IEEE paper

IEEE TRANSACTIONS ON POWER DELIVERY, VOL. 24, NO. 1, JANUARY 2009 61

The Modeling and Verification of Peer-to-PeerNegotiating Multiagent Colored Petri Nets for

Wide-Area Backup ProtectionXiaoyang Tong, Xiaoru Wang, Senior Member, IEEE, and Kenneth M. Hopkinson, Member, IEEE

Abstract—This paper focuses on the modeling and verificationof a peer-to-peer wide-area backup protection (WABP) system.Agents located in a number of substation Intelligent Electronic De-vices (IEDs) negotiate on a peer, or equal, basis. The agent-basedwide-area backup protection scheme is able to find power-linefaults and protection misoperations. A wide-area communicationnetwork based on IP technology is used to transmit shared infor-mation among the agents. A novel Agent-Oriented Peer-to-peernegotiating Colored Petri Net (AOPCPN) is proposed to imple-ment the WABP system. The algorithms, design, and dynamicbehavior of the WABP is evaluated in a simulated environmentto demonstrate its benefits. The article begins by presenting thegeneric AOPCPN architecture and its formal definition. TheAOPCPN model for the WABP multiagent system is evaluatedaccording to one algorithm, which is detailed in this article. TheWABP agent’s autonomy, cooperation, parallel operation, androbustness are embodied in modules in order to ease the softwareengineering challenges in implementing and maintaining theagents. Three example scenarios illustrate the effectiveness of thePetri net model and its ability to dynamically respond to WABPmisoperations and fault conditions.

Index Terms—Colored petri nets (PNs), modeling, multiagent,peer-to-peer negotiating agents, wide-area backup protection.

I. INTRODUCTION

I N THE last decade, large-scale power system blackoutsspread over wide areas in the U.S., Canada, and Europe

have made it increasingly necessary to study power systemsusing a regional perspective. Traditional protection relays onlymake decisions based on their local inputs. In many instances,these relays are a poor fit to modern interconnected powergrids. A better alternative, which has been proposed in recentyears, is to use wide-area backup protection (WABP) prin-ciples based on communication networks to improve powersystem security [1]–[7]. Wide-area protection information isexchanged between protection agents located in intelligent

Manuscript received May 30, 2008. Current version published December 24,2008. The views expressed in this document are those of the authors and donot reflect the official policy or position of the U.S. Air Force, Department ofDefense, or the U.S. Government. This work was supported by the NationalNatural Science Foundation of China (NSFC) under Project 90610026. Paperno. TPWRD-00396-2008.

X. Tong and X. Wang are with the School of Electrical Engineering,Southwest Jiaotong University, Chengdu, Sichuan 610031, China (e-mail:[email protected]; [email protected]).

K. M. Hopkinson is with the Department of Electrical and Computer Engi-neering, Air Force Institute of Technology, Wright-Patterson Air Force Base,OH 45433-7765 USA (e-mail: [email protected]).

Digital Object Identifier 10.1109/TPWRD.2008.2005661

electronic devices (IEDs) in order to accurately detect faultsand to quickly isolate them in as small an area as possible.The accurate diagnosis of protection misoperations and cir-cuit-breaker failures can prevent the propagation of powersystem disturbances. Multiagent technology forms a powerfulnew solution for distributed protection systems based on itsautonomous, cooperative, and proactive features. There aretwo architectures for WABP multiagent systems: 1) basedon regional central control and 2) using agents that negotiatedistributed control on a peer-to-peer basis in which there areno control centers, as described by Cong et al. [4]. The latterarchitecture is sometimes called a peer-to-peer architecture incomputer networks because all agents have the same capabil-ities as all others and they cooperate rather than working in afixed hierarchy. Peer architectures are adopted in most of theWABP literature. When a fault occurs, agents perceive it andinitiate negotiation with others in order to jointly correlate theevent and to find its location. This process improves on theintelligence and robustness of the protection system.

All WABP agents run in parallel, which makes their behaviormore complex than traditional protection systems. We need amethod or tool to model WABP systems and examine their be-havior, in order to properly maintain the algorithms and sim-ulation designs of multiagent systems. The electric power andcommunication synchronizing simulator (EPOCHS) is a feder-ated simulation platform that combines the PSCAD/EMTDCelectromagnetic transient simulator, the PSLF electromechan-ical transient simulator, and the network simulator 2 (ns2) com-munication simulator. EPOCHS allows users to simulate sce-narios where they can see how the interaction between powersystems and communication networks affects the operation oftheir protection and control systems [8]. If a multiagent WABPsystem is poorly designed, then its shortcomings can be demon-strated using the EPOCHS platform. It is important to realizethough that each simulation only tests a specific situation andso, it is never possible to obtain complete validation of an algo-rithm from a simulation platform. Precise trigger time, and othersimilar details may vary between a simulated example and onein a real environment due to imprecise modeling.

Petri nets (PNs) are mathematical models, which can beused to describe and analyze distributed systems. A petri netcan describe the interaction of multiple agents in a WABP.As a visual modeling tool for distributed systems, PNs havesome advantages over traditional methods, such as the abilityto capture behavior in the form of rule sets, flowcharts, and

0885-8977/$25.00 © 2008 IEEE

62 IEEE TRANSACTIONS ON POWER DELIVERY, VOL. 24, NO. 1, JANUARY 2009

finite state machines [9]. PNs can give explicit representationto static structures, information flows, satisfied conditions, anddependency relationships among transitions, such as their con-currency, sequence, and conflicting requirements. To overcomestate calamities, colored and object-oriented PNs have beenstudied in [9]–[11]. The G-Net is an object-based extensionof PNs, which is defined in terms of a set of independent andloosely coupled modules in [12]. Agent-oriented PNs (AOPN),based on the G-Net, have been used to express the perceptionand collaboration of agents by Xu, Han, and Kumagai, in[13]–[16]. Some intelligent elements, such as goal processing,knowledge processing, environmental data, sensor data, anddecision-making, are introduced to make an agent autonomousand goal driven. But the decision-making and sensor mod-ules are abstract, and message processing is not based on thecurrent running state of the agents. Agents failures are alsonot considered. Industrial control systems often lack well-de-fined protocols for negotiation between cooperating agents orprotection elements, and this is an important requirement forfuture systems [13]. PNs have been successfully applied inpower systems in areas, such as electric power markets, faultdiagnosis, and power system restoration [17]–[20]. Petri netmodeling for wide-area backup protection multiagent systemshas been studied in [21]. While PNs have been applied suc-cessfully in these areas, it has become increasingly difficult toverify that they will behave correctly as the number of agentshas increased.

In this paper, a novel agent-oriented peer-to-peer negotiatingcolored petri net (AOPCPN) for wide-area backup protectionsystems is proposed, which combines the principles of coloredPNs and AOPN. The formal definitions and structural propertiesare presented. Message processing, the perception, autonomicjudgment, and schedule modules are combined in AOPCPN.The autonomy, cooperation, concurrency, and robustness ofwide-area backup protection agents are embodied in modules.The analysis of L3-liveness, capturing dynamic behavior, andthe equivalent substitution of action subsequences are studiedfor the verification of the system. The results of three samplescenarios illustrate the correctness of the model and the effec-tiveness in capturing the WABP multiagent behavior.

II. PETRI NET BASICS

A petri net is a mathematical model of a discrete distributedsystem. PNs can be used to formally examine the operation ofa distributed system to evaluate its information flow and basicproperties, including various measures of correctness. PNs con-sist of places, transitions, and arcs [22]. Given two places, and, a directed arc from to indicates that a transition will lead

from an output of to an input of . As execution progressesin the petri net, tokens, or markers, representing input or otherdata can appear in places according to the rules of the underlyingsystem. For example, a keyboard place may receive a charactertoken when a user presses the “a” key. A transition can onlyfire (occur) when each of its input places has a token. When atransition fires, tokens are transferred from each of the place in-puts to corresponding outputs. A petri net’s marking refers to

Fig. 1. Generic architecture of a novel agent-oriented peer-to-peer negotiatingcolored petri net.

the distribution of tokens throughout the places in the system.The marking of a petri net is representative of its current state.In colored PNs, every token has a value, such as the letter “a” inour previous keyboard example, instead of the valueless tokensused in basic PNs [23]. The values in the colored PNs have ob-vious utility when modeling complex distributed systems.

III. ARCHITECTURE OF A NOVEL AGENT-ORIENTED

EQUAL-NEGOTIATING COLORED PETRI NET (AOPCPN)

A. Generic Architecture of AOPCPN

A generic architecture for AOPCPN has been created basedon the G-net model of agents [12], [13], which is illustratedin Fig. 1. Some elements have been combined to simplify theanalysis of the petri net. In the analysis, the Goal place (repre-senting the goals the agent may possibly adopt) and Knowledgeplace (representing information about the environment and theinternal state that an agent may adopt) have been merged intothe Goal place. The generic switch place (GSP) for messagerouting, the message processing unit (MPU) and the GSP’ (anauxiliary message routing unit) places have been omitted andmerged into a single place titled (the message receipt place).The Goal and Environment places, where the environmentplace represents the current state of the surrounding world, areregarded as ordinary places. (In petri net terminology, an ordi-nary place represents itself and nothing else. A complex place isone where a single place can represent a series of places undercomplicated relationships.) These simplifications have a min-imal impact on the petri net’s operating characteristics [12].

New capabilities have been added to the message deci-sion-making and sensor modules in the G-net framework. Anautonomic scheduling module has been added to improve theconcurrency and proactiveness of the agent. The transitionsin the AOPCPN represent the internal activities of the agents;the places represent the states and the enabling conditionsfor transitions. According to the modeling requirement forpeer-to-peer negotiating agents, a colored principle is adoptedto reduce the scale of AOPCPN because of the similaritiesbetween the agents. The -dimensional colored variable isdefined to represent the token values in each state location andthe weight vectors associated with each arc.

TONG et al.: MODELING AND VERIFICATION OF PEER-TO-PEER NEGOTIATING MULTIAGENT COLORED PETRI NETSs 63

The structure of AOPCPN includes a communication inter-face section and an internal section.

1) Communication interface section: It includes incomingand outgoing communication interfaces. The outgoinginterfaces are composed of outgoing arcs and messagetransitions , where messages are sent to other agents.The incoming interfaces are composed of message loca-tions and incoming arcs. When receiving a messagefrom other agents, the module parses it and decideswhich objective agent transitions need to be fired.

2) The message-processing module (MPM) is responsible forinterpreting and preprocessing messages.

3) Intelligent components (ICs) include some intelligent com-ponents, such as the goal, knowledge, environment, andagent’s state modules. Agents can be in a state that isnormal, in a fault state, or in a failure state.

4) In the Sensor and Scheduling module, internal events canbe perceived from the local environment to cause the agentto starting negotiating with its peers. Actions are scheduledand executed in the scheduling module based on local andcooperatively shared information.

5) In the Coordination and Arbitration module, the messages,including the variables and judgments from other agents,are processed in combination with the latest readings froma sensor. According to the joint agent objectives, variousinformation is collected from correlative agents to be usedby the module. Integrated judgments are obtained frommultiple agents in order to resolve the conflicts and achievethe objective of the whole system.

6) Miscellaneous other ordinary transitions and locationsfound in the petri net other than those just listed.

B. Formal Model of AOPCPN

The multiagent system is defined as a two-tuple, where is the set of the agent subnets,

, where is the Petri subnet model of. represents the relationship between agents, and ,

where represents interaction relation between agents and .Petri subnet of is defined as a nine-tuple

where:

limited set of places;

limited set of transitions. The transitions areclassified into the categories of ordinary,intelligent, and message transitions. Intelligenttransitions are explained as IU;

represents the arcs among places and transitions. The arcs carry variable

generated by places or transitions;

color set C(P) with the places

weight function on. The

value of is 0 or 1;

Fig. 2. Dispatching mechanism in the � module.

marking in the places. The

value of is 0 or 1;

incoming InterFace , where IArepresents incoming arcs from other agents;

Outgoing InterFace , whereis Message Transition for sending message to

other agents, OA represents outgoing arcs to otheragents, i.e., . OA is the same as IA;the structure of the message includes SenderID,ReceiverIDs, MsgName, and Content;

stands for intelligent units, which includes thedecision-making, coordination and arbitration,and sensor modules. The Goal, Knowledge, andEnvironment places are used to represent what canbe thought of as the mental states of the agent.

Except for , the transition of each only has arelationship with its own places without consideration for theother agents. For example, the firing of transition inonly depends on the marking vector of moduleand M(Goal) of the Goal state in , which itself dependson the weight vectors and W(Goal, ) on arcs

and F(Goal, ) in . These four vectorsneed to be .

When a message transition of is fired in orderto send a message to other agents. AOPCPN’s Modulereceives and parses the receiver’s information, and changesthe marking vector in the module. Next, isfired on the objective agent. The dispatching mechanism in

is shown in Fig. 2. For example, sends a mes-sage to and via , receives it and sets

. This means that the transition ofand of are fired, respectively.

IV. AOPCPN DEFINITIONS AND CAPABILITIES

A. Some Basic Definitions

Some key definitions and theorems, adapted from Perkusichand Figueiredo’s G-Nets architecture [12] as well as Xu andShatz’s agent modeling framework [13] will be used in the ver-ification of AOPCPN. These definitions include that of the in-cidence matrix(A), the firing count vector(X), the T-invariant,L3-liveness, and consistency.


L3-liveness is a term that means that any transition can beperformed as many times as needed. According to the defini-tion, petri net agents should not be blocked unless all goalsor intentions are achieved and no token is left in the petri netafter multiple negotiations. This means that the model shouldnot be blocked even if some exceptions occur during an agent’sexecution.

For a petri net , an -firing count vector of integers () is called a T-invariant if is an integer solution of

the homogeneous equation . In this equation, is theincidence matrix for petri net .

B. Effectively Tracing the Behaviors in AOPCPN

Xu and Shatz [14] describe how to effectively trace a pro-tocol . The authors define a firing sequence that starts fromthe initial marking and reproduces it, such that there are noresidual tokens left in the petri net after the conversation is com-pleted. The vector from satisfies the equation .

In order to trace the behavior of multiple agents andprocess the exceptions encountered, the technique for tracinga protocol is extended in our AOPCPN model. The basicstate set of agents in AOPCPN is defined as , where

, which represent the Goal, Environ-ment, and Agent states, respectively.

Definition 3.1: The following criteria must be met in order toeffectively trace the behaviors in AOPCPN. For the petri netand initial marking :

1) if a vector exists consisting of positive (nonnegative) in-tegers such that ;

2) given a vector such that , ,for , exists at one time, inother places except , exists (i.e.,

). We can consider that AOPCPN has theability to trace multiagent system behavior that one of thesetwo conditions holds.

For the generic colored petri net , a negotiation process , afiring sequence , a firing count vector , and initial and newmarkings and exist. The state equation for the wholesystem is given as follows:

(1)

where the incidence matrix is an integer matrixfor the petri net with transitions and places, ,

. Each element of is a -dimension integer vector.is an integer firing count vector with -dimensions

(2)

The th element in is also a -dimensional integervector

(3)

The th element in is a positive integer, which is the sumof the firing count for transition in all agents

(4)

For the AOPCPN with color variable for agents, withthe specialty of the same structure in each agent (i.e.,

), a transition in one agent only has a relationshipwith the places in the agent itself.

To simplify the reasoning process of AOPCPN and capturethe behaviors of whole system and each agent, the computationof the 3-D matrix is void. The new state equation for wholesystem is redefined as

(5)

where the incidence matrix is an integer matrix thatis the same as that of a single agent. conforms to (4). Equa-tion (5) indicates that the state change variable of the wholesystem is the superposition of those states with all agents.

The state change variable for agent is given as

(6)

(7)

where is the th element of firing count vector , which onlycounts the firing times of transition caused by agent l.

The state equation for each agent is

(8)

where, for , the subsequences are , the initialmarkings are , and new states are .

C. Equivalent Substitution of Subsequences in AOPCPN

If a negotiation process is very complex, we need to check thekey procedures or transitions. The conditions, defined as a seriesof places or transitions, which are used by the testing process,cannot be reduced into a simple place or transition. In orderto lay emphasis on the key transitions and to find system de-sign problems quickly, equivalences are proposed for the com-plex firing subsequence in AOPCPN. These equivalences do notchange the fundamental structure of the petri net. When appro-priate, subsequences in the testing process have been simplifiedby using simpler grammatical equivalents.

Definition 3.2: The equivalent substitution of a subsequencein AOPCPN. For petri net and negotiation sequence , where

is a subsequence of , , and , thereis another subsequence , and . Se-quence is considered to be equivalent to sequence if theconditions that are listed are satisfied.

1) The starting and ending transition set of isthe same as that of , respectively (i.e.,

).2) All transitions used by belong to the transition set of ,

and , exists.


3) The initial conditions of the starting and ending transitionsin are the same as those in

4) The behavior of the whole system and of each agent foris effectively traced by the petri net as well as that of .

5) The messages among agents in are the same as those inat the same time, and the fired message transition set inbelongs to the set in . The relationship

exists between and .These five conditions are sufficient in order to make an equiv-

alent substitution for a subsequence, but these are not the neces-sary conditions. Sometimes, may be equivalently substitutedby , but conditions 2 or 5 cannot be satisfied. In this case,some new transitions and places need to be added or the contentof a message may need to be changed to achieve an equivalentsubstitution.

The operational steps to create an equivalent substitution forthe complex firing subsequence in the AOPCPN are given.

1) Find the substitute subsequence for a negotiationprocess .

2) Use the given starting and ending transition sets and.

3) Check whether the substitute subsequence transitionsbelongs to those in . Then, decide to add a new transitionor change the contents of the message.

4) Check the occurrence time when the message is sent inand .

5) Use the procedure in definition 3.1 above to test the effec-tive equivalence of and .

V. MODEL OF THE AOPCPN FOR A WIDE-AREA

BACKUP PROTECTION SYSTEM

A. WABP Algorithm and its Multiagent System

A WABP algorithm is adapted from [2]. Cooperative strate-gies and measures to add robustness have been incorporated inan updated version of the original algorithm. Partial rules forthe resulting wide-area backup protection algorithm are shownin Table I. The main ideas are that after a power-line fault oc-curs, distance protection actions are used to find the fault. If thisinformation is not enough, then the current differential principleis used to find the fault and to quickly isolate it over as small anarea as possible based on the calculations made.

The protection agents are located in intelligent electronicdevices (IEDs) in substations. The agents can communicatewith remote devices via a power system intranet network. Someagents become cooperative agents, which interact with others toform cooperation—areas according to the topology of a powergrid and its required protection range. For example, when afault occurs in line3 in Fig. 3, agent5, agent3, and agent8 arecooperative with respect to agent6. They send their distanceprotections to agent6 to help judge faults in line3. Agent3 can

Fig. 3. Simple power network and its multiagent system.

find misdiagnosed faults in line2 by cooperating with agent4.Similarly, agent8 can find misdiagnosed faults in line4 withagent7. Regional security is ensured through the negotiationand coordination among multiple wide-area backup protectionagents.

B. Model of AOPCPN for WABP

When the possibility of an agent failure state is considered,the conversations among multiple wide-area backup protectionagents become more complex. It is difficult to completelycapture the range of agent activities and interactions onceone begins to consider the wide variety of fault scenarioswhere protection agents might be used. It is easy to missflaws using simulations or hand-based system analyses alone.WABP–AOPCPN is constructed as a closed petri net to modelthe static structures and control flows in the system. The modelof the wide-area backup protection system includes agent3,agent4, agent5, agent6, agent7, and agent8, which correspondto the power system illustrated in Fig. 3. The petri net repre-sentation of the WABP is shown in Fig. 4. The description ofthe places and transitions in the petri net are given in Tables IIand III, respectively.

The structure of each agent is similar. The incidence matrixof a single agent is , , .

Transition in the perception module can be activated peri-odically. After signal sampling and protection computation areperformed, basic perceptions can be obtained regarding changesin the local environment, such as distance protection actions.A running agent can use these perceptions to enter differentworking states, such as path1, path2, path0, the breaker failurestate, and the half fault state. These states correspond to placesP9, P10, P11, P12, and P13, respectively. An agent can entercooperative state from transitions or from path1or path2, where it will wait for incoming messages. Trippingfailure and half fault states represent an abnormal state in theagent.

In biology, the term “autonomic” refers to processes that areinvoluntary or automatically, such as a reflex action to remove ahand from a hot stove. Place is an autonomic schedule state inwhich an agent can make reflex judgments without coordinatingwith other agents. For example, rule 10 may be used to trip thebreaker in advance, which is not drawn in Fig. 4, or the agentmight send its protection status information through transitiont10 to the agents it is cooperating with and who have subscribedto such updates. is logically parallel to perception placein the sense that it is also autonomic.

Message-processing transition processes and reacts to var-ious messages dispatched from places or . Protection


Fig. 4. AOPCPN-WABF model for the wide-area backup protection system.

status messages are processed by ; messages regarding thecurrent signal received from the agent on another end of the lineare processed by . One precondition for firing transitionsor is that a token must exist in the cooperative place .Transitions , , , and represent the processing ofmessages regarding a fault on a line, a no-fault condition on anadjacent line, a half fault state in an agent on another end of theline, and a breaker failure, respectively.

Misoperations can be detected by transitions , , and .The agent uses the protection statuses of both ends of one lineto find the fault line through transition and . When thestrategy of integrating protection actions on both ends of the linefails in transitions and , the current differential principleis used to find the fault through transitions , , , and .

When there is a half-failure in an agent on another end of theline, the agent can use rule9 to find the fault on the line throughtransitions , , , and .

All of the transitions in WABP-AOPCPN can be checkedunder various fault conditions to verify the property ofL3-liveness.

The WABP-AOPCPN model can clearly express internal in-telligent structures and dynamic activities for wide-area backupprotection agents. The WABP algorithm in Table I and the de-sign for multiagent system can be constructed using AOPCPN.

VI. VERIFICATION OF DYNAMIC BEHAVIORS

A. Behavioral Analysis for the WABF Multiagent System

1) Example 1: Suppose that a fault occurs at point in line3,as shown in Fig. 3. The fault is in the zone I distance protectionrange of A5 (Agent5) and in the zone II protection range of A6(Agent6).

The initial making of each agent is1, there is a token in goalplace , in environmentplace , inagent self state place (that means the agent is normal), re-spectively. The negotiating process of the whole system is de-noted as , the firing sequence as , and firing count vectoras .

A5 finds the fault in line3 using transition t14 and gives atripping order to breaker5 first, and then sends message Msg5to its cooperative agents, which include A6, A3, A4, A7, andA8 (only A6 and A3 are described here in order to simplify thereasoning process). A6 receives the message and trips breaker6.As a result, the fault is cleared in a shorter time than the typicaltraditional protection tripping time of 0.5 s.

1In brief, data with values of 0 are omitted. For�, a “1” entry means a tokenexists in the corresponding place; the subscript number represents the index ofthe place. For �, an entry’s value corresponds to the firing count for a transition;the subscript represents the index of the transition.


TABLE IPARTIAL RULES OF A WIDE-AREA BACKUP PROTECTION ALGORITHM

TABLE IPARTIAL RULES OF A WIDE-AREA

BACKUP PROTECTION ALGORITHM (CONTINUED)

TABLE IIPLACES IN FIG. 4 AND THIER DESCRIPTIONS

and are listed below, respectively, in which the owneragent of the subsequence is represented as “[A” + number ofagent+“]:”

where means that the firing sequence reproduces theinitial marking , and that the state of the whole system is notchanged. A6, A5, and A3 join the negotiating process. The sub-sequences and firing count vectors for each agent are defined in


TABLE IIITRANSITIONS AND THEIR DESCRIPTIONS

pairs, such as ( ), ( ), and ( , ). Theinitial markings and changed markings, such as ( ),( ), and ( ). The subsequences and statechanges for each agent follows:

Except for the first element of place in , all markingsfor the other places have not changed. The first marking rep-resents the number of net messages. (Sending a message is pos-itive and receiving is negative.) The value 2 means that agent5sends two net messages outward. So, A5 returns to its initialstate

TABLE IIITRANSITIONS AND THEIR DESCRIPTIONS. (CONTINUED)

A6 receives one net message from the other agents, and thenreturns to its initial state

A3 returns to its initial state.This shows that is a T-invariant. The aforementioned rea-

soning illustrates that the agent negotiation process can be ef-fectively traced by the WABP-AOPCPN.

2) Example 2: The fault is still at point in line3, in thezone I protection range of A5, the zone II protection range ofA6 and A3, and the zone III protection range of A8. The re-jection of all distance protection systems in A5 occurs due to asampling failure so A5 is in a state of half failure and A5 canstill communicate with its set of cooperative agents. Placemarking is 0 . A5 cannot send itsprotection actions and current signals to its set of cooperativeagents, but it can receive messages from them describing theirjudgments about the current situation. In traditional protection


systems, clearing the fault in line3 depends on zone II protectiondelay time of (0.5 s) to complete, which would be accomplishedvia A6 and A3.

After the fault occurs, A6, A5, A3, A4, A7, and A8 negotiatefor a few rounds to produce a firing sequence and firing countvector . The partial behaviors of A3 and A4 (and A7 and A8)can be replaced by simplified sequences that are semanticallyequivalent.

1) A5 finds itself in a failure state through transition t8,and sends message Msg2 to A6 via transition t16. A6receives and records the message through transition t22.The subsequence follows:

2) A3 enters its path2 place through transitions t2 and t5,and subscribes to protection updates from A4 throughtransitions t13 and t18 (Msg4). After receiving protec-tion information from A4, A3 cannot judge the fault inline2 through transitions t17, t25, and t33. A3 then sub-scribes to current signal information from A4 throughtransition t40 (Msg6). A3 finds that there is no faultin line2 and sends this information to A6 (Msg7). Theprocess is complex, and is explored in more detail in ex-ample 3. To simplify example 2, the subsequencebetween A3 and A4 has been replaced by a subsequencefor discovering the breaker failure and sending Msg2in A3 where, in this simplified scenario, the content ofmessage Msg2 has been changed to that of Msg7. A6receives Msg7 from A3 and it is recorded through tran-sitions t44 and t11

3) Similarly, A7 finds that there is not a fault in line4 by per-forming a current differential calculation with agent A8.The subsequence between A7 and A8 has been re-placed with a subsequence for finding the breaker failureand by having A8 send Msg7. When A6 receives Msg7from A8, it enters place P24 through transition t29

4) A6 enters cooperative state P15 through path2 via tran-sitions t2, t5, and t15

5) A6 finds the fault in line2 through transition t35 (Rule9),trips breaker6 through transition t41, and sends Msg5describing the fault in line3 to A5 and A3. A5 receivesthe message and trips breaker5 through transition t20.

A3 receives the message and records it. This completesthe agents’ negotiation

First, the behavior of the WABP multiagent system be-fore the equivalent substitutions have been applied isverified. The firing count vector is

The fouth element in is 0. This means that the valueof one of the agent’s state place has been changedfrom a 1 (normal state) to a 0 (abnormal). Based on thisinformation, it is not possible to confirm which agentis abnormal based on . The negotiating subprocess ofeach agent needs to be checked to find which agent expe-riencies a half failure. The pairs of firing subsequencesand firing count vectors of A6, A5, A3, A4, A8, and A7are defined as ( , ), ( , ), ( , ),( , ), ( , ), and ( , ).

the new A6 marking is . This means thatA6 returns to its initial state

and A5’s new marking isThe fourth element

of is 0. This marking indicates that A5 has a halffailure.Other markings are also calculated: ,

, , and .Based on these marking calculations, we can say thatthe behavior of the multiagent system before equivalentsubstitutions are made is correct.The next challenge is to verify that the original system isequivalent to the one that results after a series of substi-tutions has been made. Suppose the replaced sequenceof system and the replaced firing count vector isthe following:

The marking in indicates that there is an abnormalstate in some agents. Only A6, A5, A3, and A8 were


TABLE IVINTERACTION PROCESSING AMONG MULTIPLE AGENTS LEADING TO THE REJECTION OF AGENT5’S DISTANCE PROTECTION SYSTEMS

joined in the substituted negotiation. The new mark-ings for each agent are defined as , , ,and . The equations are satisfied with

, , and ., and .

The replaced sequences are also captured by AOPCPN. Thesubstitution is equivalent because it satisfies the five conditionsof equivalent substitution.

After the aforementioned process, the system enters a newsteady state M. The petri net can continue to run after this ne-gotiation. At that point, A5 will be in a half failure state; this isin accord with what we had assumed beforehand with the orig-inal system. The equivalent substitution is shown to be effectivein simplifying the negotiation process in this example. The re-sult is in accord with the WABP algorithm through this petrinet analysis. At the same time, the WABP multiagent systemhas been designed and simulated in the EPOCHS platform. Theinteraction processing among agents at the rejection of agent5can be seen in Table IV. The processing results conform to theWABP algorithm. The match between the petri net analysis andthe EPOCHS simulation is a strong validation that the results arecorrect. Evaluation using a petri net and a simulation platformcan be used to find the design errors in the simulation systemand in the analysis and, thus, can be used as a strong verifica-tion of the correctness of the algorithm.

3) Example 3: The negotiation process (above ) thatA3 and A4 employ to find that there is not a fault in line2 isreasoned as follows.

1) A3 enters into cooperative state P14 via path2 throughtransitions t2, t9, t5, and t13. A3 subscribes to distanceprotection updates with its opposite agent A4 throughtransition t18. A3 does so by sending message Msg4 toA4. A4 receives the subscription through transition t11

2) A4 sends its protection information to A3 through tran-sition t10. A3 receives the information and performs acalculation through rule7. The fault in line2 cannot beensured by transition t33. A3 decides to subscribe to thecurrent signal with A4 and sends Msg6 to it. A4 receivesthe message and records it

3) A3 waits for the current signal messages from A4 incooperative state P14

4) A4 sends Msg3 containing its current readings to A3.A3 receives Msg3 and performs a current differentialcomputation via transition t19. No differential current isfound through transition t27, which means that there isa fault in line2. A3 sends message Msg7 to A4 and A6through transition t40

5) A4 receives Msg7 and records it

6) A6 also receives Msg7 and records it

The firing count vector of the whole system is givenby


Fig. 5. Error identification and correction process for the overall WABP algo-rithm design.

The equation results from this sequence of events.This means that is a T-invariant. The negotiation process, inwhich A3 and A4 found that there was not a line fault in line2,is captured correctly.

B. Example of Error Identification and Correction in WABPAlgorithms

Some errors in algorithm development and simulationsystem designs can be found and corrected by analyzing theactivity sequences of WABP multiagent systems. For example,a module in rule 6 of the algorithm in this paper exists toperform current differential calculations. A simple expressionin WABP-AOPCPN is constructed through transitions t26 andt27, as shown in Figs. 4 and 5(a). After receiving a currentsignal from an agent on the opposite end of a line, only onedifferential computation is made to find whether there is a faultcurrent. This may lead to inaccuracy in determining whetherthere is a line fault. With this in mind, new structures for cyclic

current differential calculations have been adopted, throughtransitions t47, t48, t49, and t50 and places P30, P31, and P32to replace the previous method, which is shown in Fig. 5(b).

Calculating the current differential a few times ensures thatthe agents can find the existence of faults in a line through tran-sitions t47 and t48. Transitions t49 and t50 make many currentdifferential calculations to look for no-fault conditions in a line,and can verify such conditions in about 140 ms.

When a fault occurs in an adjacent line, and only zone II pro-tection is operated by the line’s agent, the current differentialcalculations should be stopped because the fault will be clearedby the fault-line agent. Transitions t51 and t52 and place P33have been added for this reason. Transition t52 is used to findwhether all protections in the agent have become inactive. Forexample, a fault occurs in point m of line 3 in Fig. 3. A3 and A4start current differential calculations by initiating path2 in agentA3. When A5 and A6 clear the fault in line3, it is not necessaryfor A3 and A4 to make more current differential calculations,which is why these calculations are stopped by transition t52 inagent A3.

VII. CONCLUSION

For industrial distributed multiagent systems, such as wide-area backup protection systems, it is necessary to constructa model for the algorithms and the simulations used beforethe system is deployed. The behavior and performance of thewhole system needs to be captured and verified to ensure thatthe system operates correctly under all expected situations.

In this paper, a novel agent-oriented colored petri net hasbeen presented as one solution to the modeling and analysisof peer-to-peer negotiating multiagent systems. Some con-crete modules have been constructed in the model to enablethe agents to act intelligently, such as autonomic perception,message-parsing, integrated judgment, and a module to allowcomponents to run in parallel. AOPCPN’s structures can em-body internal static compositions and control flows, whichfollows the peer-to-peer negotiating wide-area backup protec-tion agents’ algorithm accurately.

During a negotiation process, the trigger times and sequencesof correlative actions in WABP agents can be listed precisely.The liveness of the agents can be clearly analyzed by AOPCPN.The verification of the WABP system can help to find errors inthe underlying algorithm and to design accurate simulations. Inshort, the use of a petri net model ensures that the system beingdeveloped is robust and reliable.

To simplify the analysis of the underlying WABP, the prin-ciple of the equivalent substitution of simpler sequences formore complex ones has been employed. The complexity of theanalysis process can be reduced in WABP-AOPCPN. Somestructures in AOPCPN have been abstracted, such as the Goalplace and Perception transitions. These abstractions wouldneed to be concrete in a real system. In future work, we planto extend the model in this paper to other problems in powersystems.

REFERENCES

[1] J. C. Tan, P. A. Crossley, D. Kirschen, J. Goody, and J. A. Downes, “Anexpert system for the back-up protection of a transmission network,”IEEE Trans. Power Del., vol. 15, no. 2, pp. 508–514, Apr. 2000.


[2] X. R. Wang, K. M. Hopkinson, J. S. Thorp, R. Giovanini, K. Birman,and D. Coury, “Novel backup protection systems for the electric powergrid using agents (in Chinese),” Autom. Elect. Power Syst., vol. 29, pp.50–54, Nov. 2005.

[3] S. J. Lee, B. W. Min, K. H. Chung, M. S. Choi, S. H. Hyun, and S.H. Kang, “Adaptive optimal protection of a distribution system using amulti-agent system,” in Proc. 8th Inst. Elect. Eng. Int. Conf. Develop-ments in Power System Protection, 2004, pp. 611–614.

[4] W. Cong, Z. Pan, and L. Ding, “Study of a high-speed communicationbetwork based wide-area protection system,” in Proc. 8th Inst. Elect.Eng. Int. Conf. Developments in Power System Protection, 2004, pp.689–692.

[5] M. Begovic, “Trends in power system wide area protection,” inProc. IEEE Power Eng. Soc. Power Systems Conf. Expo., 2004, pp.1612–1613.

[6] R. Giovanini, K. Hopkinson, D. V. Coury, and J. Thorp, “A primaryand backup cooperative protection system based on wide area agents,”IEEE Trans. Power Del., vol. 21, no. 3, pp. 1222–1230, Jul. 2006.

[7] G. Jiroveanu and R. K. Boel, “A common architecture for distributeddiagnosis and wide-area backup protection,” in Proc. 8th Inst. Elect.Eng., Int. Conf. Developments in Power System Protection, 2004, pp.756–759.

[8] K. Hopkinson, X. Wang, R. Giovanini, J. Thorp, K. Birman, andD. Coury, “EPOCHS: A platform for agent-based electric powerand communication simulation built from commercial off-the-shelfcomponents,” IEEE Trans. Power Syst., vol. 21, no. 2, pp. 548–558,May 2006.

[9] T. Murata, “Petri nets: Properties, analysis, and applications,” Proc.IEEE, vol. 77, no. 4, pp. 541–580, Apr. 1989.

[10] Q. Bai, M. Zhang, and H. Zhang, “A colored petri net based strategy formulti-agent scheduling,” in Proc. Rational, Robust, Secure NegotiationMechanisms Multi-Agent Systems, 2005, pp. 3–10.

[11] S. Hammami, I. Tnazefti, M. Moalla, and A. Chaillet, “Designing con-trol and diagnosis for flexible manufacturing systems as a multi-agentsystem using blackboard and object petri nets,” in Proc. INRIA/IEEESymp. Emerging Technologies Factory Automation, 1995, pp. 373–382.

[12] A. Perkusich and J. C. A. d. Figueiredo, “G-nets: A petri net basedapproach for logical and timing analysis of complex software systems,”J. Syst. Softw., vol. 39, pp. 39–59, 1997.

[13] H. Xu and S. M. Shatz, “A framework for model-based design of agent-oriented software,” IEEE Trans. Softw. Eng., vol. 29, no. 1, pp. 15–30,Jan. 2003.

[14] H. Xu and S. M. Shatz, “An agent-based petri net model with appli-cation to seller/buyer design in electronic commerce,” in Proc. 5th Int.Symp. Autonomous Decentralized Systems, 2001, pp. 11–18.

[15] W. Han and M. A. Jafari, “Controller synthesis via mapping task se-quence to petri nets in multi-agent collaboration applications,” in Proc.IEEE Int. Conf. Robotics Autom., 2003, pp. 4312–4317.

[16] S. Kumagai and T. Miyamoto, “An agent net approach to autonomousdistributed systems,” in Proc. IEEE Int. Conf. Syst., Man, Cybern., Bei-jing, China, 1996, pp. 3204–3209.

[17] N. Lu, J. H. Chow, and A. A. Desrochers, “A multi-layer petri netmodel for deregulated electric power systems,” in Proc. Amer. Con-trol Conf., Anchorage, AK, 2002, pp. 513–518.

[18] P. S. Georgilakis, J. Katsigiannis, and K. P. Valavanis, “Petri net basedtransformer fault diagnosis,” in Proc. Int. Symp. Circuits Systems, 2004,pp. V-980–V-983.

[19] J. Sun, S.-Y. Qin, and Y.-H. Song, “Fault diagnosis of electric powersystems based on fuzzy petri nets,” IEEE Trans. Power Syst., vol. 19,no. 4, pp. 2053–2059, Nov. 2004.

[20] N. A. Fountas, N. D. Hatziargyriou, and K. P. Valavanis, “Hierarchicaltime-extended petri nets as a generic tool for power system restoration,”IEEE Trans. Power Syst., vol. 12, no. 2, pp. 837–843, May 1997.

[21] X. Tong and X. Wang, “Agent-oriented petri net based modeling of dy-namic behavior for wide-area backup protection,” in Proc. 8th ACIS Int.Conf. Software Engineering, Artificial Intelligence, Networking, andParallel/Distributed Computing, Qingdao, China, 2007, pp. 160–165.

[22] J. L. Peterson, “Petri nets,” ACM Comput. Surveys, vol. 9, pp. 223–252,Sep. 1977.

[23] K. Jensen, Coloured Petri Nets: Basic Concepts, Analysis Methods, andPractical Use. Berlin, Germany: Springer, 1996, vol. 1.

Xiaoyang Tong is an Associate Professor at Southwest Jiaotong University,Chengdu, Sichuan, China. His research interests include agents, substation au-tomation, networking, and simulation.

Xiaoru Wang (M’02–SM’07) is a Professor in the School of Electrical Engi-neering at Southwest Jiaotong University, Chengdu, Sichuan, China. Her re-search interests are in the areas of power system protection and control.

Kenneth M. Hopkinson (M’04) is an Assistant Professor in the Department ofElectrical and Computer Engineering at the Air Force Institute of Technology,Wright-Patterson Air Force Base, OH. His research interests are in the areas ofdistributed systems, networking, and simulation.

IEEE paper

Documents

Transcript of IEEE paper