This action might not be possible to undo. Are you sure you want to continue?
1, JANUARY 2009
The Modeling and Veriﬁcation of Peer-to-Peer Negotiating Multiagent Colored Petri Nets for Wide-Area Backup Protection
Xiaoyang Tong, Xiaoru Wang, Senior Member, IEEE, and Kenneth M. Hopkinson, Member, IEEE
Abstract—This paper focuses on the modeling and veriﬁcation of a peer-to-peer wide-area backup protection (WABP) system. Agents located in a number of substation Intelligent Electronic Devices (IEDs) negotiate on a peer, or equal, basis. The agent-based wide-area backup protection scheme is able to ﬁnd power-line faults and protection misoperations. A wide-area communication network based on IP technology is used to transmit shared information among the agents. A novel Agent-Oriented Peer-to-peer negotiating Colored Petri Net (AOPCPN) is proposed to implement the WABP system. The algorithms, design, and dynamic behavior of the WABP is evaluated in a simulated environment to demonstrate its beneﬁts. The article begins by presenting the generic AOPCPN architecture and its formal deﬁnition. The AOPCPN model for the WABP multiagent system is evaluated according to one algorithm, which is detailed in this article. The WABP agent’s autonomy, cooperation, parallel operation, and robustness are embodied in modules in order to ease the software engineering challenges in implementing and maintaining the agents. Three example scenarios illustrate the effectiveness of the Petri net model and its ability to dynamically respond to WABP misoperations and fault conditions. Index Terms—Colored petri nets (PNs), modeling, multiagent, peer-to-peer negotiating agents, wide-area backup protection.
I. INTRODUCTION N THE last decade, large-scale power system blackouts spread over wide areas in the U.S., Canada, and Europe have made it increasingly necessary to study power systems using a regional perspective. Traditional protection relays only make decisions based on their local inputs. In many instances, these relays are a poor ﬁt to modern interconnected power grids. A better alternative, which has been proposed in recent years, is to use wide-area backup protection (WABP) principles based on communication networks to improve power system security –. Wide-area protection information is exchanged between protection agents located in intelligent
Manuscript received May 30, 2008. Current version published December 24, 2008. The views expressed in this document are those of the authors and do not reﬂect the ofﬁcial policy or position of the U.S. Air Force, Department of Defense, or the U.S. Government. This work was supported by the National Natural Science Foundation of China (NSFC) under Project 90610026. Paper no. TPWRD-00396-2008. X. Tong and X. Wang are with the School of Electrical Engineering, Southwest Jiaotong University, Chengdu, Sichuan 610031, China (e-mail: firstname.lastname@example.org; email@example.com). K. M. Hopkinson is with the Department of Electrical and Computer Engineering, Air Force Institute of Technology, Wright-Patterson Air Force Base, OH 45433-7765 USA (e-mail: kenneth.hopkinson@aﬁt.edu). Digital Object Identiﬁer 10.1109/TPWRD.2008.2005661
electronic devices (IEDs) in order to accurately detect faults and to quickly isolate them in as small an area as possible. The accurate diagnosis of protection misoperations and circuit-breaker failures can prevent the propagation of power system disturbances. Multiagent technology forms a powerful new solution for distributed protection systems based on its autonomous, cooperative, and proactive features. There are two architectures for WABP multiagent systems: 1) based on regional central control and 2) using agents that negotiate distributed control on a peer-to-peer basis in which there are no control centers, as described by Cong et al. . The latter architecture is sometimes called a peer-to-peer architecture in computer networks because all agents have the same capabilities as all others and they cooperate rather than working in a ﬁxed hierarchy. Peer architectures are adopted in most of the WABP literature. When a fault occurs, agents perceive it and initiate negotiation with others in order to jointly correlate the event and to ﬁnd its location. This process improves on the intelligence and robustness of the protection system. All WABP agents run in parallel, which makes their behavior more complex than traditional protection systems. We need a method or tool to model WABP systems and examine their behavior, in order to properly maintain the algorithms and simulation designs of multiagent systems. The electric power and communication synchronizing simulator (EPOCHS) is a federated simulation platform that combines the PSCAD/EMTDC electromagnetic transient simulator, the PSLF electromechanical transient simulator, and the network simulator 2 (ns2) communication simulator. EPOCHS allows users to simulate scenarios where they can see how the interaction between power systems and communication networks affects the operation of their protection and control systems . If a multiagent WABP system is poorly designed, then its shortcomings can be demonstrated using the EPOCHS platform. It is important to realize though that each simulation only tests a speciﬁc situation and so, it is never possible to obtain complete validation of an algorithm from a simulation platform. Precise trigger time, and other similar details may vary between a simulated example and one in a real environment due to imprecise modeling. Petri nets (PNs) are mathematical models, which can be used to describe and analyze distributed systems. A petri net can describe the interaction of multiple agents in a WABP. As a visual modeling tool for distributed systems, PNs have some advantages over traditional methods, such as the ability to capture behavior in the form of rule sets, ﬂowcharts, and
0885-8977/$25.00 © 2008 IEEE
which combines the principles of colored PNs and AOPN. Given two places. including various measures of correctness. and message processing is not based on the current running state of the agents. . transitions. and schedule modules are combined in AOPCPN. In colored PNs. VOL. such as their concurrency. A petri net’s marking refers to Fig. For example. in –. The -dimensional colored variable is deﬁned to represent the token values in each state location and the weight vectors associated with each arc. The values in the colored PNs have obvious utility when modeling complex distributed systems. a novel agent-oriented peer-to-peer negotiating colored petri net (AOPCPN) for wide-area backup protection systems is proposed. When a transition ﬁres. Industrial control systems often lack well-deﬁned protocols for negotiation between cooperating agents or protection elements. II. and decision-making. tokens are transferred from each of the place inputs to corresponding outputs. JANUARY 2009 ﬁnite state machines . In this paper. concurrency. 1. and . environmental data. which is illustrated in Fig. the message processing unit (MPU) and the GSP’ (an auxiliary message routing unit) places have been omitted and (the message receipt place). (In petri net terminology. PNs can be used to formally examine the operation of a distributed system to evaluate its information ﬂow and basic properties. and arcs . To overcome state calamities. Generic Architecture of AOPCPN A generic architecture for AOPCPN has been created based on the G-net model of agents . the distribution of tokens throughout the places in the system. Some intelligent elements. New capabilities have been added to the message decision-making and sensor modules in the G-net framework. III. satisﬁed conditions. NO. ARCHITECTURE OF A NOVEL AGENT-ORIENTED EQUAL-NEGOTIATING COLORED PETRI NET (AOPCPN) A. merged into a single place titled The Goal and Environment places. based on the G-Net. Petri net modeling for wide-area backup protection multiagent systems has been studied in .62 IEEE TRANSACTIONS ON POWER DELIVERY.) These simpliﬁcations have a minimal impact on the petri net’s operating characteristics . cooperation. fault diagnosis. 1. a colored principle is adopted to reduce the scale of AOPCPN because of the similarities between the agents. As execution progresses in the petri net. PNs have been successfully applied in power systems in areas. a keyboard place may receive a character token when a user presses the “a” key. such as electric power markets. The results of three sample scenarios illustrate the correctness of the model and the effectiveness in capturing the WABP multiagent behavior. Some elements have been combined to simplify the analysis of the petri net. PNs can give explicit representation to static structures. and power system restoration –. PETRI NET BASICS A petri net is a mathematical model of a discrete distributed system. have been used to express the perception and collaboration of agents by Xu. The marking of a petri net is representative of its current state. Agents failures are also not considered. or markers. The autonomy. are introduced to make an agent autonomous and goal driven. the perception. Han. autonomic judgment. PNs consist of places. capturing dynamic behavior. knowledge processing. representing input or other data can appear in places according to the rules of the underlying system. sensor data. are regarded as ordinary places. and this is an important requirement for future systems . it has become increasingly difﬁcult to verify that they will behave correctly as the number of agents has increased. 1. every token has a value. the places represent the states and the enabling conditions for transitions. The transitions in the AOPCPN represent the internal activities of the agents. and robustness of wide-area backup protection agents are embodied in modules. instead of the valueless tokens used in basic PNs . 24. information ﬂows. Generic architecture of a novel agent-oriented peer-to-peer negotiating colored petri net. such as goal processing. In the analysis. such as the letter “a” in our previous keyboard example. An autonomic scheduling module has been added to improve the concurrency and proactiveness of the agent. The formal deﬁnitions and structural properties are presented. and Kumagai. . But the decision-making and sensor modules are abstract. where the environment place represents the current state of the surrounding world. The G-Net is an object-based extension of PNs. a directed arc from to indicates that a transition will lead from an output of to an input of . which is deﬁned in terms of a set of independent and loosely coupled modules in . colored and object-oriented PNs have been studied in –. and conﬂicting requirements. Message processing. The analysis of L3-liveness. tokens. The generic switch place (GSP) for message routing. and the equivalent substitution of action subsequences are studied for the veriﬁcation of the system. Agent-oriented PNs (AOPN). A transition can only ﬁre (occur) when each of its input places has a token. A complex place is one where a single place can represent a series of places under complicated relationships. While PNs have been applied successfully in these areas. According to the modeling requirement for peer-to-peer negotiating agents. sequence. and dependency relationships among transitions. the Goal place (representing the goals the agent may possibly adopt) and Knowledge place (representing information about the environment and the internal state that an agent may adopt) have been merged into the Goal place. an ordinary place represents itself and nothing else.
. including the variables and judgments from other agents. 2) The message-processing module (MPM) is responsible for interpreting and preprocessing messages. i. and Environment places are used to represent what can be thought of as the mental states of the agent. limited set of transitions. ReceiverIDs. The dispatching mechanism in is shown in Fig. These deﬁnitions include that of the incidence matrix(A). various information is collected from correlative agents to be used by the module. AOPCPN’s Module receives and parses the receiver’s information. the ﬁring of transition in only depends on the marking vector of module and M(Goal) of the Goal state in .TONG et al. The arcs carry variable generated by places or transitions. Fig. represents the arcs among places and transitions . adapted from Perkusich and Figueiredo’s G-Nets architecture  as well as Xu and Shatz’s agent modeling framework  will be used in the veriﬁcation of AOPCPN. represents interaction relation between agents and . . 4) In the Sensor and Scheduling module. and agent’s state modules. IV. where IA represents incoming arcs from other agents. such as the goal. Knowledge. incoming InterFace . and Content. The value of is 0 or 1. coordination and arbitration. 2. OA represents outgoing arcs to other . This means that the transition of and of are ﬁred. Actions are scheduled and executed in the scheduling module based on local and cooperatively shared information. For example. Dispatching mechanism in the P module. which itself depends on the weight vectors and W(Goal. and changes in the module. or in a failure state. internal events can be perceived from the local environment to cause the agent to starting negotiating with its peers. 3) Intelligent components (ICs) include some intelligent components. Next. stands for intelligent units. Agents can be in a state that is normal. and . The value of is 0 or 1. receives it and sets sage to . When receiving a message tions module parses it and decides from other agents. the T-invariant. Outgoing InterFace . Some Basic Deﬁnitions Some key deﬁnitions and theorems. The transitions are classiﬁed into the categories of ordinary. where is the set of the agent subnets. environment. where is the Petri subnet model of . the messages. where is Message Transition for sending message to other agents. where of is deﬁned as a nine-tuple Petri subnet where: limited set of places. and sensor modules. B. sends a mesand via . the ﬁring count vector(X). is the marking vector ﬁred on the objective agent. 2. transitions The incoming interfaces are composed of message locaand incoming arcs. 5) In the Coordination and Arbitration module. intelligent. ) on arcs and F(Goal.e. L3-liveness.: MODELING AND VERIFICATION OF PEER-TO-PEER NEGOTIATING MULTIAGENT COLORED PETRI NETSs 63 The structure of AOPCPN includes a communication interface section and an internal section. According to the joint agent objectives. 6) Miscellaneous other ordinary transitions and locations found in the petri net other than those just listed. color set C(P) with the places weight function on . For example. ) in . OA is the same as IA. The outgoing interfaces are composed of outgoing arcs and message . Integrated judgments are obtained from multiple agents in order to resolve the conﬂicts and achieve the objective of the whole system. the which objective agent transitions need to be ﬁred. in a fault state. These four vectors . Intelligent transitions are explained as IU. . knowledge. are processed in combination with the latest readings from a sensor. and consistency. respectively. Formal Model of AOPCPN The multiagent system is deﬁned as a two-tuple . the transition of each only has a Except for relationship with its own places without consideration for the other agents. AOPCPN DEFINITIONS AND CAPABILITIES A. which includes the decision-making. need to be of is ﬁred in order When a message transition to send a message to other agents. and message transitions. The Goal. 1) Communication interface section: It includes incoming and outgoing communication interfaces. where messages are sent to other agents.. MsgName. the structure of the message includes SenderID. agents. marking in the places . represents the relationship between agents.
To simplify the reasoning process of AOPCPN and capture the behaviors of whole system and each agent. Effectively Tracing the Behaviors in AOPCPN Xu and Shatz  describe how to effectively trace a protocol . subsequences in the testing process have been simpliﬁed by using simpler grammatical equivalents. the computation of the 3-D matrix is void. there .. 24. and (3) . a ﬁring count vector . For petri net and negotiation sequence . The state equation for each agent is (8) where. such that there are no residual tokens left in the petri net after the conversation is com.2: The equivalent substitution of a subsequence in AOPCPN. is the the homogeneous equation incidence matrix for petri net .e. cannot be reduced into a simple place or transition. exists (i. the initial . which are used by the testing process. a negotiation process . The state equation for the whole system is given as follows: (1) integer matrix where the incidence matrix is an for the petri net with transitions and places.. the technique for tracing a protocol is extended in our AOPCPN model. and . When appropriate. where state set of agents in AOPCPN is deﬁned as . According to the deﬁnition. for . respectively (i. For a petri net . Deﬁnition 3.. exists at one time. Equivalent Substitution of Subsequences in AOPCPN If a negotiation process is very complex. respectively. . the subsequences are . . In this equation. which is the sum of the ﬁring count for transition in all agents (4) For the AOPCPN with color variable for agents. is 1) The starting and ending transition set of .e. ). pleted. Deﬁnition 3.1: The following criteria must be met in order to effectively trace the behaviors in AOPCPN. B. The vector from satisﬁes the equation In order to trace the behavior of multiple agents and process the exceptions encountered. and new states are . Seis another subsequence quence is considered to be equivalent to sequence if the conditions that are listed are satisﬁed. . For the petri net and initial marking : 1) if a vector exists consisting of positive (nonnegative) in. with the specialty of the same structure in each agent (i. C. The authors deﬁne a ﬁring sequence that starts from the initial marking and reproduces it. JANUARY 2009 L3-liveness is a term that means that any transition can be performed as many times as needed. 2) All transitions used by belong to the transition set of . a ﬁring sequence . an -ﬁring count vector of integers ( ) is called a T-invariant if is an integer solution of . a transition in one agent only has a relationship with the places in the agent itself.64 IEEE TRANSACTIONS ON POWER DELIVERY. we need to check the key procedures or transitions. NO. which only counts the ﬁring times of transition caused by agent l. Each element of is a -dimension integer vector. the same as that of ). and initial and new markings and exist. 1. The conditions. petri net agents should not be blocked unless all goals or intentions are achieved and no token is left in the petri net after multiple negotiations. These equivalences do not change the fundamental structure of the petri net. and Agent states. Equation (5) indicates that the state change variable of the whole system is the superposition of those states with all agents. In order to lay emphasis on the key transitions and to ﬁnd system design problems quickly. Environment. This means that the model should not be blocked even if some exceptions occur during an agent’s execution. exists. deﬁned as a series of places or transitions. where is a subsequence of . tegers such that 2) given a vector such that . . . equivalences are proposed for the complex ﬁring subsequence in AOPCPN. conforms to (4). For the generic colored petri net . We can consider that AOPCPN has the ability to trace multiagent system behavior that one of these two conditions holds. which represent the Goal.e. for markings are . The basic . and . in other places except . VOL. ). is an integer ﬁring count vector with -dimensions (2) The th element vector in is also a -dimensional integer The th element in is a positive integer. The new state equation for whole system is redeﬁned as (5) where the incidence matrix is an integer matrix that is the same as that of a single agent. The state change variable for agent is given as (6) (7) where is the th element of ﬁring count vector .
It is easy to miss ﬂaws using simulations or hand-based system analyses alone. Transition in the perception module can be activated periodically. The incidence matrix of a single agent is . The model of the wide-area backup protection system includes agent3. Place is an autonomic schedule state in which an agent can make reﬂex judgments without coordinating with other agents. The relationship exists between and . but conditions 2 or 5 cannot be satisﬁed. Some agents become cooperative agents. basic perceptions can be obtained regarding changes in the local environment. for a negotiation 1) Find the substitute subsequence process . which is not drawn in Fig. An agent can enter cooperative state from transitions or from path1 or path2. Regional security is ensured through the negotiation and coordination among multiple wide-area backup protection agents. These states correspond to places P9. The operational steps to create an equivalent substitution for the complex ﬁring subsequence in the AOPCPN are given. and P13. the breaker failure state. which correspond to the power system illustrated in Fig. respectively. The protection agents are located in intelligent electronic devices (IEDs) in substations. where it will wait for incoming messages. and 2) Use the given starting and ending transition sets . Partial rules for the resulting wide-area backup protection algorithm are shown in Table I. may be equivalently substituted by . agent5. For example. The description of the places and transitions in the petri net are given in Tables II and III. . 4) Check the occurrence time when the message is sent in and . agent5. agent6. and agent8 are cooperative with respect to agent6. which interact with others to form cooperation—areas according to the topology of a power grid and its required protection range. then the current differential principle is used to ﬁnd the fault and to quickly isolate it over as small an area as possible based on the calculations made. The main ideas are that after a power-line fault occurs. respectively. 3. tive equivalence of V. WABP Algorithm and its Multiagent System A WABP algorithm is adapted from . path0. or the agent might send its protection status information through transition t10 to the agents it is cooperating with and who have subscribed to such updates. Model of AOPCPN for WABP When the possibility of an agent failure state is considered. The structure of each agent is similar. is logically parallel to perception place in the sense that it is also autonomic. some new transitions and places need to be added or the content of a message may need to be changed to achieve an equivalent substitution. Cooperative strategies and measures to add robustness have been incorporated in an updated version of the original algorithm. For example. After signal sampling and protection computation are performed. P12. distance protection actions are used to ﬁnd the fault. WABP–AOPCPN is constructed as a closed petri net to model the static structures and control ﬂows in the system. Protection ious messages dispatched from places . Message-processing transition processes and reacts to varor . the term “autonomic” refers to processes that are involuntary or automatically.1 above to test the effecand . the conversations among multiple wide-area backup protection agents become more complex. 4) The behavior of the whole system and of each agent for is effectively traced by the petri net as well as that of . Tripping failure and half fault states represent an abnormal state in the agent. 4. agent4. when a fault occurs in line3 in Fig. 4. 3. Simple power network and its multiagent system. P10. A running agent can use these perceptions to enter different working states. They send their distance protections to agent6 to help judge faults in line3. such as path1. path2. It is difﬁcult to completely capture the range of agent activities and interactions once one begins to consider the wide variety of fault scenarios where protection agents might be used. The agents can communicate with remote devices via a power system intranet network. If this information is not enough. Similarly. decide to add a new transition or change the contents of the message. such as a reﬂex action to remove a hand from a hot stove. In this case. agent3. . The petri net representation of the WABP is shown in Fig. Then.: MODELING AND VERIFICATION OF PEER-TO-PEER NEGOTIATING MULTIAGENT COLORED PETRI NETSs 65 3) The initial conditions of the starting and ending transitions are the same as those in in Fig. 3) Check whether the substitute subsequence transitions belongs to those in . agent8 can ﬁnd misdiagnosed faults in line4 with agent7. such as distance protection actions. Sometimes. P11. Agent3 can ﬁnd misdiagnosed faults in line2 by cooperating with agent4. These ﬁve conditions are sufﬁcient in order to make an equivalent substitution for a subsequence.TONG et al. 5) Use the procedure in deﬁnition 3. rule 10 may be used to trip the breaker in advance. 5) The messages among agents in are the same as those in at the same time. and the half fault state. MODEL OF THE AOPCPN FOR A WIDE-AREA BACKUP PROTECTION SYSTEM A. In biology. agent7. B. 3. but these are not the necessary conditions. and agent8. and the ﬁred message transition set in belongs to the set in .
The negotiating process of the whole system is denoted as . messages regarding the current signal received from the agent on another end of the line are processed by . and then sends message Msg5 to its cooperative agents. the current differential principle . and ﬁring count vector as . As a result. and A8 (only A6 and A3 are described here in order to simplify the reasoning process). respectively. A7. . For . The fault is in the zone I distance protection range of A5 (Agent5) and in the zone II protection range of A6 (Agent6). and represent the processing of Transitions messages regarding a fault on a line. x M . . 1In brief. status messages are processed by . A4. and . a half fault state in an agent on another end of the line. VI.66 IEEE TRANSACTIONS ON POWER DELIVERY. 4. JANUARY 2009 Fig. A3. data with values of 0 are omitted. and . which include A6.5 s. in agent self state place (that means the agent is normal). Misoperations can be detected by transitions . When there is a half-failure in an agent on another end of the line. A5 ﬁnds the fault in line3 using transition t14 and gives a tripping order to breaker5 ﬁrst. 1. . Behavioral Analysis for the WABF Multiagent System 1) Example 1: Suppose that a fault occurs at point in line3. The WABP-AOPCPN model can clearly express internal intelligent structures and dynamic activities for wide-area backup protection agents. and . . an entry’s value corresponds to the ﬁring count for a transition. the agent can use rule9 to ﬁnd the fault on the line through transitions . 24. the subscript number represents the index of the place. VERIFICATION OF DYNAMIC BEHAVIORS A. a “1” entry means a token exists in the corresponding place. When the to ﬁnd the fault line through transition strategy of integrating protection actions on both ends of the line fails in transitions and . in environmentplace . The WABP algorithm in Table I and the design for multiagent system can be constructed using AOPCPN. One precondition for ﬁring transitions or is that a token must exist in the cooperative place . 3. respectively. and a breaker failure. VOL. . the fault is cleared in a shorter time than the typical traditional protection tripping time of 0. For . a no-fault condition on an adjacent line. there is a token in goalplace . . NO. All of the transitions in WABP-AOPCPN can be checked under various fault conditions to verify the property of L3-liveness. The initial making of each agent is 1. A6 receives the message and trips breaker6. as shown in Fig. the subscript represents the index of the transition. AOPCPN-WABF model for the wide-area backup protection system. The agent uses the protection statuses of both ends of one line and . . the ﬁring sequence as . is used to ﬁnd the fault through transitions .
A5.: MODELING AND VERIFICATION OF PEER-TO-PEER NEGOTIATING MULTIAGENT COLORED PETRI NETSs 67 TABLE I PARTIAL RULES OF A WIDE-AREA BACKUP PROTECTION ALGORITHM TABLE II PLACES IN FIG. The subsequences and ﬁring count vectors for each agent are deﬁned in . A6.TONG et al. 4 AND THIER DESCRIPTIONS TABLE I PARTIAL RULES OF A WIDE-AREA BACKUP PROTECTION ALGORITHM (CONTINUED) and are listed below. in which the owner agent of the subsequence is represented as “[A” + number of agent+“]:” where means that the ﬁring sequence reproduces the . and A3 join the negotiating process. respectively. and that the state of the whole system is not initial marking changed.
Place marking is 0 . NO. (Sending a message is positive and receiving is negative. A5 cannot send its protection actions and current signals to its set of cooperative agents. 2) Example 2: The fault is still at point in line3. (CONTINUED) A6 receives one net message from the other agents. 24. JANUARY 2009 TABLE III TRANSITIONS AND THEIR DESCRIPTIONS TABLE III TRANSITIONS AND THEIR DESCRIPTIONS. but it can receive messages from them describing their judgments about the current situation. The aforementioned reasoning illustrates that the agent negotiation process can be effectively traced by the WABP-AOPCPN. The subsequences and state ( changes for each agent follows: Except for the ﬁrst element of place in . This shows that is a T-invariant. In traditional protection . such as ( ). ( ). the zone II protection range of A6 and A3. in the zone I protection range of A5. The rejection of all distance protection systems in A5 occurs due to a sampling failure so A5 is in a state of half failure and A5 can still communicate with its set of cooperative agents. and the zone III protection range of A8. A5 returns to its initial state A3 returns to its initial state. and then returns to its initial state pairs. The ﬁrst resents the number of net messages. So. The initial markings and changed markings. 1.) The value 2 means that agent5 sends two net messages outward.68 IEEE TRANSACTIONS ON POWER DELIVERY. VOL. ). ). and ( ). all markings marking repfor the other places have not changed. and ( . such as ( ).
A3. and . A3 then subscribes to current signal information from A4 through transition t40 (Msg6). ( . ). To simplify example 2. Other markings are also calculated: . the content of message Msg2 has been changed to that of Msg7. ). ( the new A6 marking is A6 returns to its initial state . The marking in indicates that there is an abnormal state in some agents. This completes the agents’ negotiation First. and A8 were . The process is complex. This means that and 3) Similarly. The partial behaviors of A3 and A4 (and A7 and A8) can be replaced by simpliﬁed sequences that are semantically equivalent. ). which would be accomplished via A6 and A3. The next challenge is to verify that the original system is equivalent to the one that results after a series of substitutions has been made. The subsequence follows: A3 receives the message and records it. A5. Suppose the replaced sequence and the replaced ﬁring count vector is of system the following: is The fourth element is 0. the behavior of the WABP multiagent system before the equivalent substitutions have been applied is is veriﬁed. When A6 receives Msg7 from A8. and sends message Msg2 to A6 via transition t16. After receiving protection information from A4. and subscribes to protection updates from A4 through transitions t13 and t18 (Msg4). ). The pairs of ﬁring subsequences and ﬁring count vectors of A6. we can say that the behavior of the multiagent system before equivalent substitutions are made is correct. it is not possible to conﬁrm which agent is abnormal based on . clearing the fault in line3 depends on zone II protection delay time of (0. A3. ( . Based on this information. . A5.5 s) to complete. Based on these marking calculations. and t33. and A8 negotiate for a few rounds to produce a ﬁring sequence and ﬁring count vector . . This marking indicates that A5 has a half new marking 5) A6 ﬁnds the fault in line2 through transition t35 (Rule9). ). and is explored in more detail in example 3. t5. A6. After the fault occurs. trips breaker6 through transition t41. A4. A6 receives Msg7 from A3 and it is recorded through transitions t44 and t11 The fouth element in is 0. A3 ﬁnds that there is no fault in line2 and sends this information to A6 (Msg7). ). This means that the value has been changed of one of the agent’s state place from a 1 (normal state) to a 0 (abnormal). Only A6. A5 receives the message and trips breaker5 through transition t20. ( .: MODELING AND VERIFICATION OF PEER-TO-PEER NEGOTIATING MULTIAGENT COLORED PETRI NETSs 69 systems. A7 ﬁnds that there is not a fault in line4 by performing a current differential calculation with agent A8. t25. between A7 and A8 has been reThe subsequence placed with a subsequence for ﬁnding the breaker failure and by having A8 send Msg7.TONG et al. are deﬁned as ( . and t15 of failure. and A7 . it enters place P24 through transition t29 A5’s 4) A6 enters cooperative state P15 through path2 via transitions t2. A3. A6 receives and records the message through transition t22. A4. A8. and ( . A3 cannot judge the fault in line2 through transitions t17. A5. A7. the subsequence between A3 and A4 has been replaced by a subsequence for discovering the breaker failure and sending Msg2 in A3 where. 1) A5 ﬁnds itself in a failure state through transition t8. The negotiating subprocess of each agent needs to be checked to ﬁnd which agent experiencies a half failure. and sends Msg5 describing the fault in line3 to A5 and A3. in this simpliﬁed scenario. The ﬁring count vector 2) A3 enters its path2 place through transitions t2 and t5.
and t13. VOL. A3 does so by sending message Msg4 to A4. A3 receives the information and performs a calculation through rule7. and . A3 subscribes to distance protection updates with its opposite agent A4 through transition t18. A5 will be in a half failure state. and . which means that there is a fault in line2. The match between the petri net analysis and the EPOCHS simulation is a strong validation that the results are correct. JANUARY 2009 TABLE IV INTERACTION PROCESSING AMONG MULTIPLE AGENTS LEADING TO THE REJECTION OF AGENT5’S DISTANCE PROTECTION SYSTEMS joined in the substituted negotiation. The result is in accord with the WABP algorithm through this petri net analysis. The substitution is equivalent because it satisﬁes the ﬁve conditions of equivalent substitution. 1) A3 enters into cooperative state P14 via path2 through transitions t2. can be used as a strong veriﬁcation of the correctness of the algorithm. After the aforementioned process. . The replaced sequences are also captured by AOPCPN.70 IEEE TRANSACTIONS ON POWER DELIVERY. No differential current is found through transition t27. A3 receives Msg3 and performs a current differential computation via transition t19. NO. Evaluation using a petri net and a simulation platform can be used to ﬁnd the design errors in the simulation system and in the analysis and. The equivalent substitution is shown to be effective in simplifying the negotiation process in this example. 1. The new mark. t5. . thus. At that point. this is in accord with what we had assumed beforehand with the original system. . At the same time. The processing results conform to the WABP algorithm. the WABP multiagent system has been designed and simulated in the EPOCHS platform. ings for each agent are deﬁned as and . A4 receives the message and records it 3) A3 waits for the current signal messages from A4 in cooperative state P14 4) A4 sends Msg3 containing its current readings to A3. The equations are satisﬁed with . 24. . t9. The petri net can continue to run after this negotiation. the system enters a new steady state M. A3 sends message Msg7 to A4 and A6 through transition t40 5) A4 receives Msg7 and records it 6) A6 also receives Msg7 and records it The ﬁring count vector of the whole system is given by . ) that 3) Example 3: The negotiation process (above A3 and A4 employ to ﬁnd that there is not a fault in line2 is reasoned as follows. A4 receives the subscription through transition t11 2) A4 sends its protection information to A3 through transition t10. The fault in line2 cannot be ensured by transition t33. A3 decides to subscribe to the current signal with A4 and sends Msg6 to it. The interaction processing among agents at the rejection of agent5 can be seen in Table IV.
2. Transition t52 is used to ﬁnd whether all protections in the agent have become inactive. the principle of the equivalent substitution of simpler sequences for more complex ones has been employed. Example of Error Identiﬁcation and Correction in WABP Algorithms Some errors in algorithm development and simulation system designs can be found and corrected by analyzing the activity sequences of WABP multiagent systems. t48. pp.. and only zone II protection is operated by the line’s agent. message-parsing. P31. C. and P32 to replace the previous method. Some concrete modules have been constructed in the model to enable the agents to act intelligently. During a negotiation process. new structures for cyclic . and can verify such conditions in about 140 ms. REFERENCES  J. The liveness of the agents can be clearly analyzed by AOPCPN. With this in mind. the current differential calculations should be stopped because the fault will be cleared by the fault-line agent. 3. The negotiation process. Error identiﬁcation and correction process for the overall WABP algorithm design. Goody. no. 5. Kirschen. the use of a petri net model ensures that the system being developed is robust and reliable. When a fault occurs in an adjacent line. a fault occurs in point m of line 3 in Fig. This means that is a T-invariant. This may lead to inaccuracy in determining whether there is a line fault. The complexity of the analysis process can be reduced in WABP-AOPCPN. such as the Goal place and Perception transitions. These abstractions would need to be concrete in a real system. After receiving a current signal from an agent on the opposite end of a line. The equation results from this sequence of events. CONCLUSION For industrial distributed multiagent systems. which is shown in Fig.: MODELING AND VERIFICATION OF PEER-TO-PEER NEGOTIATING MULTIAGENT COLORED PETRI NETSs 71 current differential calculations have been adopted. Fig. which follows the peer-to-peer negotiating wide-area backup protection agents’ algorithm accurately. A. Calculating the current differential a few times ensures that the agents can ﬁnd the existence of faults in a line through transitions t47 and t48. Power Del. In short. J. Tan. Apr. only one differential computation is made to ﬁnd whether there is a fault current.” IEEE Trans. In this paper. such as widearea backup protection systems. it is not necessary for A3 and A4 to make more current differential calculations. integrated judgment. 4 and 5(a). Downes. The veriﬁcation of the WABP system can help to ﬁnd errors in the underlying algorithm and to design accurate simulations. P.TONG et al. Some structures in AOPCPN have been abstracted. VII. t49. AOPCPN’s structures can embody internal static compositions and control ﬂows. Transitions t49 and t50 make many current differential calculations to look for no-fault conditions in a line. In future work. For example. 5(b). A simple expression in WABP-AOPCPN is constructed through transitions t26 and t27. When A5 and A6 clear the fault in line3. For example. “An expert system for the back-up protection of a transmission network. A. such as autonomic perception. A3 and A4 start current differential calculations by initiating path2 in agent A3. the trigger times and sequences of correlative actions in WABP agents can be listed precisely. a novel agent-oriented colored petri net has been presented as one solution to the modeling and analysis of peer-to-peer negotiating multiagent systems. B. and J. 508–514. Transitions t51 and t52 and place P33 have been added for this reason. through transitions t47. 15. in which A3 and A4 found that there was not a line fault in line2. vol. is captured correctly. Crossley. which is why these calculations are stopped by transition t52 in agent A3. 2000. and t50 and places P30. a module in rule 6 of the algorithm in this paper exists to perform current differential calculations. The behavior and performance of the whole system needs to be captured and veriﬁed to ensure that the system operates correctly under all expected situations. as shown in Figs. D. it is necessary to construct a model for the algorithms and the simulations used before the system is deployed. and a module to allow components to run in parallel. we plan to extend the model in this paper to other problems in power systems. To simplify the analysis of the underlying WABP.
M.. Chengdu. B. networking.  X. 3204–3209. K.” in Proc. 39–59.. 1977. 24. Min. C. 11–18. no. and A. “Hierarchical time-extended petri nets as a generic tool for power system restoration. OH. Chaillet. S. 9. no. Int. pp. “Petri nets. Anchorage. Xiaoyang Tong is an Associate Professor at Southwest Jiaotong University. Syst. Tong and X.” in Proc. pp. Wang. Conf. and applications. 21. 2005. Ding. 2005. and K. D. Xu and S. “A multi-layer petri net model for deregulated electric power systems. “Adaptive optimal protection of a distribution system using a multi-agent system. S. 8th Inst. 548–558. Analysis Methods. Her research interests are in the areas of power system protection and control. pp. Pan.  S. D. K. Peterson. 29. Hopkinson (M’04) is an Assistant Professor in the Department of Electrical and Computer Engineering at the Air Force Institute of Technology. 2003. 689–692. VOL. Qin. L. 15–30. Hatziargyriou. pp.” IEEE Trans.  H. vol. X. Thorp. K. Eng. Nov. Symp. pp. pp. pp. no. Coloured Petri Nets: Basic Concepts. 2004. 5th Int. IEEE Power Eng.  T. China. 39. M. 77. and D. Giovanini. R. 513–518. Hyun. and S. “Agent-oriented petri net based modeling of dynamic behavior for wide-area backup protection. . Conf. Berlin. pp. R. 1. “Fault diagnosis of electric power systems based on fuzzy petri nets. JANUARY 2009  X. Georgilakis. vol. Valavanis. 2004.. IEEE Int.  J. 1995. and D. Begovic. Chow. networking.” in Proc. R. Conf.-Y. Thorp.  N. vol..” IEEE Trans. Beijing.  S. d. Control Conf. and Y. 12. 2004. INRIA/IEEE Symp. Kumagai and T. Hopkinson. Kang.” in Proc. A. “Trends in power system wide area protection. S. Jensen.72 IEEE TRANSACTIONS ON POWER DELIVERY.  P. Jan. 3–10. vol. Eng. “An agent net approach to autonomous distributed systems. pp. 1996. 2003. “Designing control and diagnosis for ﬂexible manufacturing systems as a multi-agent system using blackboard and object petri nets. 837–843.  G.” in Proc. no. 1. M.  H.” in Proc. Giovanini. pp. Elect. May 1997. Kenneth M. and H. 3.  K. P. Germany: Springer. J. Boel. 1997. “G-nets: A petri net based approach for logical and timing analysis of complex software systems. and simulation. Emerging Technologies Factory Automation. 19. “A colored petri net based strategy for multi-agent scheduling. A. and simulation. Software Engineering. Bai. Nov. Fountas. J. Perkusich and J.  J. A. 4. Shatz.  N. Cybern. Choi.” in Proc. Apr. Giovanini. and L. 2006.. Hopkinson. Syst. Soc. Tnazefti.. 2. Jiroveanu and R. Power Del. Symp. Coury. K. “Petri nets: Properties. Song. 2002. substation automation. Coury. H. IEEE. 1989.” Proc.  Q. 8th ACIS Int. “A primary and backup cooperative protection system based on wide area agents. pp. pp. pp. 8th Inst. 2004. Jul. May 2006. Birman. NO. Desrochers. Power Syst. pp. Man. Miyamoto.. Qingdao. “Study of a high-speed communication betwork based wide-area protection system. “Novel backup protection systems for the electric power grid using agents (in Chinese). 373–382. Xu and S.. Circuits Systems. Eng. 541–580. Coury. pp. IEEE Int. Softw. Thorp. Power Syst. M.  W. Int. M. Han and M. 8th Inst. Power Syst. W. Secure Negotiation Mechanisms Multi-Agent Systems. Sichuan. vol. Figueiredo. 50–54.-H. pp. 2004. Wright-Patterson Air Force Base. K.” IEEE Trans. 2004. Robust.” IEEE Trans. H. Expo. Developments in Power System Protection. Int. China. 2007.” in Proc. Chung. Developments in Power System Protection.  K. “A framework for model-based design of agentoriented software. Eng. H. 2. J. Birman. Amer. I. S. Sep.. A. 21. Lee. pp. Lu. Elect.  R.” ACM Comput. Developments in Power System Protection. 29. Hammami. pp. V. 1996. 4. Valavanis. 2053–2059. Surveys. 223–252. 1. “EPOCHS: A platform for agent-based electric power and communication simulation built from commercial off-the-shelf components.. vol. Sun. Wang.” in Proc. Hopkinson. pp. Katsigiannis. J. 1612–1613.  M. “Petri net based transformer fault diagnosis.. Autonomous Decentralized Systems. 2001. no. S. Int. China. Shatz. pp. Cong.” in Proc. Artiﬁcial Intelligence. and A. Conf. K. V-980–V-983. Networking. 756–759. and Parallel/Distributed Computing. 4312–4317. AK. Moalla. His research interests are in the areas of distributed systems.  S. Murata. pp. vol. Conf. Xiaoru Wang (M’02–SM’07) is a Professor in the School of Electrical Engineering at Southwest Jiaotong University. vol. and K. Power Syst. analysis. Sichuan.  W. vol. 1222–1230. Z.. Wang. P. “Controller synthesis via mapping task sequence to petri nets in multi-agent collaboration applications. Elect.” in Proc. Robotics Autom. His research interests include agents. Conf.. China. M. vol. 611–614. and Practical Use. Elect. Power Systems Conf. Chengdu.” J. “An agent-based petri net model with application to seller/buyer design in electronic commerce. Jafari. Softw. Rational. H. no. J.” in Proc. Zhang. and J. 160–165. Zhang. N.” IEEE Trans.  A.” Autom. “A common architecture for distributed diagnosis and wide-area backup protection.