This discussion paper introduces a modeling technique, based on Boolean Control Networks, for assessing useful properties of Context Aware systems. Indeed, Context Aware systems are becoming useful components in autonomic and monitoring applications and the assessment of their properties is an important step towards reliable implementation, especially in safety-critical applications.
mechanical systems.
Stability is a traditional topic in control systems theory, and in [8] the authors explore “... the extent to which control theory can provide an architectural and analytic foundation for building self-managing systems ...”. However, control systems are typically described by means of differential equations and by Matrix Algebra, while C-A systems are digital and mostly based on Logics. Inspired by biological systems, Boolean Networks (BN) and Boolean Control Networks (BCN) have been introduced, their representative equations have been converted into an equivalent algebraic form, and solutions to problems such as controllability, observability, stability and reconstructibility have been proposed [3, 10, 12].
In Section 2 the case study is outlined. In Section 3, we show how, by making use of the algebraic approach to Boolean Control Networks, it is possible to formalize, by means of a C-A system, a decision process to avoid hydrogeological disasters, as the one that happened in Abruzzo, where a hotel was hit by an avalanche [16], as well as false alarms. We can then assess the existence of globally attractive equilibrium points of the overall system, corresponding to constant inputs, and investigate some interesting structural properties such as observability and reconstructibility that formalize system features of great practical relevance. Moreover, the possibility of identifying some kinds of faults in the inputs, that could result in errors in the alarm system, is examined. Sections 4 and 5 respectively describe the results of the analysis and possible future developments.
To conclude, we think that cooperation between C-A computing and Control Systems theory can be fruitful to fill in the model gap. 2
Figure 1 shows the architecture of a C-A system [2, 7] conceived for monitoring possible snow/ground slides. Signals, coming from physical sensors on the ground, are evaluated in the context of the seismic and meteorological information provided by Web Services RSSs - which can suggest immediate danger - in order to issue alarms. The integration of data from the Context state with the actual physical data that are input to the functional system allows the design of a flexible and effective prevention information system which, as an example, can distinguish between the vibration caused by the detachment of a snow mass and the one caused by a skier or a deer occasionally passing near a sensor.
In the monitoring system some states produce outputs that can affect the environment, e.g. by possibly activating an alarm siren. In case of an alarm, the time to evacuate a hotel can be in the order of hours, while the seismic and meteorological conditions can change faster. The ultimate goal of this study is to be sure that, in dangerous situations, an alarm signal is issued, but at the same time that frequent changes in the Context State do not induce an oscillatory behavior of the alarm system and the resulting movement of people out and back into the hotel; the designer of the C-A system must ensure that no action is started before the preceding one is terminated. In this paper we use a simple open-loop model; however, in more complex C-A self managing applications, the system output can affect the context itself.
Our aim is therefore: – To describe a C-A system, as in Figure 1, by means of a logic State Space model: web services provide input messages to the Context and sensors provide input signals to the Monitoring System; the Context state is a further input to the latter. – To use BCNs and System Theory tools to asses properties of a C-A system such as: the existence of globally stable equilibrium points and the absence of oscillatory behaviors (limit cycles) under constant inputs; the reconstructibility of the system and the detection of some faults affecting the C-A system inputs.
terrain temp. snow height accelerometer
SYSTEM
alarm
Although the following analysis refers to the case study, the proposed approach is quite general and can be applied whenever properties should be proved in C-A dynamic systems. 3
In [16] a short introduction to the algebraic representation of Boolean Control Networks can be found; in the following we introduce the BCN model of our example case. 3.1
Context Input Variables The values of the Context Input Variables are supplied by RSS messages coming from National Web Services, such as Meteorological forecasts and the National Geophysics Institute. Even if the message frequency can be variable, for ease of modeling, we suppose that the system samples them with the same constant frequency. Moreover, we suppose that a real danger situation can be expected only when a defined number - in our example at least four - of consecutive earthquake announcements are sent together with a snow forecast.
We assume:
INGVfearthquake; :earthquakeg := U1
METEOfsnow; :snowg :=U2 Therefore, by expressing the context input variables in terms of canonical vectors, we get:
Context States As previously mentioned, we assume that simultaneous snow and earthquake alerts can be regarded as reliable only if not isolated, namely if a sufficiently high number of consecutive (simultaneous) alerts are sent (and received). For this reason we introduce as Context State a counter: COUNTERf0; 1; 2; 3; > 3g =: C In the representation by means of canonical vectors, the counter is denoted by c and d 1; d52; d53; d54; d55g, depending on how many consecutive simultakes values in D5 := f 5 taneous alerts for snow and earthquake have been received. Specifically, for i = 1; 2; 3; 4, we have that c(t) = d5i if the counter is i 1 at time t, while c(t) = d55 if the counter is d 1; d52; d53; d54g and the context at least 4 at time t. If the counter at time t has a value in f 5 input is u(t) = d41 (another simultaneous snow and earthquake alert comes in), then the counter value at t + 1 is increased by 1. If c(t) = d55 and u(t) = d41, then c(t + 1) = d55, while in every other case the counter is reset to c(t + 1) = d 1. 5 Therefore, the counter updates according to the following model (BCN): c(t +1) = Cnu(t)nc(t), where n denotes the semi-tensor product, C = C1 C2 C3 C4 2 20, and L5 20, the set of logic matrices of size 5 C1 = C n d41 = [d52 d53 d54 d55 d 5]
5 C2 = C n d42 = [d51 d51 d51 d51 d51] C3 = C n d43 = C2 C4 = C n d44 = C2 Obviously, the number of consecutive alert situations is a design variable which allows to set stricter - if increased - or loser - if lowered - requirements on the alarm system. Context Output Introduce the Context model output
CONTEXT-ALERTfdanger; quietg := Uc Since we assume that the CONTEXT-ALERT variable Uc is danger (the corresponding canonical vector uc takes the value d21) if and only if there have been at least four simultaneous snow and earthquake alerts, the variable uc is updated following the algebraic rule: uc(t) = Hc n c(t) where Hc = d22 d22 d22 d22 d21 2 L2 5
This is one possible solution, but it may be regarded as somewhat dangerous: if the counter is erroneously reset, then the alert ends up being significantly delayed. An alternative solution could be that of simply decreasing the counter by one if u(t) 6= d41 (or if u(t) = d4i ; i = 2; 3). This solution would be more robust to possible disturbances occasionally affecting the context inputs. C=δ51 C=δ55 δ41
C=δ52
δ41
Functional System Input Variables We assume that, in addition to the CONTEXTALERT variable, the Functional System model receives three more input signals from local sensors, so that, at the end, the Input Vector v(t) 2 D16 is composed by the following variables determining the system dynamics: terrain temperature fhigh; lowg := V1 snow height fhigh; lowg := V2 accelerometer fhigh; lowg := V3 context-alert fdanger; quietg := V4 = Uc Functional System State The CONTEXT-ALERT input is already the result of repeated and consecutive notifications of alert situations, so we may regard it as a variable that is hardly affected by false alarms. Also, we assume that a disturbance that can instantaneously modify the terrain temperature or the snow height, unless connected with an earthquake, is statistically not very realistic. On the other hand, the accelerometer may be a source of false alarms since it can detect a “high” signal for reasons that are not related to earthquakes: for instance, animals running close to the accelerometer. As a result, we regard as reliable only repeated alerts coming from the accelerometer. So, as in the case of simultaneous snow and earthquake warnings, we require that the accelerometer has been “high” for two consecutive time instants (before t) in order to regard the information given by the accelerometer as a real warning. Therefore, we introduce the state variable:
ACC-COUNTERf0; 1; > 1g The canonical vector representing the accelerometer counter is denoted by a and d 1; d32; d33g. Specifically, a(t) = d31 if the counter is 0 at time takes values in D3 = f 3 t; a(t) = d32 if the counter is 1 at time t; and a(t) = d33 if the counter is at least 2 at time t. If the counter at time t has a value in fd31; d32g and the accelerometer vector is v3(t) = d21, then the counter value at t + 1 is increased by 1. If a(t) = d33 and v3(t) = d 1, 2 then a(t + 1) = d 3, while when v3(t) = d22 the counter is moved back to a(t + 1) = d 1.
3 3 Therefore, the accelerometer counter updates according to the following BCN: a(t + 1) = A n v3(t) n a(t), where A = A1 A2 2 L3 6, and A1 = A n d21 = [d32 d33 d 3]
3 A2 = A n d22 = [d31 d31 d31] Functional System Output We assume that the Functional System output can take three values: ALARM ftemp high; snow high; acc counter > 1; acc high; ctx dangerg ATTENTION ftemp low; snow high; acc counter ; acc ; ctx OR temp high; snow low; acc counter ; acc ; ctx OR temp high; snow high; acc counter low; acc ; ctx OR temp high; snow high; acc counter ; acc low; ctx OR temp high; snow high; acc counter ; acc ; ctx quietg NORMAL ftemp low; snow low; acc counter ; acc ; ctx g Note that the alarm is sent out only when “acc counter > 1” and “acc-high”. This means that at the time t the alarm signal is issued if the accelerometer has detected some movement for at least three consecutive time instants t ; t 1 and t 2. Of course, as for the context-alert variable, the choice of how long we want to wait before issuing the alarm signal is a design parameter that balances conflicting requirements: security on the one hand and the need to avoid false alarms on the other.
The functional system output is denoted by m and takes values in D3. Based on the previous description of the three possible output values, it follows that the output vector is generated based on the state a(t) and the input v(t) according to the following model: m(t) = M n v(t) n a(t), where M = M1 M2 : : : M16 2 L6 16, and M1 = M n d116 = [d32 d32 d 1]
3 M2 = M n d126 = [d32 d32 d 2] Mi = M n d1i6 = M2; for3 i = 3; : : : ; 12 M13 = M n d1163 = [d33 d33 d 3] Mi = M n d1i6 = M13; for3 i = 14; 15; 16
So, overall, the system model is a BCN obtained by connecting the BCN describing
the context and the BCN describing the functional model, and hence it is described by
the following equations:
c(t + 1) = C n u(t) n c(t)
a(t + 1) = A n v3(t) n a(t)
v4(t) = Hc n c(t)
m(t) = M n v(t) n a(t):
(
In [16] we present a detailed description of the kind of reasoning that can be made using the model developed in the previous sections. Here we only mention the main results, referring to the original paper for a full treatment.
– We use definitions and methods as in [4, 5, 11] to find equilibrium points of BCNs
corresponding to constant inputs. The analysis shows that no limit cycles can
appear in the system, and hence no contradicting alarm messages can be delivered by
it.
– Observability does not seem to be a fundamental system property for the
hydrogeological model, since identifying the initial state of the system during some
observation interval does not bring any practical advantage. On the other hand,
reconstructibility is a more relevant property to investigate: by identifying the current
system state, say x(T ), from the observation of the input and the output in some
time interval [0; T ], one may anticipate whether an alert signal will lead to an
alarm signal at the next time instant or not and hence be ready to run away or to
provide support. The analysis shows that the hydrogeological system described by
(
In this paper we model a simple Context-aware system as a Boolean Control Network in order to use the powerful tools typical of system theory, which apply to linear analog systems, also to digital systems, whose properties are usually expressed by logical rules. The ultimate goal is to pave the way to formally assess reliability and safety properties of self adapting safety critical systems. The existence of globally attractive equilibrium points under constant input and the reconstructibility of the system have been proved, as well as the possibility of identifying some faults which could adversely affect the system output.
The main advantages of the proposed approach are on the one hand to provide a solid system theoretic framework where intuitive and practical features or goals for Contextaware systems can be properly formalised, on the other hand to offer rigorous algebraic tools to test these properties and solve those problems. The proposed solutions are easily converted into computer algorithms. We are working to apply these techniques to more complex feedback systems, where the output of the functional systems can affect in turn the state of the Context, and to enhance fault tolerance by considering possible correlations among the sensors and other system input/output devices.