Incremental Diagnosis of DES with a Non-Exhaustive Diagnosis Engine

Transcription

1 Inremental Diagnosis of DES with a Non-Exhaustive Diagnosis Engine Alban Grastien Anbulagan NICTA and The Australian National University (ANU), Canberra, Australia {alban.grastien anbulagan}@nita.om.au Abstrat: The inremental diagnosis of disrete-event systems is the problem of updating the diagnosis when new observations are available. For solving this problem, most approahes use diagnosis engines that return all the diagnoses, and onatenate the diagnoses of the new observations to the previous diagnoses. In this paper, we define the notion of non-exhaustive diagnosis engine, whih returns only the preferred diagnosis, and we show how suh an engine an be used for the inremental diagnosis. This is done by the mean of the so-alled predition windows that speify a delay that is suffiient to return a orret and aurate diagnosis. Keywords: Diagnosis, Disrete-Event Systems, Inremental Diagnosis 1. INTRODUCTION Many man-made systems require proper supervision to detet the ourrene of failures, in order to take appropriate ations and to reover to an aeptable state. This task, known as diagnosis, an be performed based on expert knowledge, but the most robust tehniques use model-based reasoning. In this ontext, disrete-event systems often offer a satisfying level of abstration, i.e. a good trade-off between omplexity and auray. Model-based diagnosis of disrete-event systems attrated a lot of researh effort over the last two deades (Sampath et al. [1995], Lamperti and Zanella [2003], Fabre et al. [2005] to ite a few). The model of the system ontains information that is relevant for diagnosis but that does not diretly interest the agent in harge of the supervision. For instane, the diagnosis engine, also alled diagnoser in this paper, may have to monitor the value of a partiular state variable to determine the ourrene of a failure, while the agent is interested only by all possible ourrenes of failures and definitely not by the evolution of this speifi variable assignment over the time. A diagnoser must be able to disregard these time- and memory-onsuming details and only onsider the relevant high-level information. Furthermore in some ontexts, several diagnoses are onsistent with the observations, but not all these diagnoses are required. A preferene riterion exists on these diagnoses, based e.g. on the probability of the diagnosis or the level of gravity of the diagnosis. In this ontext, any deision based on the diagnosis will only onsider the preferred diagnosis hypothesis, and an effiient proedure only needs to return this hypothesis. This paper makes two ontributions based on these onsiderations. The first ontribution is the haraterisation of nonexhaustive diagnosis engine. Suh a diagnoser exhibits the following features: the engine is able to determine whether a speified lass of behaviours ourred and an exhibit one suh behaviour onsistent with the observations if existing. A downgrade to a non-exhaustive engine an signifiantly improve the effiieny of a diagnosis algorithm sine not all the diagnoses are required. On-line diagnosis is the problem of diagnosing the system while it is running, by updating the diagnosis regularly. Though required by most real-world systems, on-line diagnosis is not well-studied. Notable exeptions inlude the work of Penolé and Cordier [2005], Grastien et al. [2005], Lamperti and Zanella [2007], Torta and Torasso [2007], and Shumann et al. [2007]. A well-known harateristi that makes on-line diagnosis diffiult is the temporal unertainties on the observations: when a delay is required to transmit the observations, it gets hard to determine the list of observations that were emitted at a given date. In this paper, we identify an orthogonal harateristi that makes the on-line diagnosis non trivial for some diagnosers. Thus the seond ontribution is the investigation of the on-line diagnosis using a non-exhaustive diagnosis engine. As opposed to exhaustive diagnosers, suh a diagnoser needs in general to restart from srath every time new observations are provided. As the number of observations grows, this proedure will eventually fail to return the diagnosis in reasonable time. We want to bound the omplexity of updating the diagnosis in order to allow a theoretially never-ending supervision. The idea behind this ontribution is to assume that the behaviour omputed until some date in the past is established, i.e. that it is known for sure. We run the diagnosis starting from the state reahed at the end of this established behaviour, and onatenate this new behaviour to the established one. The issue here is to make sure that establishing the behaviour is not harmful to ompleteness. A system may indeed generate a behaviour that annot be preisely and immediately diagnosed by an external observer. As the behaviour goes on, the system generates more observations that help disambiguate the original

2 behaviour (although additional ambiguities an arise regarding the more reent parts of the behaviour). There is usually a delay after whih new observations are no longer useful either beause the ambiguity has already been leared or beause it an no longer be leared. We propose to establish the behaviour that ourred before this delay. Sine we onsider that no more ontraditory information an be reeived, this approah should be orret, provided that the delay is orretly omputed. The paper is strutured as follows. The next setion presents the diagnosis of disrete-event systems and nonexhaustive diagnosers. Then, we present how to perform inremental diagnosis and how to determine the predition window. Experiments are presented to validate this approah. Finally, we disuss related works and possible extensions. 2. NON-EXHAUSTIVE DIAGNOSIS This setion desribes the disrete-event system (DES), the diagnosis of DES, and non-exhaustive diagnosis engines. 2.1 Diagnosis of Disrete-Event System A disrete-event system is basially a finite-state mahine with partially observable transitions. Definition 1. (Disrete-Event System). A disrete-event system is a tuple A = Q,E u,e o,t,i where Q is a finite set of states, E u is a finite set of unobservable events, E o is a finite set of observable events, T Q (E u E o ) Q is a finite set of transitions, and I Q is a finite set of initial states. A DES represents a set of behaviours modeled as paths on the DES. A path on the DES A is a sequene of onseutive transitions ρ = q 0 e 1 q1 e 2... e n qn on the system (i.e. q i 1,e i,q i T for i {1,...,n}). The system takes a path ρ starting from an initial state q 0 I and generates a sequene of j observations obs(ρ) = [o 1,...,o j ] that orresponds to the elimination of the n j unobservable events in the sequene [e 1,...,e n ]. This sequene is observed by the diagnosis engine. 1 The goal of the diagnosis engine is to reover what happened in the system aording to these observations. An agent on a DES is usually onerned with traking unaeptable faulty behaviours. The definition of suh behaviours an be elaborate (Jéron et al. [2006]), but for sake of simpliity we onsider that a subset E f E u of unobservable events are defined as faulty. A path is faulty if it ontains at least one faulty event. The goal of the diagnosis is then to determine the sequene [f 1,...,f k ] of k faulty events that orresponds to the elimination of the non faulty events (E o E u \ E f ) of the sequene of events [e 1,...,e n ]. The path that supports a diagnosis is alled an explanation of the diagnosis. Note that this work is not restrited to this definition of diagnosis. Example 1. Figure 1 presents a running example for this paper. The states are represented by irles, and the 1 This sequene may be unertain (partial order, noise, et.) see (Grastien et al. [2005], Lamperti and Zanella [2007]) for instane, but this issue is rather orthogonal to this artile. transitions by arrows. The unique initial state is 1. The observable events are a, b, and, and the unobservable events are u and the faulty event f. Given the sequene of observations obs = [b,,b,a,b], the only behaviour onsistent with obs is 1 b 2 4 u 5 b 6 a 1 b 2; the diagnosis is the empty sequene of faults ([]). However, if the sequene of observations is [,b,], three behaviours are possible: 1 3 b 4 u 5 7, 1 f 2 4 u 5 b 6 8, or 1 f 2 4 u 5 b 6 8 u 5; the two orresponding diagnosis andidates (or diagnoses) are: [] or [f]. b f b u 4 5 Fig. 1. Example of a disrete-event system. 2.2 Non-Exhaustive Diagnosers a a As seen in Example 1, the observations of the behaviour of a system an be ambiguous, i.e. it is not possible to retrieve preisely what behaviour generated these observations. In partiular, many systems are not diagnosable (Sampath et al. [1995]) whih means that the sequene of faults that atually ourred on the system annot always be preisely dedued from the sequene of observations. In this ase, several diagnoses an be returned to explain the observations. What the diagnoser should do when ambiguous diagnoses arise depends on the appliation: the agent may expet all diagnoses, all minimal diagnoses, the most probable diagnosis, the worst-ase diagnosis, et. For this purpose, we onsider a notion of preferene, suh that the expeted output of the diagnoser is the preferred diagnosis. Definition 2. (Diagnosis Preferene). The (diagnosis) preferene is an ordering relation on the set of diagnoses suh that the diagnosis is preferred to the diagnosis if. We extend the notion of preferene to paths, in the sense that if the path ρ is preferred to the path ρ (denoted ρ ρ ), then the diagnosis of ρ is preferred to the diagnosis of ρ. The preferability notion may inlude e.g. the probability of a diagnosis. Consider that the agent in harge of the system only requires the preferred diagnosis, e.g. beause the number of possible diagnoses is prohibitive and no deision an be made that satisfies all possible diagnosis. We all non-exhaustive diagnosis engine (nede) a diagnoser that returns only the preferred diagnosis. To allow the inremental diagnosis, we also require that this engine returns an explanation of the diagnosis. Definition 3. (Non-Exhaustive Diagnosis Engine). A non-exhaustive diagnosis engine is a proedure that b 6 u 7 b 8

3 returns the preferred diagnosis, along with an explanation of this diagnosis. Example 2. Through the examples of this paper, the preferred diagnosis is the most probable diagnosis, defined as the minimum ardinality diagnosis, i.e. the diagnosis that exhibits the smallest number of faulty events. In Example 1, for the sequene of observations [,b,], the nede will only return the empty diagnosis [] with the assoiated explanation 1 3 b 4 u 5 7. In many irumstanes, a non-exhaustive diagnosis will be suffiient for the agent. Indeed, the agent will only onsider the preferred diagnoses. It is possible to turn an exhaustive diagnoser that returns the explanations into a nede simply by determining the preferred diagnosis and extrating one of its explanations. However, the restrition proposed in Definition 3 allows more effiient omputation as the searh spae an be pruned as soon as a first diagnosis is omputed. The only nede we are aware of in the domain of DES is the SAT-based diagnoser we proposed reently (Grastien et al. [2007]). 2 Other existing approahes prefer to ensure ompleteness. The present artile is not restrited to any nede in partiular. 3. INCREMENTAL DIAGNOSIS 3.1 Definition of Inremental Diagnosis On-line diagnosis is the problem of supervising a system that is running. It usually inludes managing the flow of observations (Penolé and Cordier [2005], Grastien et al. [2005], Lamperti and Zanella [2007]), whih is independent from our problem. Another problem assoiated with online diagnosis is that the number of observations inreases regularly, and the diagnosis annot be omputed from srath every time it is updated. This is the problem of inremental diagnosis. Definition 4. (Inremental Diagnosis). Given a disrete-event system A, given a sequene of observation obs j = [o 1,...,o j ], given a ontinuation obs j = [o 1,...,o j ] of obs j (i.e. suh that j j), the inremental diagnosis is the omputation of the diagnosis of obs j using the diagnosis of obs j. An important onept in inremental diagnosis is the notion of onsisteny with preferene. Basially, if a path ρ 1 is preferable to another path ρ 2, then the onatenation ρ 1 ρ of the two paths ρ 1 and ρ is usually preferable to the onatenation ρ 2 ρ. This strongly suggests that the omputations performed for obs j should be partially reusable for obs j. The inremental diagnosis must satisfy a omplexity requirement. This requirement states that the omplexity of updating a diagnosis only depends on the number of additional observations, and not on the total number of observations. Formally, the omplexity of the inremental diagnosis must be bounded by some omplexity funtion f(j j) and not by f(j ). 2 Although we are aware that planning-based approahes are being developed. The inremental diagnosis an be defined in a omputationally-hard yet simple-to-define manner for the exhaustive diagnosis engines. For any possible state q Q of the system reahed in the previous diagnosis after observation o j, new paths starting from q and onsistent with the sequene of observations [o j+1,...,o j ] are omputed. The sequene of faults of these paths are then onatenated to the sequenes of faults already assoiated with reahing state q. In ase the diagnosis engine is a nede, the problem is not that trivial sine only one possible state q at the end of the previous diagnosis is known. This was already pointed out in (Kurien and Nayak [2000]), but we illustrate it here with Example 3. Example 3. Reall Example 1 with the observations [,b,]. The diagnoses were [] with urrent state 7, or [f] with urrent state 5 or 8. Consider the additional observations [a,,b]. The path ending in state 7 an be extended by 7 a 1 3 b 4, 7 a 1 3 b 4 u 5, or 7 a 1 f 2 4 u 5 b 6, leading to inremented diagnoses [] or [f]. The paths from states 5 and 8 an also be extended leading to diagnoses [f] or [f,f]. Consider now that the additional observations are not [a,,b] but [,b]. The path ending in state 7 annot be extended, while the paths ending in state 5 or state 8 an be extended, leading to the diagnosis [f]. In ase the diagnoser is non-exhaustive, it only returned the path ending in state 7. The proedure presented above fails to ompute a diagnosis. As shown in the Example 3, the proedure may return no diagnosis if the diagnosis is performed by a nede. This is the worst ase senario: in a slightly less harmful senario (whih annot be reprodued in the partiular example of this artile), the proedure returns a diagnosis that is not the preferred one. Basially, the inremented diagnosis ρ is preferred to ρ, but ρ is returned beause the prefix of ρ was preferred to the prefix of ρ. It is easy to determine when no diagnosis is found, and a baktraking tehnique an then be applied. However, we want to limit the baktraking so as to not violate the omplexity requirement. Furthermore, the less harmful senario is usually very hard to identify without a total baktraking, whih is definitely impossible. Kurien and Nayak [2000] proposed to abstrat the problem for allowing the inremental proedure. We present a different approah for this problem. 3.2 Inremental Diagnosis with nede We first illustrate the priniple of our approah through Example 4. Example 4. Bak to Example 3 with the inremental observations [,b], the main ambiguity here is the following: when the system is in state 1 (at the beginning or after the ourrene of a) and it generates the observable event, did the system go through state 3 (without a fault) or state 2 (with a fault)? This ambiguity remains as long as the system generates a sequene of (,b) n. If the system generates two bs or two s in a row, the ambiguity disappears. If it generates a, then the state is reset to 1 and the ambiguity an no longer be solved. Consider now that,

4 independently from the path leading to the state 5, the probability of triggering b in this state is the same as that of triggering or a. Then, the probability of generating (,b) m dereases exponentially with m (< 3 m ). 3 It is reasonable to onsider that for a value of m large enough (say m = 50), this probability gets negligible. Thus, if there is an ambiguity about the ourrene of a failure at a given time, after n = 2 m observations, this ambiguity will either (1) be impossible to ever solve beause of the ourrene of a, and the best is then to onsider the preferred possibility, i.e. no failure ourred, or (2) be dispelled by the ourrene of a pair of bs or s. Therefore, a property of the system is that the behaviour before the last n observations an be safely established, and that no baktrak should be required further than this state. This property is not a feature of this partiular example, but it is a feature of any system though the value n may be diffiult to determine. When a system generates an ambiguous behaviour, the next observations may help to solve or determine the most probable path (aording to the preferred diagnosis). The observations immediately after the date of this ambiguity are likely to provide the more information. After a longer delay, the information provided by the observations about this partiular ambiguity weakens for two reasons: (1) beause the ambiguous behaviours an no longer be distinguished, or (2) beause the ambiguity was already leared by the previous observations. We propose a diagnosis tehnique based on this property. When the behaviour of the system is omputed at a given time, the property makes reliable the first part of this behaviour. Thus, we onsider that this part is the prefix of what really happened on the system. The last part is not established yet at this stage, but will be when new observations are available. Thanks to this tehnique, the first part of the behaviour does not need to be omputed again when new observations are gathered. On the ontrary, the last part of the diagnosis is omputed again, and a different explanation (and a different diagnosis) may be generated for this part. This tehnique is illustrated in Algorithm 1, whih requires the following three inputs: (1) Predition window µ, whih indiates how many observations are required before a diagnosis is established. (2) Non-exhaustive diagnosis engine Ω, whih takes as input a set of initial states 4 and a sequene of observations, and returns a preferred explanation. (3) An observation flow OF, whih provides the ordered sequene of observations on the system. This flow does not return all the observations at one. 3 This upper-bound onsiders only the transitions on state 5; the other possible transitions on states 6, 7, and 8 should be onsidered for a more aurate value. 4 A set of states is required beause of diagnosis resets as explained later. The established explanation of the observations is stored in ρ and its final state is stored in S 0. The path ρ u represents the urrent explanation of all the observations; it may be inonsistent with the final diagnosis; it an be returned any time if the proedure is on-line (see setion 3.3). obs ontains the list of observations that are not yet explained in ρ; its size will generally be bounded by µ. Whenever new observations newobs are available, the following proedure takes plae: the new observations are added to the observations not explained and a path ρ is omputed from a state of S 0 ; the if statement is explained later; both paths ρ u and ρ are updated, and the last µ observations are kept; finally the set of states S 0 is updated. The algorithm does not return the diagnosis but a path from whih the diagnosis an be trivially omputed. Algorithm 1 Inremental Diagnosis with a nede. 1: input predition window µ 2: input nede Ω 3: input observation flow OF 4: S 0 := I 5: obs := [] 6: ρ := 7: ρ u := 8: while OF generates newobs do 9: obs := obs newobs 10: ρ := Ω(obs,S 0 ) 11: if ρ not found then 12: ρ := Ω(obs,Q) // Diagnosis reset 13: end if 14: ρ u := ρ ρ 15: ρ := ρ remove-last(ρ,µ) 16: obs := keep-last(obs, µ) 17: S 0 := {last-state(ρ)} 18: end while 19: return ρ u Suh a proedure an be seen as a baktraking tehnique. The diagnoser is allowed to baktrak until the µ previous observations, and the baktraking is limited to this position to avoid omplexity explosion. The algorithm may return an inorret diagnosis. Obviously, if the value µ is set poorly, the algorithm may return a diagnosis that is not the preferred one, in partiular if µ = 0. The system presented in Figure 1 has no minimal value for µ that makes the algorithm orret. We disuss how to determine µ in Setion 4. Sine this proedure may be inorret, it may fail to ompute a diagnosis (line 10). What shall we do in this ase? As speified preedently, the baktraking is limited until a bounded number of observations. The state of the system being lost, the proedure an be simply stopped, and return a failure message. Alternatively, we an onsider that the set of observations obs will be suffiient to reover the state of the system. Sine the urrent state is unknown, we run the algorithm from any state of Q (line 12), whih is alled a diagnosis reset. This means that the behaviour omputed is not

5 globally onsistent: the state at the beginning of the predition window abruptly jumps for no sensible reason. However, we expet the proedure to bring the supervision system bak on trak. If the supervision system is able to reover the system state, the diagnosis will be inorret around the diagnosis reset but should be orret before and after. In ase the system generates many failures, in partiular in ase of intermittent failures, this proedure should be aeptable and have a good ratio of orret fault identifiations. Obviously, the inremental algorithm should warn the human agent of this inorretness. 3.3 Extension to On-line Diagnosis This algorithm was presented in the ontext of inremental diagnosis, but not of on-line diagnosis. In on-line diagnosis, the goal is to determine what is urrently happening, as opposed to what happened some time ago. It is very diffiult to determine what is urrently happening beause only a very little information is available. The urrent behaviour is usually ambiguous. However, although exhaustive algorithms return all possible senarios, the agent generally onsiders only the preferred one. Exhaustive methods ensure monotoniity (Lamperti and Zanella [2007]), whih basially states that any diagnosis at time t is onsistent with at least one diagnosis at any time t < t; the diagnosis at time t possibly ontains more faults than the diagnosis at time t sine faults possibly ourred between times t and t. It is possible to return the explanation ρ u at any time. This explanation indiates what the urrent preferred diagnosis is. Note the suffix of this diagnosis is not established, whih means that a latter explanation after reeiving new observations may be inonsistent with the urrent one. The monotoniity is thus not ensured. However, we onsider that this is not harmful in most ases: sine the ontrol deisions on the system are usually performed by the human operator on the preferred diagnoses, the monotoniity is not a strong requirement. Besides, when the behaviour is ambiguous, deisions must still be taken. 4. DETERMINING THE PREDICTION WINDOW In this setion, we disuss how to determine the value of the predition window µ. Some systems have the property, where Algorithm 1 will always return the preferred diagnosis for value µ greater than a partiular value n. We first disuss this value. Beause most systems (in partiular the deentralised ones) atually do not exhibit suh a feature, we propose to use a large value for µ. Experiments in the next setion show how the seleted values impat on the quality of the diagnosis and the effiieny of the omputation. 4.1 Corret Predition Window Some systems have the following property: any ambiguity on their behaviour raised by an observer an be solved after a bounded number of additional observations is provided. We all these systems finitely trakable, and define the property in Definition 5. In this definition, we onsider ρ k and ρ k ρ k are paths on the system model. Furthermore, obs(ρ i ) = [o 1,...,o n,...] means that the observations generated by ρ j start with [o 1,...,o n ]. Definition 5. (Finite trakability). A disrete-event system A is finitely trakable iff: n N : ρ 1,ρ 2, obs(ρ 1 ) = obs(ρ 2 ), [o 1,...,o n ] (E o ) n, i,j : {i,j} = {1,2} ρ j, obs(ρ j) = [o 1,...,o n,...] ρ i : obs(ρ i) = obs(ρ j) ρ i ρ i ρ j ρ j. This definition means that there is a finite delay n suh that for any ambiguity (expressed by obs(ρ 1 ) = obs(ρ 2 )), and for any sequene of n observations generated after this ambiguity, it is possible to keep only one path ρ i. Indeed for any path ρ j ρ j onsistent with the observations (inluding the next unknown observations), a preferable path ρ i ρ i ρ jρ j also onsistent with these observations an be found. Given two paths ρ 1 and ρ 2, the preferred path ρ i an be different depending on the next observations [o 1,...,o n ]. There are some similarities between this property and the diagnosability property (Sampath et al. [1995]). The latter one indiates that a omplete diagnoser an always diagnose the ourrene of a fault after a bounded number of observations after the fault ourred. This is very similar to our finite trakability property espeially regarding the finite bound. However, there is no logial relation between diagnosability and finite trakability: A finitely trakable system an be non diagnosable. Indeed, a trakable diagnoser solves the ambiguity by hoosing the preferred diagnosis while a diagnosable diagnoser finds the exat one. E.g., remove the transition 5 7 in the system presented in Figure 1; then this system is finitely trakable with n = 3 but is not diagnosable: did a fault our if we observe [(,b,a) ]? A diagnosable system may be not finitely trakable. The reason is that diagnosability is tested on an exhaustive diagnoser: it may be required to keep trak of several possible paths on an unbounded delay before the ourrene of the failure. Consider the system presented in Figure 2. Clearly, the system is diagnosable beause a failure is always followed by the observable event b. However, it is not finitely trakable beause the ambiguity in the first transition (3 u 2 or 3 u 4) annot be solved in a bounded delay. a a b u u u f Fig. 2. Example of a diagnosable yet not finitely trakable disrete-event system. Distributed systems are generally not finitely trakable for the following reason. Whenever an ambiguous behaviour ours on some part of the system and given an upper bound n, another part of the system an generate (n + 1) observations unrelated to the ambiguity; this independent behaviour does not help learing the original ambiguity, thus ontraditing the existene of n.

6 4.2 Inorret Predition Window If the system is not finitely trakable, it is still possible to hoose a large enough value for µ to ensure a orret diagnosis in most ases. A larger predition window inreases the probability of a orret diagnosis. But it also has drawbaks. First the omputation is almost ertainly more expensive with a larger predition window, sine eah all to the nede is performed on a larger window. Moreover, a behaviour is established and onsidered sure only after a long delay µ, whih an be unsatisfatory for on-line diagnosis. There is a seond parameter that an influene the hoie of µ. This parameter, denoted λ and alled diagnosis window, is the number of new observations at eah new step, i.e. the size of newobs in Algorithm 1. If the parameter λ is small, the diagnosis is updated more often. However, a large value of λ may make the diagnosis simpler to solve beause the nede is alled less often. We onduted a series of experiments on this topi. 5. EXPERIMENTS For this study, we reuse the benhmark we proposed in (Grastien et al. [2007]). The system ontains 20 omponents with 6 states eah. This makes the number of states reah In many diagnosis problems, some states are no longer reahable after some time, whih makes the inremental diagnosis simpler as the size of the searh spae is diminished. This is not the ase in this example sine it is always possible to return to the initial state. The problem is to find one minimal ardinality diagnosis on a sequene of 1,000 totally-ordered observations. 5 The nede is the implementation of the proedure presented in (Grastien et al. [2007]) using one of the state-of-the-art SAT solvers, MiniSAT v2.0 (Eén and Sörensson [2003]). 6 The experiments were onduted on a 1.73 GHz Pentium 4 omputer. The diagnosis problem is translated into the following problem: Finding a path on the system onsistent with the observations with the optimality riterion that the number of faults in the path must be minimal. The path-finding problem is in turn translated into a SAT problem as in the lassial SAT planning (Kautz and Selman [1996]), and the searh is performed for an inremental number of faults starting from 0. To test the existene of a path (line 11 in Algorithm 1), the path-finding is first performed without onstraint on the number of faults. We studied the performanes of the diagnoser with two parameters: µ (size of the predition window) and λ (number of observations added at eah iteration). The inremental SAT feature (Hooker [1993]) was used to speed-up the solving of similar SAT problems within the same pair of parameters but is out of the sope of this artile. 5 Althought several different diagnosis with the same ardinality may be generated, we onsider only one diagnosis. 6 This SAT solver is available from or Table 1. Runtime in seonds. λ µ The runtime to inrementally solve the diagnosis problem is given in Table 1. As one ould expet, a larger predition window inreases the runtime. A small diagnosis window also has a negative impat on the time, as the number of inremental diagnosis problems solved inreases (this number is roughly the total number of observations divided by λ). Note however that a large diagnosis window also inreases the runtime espeially for small predition windows beause the inremental diagnosis is then performed on larger windows. We tried to solve the diagnosis problem in a non-inremental way with the algorithm used in this experiment; however, no solution was found within two hours (7,200 seonds). Table 2. Number of diagnosis resets. λ µ The number of diagnosis resets during the omputation is given in Table 2. With a predition window of more than 40, the number of resets is null. On this partiular system, a good value for µ is probably 50 or more. Another interesting result is that small diagnosis windows inrease the number of resets beause they inrease the number of inremental problems. Table 3. Number of false negatives (out of 108). λ µ We now propose to evaluate the quality of the diagnosis. We study whether the diagnosis algorithm was able to identify eah fault and the time they ourred. The senario used for this evaluation ontains 108 faults; the ourrene date within the flow of observations is known for eah fault. Using only the observations, it is impossible to determine exatly at what time a fault ourred: there is a varying delay between the ourrene of the fault and the reeption of the relevant observations. We onsidered that the diagnoser identified orretly a fault if it suggested the ourrene of this fault at a date within the flow of observations that differs by no more than 25 observations. The number of missed faults (false negative) is given in Table 3. The faults are well identified when the predition is large enough. Interestingly, with small predition windows, the algorithm performs better for the large diagnosis windows than for the small ones. The reason is that a large diagnosis windows ats as a predition window for the events that

7 ourred in the beginning of the diagnosis window. The false positives follow a similar tendeny. These experiments learly show that a large predition window an lead to a orret inremental diagnosis. This tehnique an be used to perform diagnosis in an inremental manner or in an on-line ontext. The experiments also show that the two parameters together with the nede have an impat on the omputation time whih must be onsidered. 6. RELATED WORK Diagnosis is often onerned with the on-line monitoring of system, beause on-line detetion of faults enables an agent to irumvent unfortunate onsequenes. Yet online diagnosis and in partiular the issue of inremental diagnosis, are often omitted in the literature. The Sampath Diagnoser (Sampath et al. [1995]) allows inremental diagnosis with great effiieny. The system model is ompiled into a deterministi finite state mahine whose transitions are labeled by observable events. Given a sequene of observations, it suffies to follow the single path on the diagnoser and to read the diagnosis labeling the state reahed thereby. The limitations of this method are well-known. First although being omputed off-line, this approah does not sale up at all, sine the size of the diagnoser is exponential in the size of the system model, whih is in turn exponential in the number of omponents. To some extend, this issue an be prevented by the use of speialised and loal diagnosers (Penolé et al. [2006]) but with the loss of global view and generally the loss of auray. The seond issue is that this method was defined for totally-ordered sequenes of observations, and the extension to unertain observations was not studied and probably adds another omplexity. Finally the diagnoser works as a blak-box and returns no explanation; an explanation is sometimes expeted by the (human) agent in harge of the system. More reently, some frameworks were developed for the inremental diagnosis (Penolé and Cordier [2005], Grastien et al. [2005], Lamperti and Zanella [2007]). The diagnosis is redued to finding all the paths on the model onsistent with the observations. Sine all the paths are omputed, the issue of inremental diagnosis is not that some paths may be missed but how to slie the flow of observations in ase of delays. In (Penolé and Cordier [2005]), the effiieny is ensured by the use of a deentralised approah together with partial-order redution tehniques. In (Cordier and Grastien [2006]), the momentary independenies are used to avoid global and omplex omputations. Symboli methods have also been proposed for the diagnosis of disrete-event systems. In (Shumann et al. [2007]), the unfolding of the model onsistently with the observations is performed with BDDs. This approah is omplete and the use of symboli tools greatly simplifies the proedure. What does the diagnoser need to keep from previous and urrent omputations in inremental diagnosis? The Fault Detetion and Identifiation (FDI) ommunity proposed the use of Kalman filters (Kalman [1960]), whih only requires the estimated state from the previous time step. 7. CONCLUSION AND FUTURE WORK We introdued the notion of non-exhaustive algorithm for the diagnosis of disrete-event systems. The harateristi of suh algorithms is that they do not ompute all the diagnoses but only the preferred diagnosis. This restrition simplifies the problem as the number of possible diagnoses and their explanations is usually exponential in the number of omponents. Yet, this restrition is aeptable as the (human) agent is usually only interested by the preferred diagnosis. Inremental diagnosis is the problem of updating the diagnosis when new observations are reeived. Beause the urrently preferred diagnosis may ontradit latter observations, a orret inremental algorithm usually needs to ompute all the diagnoses, or start from srath everytime new observations are available. Our proposal relies on the following remark: when a diagnosis is omputed, the first part is more reliable than the last part beause it is supported by more future observations. When omputing a diagnosis, we thus propose to establish the first part, and let the last part, alled predition window, free; this latter part is established only when more observations are available. We have shown that our algorithm does not ensure ompleteness or even onsisteny in general. However, experiments have demonstrated that for some parameters, the diagnosis returned by this proedure is orret. We see several extensions to the presented work. We onsidered the nede returns only the preferred diagnosis. Extensions inlude returning the k preferred diagnoses or even all the diagnoses (but not neessarily all the paths). It is also possible to inrease the number of paths returned by the nede. For instane, the intrakable problem in Figure 2 beomes trakable if two paths are monitored sine the ambiguity of the transitions 3 u 2 and 3 u 4 no longer needs to be solved. The definition of finite trakability indiates that after a number of observations, it suffies to establish a single path; it an be extended for k paths. These problems inlude formally defining when two paths are onsidered different. Typially, it is not useful to store a path, plus a opy of this path followed by unobservable events, or an equivalent version with respet to onurreny. Our work an be used for any non-exhaustive algorithm. Whihever algorithm is used, one onern should be the reuse of past omputations: the suffix of the path omputed at time t is not established, and this suffix will be omputed again when new observations are available. It should be possible to reyle several onlusions that arose from the previous omputations. This should be investigated more losely. Finally, we used a temporal deomposition to simplify a diagnosis problem. We want to investigate the spatial deomposition as well. For instane, it may be possible to diagnose a subsystem, establish the diagnosis of a part (the ore) of this subsystem, and inrementally onsider a bigger subsystem. After the ore behaviour is set, the diagnosis of the latter subsystem is easier.

8 ACKNOWLEDGEMENT We want to thank the reviewers for the very useful omments they provided during the reviewing proess. This researh was supported by NICTA. NICTA is funded by the Australian Government as represented by the Department of Broadband, Communiations and the Digital Eonomy and the Australian Researh Counil through the ICT Centre of Exellene program. REFERENCES M.-O. Cordier and A. Grastien. Exploiting independene in a deentralised and inremental approah of diagnosis. In Pro. of Seventeenth International Workshop on Priniples of Diagnosis (DX 06), N. Eén and N. Sörensson. An extensible SAT-solver. In Pro. of Sixth International Conferene on Theory and Appliations of Satisfiability Testing (SAT-03), É. Fabre, Al. Benveniste, St. Haar, and Cl. Jard. Distributed monitoring of onurrent and asynhronous systems. Journal of Disrete Event Systems, pages 33 84, Speial issue. A. Grastien, M.-O. Cordier, and Ch. Largouët. Inremental diagnosis of disrete-event systems. In Pro. of Sixteenth International Workshop on Priniples of Diagnosis (DX-05), pages , A. Grastien, Anbulagan, J. Rintanen, and E. Kelareva. Diagnosis of disrete-event systems using satisfiability algorithms. In Pro. of Twenty-Seond AAAI Conferene on Artifiial Intelligene (AAAI-07), pages AAAI Press, J. Hooker. Solving the inremental satisfiability problem. Journal of Logi Programming, 15(1-2): , Th. Jéron, H. Marhand, S. Pinhinat, and M.-O. Cordier. Supervision patterns in disrete-event systems diagnosis. In Pro. of Seventeenth International Workshop on Priniples of Diagnosis (DX-06), pages , R. Kalman. A new approah to linear filtering and predition problems. Transations of the ASME Journal of Basi Engineering, 82(Series D):35 45, H. Kautz and B. Selman. Pushing the envelope: planning, propositional logi, and stohasti searh. In Pro. of Thirteenth National Conferene on Artifiial Intelligene (AAAI-96) and the Eighth Innovative Appliations of Artifiial Intelligene Conferene (IAAI- 96), pages AAAI Press., J. Kurien and P. Nayak. Bak to the future for onsistenybased trajetory traking. In Pro. of the Seventeenth National Conferene on Artifiial Intelligene (AAAI- 00) and Twelfth Conferene on Innovative Appliations of Artifiial Intelligene (IAAI-00), pages AAAI Press, G. Lamperti and M. Zanella. Diagnosis of Ative Systems. Kluwer Aademi Publishers, G. Lamperti and M. Zanella. On monotoni monitoring of disrete-event systems. In Pro. of Eighteenth International Workshop on Priniples of Diagnosis (DX-07), Y. Penolé and M.-O. Cordier. A formal framework for the deentralised diagnosis of large sale disrete event systems and its appliation to teleommuniation networks. Artifiial Intelligene (AIJ), 164: , Y. Penolé, D. Kamenetsky, and A. Shumann. Towards low-ost diagnosis of omponent-based systems. In Pro of the Sixth IFAC Symposium on Fault Detetion, Supervision and Safety of Tehnial Proess (SAFEPRO- CESS), M. Sampath, R. Sengupta, St. Lafortune, K. Sinnamohideen, and D. Tenletzis. Diagnosability of disreteevent systems. IEEE Transations on Automati Control, 40(9): , A. Shumann, Y. Penolé, and S. Thiébaux. A spetrum of symboli on-line diagnosis approahes. In Pro. of Twenty-Seond AAAI Conferene on Artifiial Intelligene (AAAI-07). AAAI Press, G. Torta and P. Torasso. An on-line approah to the omputation and presentation of preferred diagnoses for dynami systems. AI Communiations, 20(2):93 116, 2007.