Distributed Control Systems Reliability:

Consideration of Multi-agent Behavior

J. Galdun
*
,
**
, L. Tak
*
, J. Ligu
*
, J.M. Thiriet
**
and J. Sarnovsk
*

*
Department of Cybernetics and Artificial Intelligence, Koice, Slovakia

**
Laboratory GIPSA-Lab, Grenoble, France
Jan.Galdun@tuke.sk, Ladislav.Takac@tuke.sk, Jan.Ligus@tuke.sk,
Jean-Marc.Thiriet@ujf-grenoble.fr, Jan.Sarnovsky@tuke.sk


AbstractThe main goal of this paper is to present new
principles of distributed control systems (DCS) with
consideration of multi-agent behavior and its reliability aspect.
The fault-tolerant control based on networked cascade control
architecture is presented with application of intelligent multi-
agent behavior. There are different approaches how to increase
the reliability of distributed control systems. The approach
proposed in this paper profits from reconfiguration mechanism
as well as smart quasi-redundant components.
I. INTRODUCTION
he main goal of this paper is to present new principles of
Distributed Control systems (DCS) with consideration of
multi-agent behavior and its reliability aspect. The main
requirement for the control systems is to obtain a sufficient
level of quality of control (QoC). This is a primary aim in
control systems. However, very often in conventional control
systems miss the reliability aspect. Will the controlled system
accomplish its mission when a component failure will occur?
Primarily, in classic control structures using simple closed-
loop structure are not taken into account the fault-tolerant
components passive or active redundancy [13]. However, to
obtain a guaranty of the sufficient reliability level of the
control system it is needed to look for a suitable control
structure as well as smart components which will accomplish
the requirements for better dependability parameters in
comparison to a reference basic control structure.
The question of reliability is more important when networks
are used for transmission of required values among control
system components as sensors, controllers and actuators thus
in case of DCS or networked control systems (further only
NCS). There are new phenomena which appear such as
random delays, data losses, asynchronisms, problems of
components initialization [12] which have influence on the
reliability of the NCS.
A. Introduction to DCS
DCS is a system composed of components which are
interconnected by communication network. In case of DCS
with smart components, the subsystems are able to cooperate
among themselves as well as recognize system failure states.
Thus system where behavior has features appeared in multi-
agent systems. In general model DCS consists of four levels
(partially shown in Figure 1.) which are as follows:
a. technological level
b. supervisory level
c. information level
d. management level

Technological level is represented by a controllers, sensors
and specific component of system. All of these components
are connected in several technological networks.
Supervisory level is separated level of DCS. Main function
of this level is interaction between operators and technological
process on-line with real conditions.
Information level contains information of technological
process saved in huge database system.
Management level includes tools for OLAP (online analyse
processing) which provide final data for top management. This
level includes multidimensional databases, powerful tools for
online analyse data processing of large volume of wide-spread
data, data warehouses and so on.

The architecture (abovementioned) of DCS gives
possibilities to extend intelligence into lower levels of DCS
[1].
1. First principle in DCS design is called the principle of
direct communication of element and says about the structure
of DCS which should be designed by way, where PLC
(generally technological level) provides direct communication
with elements on higher levels.
2. Gateway principle in supervisory level of DCS. This
principle is an extension of the first principle, where
connection between technological and supervisory levels is
direct, but if supervisory level is large-scaled (large number of
visualization stations) it is efficient to use gateway (Figure 1.)
communication server (gateway).
3. Archivation principle of DCS means using an archivation
real-time process database server in supervisory level (see
technological DB-gateway in figure 1).
4. Component architecture principle. Presently, not only
control systems are distributed, but Graphical User Interfaces
(GUIs) are distributed as well. GUI reveals on every level of
DCS (even LCD display on the intelligent sensor). Component
architecture is based on independent components which can be
easy inserted into GUI application according to the customers
requirements and not on general visualization software
packages. Advantages of this approach are low memory
consumption and lower prices.
T
978-1-4244-2106-0/08/$25.00 2008 IEEE. 157



Figure 1. Communication gateway in DCS

B. Multi-agent systems and theirs behavior
The multi-agent systems are the new structure of
decentralized control system, with special attributes like
autonomy, an adaptivity and communication. The multi-agent
system consists of many individual agents, which
communicated among themselves. For example, the
components of the DCS or networked control system. There is
not general valid answer for the question: What is agent?
There are many different definitions of this term.
In [2], [3] there are mentioned two different agent types the
weak and strong agent. The definition of weak the agent is:
Hardware or software system, which fulfill following
conditions:
- Autonomity agent working without direct human
intervention or another intervention.
- Social skills agent interaction with another agent or
a human by special communication language.
- Reactivity agent influents its environments (the
environment may be represented by really world,
internet, users with special visual interface etc.).
- Pro-activity work of the agent is not simple respond
to environment conditions.
The definition of the strong agent is:
The agent includes above mentioned condition and the agent
has special attributes which has represented mental and
emotion status like knowledge, religion, contemplation. The
agents fulfill following conditions:
- Autonomity the same like a weak agent, but the
environment could not be simply described.
- Cooperation this is the group of the social skills
that agent use for communicating with another agent
or human by a special communication language.
- Learning if agent is able to react on dynamic
undetermined environment.
By [4] agent must fulfill two of above mentioned previsions
conditions.
In case of considered DCS (Networked control system NCS)
the agent could be represented by intelligent components used
within NCS (sensors, controllers, actuators). Thus, multi agent
behaviour should appear as follows:
- Recognize the system states change of logical
structure, agents (components) failure
- Ability to apply the reconfiguration mechanism when
an agents failure is occurred

II. RESEARCH BACKGROUND
In our previous work we dealt with networked control
system [6] with implementation of different types of networks
for the control of a 4-rotor mini-drone (helicopter Figure 3.)
model. Later was examined the influence of several types of
faults of the components (sensors, etc.) in helicopters control
system [7]. With consideration of different types of networks
and faults we take a focus to reliability aspect of the
distributed control structure and its advantages which are
taken into account.
One of the advantages which is proposed by networked
control structure is shared redundancy mentioned by Wysocki,
Debouk and Nouri in [5]. This type of redundancy represents
parts of system (subsystems) which could replace another
subsystem in case of its failure. This feature is conditioned
with the same or similar function of subsystem. Another
advantage which evokes the multi-agent behavior is
considered by Guenab and others in [8] whereas they deal
with fault-tolerant control and reconfiguration strategy in
complex systems.
In the similar sense as shared redundancy [5], we use term
quasi-redundant components in networked cascade control
structure. These parts of the system are not primary redundant
because each one accomplishes some mission within the entire
system, but its functionality allows compensate the failure of
another subsystem. Further in our model we deal this
functionality in combination with cascade control structure.

III. CONTROL STRUCTURE IMPLEMENTATION
Applied control is represented by cascade control structure
(Figure 2.). As was mentioned above this structure was chosen
for its suitable application on physical system (mini-drone).
There are one primary controller for altitude control and other
secondary controllers for rotors angular velocity control.
SAMI 2008 6th International Symposium on Applied Machine Intelligence and Informatics
158

A. Cascade control
With using cascade control (CC) structure there are several
constraints. In order to application this control structure must
be fulfilled one of these conditions [9]:
- Controlled system must contain subsystem
(secondary subsystem) that directly affect to primary
system.
- The gain of the secondary subsystem (encapsulate in
actuator) is non-linear.
- The disturbance is directly measured.

Usually for secondary subsystems there is a condition of faster
dynamics than primary process. This condition must not be
fulfilled [9]. However, when dynamics of the primary process
is faster after that some modifications of conventional cascade
structure (Figure 2.) and control laws must be provided.
Primarily we suppose that the secondary subsystem has faster
dynamics than the primary system.
CM(s) CS(s)
+
_
_
+
y
2
y
1
u1 u2
FP(s) FS(s)

Figure 2. Main structure of the cascade control

As we can see from conditions of CC the system must
contain a primary system F
P
(s) and a secondary subsystem
F
S
(s) that affects directly the primary system (Figure 1). The
same structure could be applied as networked cascade control
(NCC) structure with all control components included
(sensors, controllers and actuators) connected to network
networked cascade control system (NCCS).
In cascade control structure there are inner and outer control
loops. Inner loop contains a secondary controller(s) Slave (see
Figure 3. mini-drones CC structure) and the secondary
subsystem F
S
(s) (propellers). The main function of this control
loop is to eliminate disturbances through secondary measured
state value with faster dynamics. The outer loop encapsulates
the inner loop, the primary controller (Master - CM) and the
primary process F
P
(s) (mini-drone altitude control).
Thus, using the cascade control structure has the main
objective to eliminate the influence of the disturbances on the
primary process through the secondary subsystem and in
consequence to improve the parameters of QoC. However, we
will profit from other features provided by this control
structure described in more details further.
B. Contribution of NCC structure with multi-agent
behavior for mini-drone reliability
As it was mentioned above, using networked cascade control
structure for control systems allows profit from several
advantages. In this approach there are two points of view:
- Quality of control QoC
- Reliability aspect of the networked cascade control
(NCC) structure
o Quasi-redundant parts of the controlled system
o Reconfiguration of the control system
The first aspect relates with performance parameters of the
controlled system such as time of regulation, overshooting,
etc. Using CC approach could improve these parameters. For
example, mentioned faster disturbance elimination of the
controlled system can lead to positive effect on performance
parameters [9].
The second aspect that we would like to mainly deal with
is the possibility which offer NCC structure in term of
reliability of the system. Mentioned features as system
reconfiguration as well as sharing the sources (shared
redundancy) evoke the intelligent multi-agent behavior. These
features of the multi-agent system are implemented in our
model of the mini- helicopter. Before detailed description of
the mentioned properties the laboratory mini-helicopter will be
presented. This model composes of the following parts:

TABLE I
PHYSICAL PARAMETERS OF THE MINI-DRONE LABORATORY MODEL

Mini-Helicopters part / distances Weight / size
Helicopter (excluding batteries) 320 g
Batteries 200 g
Maximum length 74 cm
Diameter of rotors 29 cm
Height 11 cm
Distance between motor and
center of gravity
20.5 cm

Sensors:
- Three magnetometers measure the intensity of the
local magnetic field.
- Three gyrometers measure angular speed of the
helicopter.
- Three accelerometers acceleration measuring,
- Four sensors for measuring the angular velocity of
each rotor.
- Six ultrasonic sensors used to measure the distance
from any obstacle and define the position of the
helicopter.
Actuators
- Four motors.
Other parts:
- Four propellers,
- Four branches arranged in a cross.
- Electronics placed in the middle of the cross.
- Others.

Detailed basic physical characteristics of the mini-
helicopter model are shown in the table 1. This table describes
weight and size of the helicopters parts and the distances
between them. Figure 1 shown abovementioned discussed real
mini-helicopter model.

SAMI 2008 6th International Symposium on Applied Machine Intelligence and Informatics
159

The NCC structure is proposed be applied for control of
mentioned 4 rotors helicopter (Figure 3.). The proposed NCC
structure for this real model is composed of one primary
controller (Master) and four secondary controllers (Slave 1-4).
The Master is designed for altitude stabilization (control)
through Slave controllers for angular velocity control of each
propeller. This control architecture could be described as two
level cascades with the same primary controller for all
secondary controllers.
The aim of the control is to stabilize coordinates of
helicopter. The generalized coordinates for the rotorcraft are:

( ) | u , , , , , z y x q = (1)

where x, y and z denote the position of the centre of mass of
the rotorcraft and angles , u and | represent Euler angles
(yaw, pitch and roll angles) which denote the orientation of the
rotorcraft. These coordinates can be divided into translational
and rotational coordinates:

( ) z y x , , = , ( ) | u q , , = (3)

The final model is obtained using Lagrangian and Euler-
Lagrange equations. The Lagrangian is:

mgz J J
m
U T T q q L rot trans
+ =
+ =
q q

T T
.
2
1
2
) , (
(4)

where trans T is the translational kinetic energy, rot T is the
rotational kinetic energy and matrix J represents the inertia
matrix. Euler-Lagrange equations with external generalized
force:

F
q
L
q
L
dt
d
=
c
c

c
c
.
(5)

With other mathematical modifications we can obtain this
model:
|
|
|
.
|

\
|

+
|
|
|
.
|

\
|
=
mg
u m 0
0
cos cos
sin cos
sin
| u
| u
u

(6)
t q q q q + = ) , ( C J

C. Shared functionality - Quasi-redundant components
In figure 3 is shown a proposed NCC structure. We can see
two types of quasi-redundant components Slave controllers
and two different networks.
Slave controllers could be used as quasi-redundant
components of the NCCS. They use the same control
algorithm (propellers angular velocity control) but with
different input data (set point, system output, etc.)
Netw ork 2
Network 1
Master
controller
Slave
controller 1
Slave
controller 4
Slave
controller 3
Slave
controller 2
Actuator 4 Actuator 3 Actuator 2 Actuator 1
Four propellers
Sensors
Pr opeller 1 Propeller 2 Propeller 3 Propeller 4

Figure 3. Mini-helicopter real model and its NCC structure

Hence, in case of failure one of them could retransmit all
required data to another one, whereas pre-programmed control
algorithm should compute the actuating value with different
input values. Thus, failed controller is replaced by another one
which start to compute actuating value for two actuators
(propellers) using different input information.
Other quasi-redundant parts of this control structure are
networks. As well as in case of controllers, one of the
networks should compensate another one after system
reconfiguration (see part III. D). Thus each queasy-redundant
component is considered as agent connected to network
whereas its intelligent behavior allows replace functionality of
another one.
Two networks are primary designed due to reduction amount
of transmitted data. However, in case of network failure all
data could be retransmitted through second one. As it was
mentioned above, the compensation of this failure could not
be realized without previous system logical reconfiguration.
Described control architecture could be applied for similar
systems. For example, this architecture could be proposed for
Steer-by-Wire control [10], [11] of two front wheels in a car.
D. Control system reconfiguration
The aim of system reconfiguration is to obtain the same or
sufficient outputs as before the failure appearance. There are
several types of system reconfiguration. Control system could
be reconfigured by changing the control laws, physical
hardware structure or logical structure.
Our aim is to define the change of the logical structure by
implementing the multi-agent behavior. In model there are two
groups of quasi-redundant intelligent components as Slave
controllers well as networks. To be able to reconfigure the
system after network failure was implemented multi-agent
behavior into the prepared model. Each component represents
agent which communicates through network. Its basic features
are as follows:
SAMI 2008 6th International Symposium on Applied Machine Intelligence and Informatics
160

- recognize own failure and inform other agents
- in case of failure of shared agent (quasi-redundant
component) another agent must replace its
functionality

Thus, when a network failure appears then the
communication ways (logical structure) must be changed and
all agents within NCCS uses only with one network. But,
hardware structure is still the same even though one of the
networks has failed.
Thus in drone control structure when one network is failed
the components (agents) recognize failure state and send all
required information trough second one. In case of slave
controllers each must be able to replace other one. Hence,
each Slave controller inform others Slaves about its state.
When failure will occurs its mission is replaced by another
one.
When controllers are considered as quasi-redundant
components is necessary take into account the sample period T
and executes time of the controller. In general the conditions
for using controllers as quasi-redundant components are as
follows:
- The quasi-redundant controllers should encapsulate
all necessary algorithms whose could be replaced
- Sum of the all algorithm execute time should not be
grater than sample period T. Otherwise is necessary
implement a method for compensate the delay
caused by longer execute time.
In our model we suppose that execute time all of Slave
controllers is sufficient to replace other three controllers.

IV. SIMULATIONS AND RESULTS

Presented networked cascade structure (Figure 3.) was
modeled using Petri nets. This tool was chosen for its wide
possibilities of using from basic structure modeling to
intelligent multi-agent behavior modeling. Their reliability
analyses were provided using Monte Carlo simulations. The
Monte-Carlo simulations are used in this application because
formal evaluation by using conventional tools as fault trees is
very difficult to achieve because of complexity studied
structure. The system is indeed a complex one, with several
dynamics.
For the reliability evaluation of the prepared Petri nets
models created in CPN Tools, this method is suitable because
we provide multiple simulations of the modeled structure
where output of simulations is set of times of failure of the
system. For processing this set of values thus determines the
reliability of this cascade topology by using Monte Carlo
simulation, which gives very useful results. Provided
simulations are as follows:
- Drones NCC structure without reconfiguration
mechanism
- Drones NCC structure with reconfiguration in case
of network failure
- Drones NCC structure with reconfiguration in case
of Slave controller failure.
- Drones NCC structure with network and controllers
reconfiguration mechanism

As it was referred, presented control structures were
prepared for simulation using CPN Tools as Petri nets models.
Each subsystem (components as sensor controller actuator as
well as network) has implemented generator of the random
failure. This generator represents probability of the
components failure. The dependencies given by quasi-
redundant component were modeled, too.
Considered probability of failure (P
failure
) all parts of the
system (agents) is 10
-3
. In case of controllers reconfiguration
its reliability (R
c
(T)) is not changed the same in case of
network reconfiguration.
0 50 100 150 200 250
0
0.5
1
R(T) = 0.999; P
f ailure
= 10
-3
a)
time t[s]
R
e
lia
b
ilit
y

R
(
t
)


R
noR
(t)
R
wCtrNetR
(t)
0 50 100 150 200 250
0
0.5
1
time t[s]
R
e
lia
b
ilit
y

R
(
t
)
b)


R
wNetR
(t)
R
wCtrR
(t)
0 50 100 150
0
0.5
1
time t[s]
R
e
lia
b
ilit
y

R
(
t
)
c)


R
noR
(t)
R
wNetR
(t)
R
wCtrR
(t)
R
wCtrNetR
(t)

Figure 4. Reliability curves of simulated NCC structure

The result of the simulation is shown in figure 4. We can
see that proposed NCCS without implementation any
reconfiguration mechanism (R
noR
(t)) gives the worst results
(Figure 4a,c).
We could have supposed that system with network
reconfiguration will less reliable than system with Slave
controller reconfiguration because of number of quasi-
redundant components. This presumption is true and
confirmed by results. The curve R
wCtrR
(t) (Figure
4b,c)represent reliable control structure than structure which
gives final reliability curve R
wNetR
(t). With combination both
approaches we obtained the best results which are given by
curve R
wCtrNet
R(t) in Figure 4. Maximal difference between the
SAMI 2008 6th International Symposium on Applied Machine Intelligence and Informatics
161

best a nd the worst results is for time 40*T where difference
between reliability of these two structures is 11,24%.
Thus we can say that approach with intelligent multi-agent
behavior covered by smart components brings more reliable
systems.
V. CONCLUSIONS
The paper presents the advantages of implementing the
intelligent multi-agent behavior within DCS which increase
the reliability level of the distributed control system. Used
networked cascade control structure gives possibilities to
implement this behavior by proposing the quasi-redundant part
of the system.
The result shown different reliability levels of proposed
structure with simulation in different functional modes
(without / with reconfiguration, partial reconfiguration, etc.).
The influence of the structures intelligent behavior is
significant.
Despite of advantages shown in this paper it is needed to
remind that cascade control structure can be applied only for
some processes which accomplish several basic conditions
described above.
REFERENCES
[1] Ligu, J., Horanska, J., The Principle of Direct Communication in
Distributed Control System Design, EAEEIE, France, 2001.
[2] Wooldridge M., Jennings N. R., Intelligent Agents Theory and
Practice, Knowledge Engineering Review, 1995.
[3] Wooldridge M., Jennings N. R., Agent Theories Architectures and
Languages: A Survey, Intelligent Agents, Berlin, 1995.
[4] Nwana H.S., Software Agents: An Overview. Knowledge Engineering
Review, 1996.
[5] Wysocki, J., Debouk, R., Nouri, K., Shared redundancy as a means of
producing reliable mission critical systems, 2004 Annual Symposium
RAMS - Reliability and Maintainability, p.: 376-381, 2004.
[6] Galdun, J., Ghostine, R., Thiriet, J. M., Ligu, J., Sarnovsk J.,
Definition and modelling of the communication architecture for the
control of a helicopter-drone, 8th IFAC Symposium on Cost Oriented
Automation, 2007.
[7] Tanwani, A., Galdun, J., Thiriet, J-M., Lesecq, S., Gentil, S.,
Experimental Networked Embedded Mini Drone - Part I. Consideration
of Faults, European Control Conference 2007, 2007.
[8] Guenab, F., Theilliol, D., Weber, P., Zhang, Y.,M., Sauter, D., Fault-
tolerant control system design: A reconfiguration strategy based on
reliability analysis under dynamic behaviour constraints, p. : 1387-
1392, 6th IFAC Symposium on Fault Detection, 2006.
[9] Brosilow, C., Babu, J., Techniques of Model-Based Control, Chapter
10, Prentice Hall, ISBN: 978-0-13-028078-7, 2002.
[10] Leen, G., Heffernan, D., Expanding Automotive Electronic Systems,
Computer IEEE, Vol. 35, p.: 88-93, 2002.
[11] Yih, P., Gerdes, J.C., Modification of Vehicle Handling Characteristics
via Steer-by-Wire, IEEE Transactions on Control Systems Technology,
Vol. 13, p. 965-976, 2005.
[12] Liguova, J., Thiriet, J.M., Ligu, J., Barger, P., Effect of Elements
Initialization in Synchronous Network Control System to Control
Quality, RAMS/IEEE conference Annual Reliability and
Maintainability Symposium, 2004.
[13] Pimentel, J.R., Salazar, M., (2002) Dependability of Distributed Control
System Fault Tolerant Units, The 28th Annual Conference of the IEEE
Industrial Electronics Society, vol. 4, p. 3164- 3169, IECON '02, ISBN:
0-7803-7474-6
SAMI 2008 6th International Symposium on Applied Machine Intelligence and Informatics
162