values from all submachines Σ
1
, . . . , Σ
m
and selects x,
the feedback value generated by the active subma-
chine Σ
σ
. P forwards x and i ∈ M, the index of the
active submachine, to C. Let Σ
c
denote the closed-
loop system consisting of C, D, P, and Σ.
In Figure 1, v ∈ A
n
is the external input and
w
1
, . . . , w
m
∈ A
d
are the adversarial input occurring to
Σ
1
, . . . , Σ
m
, respectively. When w
i
occurs, Σ
i
experi-
ences an unauthorized state transition. For instance,
if the active submachine of Σ is Σ
i
staying at a stable
state x at which w
i
is defined, Σ
i
must be forced to
reach s
i
(x, w
i
) as the result of the fault. If an imme-
diate fault recovery to the original state is not con-
ducted, the next behavior of Σ with respect to the
new external input would show incorrect state/input
behavior. Thus the objective of fault diagnosis and
tolerance is that the corrective controller C must be
designed such that the closed-loop system Σ
c
can
achieve instantaneous fault recovery upon diagnosing
an occurrence of a fault.
One point to be reminded is that immediate fault
recovery is impossible in the case that the fault shows
intermittent characteristics. When w
i
represents the
intermittent fault, Σ
i
cannot return to x upon diag-
nosing an occurrence of w
i
. But since Σ has m sub-
machines and each submachine has the same state
space made of X, we can regard that fault tolerance
is achieved if Σ returns to the state x of another sub-
machine. Whether Σ has such robust reachability will
be discussed in detail in the next section.
To avoid unpredictable behaviors caused by the
absence of a synchronizing clock, we assume that Σ
c
always preserves the principle of fundamental mode
operations (Kohavi and Jha, 2010) whereby a variable
must change its value when both C and Σ are in sta-
ble states, and no two or more variables can be altered
simultaneously.
3 ROBUST REACHABILITY
3.1 Skeleton Matrix
Assuming |X| = n, we denote the state set by X =
{x
1
, . . . , x
n
}. Reachability of switched asynchronous
sequential machines is classified into to two aspects:
(i) stable reachability of each submachine, and (ii)
switching capability between different submachines.
In corrective control of single asynchronous ma-
chines, reachability of a machine is described by a
Boolean matrix, termed the skeleton matrix (Murphy
et al., 2003; Peng and Hammer, 2012), as follows.
Definition 1. K(Σ
i
), the skeleton matrix of Σ
i
=
(A, X, f
i
), is an n× n matrix whose (p, q) entry is
K
p,q
(Σ
i
) =
1 ∃t ∈ A
+
n
s.t. x
q
= s
i
(x
p
, t)
0 otherwise
If K
p,q
(Σ
i
) = 1, a corrective controller can be con-
structed that takes Σ
i
from x
p
toward x
q
in the asyn-
chronous mechanism using an input string t ∈ A
+
n
such that x
q
= s
i
(x
p
, t). For a detailed procedure
of controller construction, the readers are referred to
Murphy et al. (2003); Peng and Hammer (2012).
Switching capability of Σ implies the ability of Σ
to change its mode from a submachine to another sub-
machine at a specific stable state. In the prior work
(Yang, 2016), a constraint is imposed on the switch-
ing operation that as the result of switching, the active
submachine always takes the same state possessed by
the previous submachine. In this study, we general-
ize the switching operation by relaxing the foregoing
constraint. In other words, the new active subma-
chine does not necessarily transfer to the same state
at which the old one has stayed before switching. To
address the switching relation between two subma-
chines, we define the following matrix.
Definition 2. W(i, j), the switching incidence ma-
trix of two submachines Σ
i
and Σ
j
, is an n × n matrix
whose (p, q) entry is
W
p,q
(i, j) =
1 Σ switches the mode from Σ
i
at x
p
to Σ
j
at x
q
0 otherwise
W(i, j) represents switching capability of Σ in the
most general way, that is, the state of the present
submachine may differ from the previous one after
switching. The motivation for introducing W(i, j)
stems from the fact that some switched machines have
multiple submachines that share the same system
module to realize the state space. As the switching op-
eration depends on this implementation restraint, the
next state may be different from the previous one.
Note that for switching from Σ
i
at x
p
to Σ
j
at x
q
,
there must exist an input a ∈ A
n
that makes a stable
pair with both x
p
of Σ
i
and x
q
of Σ
j
, i.e.,
W
p,q
(i, j) = 1 ⇒ U
i
(x
p
) ∩U
j
(x
q
) 6=
/
0 (1)
Under the principle of fundamental mode operations,
Σ
i
should stay at the stable state x
p
at the moment that
the switching signal σ changes. Hence the present
control signal is u ∈ U
i
(x
p
). Moreover, u must also
make a stable pair with x
q
in Σ
j
, namely u ∈ U
j
(x
q
);
otherwise Σ
j
could not maintain x
q
upon completion
of the switching operation. However, the condition
u ∈ U
j
(x
q
) may not be always valid since u is deter-
mined only by the past state trajectory of Σ
i
. Still, as
long as U
i
(x
p
)∩U
j
(x
q
) 6=
/
0 is held true, C can achieve