SPN 2003 Preliminary Version. Translating Hybrid Petri Nets into Hybrid. Automata 1. Dipartimento di Informatica. Universita di Torino

Transcription

1 SPN 2003 Preliminary Version Translating Hybrid Petri Nets into Hybrid Automata 1 Marco Gribaudo 2 and Andras Horvath 3 Dipartimento di Informatica Universita di Torino Corso Svizzera 185, Torino, Italy Abstract In this paper we discuss how hybrid Petri nets (HPN) can be translated into hybrid automata. Hybrid (or Fluid) Petri nets are Petri net (PN) based model with two classes of places: discrete places that carry a natural number of distinct objects (tokens), and uid places that hold a positive amount of uid, represented by a real number. The HPN formalism we present in this work allows for dening the system model using nondeterministic transition rates and is intended for analysis in non-stochastic setting. 1 Introduction Hybrid Petri nets (HPN) are Petri net (PN) based models in which some places may hold a discrete number of tokens and some places a continuous quantity represented by a real number. HPN were introduced in [2], and in [7] were extended to include non-determinism both for ring times and rate of uid transitions. HPNs aim at providing an approximation to discrete-state systems in which the number of objects (customers, packets, tasks, etc.) becomes exceedingly large to be treated with the discrete state approach common to PN. Traditionally, non-stochastic PN based formalisms are applied for addressing qualitative questions (like reachability) and model checking, while on the stochastic side the main objective is performance evaluation. In [4] a unied modelling view for PN was presented that allows for both non-stochastic and stochastic analysis of the same model. In [7] a similar unied view for HPN 1 Authors acknowledge partial support of project FIRB-PERF. 2 marcog@di.unito.it 3 horvath@di.unito.it This is a preliminary version. The nal version will be published in Electronic Notes in Theoretical Computer Science URL:

2 p i discrete place T j timed transition discrete arc p i tokens t k immediate transition inhibitor arc test arc c l x 2 fluid place F j Fluid transition fluid arc c l fluid set arc Fig. 1. All the primitives of the HPN formalism was presented, but the details on how a HPN model can be analyzed in a non-stochastic setting were not presented. On the other hand, hybrid automata (HA) [3] have been introduced to study real time system in non-deterministic environment. The modelling power of hybrid automata and uid stochastic Petri nets (FSPNs, a formalism similar to the HPN model we present here) has been compared in [10], and some idea on how a FSPN could be translated into a HA were proposed in that work. In this work we will present how a HPN model with non-deterministic ring times and non-deterministic ow rates, described in [7], can be analyzed by translating the model into hybrid automata. The paper is organized as follows. Section 2 briey recalls the proposed HPN formalism. In Section 3 we present the denition of the hybrid automata used in the remaining part of the paper. The translation procedure is presented in Section 4. An example is discussed in Section 5. Conclusions are drawn in Section 6. 2 The formalism We dene an HPN as a tuple hp; T ; A; M 0 i. Hereinafter we introduce all the elements of this tuple and the evolution of the model emphasizing the non-stochastic part of the formalism. Figure 1. summarizes the graphical representation of all the HPN primitives. P is the set of places partitioned into a set of discrete places Pd = fp 1 ; : : : ; p jpd jg, and a set of continuous places P c = c 1 ; : : : ; c jpcj (with P d \ P c = ; and P d [ P c = P). The discrete places may contain tokens (the number of tokens is a natural number), while the marking of a continuous place is a 93

3 p 1 T j p 2 F j c l F j p 1 T i p 1 T i c 1 c 2 A c F j F j t k T j c l t k c 1 c 1 A d t k t k A s A h A t Fig. 2. All the possible ways of placing arcs in a net non negative real number. The complete state (marking) of a HPN is described by a pair of vectors M = (m; x). The vector m represents the marking of the discrete part of the state, with m i 0 for any i : p i 2 P d. The uid levels of the continuous places are represented by the vector x with x i 0 for any i : c i 2 P c. T is the set of transitions partitioned into a set of timed transitions Tt, a set of immediate transitions T i, and a set of uid transitions T f (with T u \ T k = ;, for u; k = t; i; f; u 6= k and T t [ T i [ T f = T ). A is the set of arcs partitioned into ve subsets: Ad, A c, A s, A h and A t. All the possible ways of placing arcs in a net is depicted in Figure 2. The subset A d contains the discrete arcs which can be seen as a function A d : ((P (T t [ T i )) [ ((T t [ T i ) P))! IN, i.e. discrete arcs connect places (either discrete and continuous) to timed and immediate transitions. The subset A c of ((P c T f ) [ (T f P c ))! IR, denes the continuous arcs along which uid is moved. A continuous arc can connect a uid place to a uid transition or it can connect a uid transition to a uid place. The subset A s of ((T t [T i )P c )! IR contains the set arcs. A s. These arcs connect continuous places to timed or immediate transitions, and describe the capability of a transition to set the uid level into a continuous place when it res. The subset A h is the set of inhibitor arcs, A h : (P d T )! IN [ (P c T )! IR, and refers to the possibility of enabling a transition when to which it is connected has a marking which is lass than the weight of the arc. The subset A t contains the test arcs, A t : (P d T )! IN [(P c T )! IR. They test if a place contains at least a given number of token (or a quantity of uid). Based on the result of the test, transitions can be enabled or disabled. M 0 = (m 0 ; x 0 ) denotes the initial state of the FSPN. The subsets A d and A h dene the input/output and the inhibitor arcs of common notation of Generalized Stochastic Petri Nets (GSPN, see [1] for further details) while the subsets A c and A s dene arcs that are related with the continuous places. Test arcs A t have been introduced to visually dene (together with the inhibitor arcs that starts from uid places) the enabling 94

4 condition on uid transitions. Given a transition t j 2 T, we denote with t j = fp i 2 P d : A d (p i ; t j ) > 0g[ fp i 2 P : A t (p i ; t j ) > 0g and with t j = fp i 2 P d : A d (t j ; p i ) > 0g the input and the output set of transition t j, and with t j = fp i 2 P : A h (p i ; t j )g the inhibition set of transition t j. The denition of t j involves only discrete places and hence is exactly the one dened for common GSPN. The denitions of t j and t j are instead dierent since they include also uid places (see [7]). In the following, by providing the enabling and ring rules, we describe how the marking process evolves in time. Let us denote by m i the i-th component of vector m, i.e., the number of tokens in place p i when the discrete marking is m. We say that a transition t j 2 T d [T i has concession in marking M = (m; x) if and only if 8 p i 2 t j ; p i 2 P d ; m i A d (p i ; t j ) and m i A t (p i ; t j ); 8 p i 2 t j ; p i 2 P d m i < A h (p i ; t j ); c i 2 t j ; c i 2 P c ; x i A d (c i ; t j ) and x i A t (c i ; t j ); 8 c i 2 t j ; c i 2 P c x i < A h (c i ; t j ): If any immediate transition t j has concession in M = (m; x), and its enabling condition does not depend on the continuous component of the marking (i.e. ( t j [ t j ) \ P c = ;), it is said to be enabled and the marking is said to be vanishing. If some immediate transition t j has concession in M = (m; x), but its enabling condition depends on the continuous component of the marking (i.e. ( t j [ t j )\P c 6= ;), then this particular transition may become enabled or disabled due to a change in the uid part of the marking. In this case the marking is said to be potentially vanishing, and both the immediate and timed transitions that have concession must be considered potentially enabled. Otherwise, the marking is said to be tangible and any timed transition with concession is enabled in it. In other words, a timed transition is not enabled in a vanishing marking even if it has concession. It may however be enabled in a potentially vanishing marking due to the uid part of marking 4. The ring of a transition T j 2 (T t [ T i ) enabled in marking M = (m; x) yields a new marking M 0 = (m 0 ; x 0 ), i.e., (m; x) T j?! (m 0 ; x 0 ), where 8 p i 2 P d ; m 0 i = m i + A d (T j ; p i )? A d (p i ; T j ) and 8 c l 2 P c ; x 0 l = 8 < : A s(c l ; T j ) if (c l ; T j ) 2 A s x l + A d (T j ; c l )? A d (c l ; T j ) otherwise. In other words, the ring of a timed transition T j immediately set the level of all the continuous places c k that are connected with set arcs to T j (of weight 4 Note that the previous denition is dierent from the one of standard GSPNs [1], since it must take into account problems that may arise due to the uid part of the model. The ring rule is also dierent from the one of GSPNs because the ring of a transition may aect the continuous part of the marking due to set and discrete arcs. 95

5 w k ) to the value associated to the arc, that is x k = w k (ignoring the eect that standard arcs may have). In HPN we allow non-determinism only on the transition ring rates. We do not allow non-deterministic arc weights. The denition of the transition ring rates follows the idea of [9]. Firing time is assigned as a constant value or as an interval dened by earliest and latest ring time values. The ring semantics is interleaving with non-determinism (no weight is assigned to the action of atomic ring inside the allowed interval or for resolving conicts). Moreover, we follow the extended ring semantics introduced in [6]: time is assigned as intervals, and ring may be forced when the maximum time expires (strong ring semantics) or ring may be not mandatory when the maximum time expires (weak ring semantics). The earliest and the latest ring time can depend on the actual marking of the net. A transition can re after any amount of time that is contained inside the interval dened by the earliest and the latest ring time. The evolution of the discrete part of the HPN in a tangible marking is governed by a race. In a vanishing marking instead, the choice of which transition should re is left non-deterministic 5. The evolution of the continuous part depends on the uid transitions. Fluid transitions can be enabled or disabled in any marking, tangible or vanishing. A uid transition t j is enabled if and only if 8 p i 2 t j ; p i 2 P d ; m i A t (p i ; t j ); 8 p i 2 t j ; p i 2 P d ; m i < A h (p i ; t j ); 8 c i 2 t j ; c i 2 P c ; x i A t (c i ; t j ); 8 c i 2 t j ; c i 2 P c x i < A h (c i ; t j ): Each continuous arc that connects a uid place c k 2 P c to an enabled uid transition T j 2 T f (or an enabled transition T j to a uid place c k ), causes a non-deterministic \change" in the uid level of place c k. Along a uid arc the rate at which the uid is moved into a uid place or away from a uid place is dened by an interval. The actual uid rate along the arc can be any value from this interval chosen in non-deterministic but non-stochastic manner. The potential rate of change of uid level of a given place can be computed by superposing the eect of the connected uid arcs. 3 Hybrid Automata In this section an informal description of HA is given. Detailed denition is given in [3]. A hybrid automata consists of the following components: Variables. Continuous quantities of the hybrid system are modelled by a nite number of real-valued variables. In the present section, the variables of a HA will be denoted by X i. 5 Note that priority as dened in [1] could be introduced as well, but it has been avoided to simplify the presentation of the formalism. 96

6 Locations. Locations are used to model discrete states of the hybrid system. The graph that consists of the locations and the transitions of the automata is called the control graph of the automata. Initial condition. The initial state of the model is dened by the initial condition. It denes the initial location and the initial values of the variables. Initial values of the variables can be written, for example, as X 1 = 10 ^ X 2 = 5. Invariant conditions. An invariant condition can be associated to each location. A location is not admissible if its invariant condition does not hold. Invariant condition can be written, for example, as X 1 > 5 ^ X 2 < 10X 1 _ X 1 4. Since the automata may stay in a given location only if its invariant condition holds, invariants can be used to enforce the automata to change location. Flow conditions. The rate of change of the real-valued variables in a location is dened by the ow condition associated to the given location. The ow condition is a predicate over the variables of the automata, X i and the rst derivatives of the variables, X_ i. As long as the automata stays in a location, the variables change along trajectories whose rst derivatives satisfy the ow condition associated to the location. A possible ow condition is, for example, X 1 1 ^ X _ 1 = 0 _ X 1 > 1 ^ 1 X _ 1 2. Transitions. Change of location of the automata is modelled using transitions. A transition is an edge between two locations of the automata. We assign to each transition a jump condition. The jump condition consists of two predicates on the variables of the automata: the enabling predicate and the transition predicate. The enabling predicate denes \when" the automata can change its location. The enabling predicate can be written, for example, as X 1 > 3 ^ X 2 = 5. The transition predicate instead determines "what" happens to the variables during the transition, i.e. we can dene which variables will be changed during the transition and give their value after the transition is taken. The transition predicate can be, for example, X 1 = 5 ^ X 2 = 10. Furthermore, a transition can be assigned with the ag urgent. The presence of the ag urgent means that if the enabling predicate holds then the automata has to change location. If in a location more then one enabling predicate hold the transition to be taken is chosen in non-deterministic manner. 4 Translation of HPN into HA An HPN can be converted into a hybrid automata following a procedure similar to the one described in [10]. In particular, the hybrid automata corresponding to a HPN will be constructed as follow: Variables. The HA will have a real-valued variable X i for each uid place c i 2 P c, and a real-valued variable C j for each timed transition T j 2 T e to 97

7 represent its clock (i.e. the time since which the transition is enabled). Locations. The reachability graph of the HPN will correspond to the control graph of HA. In particular, each discrete state will correspond to a location, while each discrete state transition of the HPN will correspond to a transition of the HA. Due to the presence of potentially vanishing markings extra care has to be taken when dening the reachability graph of a HPN. In particular, vanishing marking will have edges associated only to immediate transitions, tangible marking will have edges associated only to timed transition, while potentially vanishing marking will have edges associated with both timed and immediate transitions. Initial condition. The initial condition will give as initial location the on that corresponds to the initial marking (m 0 ) of the HPN and set the initial values of the real-valued variables as X = x 0 ; C = 0. Invariant conditions. The invariant condition of a location, on the one hand, will correspond to the conjunction of the validity regions of all the uid places in the associated discrete marking m i, that is: B l (m i ; x) X B u (m i ; x). On the other hand, invariant conditions are used to force the automata to change location when a clock of a transition whit strong ring semantics reaches the latest ring time associated with the transition. Flow conditions. The ow conditions will assign to each variable X j the ow rate of the associated uid place c j in the state mi corresponding to that location: X_ j 2 [r l (c j ; m i ; X); r u (c j ; m i ; X)]. It will also associate to each clock C i corresponding to an enabled timed transition T i the rate _C i = 1, and to each clock corresponding to a disabled timed transition T k the rate _C k = 0. Transitions. State change rules will be implemented by jump conditions. Jump conditions specify both the conditions that makes a jump possible (enabling predicate) and the values of the variables in the new state reached after the jump (transition predicate). In particular, in every location that represents a vanishing marking, each transition will be urgent and will have \true" as enabling predicate since in this case all the transitions connected to that location represents immediate transitions whose enabling state does not depend on the uid part of the marking. For tangible marking, each transition corresponding to a particular transition T j in a marking m i will have associated an enabling predicate of the form Cl(j; i) ^ F l(j; i) where Cl(j; i) represents an enabling condition depending on the time spent since the transition become enabled, and F l(j; i) represents an enabling condition depending on the uid part of the marking. In particular Cl(j; i) = C j 2 [F l (T j ; m i ; x); F u (T j ; m i ; x)] which means that transition T j will only be possible when its associated clock will have a value included in the ring interval associated to that transition, and F l(j; i) = X A d ( T j ; T j )\X A d ( T j ; T j ). For potentially vanishing marking each transition representing an immediate transition t k will be urgent and will have an enabling predicate 98

8 corresponding to its enabling state, restricted to the uid levels, that is X A d ( t k \ P c ; t k ) \ X A d ( t k \ P c ; t k ), and transitions representing a timed transition T j will have an enabling predicate of the form Cl(j; i) \ F l(j; i) \ Ni(i) where Cl(j; i) and F l(j; i) have the same meaning as in the tangible case, and N i(i) correspond to the predicate that no immediate transition is enabled in marking m i due to the uid part of the model. The transition predicate, will reect the changes in the uid part of the model due to the transition ring. In particular for the edge that represent transition T j in marking m i, it will contain: C j = 0 if the transition is a timed transition (in order to reset the clock of the transition that has red), X k = A s (c k ; T j ; m i ) if a set arc from c k to T j exist, X k = X k + A s (c k ; T j )? A s (T j ; c k ) if no set arc exists. Note that memory policies like prd, prs and pri [5] may be easily implemented by appropriately setting and resetting the clocks in the edges associated to the various transitions 6. 5 An example of the translation procedure Figure 3 presents a HPN model of a rail-crossing. The model is divided into two parts. Left part of Figure 3 represents the train, right part describes the barrier. For what concerns the train, two situations are distinguished: the train may be away from the rail-crossing or it can be approaching. Place away is marked when the train is far away, while place approaching is marked when the train is near the crossing. Transition next-train represents the arrival of a new train in the rail-crossing area. Firing time of transition next-train is chosen in non-deterministic manner from the interval [E next?train : L next?train ]. The distance between the train and the barrier is represented by uid place trainposition whose level is altered by transition train-moving. This transition is enabled when place approaching is marked since it is connected to place approaching by a test arc. When transition approaching is enabled it decreases the uid level of place train-position in every time unit by a quantity chosen from the interval [S min : S max ]. In other words, the speed of the train is 6 For the pri case another variable would be necessary next-train TRAIN up opening BARRIER approaching away train-moving train-position x far barrierangle open closed x away x near train-away down closing Fig. 3. Hybrid Petri net of the rail-crossing 99

9 x = x aw ay ^ y = 90 ^ t = 0 away,open _t = 1 ^ _x = 0^ ( _y = 0 ^ x > x near y =?B ^ x x near ) t L next?train ^ x 0 ^ y 0 y = 90 y = 0 E next?train t L next?train x = 0 x = x aw ay ^ t = 0 approaching,open _t = 0 ^?Smax _x?smin^ away,closed _t = 1 ^ _x = 0^ ( _y = 0 ^ x > x near y =?B ^ x x near ) x 0 ^ y 0 ( _y = 0 ^ x < x f ar y = B ^ x x f ar ) t L next?train ^ x 0 ^ y 90 y = 0 y = 90 approaching,closed _t = 0 ^?Smax _x?smin^ ( _y = 0 ^ x < x f ar y = B ^ x x f ar ) x 0 ^ y 90 E next?train t L next?train x = 0 x = x aw ay ^ t = 0 Fig. 4. Hybrid automata of the rail-crossing between S min and S max. As soon as the train arrives at the barrier, i.e. uid level of place train-position becomes 0, transition train-away becomes enabled and res. During the ring of this transition uid level of place train-position is set to x away. The barrier may be either open or closed, depending on the marking of places open and closed. The angle of the barrier is represented by uid place barrier-angle. As soon as the angle reaches 0, the token moves from place open to place close. This happens due to immediate transition closing which can re due to the inhibitor arc that connects it to uid place barrier-angle. When the angle reaches 90, the system jumps from closed to open because of transition opening and the test arc that connects it to place barrier-angle. The movement of the barrier is regulated by uid transitions up and down. Transition down is enabled when the train is after (test arc) a given point (x near ) and place open is marked. Transition up is enabled when the train has passed the rail-crossing (inhibitor arc) and is far enough (x f ar ). Initial marking of the model is one token in place away, one token in place open, uid level of place train-position equal to x away and uid level of place barrier-angle equal to 90. The hybrid automata that is generated according to the translation procedure outlined in Section 4 is depicted in Figure 4. In the gure each location is divided into three parts: the rst one describes to which discrete marking 100

10 of the HPN the given node corresponds to, the second gives the ow condition of the location, while the third one describes the invariant condition. Near to the edges, at rst the enabling predicate is given, then, if there are variables to set, under a line, the transition predicate is placed. Since the HPN has four discrete markings the HA has four locations. Further, the HA has three real-valued variables: x and y represent the uid level of place train-position and barrier-angle, respectively, t is the \clock" of timed transition next-train (i.e. it measures the time since which this transition is enabled). Initial location of the HA is away,open. Initial values of the real-valued variables are x = x away, y = 90 and t = 0. In every location that represent a marking in which transition next-train is enabled (locations away,open and away,closed), the associated clock, t is increasing and its maximal value (the latest ring time of transition next-train) is reected by the invariant condition of the location. Change of location caused by ring of transition next-train is possible when E next?train t L next?train. In locations approaching,open and approaching,closed, variable x is decreasing according to a derivative which is inside the interval [S min : S max ] describing the speed of the train. Variable x has to be larger or equal to 0. In locations approaching,open and away,open the angle of the barrier is decreasing if the train is close, i.e. if x x near. Instead, in the two locations approaching,closed and away,closed the angle of the barrier is increasing if the train is far enough, i.e. if x x f ar. The angle of the barrier has to be between 0 and 90. The HA changes its location as a result of the ring of timed transition next-train or one of the immediate transitions train-away, opening and closing. Enabling predicates reect timing properties in case of timed transitions, and enabling conditions in case of immediate transitions. Note that as a result of the automatic translation process several transitions are generated that are not possible. Some of these could be recognized by further processing of the resulting HA. 6 Conclusions In this paper we have outlined a possible translation technique from the hybrid Petri net formalism presented in [8] to hybrid automata. Thanks to the translation, a model described by hybrid Petri net can be analysed resorting to algorithms and tools available for the analysis of hybrid automata. 101

11 References [1] M. Ajmone Marsan, G. Balbo, G. Conte, S. Donatelli, and G. Franceschinis. Modelling with Generalized Stochastic Petri Nets. John Wiley & Sons, [2] H. Alla and R. David. Continuous and Hybrid Petri Nets. Journal of Systems Circuits and Computers, 8(1):159{188, Feb [3] R. Alur, C. Courcoubetis, T.A. Henzinger, and P.-H. Ho. Hybrid automata: An algorithmic approach to the specication and verication of hybrid systems. In R.L. Grossman, A. Nerode, A.P. Ravn, and H. Rischel, editors, Hybrid Systems, Lecture Notes in Computer Science 736, pages 209{229. Springer-Verlag, [4] A. Bobbio and A. Horvath. Petri nets with discrete phase type timing: A bridge between stochastic and functional analysis. In Proc. of MTCS'01, volume 52 No. 3 of ENTCS, Aalborg, Denmark, Aug [5] A. Bobbio, A. Puliato, and M. Telek. A modeling framework to implement combined preemption policies in MRSPNs. IEEE Transactions on Software Engineering, 26:36{54, [6] C. Ghezzi, D. Mandrioli, S. Morasca, and M. Pezzee. A unied high level Petri net formalism for time-critical systems. IEEE Tr. on Software Engineering, 17:160{171, [7] M. Gribaudo and A. Horvath. Modeling hybrid positive systems with hybrid petri nets. In Proc. of 1st Multidisciplinary Int. Symp. on Positive Systems: Theory and Applications (POSTA'03), Rome, Italy, Aug To appear in Lectures Notes in Control and Information Sciences. [8] M. Gribaudo, A. Horvath, A. Bobbio, E. Tronci, E. Ciancamerla, and M. Minichino. Model-checking based on uid petri nets for the temperature control system of the icaro co-generative plant. In Proc. of SAFECOMP'02), volume 2434 of LNCS, Catania, Italy, Sept To appear in Int. Journal of Reliability Engineering & System Safety. [9] P. Merlin and D. J. Faber. Recoverability of communication protocols. IEEE Tr. on Communication, 24(9):1036{1043, [10] B. Tun, D. Chen, and K. S. Trivedi. Comparison of hybrid systems and uid stochastic petri nets. Discrete Event Dynamic Systems: Theory and Applications, 11(1{2):77{95,