requires some resource(s) currently allocated to some other job in this subset.
Logical vs Performance Control of Sequential RAS
ResourceAllocation
System
BehavioralCorrectness Efficiency
An Event-Driven RAS Control Scheme
RAS Domain
Logi
cal
Con
trol
Sys
tem
Sta
te M
odel
Per
form
ance
Con
trol
Configuration Data
FeasibleActions
AdmissibleActionsEvent Commanded
Action
The RAS Logical Control Problem:Characterization of the optimal solution and its complexity
q0
q16
12J 21J
q17
11J 22J
q1
11J
q2
21J
q3
12J
q4
22J
q15
11J 21J
q18
11J 12J 21J
q19
11J 21J22J
Finite State Automata (FSA)-based modeling of RAS behavior
Safe vs. Unsafe Region andthe Optimal Logical Control Policy
q0
q16
12J 21J
q17
11J 22J
q1
11J
q2
21J
q3
12J
q4
22J
q15
11J 21J
q18
11J 12J 21J
q19
11J 21J22J
q6
13J
q5
11J 12J
q7
23J
q8
21J22J
q9
11J 13J
q11
12J 13J
q13
11J 12J 13J
q10
21J23J
q12
22J23J
q14
21J22J23J
Complexity Considerations
• State Safety is an NP-complete problem in sequential RAS(by reduction of the 3SAT problem)
• State Transition Diagram (STD) size:
)(m
QQC
O
where:• C = max resource capacity• Q = max number of stages supported by a resource• m = number of resource types
Dealing with the non-polynomial complexity
• Special RAS structure admitting an optimal logical control policy of polynomial complexity w.r.t the RAS size
• Polynomial-Kernel (PK-) RAS logical control policies: Sub-optimal one-step-lookahead policies based on state properties that are polynomially verifiable, e.g.,– RUN (Resource Upstream Neighborhood)– RO (Resource Ordering)– Banker’s algorithm
• An analytical framework for – interpreting the correctness of the above policies, and– enabling the “automatic” validation and synthesis of new members from
this class of policies
Some Major Contributors and Research Groups in this Area
The first attempts, primarily in the computer system context (60’s and 70’s)– Dijkstra, Havender, Habermann, Coffman, Holt– Gold, Araki, Sugiyama, Kasami, OkuiThe problem revival in the manufacturing context (late 80’s / early 90’s)– Banaszak & Krogh– Viswanadham, Narahari & Johnson– Wysk, Joshi & SmithThe current DES-based community (mid-90’s to present)– Colom, Ezpeleta & Tricas– Xie & Jeng – Zhou and his colleagues– Fanti & her colleagues– Roszkowska– Hsieh– Reveliotis, Lawley, Ferreira, Park and Choi
A RAS taxonomy
Structure of the process sequential logic
• Linear: each process is defined by a linear sequence of stages
• Disjunctive: A number of alternative process plans encoded by an acyclic digraph
• Merge-Split or Fork-Join: each process is a fork-join network
• Complex: a combination of the above behaviors
Structure of the stage resource requirement vectors
• Single-unit: each stage requires a single unit from a single resource
• Single-type: each stage requires an arbitrary number of units, but all from a single resource
• Conjunctive: Arbitrary number of units from different resources
RAS admitting optimal logical control of polynomial complexity
• Type 1: The search for a process terminating sequence can be organized in a way that backtracking is not necessary:Process advancing events can be selected in such a manner that the resource slack capacity is increased monotonically – e.g., under “nested” resource allocation: resources are released by a
process in a sequence that is reverse to that followed for their acquisition
• Type 2: Unsafety Deadlock deadlock is polynomially identifiable.This kind of results are available for sub-classes of DIS-SU-RAS only.
DC-RAS with “nested” resource allocation
1. Every process transition corresponds either to a pure allocation or a pure de-allocation.
2. Resources allocated as a block are also de-allocated as a block. The “scope” of each such allocation is defined by the processing stages that engage the corresponding resource block.
3. In each path of the process-defining graph that corresponds to a single realization of the process, the “scopes” of two different allocations are either disjoint or one contains the other – this is equivalent to the statement that resource blocks are de-allocated in reverse order of their allocation.
R1 R1+R2
A(R1) A(R2) A(R3)
R1+R2+R3
D(R3) D(R2) D(R1)
R1+R2 R1
A polynomial algorithm resolving safety in DC-RAS with nested allocations
• Given a state RAS state s, let:– δi(s) be the slack capacity of resource Ri at s, for all i;– Sa(s) be the set of “active” processing stages at s;– <Ajk
1, Ajk2, …, Ajk
n(jk)> be the resource allocation sequence for the resources occupied by a job instance executing proc. stage Ξjk in Sa(s);
– Q := { Ajkn(jk) | Ξjk in Sa(s) }.
• While Q is not empty:– Try to find an allocation Ajk
i in Q that is de-allocateable under the current slack capacities;
– If no such allocation exists, declare s as unsafe and exit.– O.w.,
• add the resources corresponding to Ajki to the slack vars δi(s);
• remove Ajki from Q and, if i > 1, enter in Q the allocation Ajk
i-1. • Declare state s safe and exit.
An Example Result of the 2nd Type
Theorem 1: In a DIS-SU-RAS where every resource has at least two units of capacity, the optimal logical control policy is polynomially implementable (through one-step lookahead)
Proof: We shall show that for this class of systems, – unsafety deadlock, and– deadlock is polynomially identifiable.
A polynomial deadlock detection algorithm for DIS-SU RAS
• Given a state s of a DIS-SU RAS,– R := the entire set of the system resources;– DEADLOCK := FALSE;
• While (R is not empty AND not DEADLOCK)– Try to identify a resource R in R s.t. R is not allocated to
capacity in s or it contains a job requesting advancement to a resource not in R or out of the system.
– If successful, R := R\{R} else DEADLOCK:=TRUE;• Return DEADLOCK
• Algorithm complexity: O(|R|2Cmax)
Unsafety Deadlock
UNSAFEDEADLOCK
Rl
Rk
Rj
The topological relationship of DEADLOCK and UNSAFE spaces / Deadlock-free unsafe states one step away from deadlock
The absurdity of the existence of a deadlock-free unsafe state one step away from deadlock for the considered RAS class
An alternative mechanism for establishing UNSAFETY= DEADLOCK in
various sub-classes of DIS-SU-RAS
C=1
PotentialDeadlock 1
PotentialDeadlock 2
PotentialDeadlock i
PotentialDeadlock n
Basic structure of deadlock-free unsafe states one step away from deadlock in DIS-SU-RAS
Polynomial-Kernel Policies• Search-based: Confine the system operation to those states
from which there exists a terminating sequence that completes one process stage at a time. This sub-class of states are called ordered, and the resulting policy is the renowned (Dijkstra’s) Banker’s algorithm.
• Algebraic: Confine the system operation to those states s that satisfy an inequality of the type:
A·s bRemark: The system state s is a vector with its components indicating how many jobs execute each processing stage of the considered RAS
Example: The RUN (Resource Upstream Neighborhood) Policy for SU-RAS
A partial resource reservation scheme based on a (partial) ordering of the resource set: A job instance executing on a resource reserves capacity on every downstream resource of order greater than or equal to the order of the currently held resource, unless there is an intermediate resource of higher order than the considered downstream resource.
111
111111
11
3
2
1
23
22
21
13
12
11
CCC
JJJJJJ
A × s b
R3R2R1
J1 : R1 ® R2 ® R3
J2 : R3 ® R2 ® R1
O(R1) = 1, O(R2) = 2, O(R3) = 1
q0
q16
12J 21J
q17
11J 22J
q1
11J
q2
21J
q3
12J
q4
22J
q15
11J 21J
q18
11J 12J 21J
q19
11J 21J22J
q6
13J
q5
11J 12J
q7
23J
q8
21J22J
q9
11J 13J
q11
12J 13J
q13
11J 12J 13J
q10
21J23J
q12
22J23J
q14
21J22J23J
Example: The Policy-Admissible Region
Proving RUN Correctness• It suffices to show that for every policy-admissible state, other than
the empty state, there is at least one loaded job that can advance.
• If there exists a job that needs to advance to a resource of order higher than or equal to the order of the currently held resource, then, this job does not enter a new resource neighborhood upon its advancement. Therefore, (i) it has already reserved capacity on the requested resource and (ii) it can advance without violating the policy.
• If every loaded job requests advancement to a resource of lower order than the order of the currently held resource, consider a minimal order resource containing jobs. Then, (i) the resource requested by any of these jobs has free capacity. Furthermore, (ii) any new neighborhoods entered by these jobs upon their advancement, are empty (since they must belong to even lower-order resources). Therefore, any of these jobs can advance without violating the policy.
Case 1 in the proof of RUN correctness
Rc Rn Rh
NH(Rh)
o(Rc) o(Rn) o(Ri) o(Rh)
Ri
Case 2 in the proof of RUN correctness
Rc is a minimum-order resource containing jobsThen,by case assumptions, • o(Rn) < o(Rc) Rn emptyAlso, • for any resource Rh such that st(Rn) NH(Rh) and o(Rh) o(Rc):
st(Rn) NH(Rh) st(Rc) NH(Rh)• for any resource Rl such that st(Rn) NH(Rl) and o(Rl) < o(Rc):
Ri, Ri NH(Rl) o(Ri) o(Rl) < o(Rc) Ri empty NH(Rl) empty
Rc Rn Rl Rh
NH(Rh)NH(Rl)
Automatic Correctness Verification of Algebraic PK Policies
Petri Net-based modeling of RAS
P20
P11
P12
P13
P21
P22
P23
P10
T10
T11
T12
T13
T20
T21
T22
T23
R1
R2
R3
R3R2R1
J1 : R1 ® R2 ® R3
J2 : R3 ® R2 ® R1
O(R1) = 1, O(R2) = 2, O(R3) = 1
Siphon-based characterization of RAS liveness: Single Unit-RAS
P11
P12
P13
P21
P22
P23
P10 P20
T10
T11
T12
T13
T20
T21
T22
T23
R1
R2
R3
S = {R1, R2, P12, P23}S* = {T10, T22, T11, T21, T12, T23}*S = {T11, T23, T12, T22}
*S S*
Siphon-based characterization of RAS liveness: Conjunctive RAS
t20
• Generalizing empty siphon: Siphon S is deadly marked iff t*S, t is disabled by some pS
2
3
p10
t10
t11
p11
r1
t20
p20t21
t22
p21
p22
2
3
p10
t10
t11
p11
r1 p20t21
t22
p21
p22Modifiedmarking
Resource-induced
A key resultTheorem 2: Consider a process-resource net N where:
I. every process subnet Ni is– quasi-live for M0(pi0) = 1,– reversible for every initial marking M0(pi0), and– “acyclic”, i.e., strongly connected with every cycle containing pi0;
II. Resources are re-usable, i.e., for every resource Rk, p-semiflow yRk s.t.– yRk(rk) = 1,– p sup(Rk), yRk(p) = # units of Rk required for the execution of stage p,– yRk(p) = 0, o.w.III. Each process sub-net when augmented with the required resource places is
quasi-live (i.e., the process-resource net is “well-marked”).Then, 1. N is live iff ~ resource-induced deadly marked siphon in the modified
reachability space.2. Liveness Reversibility3. If N is PT-ordinary, liveness ~ empty siphon in the reachability space.
Modeling an algebraic PK policy as a set of fictitious resources
P10
P11
P12
P13
P21
P22
P23
P20
T10
T11
T12
T13
T20
T21
T22
T23
R1
R2
R3
W1
W2
W3
111
111111
11
3
2
1
23
22
21
13
12
11
CCC
JJJJJJ
Computing the maximal empty siphon
P12
P13
P21
P23
T10
T11
T12
T13
T20
T21
T22
T23
R1
R2
Remove Marked Places
P11
P12
P13
P21
P22
P23
P10 P20
T10
T11
T12
T13
T20
T21
T22
T23
R1
R2
R3
Computing the maximal empty siphon (cont.)
P12
P13 P23
T10
T11
T12
T13
T21
T22
T23
R1
R2
Remove enabled transitions and places that will be marked by their firing.; repeat.
P12
P13
P21
P23
T10
T11
T12
T13
T20
T21
T22
T23
R1
R2
A sufficiency condition for non-existence of reachable empty siphons in structurally bounded Petri nets
Theorem 3: A structurally bounded Petri net N=(P,T,F, M0) has no reachable empty siphons if C(N) = |P|, where
Pp
pvNC min)(s.t.
Tttvztppt
,1||
Fptzv tp ),(,
PppSBpMvp ,
)()(
yMM 0
0,};1,0{, yMzv tp
Practical Implications• Theorems 2 and 3 provide the basis for the development of verification tests
for– RAS liveness and– algebraic PK policy correctness
that take the form of a Mixed Integer Programming formulation with polynomial number of variables and constraints in terms of the size of the underlying RAS.
• Embedded in a search process, these tests can support the design of optimized algebraic PK policies – This is essentially a combinatorial optimization problem and constitutes ongoing research.
Some Additional Developments and Future Work
• An algebraic theory for interpreting the functionality of algebraic PK policies through siphon dependencies and the notion of “basic” / “elementary” siphons.
• A methodology for designing optimized (maximally permissive) algebraic PK policies through non-blocking supervisory control theory and the theory of regions for Petri net synthesis from their reachability space.
• A generalization of the concept of algebraic PK policy in order to encompass the potential nonlinearity of the maximally permissive supervisor, based on results from pattern recognition / classification theory, and extension of the correctness verification tests to these policies.
• Future work: Integrate the presented results on the RAS logical control problem with the time-based performance control / scheduling problems arising in these environments.
• The proposed framework: Markov Decision Processes and Approximate Dynamic Programming.
Thank You!