Using Integer Time Steps for Checking Branching Time Properties of Time Petri Nets

Transcription

1 Using Integer Time Steps for Checking Brnching Time Properties of Time Petri Nets Agt Jnowsk1, Wojciech Penczek2, Agt Półrol3, nd Andrzej Zbrzezny4 1 4 Institute of Informtics, University of Wrsw, Bnch 2, Wrsw, Polnd jnowsk@mimuw.edu.pl 2 Institute of Computer Science, PAS, Ordon 21, Wrsw, Polnd penczek@ipipn.ww.pl 3 University of Łódź, FMCS, Bnch 22, Łódź, Polnd polrol@mth.uni.lodz.pl Jn Długosz University, IMCS, Armii Krjowej 13/15, Cze stochow, Polnd.zbrzezny@jd.czest.pl Abstrct. Verifiction of timed systems is n importnt subject of reserch, nd one of its crucil spects is the efficiency of the methods developed. Extending the result of Popov which sttes tht integer time steps re sufficient to test rechbility properties of time Petri nets [5, 8], in our work we prove tht the discrete-time semntics is lso sufficient to verify ECTL nd ACTL properties of TPNs with the dense semntics. To show tht considering this semntics insted of the dense one is profitble, we compre the results for SAT-bsed bounded model checking of ACTL X properties nd the clss of distributed time Petri nets. 1 Introduction Verifiction of time-dependent systems is n importnt subject of reserch. The crucil problem to del with is the stte explosion: the stte spces of these systems re usully very lrge due to infinity of the dense time domin, nd re likely to grow exponentilly in the number of concurrent components of the system. This influences strongly the efficiency of the model checking methods. The ppers of Popov [5, 8] show tht in the cse of checking rechbility for systems modelled by time Petri nets (i.e., while testing whether mrking of net is rechble) one cn use discrete (integer) time steps insted of relvlued ones. This reduces the stte spce to be serched. The im of our work is to investigte whether the result of Popov cn be extended, i.e., whether the discrete-time semntics cn replce the dense-time one lso while verifying wider clss of properties of dense-time Petri net systems. In this pper we present our preliminry result, i.e., prove tht the discrete-time model cn be used insted of the dense-time one while verifying ECTL nd ACTL properties. To show tht such n pproch cn be profitble we perform some experiments, using n implementtion for SAT-bsed bounded model checking of ACTL X

2 16 PNSE 12 Petri Nets nd Softwre Engineering nd the clss of distributed time Petri nets with the discrete-time semntics [4], s well s its modifiction for the dense-time cse. The rest of the pper is orgnised s follows: Sec. 2 discusses the relted work. Sec. 3 introduces time Petri nets nd their dense nd discrete models. Sec. 4 presents the logics ECTL nd ACTL. Sec. 5 dels with the theoreticl considertions, while Sec. 6 presents the experimentl results. Sec. 7 contins finl remrks nd sketches directions of the further work. 2 Relted Works We would like to stress tht in our work we re interested in brnching time properties. To our best knowledge the fct tht the discrete-time semntics is sufficient to verify ECTL or ACTL properties of time Petri nets (TPNs) with the dense-time semntics hs never been proven before. The topic of verifiction of dense-time Petri nets using integer time steps hs been studied in severl publictions. In pper [5] it is shown how to construct rechbility grph whose vertices re rechble integer sttes for time Petri nets in which ll the ltest firing times re finite. The min theorem of [5] (Thm 3.2) sttes tht for ech run of TPN, strting t its initil stte, it is possible to find corresponding run which strts t the initil stte s well, nd visits integer sttes only. Due to this theorem discrete nlysis of boundedness nd liveness of TPN is possible. The work [6] extends the results of [5] to rbitrry TPNs. It uses the ide of freezing the clock vlues of trnsitions with infinite Lf t just s their Eft is reched. This wy reduced (finite) rechbility grph of essentil (integer) sttes is obtined. In [8] nd [7] the stte spce of TPN is chrcterised prmetriclly. The min theorems (Thm 3.1 nd Thm 3.2) of [8] stte tht for n rbitrry fesible execution pth where the clocks hve rel vlues it is possible to replce these rel vlues by integer ones nd obtin nother fesible pth. The derences between the clocks vlues of ech enbled trnsition t given mrking in the former nd the ltter pth re lwys smller thn 1, nd so re the derences between totl times of both the executions. The min ide of the proof is s follows: the integer vlues re constructed out of the given ssignments of rel vlues by successive trnsforming ll the non-integer numbers to nerby integers in n + 1 steps, where n is the length of the pth. According to the theorems the miniml nd mximl time durtion of trnsition sequence re integer vlues. In the pper [7] n enumertive procedure for reducing the stte spce is introduced. The ide is to divide problem into finite number of smller problems, which cn be solved recursively with methodology inspired from dynmic progrmming. Moreover, it extends the method of [8] to the nets with rel-vlued time steps (in [8] rtionl time steps were llowed only) nd infinite ltest firing times. The uthors of the bove-mentioned ppers clim tht the knowledge of the rechble integer sttes is sufficient to determine the entire behviour of the net t ny point in time. However, ll these ppers show the trce equivlence

3 A. Jnowsk et l.: Checking Brnching Time Properties of Time Petri Nets 17 b c b c p1 p2 p1 p2 Fig. 1. Two trce equivlent models which re not (bi)similr. A formul distinguishing them is e.g. ϕ = EF(EXp1 EXp2) which holds for the model on the right only between continuous model nd (restricted) discrete one. It is very well known tht trce equivlence preserves liner time properties, but it does not preserve brnching time properties (see Fig. 1 nd [1]), so the word behviour should probbly be understood in wy following from frgment of [7]: The properties of Petri net, both the clssicl one s well s the TPN, cn be divided into two prts: There re sttic properties, like being pure, ordinry, free choice, extended simple, conservtive, etc., nd there re dynmic properties like being bounded, live, rechble, nd hving plce- or trnsitions invrints, dedlocks, etc. While it is esy to prove the sttic behvior of net using only the sttic definition, the dynmic behvior depends on both the sttic nd dynmic definitions nd is quite complicted to prove., so s the dynmic properties listed. Moreover, the result of the ppers [5, 6] does not imply bisimultion between both the models, s the construction given in these ppers cnnot be used to prove it. We discuss this on p. 27, showing tht the reltion R used in our proof nd derived from the result of [5, 6] cnnot be used to prove bisimultion. This follows from the fct tht the integer run π justifying σ Rσ (generted ccording to the construction of [5]) nd the dense run π occurring in the reltion do not need to brnch in the sme wy. Similrly, the result of [8, 7] does not imply (bi)simultion s well. Although it is not stted directly, the construction given in these ppers is bsed on prmetric description of the clsses of the forwrd-rechbility grph for net considered (i.e., structure in which the initil stte clss contins the initil stte of the net nd ll the time successors of this stte, nd given stte clss C x corresponding to firing sequence of trnsitions x, its successor clss on trnsition t contins ll the concrete sttes which cn be obtined by firing t t concrete stte σ C x nd then pssing some time not disbling ny enbled trnsition). It is well known tht such structure preserves rechbility nd liner time properties, but it does not preserve brnching time properties. The discrete runs constructed in both the ppers re retrieved from the dense ones to preserve nothing but visiting the sme stte clsses s the runs they correspond to. The current pper is modified nd improved version of our work [3] (published in the proceedings of locl workshop, nd contining completely derent proof which does not define simultion explicitely).

4 18 PNSE 12 Petri Nets nd Softwre Engineering 3 Time Petri Nets We strt from introducing some bsic definitions relted to time Petri nets. For simplicity of the presenttion we focus on 1-sfe time Petri nets only. However, our result pplies lso to unbounded nets, which is explined in more detils in the finl section. Let IN be the set of nturl numbers (including zero), nd IR (IR + ) be the set of (nonnegtive) rels. Time Petri nets re defined s follows: Definition 1. A time Petri net (TPN, for short) is six-element tuple N = (P, T, F, Eft, Lft, m 0 ), where P = {p 1,..., p np } is finite set of plces, T = {t 1,..., t nt } is finite set of trnsitions, F (P T ) (T P ) is the flow reltion, Eft : T IN nd Lft : T IN { } re functions describing the erliest nd the ltest firing time of the trnsition, where for ech t T we hve Eft(t) Lft(t), nd m 0 P is the initil mrking of N. For trnsition t T we define its preset t = {p P (p, t) F } nd postset t = {p P (t, p) F }, nd consider only the nets such tht for ech trnsition the preset nd the postset re nonempty. We need lso the following nottions nd definitions: mrking of N is ny subset m P, trnsition t T is enbled t m (m[t for short) if t m nd t (m\ t) = ; nd leds from m to m, if it is enbled t m, nd m = (m \ t) t. The mrking m is denoted by m[t s well, if this does not led to misunderstnding. en(m) = {t T m[t }; for t en(m), newly_en(m, t) = {u T u en(m[t ) (t u u t )}. Concerning the behviour of time Petri nets, it is possible to consider densetime semntics, i.e. the one in which the time steps cn be of n rbitrry (nonnegtive) rel-vlued length, nd the discrete one which considers integer time pssings only. Below we define both of them. 3.1 Dense-Time Semntics In the dense-time semntics (the dense semntics in short) concrete stte σ of net N is defined s pir (m, clock), where m is mrking, nd clock : T IR + is function which for ech trnsition t en(m) gives the time elpsed since t becme enbled most recently, nd ssigns zero to other trnsitions. Given stte (m, clock) nd δ IR +, denote by clock + δ the function defined by (clock +δ)(t) = clock(t)+δ for ech t en(m), nd (clock +δ)(t) = 0 otherwise. By (m, clock) + δ we denote (m, clock + δ). The dense concrete stte spce of N is structure (T IR +, Σ, σ 0, r ), where Σ is the set of ll the concrete sttes of N, σ 0 = (m 0, clock 0 ) with clock 0 (t) = 0 for ech t T is the initil stte of N, nd r Σ (T IR + ) Σ is timed consecution reltion defined by:

5 A. Jnowsk et l.: Checking Brnching Time Properties of Time Petri Nets 19 for δ IR +, (m, clock) δ r (m, clock + δ) (clock + δ)(t) Lft(t) for ll t en(m) (time successor), t for t T, (m, clock) r (m, clock ) t en(m), Eft(t) clock(t) Lft(t), m = m[t, nd for ll u T we hve clock (u) = 0 for u newly_en(m, t) nd clock (u) = clock(u) otherwise (ction successor). Notice tht firing of trnsition tkes no time. Given set of propositionl vribles P V, we introduce vlution function V : Σ 2 P V which ssigns the sme propositions to the sttes with the sme mrkings. We ssume the set P V to be such tht ech q P V corresponds to exctly one p P, nd use the sme nmes for the propositions nd the plces. The function V is then defined by p V (σ) p m for ech σ = (m, ). The structure M r (N ) = (T IR +, Σ, σ 0, r, V ) is dense concrete model of N. A dense σ-run of TPN N is (mximl) sequence of sttes: σ 0 0 r σ 1 1 r σ 2 2 r..., where σ 0 = σ Σ nd i T IR + for ech i 0. A stte σ is rechble in M r (N ) if there is dense σ 0 -run σ 0 0 r σ 1 1 r σ 2 2 r... such tht σ = σ i for some i IN. 3.2 Discrete-Time Semntics Alterntively, one cn consider integer time pssings only. In such discretetime semntics (discrete semntics in short) (discrete) concrete stte σ n of net N is pir (m, clock n ), where m is mrking, nd clock n : T IN is function which for ech trnsition t en(m) gives the time elpsed since t becme enbled most recently, nd ssigns zero to the other trnsitions. Given stte (m, clock n ) nd δ IN, we define clock n +δ nd (m, clock n )+δ nlogously s in the dense-time cse. The discrete concrete stte spce of N is structure (T IN, Σ n, σ n 0, n ), where Σ n is the set of ll the discrete concrete sttes of N, σ n 0 = (m 0, clock n 0 ) with clock n 0 (t) = 0 for ech t T is the initil stte of N, nd n Σ n (T IN) Σ n is timed consecution reltion defined by: for δ IN, (m, clock n ) δ n (m, clock n + δ) (clock n + δ)(t) Lft(t) for ll t en(m) (time successor), for t T, (m, clock n ) t n (m, clock n ) t en(m), Eft(t) clock n (t) Lft(t), m = m[t, nd for ll u T we hve clock n (u) = 0 for u newly_en(m, t) nd clock n (u) = clock n (u) otherwise (ction successor). Agin, firing of trnsition tkes no time. Given set of propositionl vribles P V, we introduce vlution function V n : Σ n 2 P V which ssigns the sme propositions to the sttes with the sme mrkings. Similrly s in the dense cse, we ssume the set P V to be such tht ech q P V corresponds to exctly one p P, nd use the sme nmes for the propositions nd the plces. The function V n is then defined by p V n (σ n ) p m for ech σ n = (m, ). The structure M n (N ) = (T IN, Σ n, σ 0 n, n, V n ) is discrete concrete model of N.

6 20 PNSE 12 Petri Nets nd Softwre Engineering A discrete σ n -run of TPN N is (mximl) sequence of sttes: σ 0 n0 n n..., where σ n0 = σ n Σ n nd i T IN for ech i 0. A stte σ n1 1 n σ n2 2 σ n is rechble in M n (N ) there is σ 0 n -run of N σ 0 n0 n σ 1 n1 n σ 2 n2 such tht σ n = σ ni for some i IN. n... 4 Temporl Logics ACTL nd ECTL In our work we del with verifiction of properties of time Petri nets expressed in certin sublogics of the stndrd brnching time logic CTL. Below, we define the logics of our interest. 4.1 Syntx nd Sublogics of CTL Let P V = { 1, 2...} be set of propositionl vribles. The lnguge of CTL is given s the set of ll the stte formuls ϕ s (interpreted t sttes of model), defined using pth formuls ϕ p (interpreted long pths of model), by the following grmmr: ϕ s := ϕ s ϕ s ϕ s ϕ s ϕ s Aϕ p Eϕ p ϕ p := ϕ s ϕ p ϕ p ϕ p ϕ p Xϕ p U(ϕ p, ϕ p ) R(ϕ p, ϕ p ). In the bove P V, A ( for All pths ) nd E ( there Exists pth ) re pth quntifiers, wheres U ( Until ) nd R ( Relese ) re stte opertors. Intuitively, the formul Xϕ p specifies tht ϕ p holds in the next stte of the pth, wheres U(ϕ p, ψ p ) expresses tht ψ p eventully occurs nd tht ϕ p holds continuously until then. The opertor R is dul to U: the formul R(ϕ p, ψ p ) sys tht either ψ p holds lwys or it is relesed when ϕ p eventully occurs. Derived opertors def def re defined s Gϕ p = R(flse, ϕ p ) nd Fϕ p = U(true, ϕ p ), where true def =, nd flse def = for n rbitrry P V. Intuitively, the formul Fϕ p specifies tht ϕ p occurs in some stte of the pth ( Finlly ), wheres Gϕ p expresses tht ϕ p holds in ll the sttes of the pth ( Globlly ). Next, we define some sublogics of CTL : ACTL : the frgment of CTL in which the stte formuls re restricted such tht negtion cn be pplied to propositions only, nd the existentil quntifier E is not llowed, ECTL : the frgment of CTL in which the stte formuls re restricted such tht negtion cn be pplied to propositions only, nd the universl quntifier A is not llowed, ACTL : the frgment of ACTL in which the temporl formuls re restricted to positive boolen combintions of A(ϕUψ), A(ϕRψ), nd AXϕ only. ECTL : the frgment of ECTL in which the temporl formuls re restricted to positive boolen combintions of E(ϕUψ), E(ϕRψ) nd EXϕ only. L X denotes the logic L without the next-step opertor X.

7 A. Jnowsk et l.: Checking Brnching Time Properties of Time Petri Nets Semntics of CTL Let P V be set of propositions. A model for CTL is tuple M = (L, S, s0,, V ), where L is set of lbels, S is set of sttes, s0 S is the initil stte, S L S is totl successor reltion5, nd V : S 2P V is vlution function. For s, s0 S the nottion s s0 mens tht there is l L such tht l s s0. Moreover, for s0 S pth π = (s0, s1,...) is n infinite sequence of sttes in S strting t s0, where si si+1 for ll i 0, πi = (si, si+1,...) is the i-th suffix of π, nd π(i) = si. Given model M, stte s, nd pth π of M, by M, s = ϕ (M, π = ϕ) we men tht ϕ holds in the stte s (long the pth π, respectively) of the model M. The model is sometimes omitted if it is cler from the context. The reltion = is defined inductively s follows: M, s = M, s = M, x = ϕ ψ M, x = ϕ ψ M, s = Aϕ M, s = Eϕ M, π = ϕ M, π = Xϕ M, π = ϕuψ M, π = ϕrψ V (s), for P V, M, s 6 =, for P V, M, x = ϕ nd M, x = ψ, for x {s, π}, M, x = ϕ or M, x = ψ, for x {s, π}, M, π = ϕ for ech pth π strting t s, M, π = ϕ for some pth π strting t s, M, π(0) = ϕ, for stte formul ϕ, M, π1 = ϕ, ( j 0) M, πj = ψ nd ( 0 i < j) M, πi = ϕ, ( j 0) M, πj = ψ or ( 0 i < j) M, πi = ϕ. Moreover, we ssume M = ϕ M, s0 = ϕ, where s0 is the initil stte of M. 4.3 Equivlence Preserving ACTL nd ECTL Let M = (L, S, s0,, V ) nd M 0 = (L0, S 0, s00, 0, V 0 ) be two models. Definition 2 ([2]). A reltion ;sim S 0 S is simultion from M 0 to M if the following conditions hold: s00 ;sim s0, for ech s S nd s0 S 0, if s0 ;sim s, then V (s) = V 0 (s0 ), nd for every l l0 0 s1 S such tht s s1 for some l L, there is s01 S 0 such tht s0 s01 for some l0 L0 nd s01 ;sim s1. The model M 0 simultes M (M 0 ;sim M ) if there is simultion from M 0 to M. The models M, M 0 re simultion equivlent M ;1sim M 0 nd M 0 ;2sim M for some simultions ;1sim S S 0 nd ;2sim S 0 S. Two models M nd M 0 re clled bisimultion equivlent if M 0 ;sim M nd M (;sim ) 1 M 0, where (;sim ) 1 is the inverse of ;sim. 5 Totlity mens tht ( s S)( s0 S) s s0.

8 22 PNSE 12 Petri Nets nd Softwre Engineering The following theorem holds: Theorem 1 ([2]). Let M, M be two simultion equivlent models, where the rnge of the vlution functions V, V is 2 P V. Then, M, s 0 = ϕ M, s 0 = ϕ, for ny formul ϕ over P V such tht ϕ ACTL ECTL. 5 Discrete- vs. Dense-Time Verifiction for ACTL nd ECTL It is esy to see tht both the models M r (N ) nd M n (N ) cn be used in ACTL nd ECTL verifiction for net with the semntics given model corresponds to (s both meet the definition of the model for CTL ). However, it is lso not dicult to see tht the second model is smller nd less prone to the stte explosion problem. The im of our work is then to show tht both the models re equivlent w.r.t. checking ACTL nd ECTL properties of time Petri nets with the dense-time semntics. In our proof we mke use of the pproch of Popov presented in the pper [5]. Consider the dense concrete model M r (N ) = (T IR +, Σ, σ 0, r, V ) of TPN N. A stte σ = (m, clock) Σ is clled n integer-stte if clock(t) IN for ll t T. A integer σ-run of N is sequence of sttes σ 0 0 r σ 1 1 r σ 2 2 r..., where σ 0 = σ Σ nd i T IN for ech i 0. Note tht ll the sttes of n integer-run which strts t n integer-stte re integer-sttes s well. Thus, it is esy to see tht the following holds: Lemm 1. For given time Petri net N the model M r (N ) reduced to the integer-sttes nd the trnsition reltion between them is equl to M n (N ). Given number x IR +, let x denote the floor of x, i.e., the gretest IN such tht x, nd let x denote the ceiling of x, i.e. the smllest IN such tht x. Moreover, let fire(σ) denote set of trnsition tht re redy to fire in the stte σ Σ, i.e., fire(σ) = {t en(m) clock(t) [Eft(t), Lft(t)]}. We define the integer-sttes to be neighbour sttes of rel-vlued ones s follows: Definition 3 (Neighbour sttes). Let σ = (m, clock) be stte of TPN N. An integer-stte σ = (m, clock ) is neighbour stte of σ (denoted σ n σ) m = m, for ech t en(m), clock(t) clock (t) clock(t). Intuitively, neighbour stte of σ is n integer-stte of the sme mrking, nd such tht the vlues of its clocks, for ll the enbled trnsitions, re in neighbourhood of these of σ. However, it is esy to see tht these vlues cn be such tht they mke more trnsitions redy to fire thn the corresponding vlues in σ do: ech trnsition t which cn be fired t given vlue of clock(t) cn be fired both t clock(t) nd t clock(t) since ll these three vlues re either equl if clock(t) is nturl number, or belong to the sme (integer-bounded) intervl

9 A. Jnowsk et l.: Checking Brnching Time Properties of Time Petri Nets 23 [Ef t(t), Lf t(t)] if clock(t) 6 IN; on the other hnd, trnsition t0 which is not redy to fire t clock(t0 ) cn be firble t dclock(t0 )e if dclock(t0 )e = Ef t(t0 ). This implies f ire(σ) f ire(σ 0 ). Let π := σ0 0 r σ1 1 r... be σ 0 -run in Mr (N ). By π[k], for k IN, we k 1 denote the prefix σ0 0 r σ1 1 r... r σk of π, nd by π(k) - the k-th stte of π, i.e., σk. Moreover, we ssign time δi to ech step σi i r σi+1 in the run, i.e., define δi = i if i IR, nd δi = 0 otherwise. By G (σi, π), for i IN, i 1 we denote the vlue Σj=0 δi (i.e., the time pssed long π before reching σi ). b b b Moreover, given k IN nd π(k)-run ρ := σk r β1 r β2 r..., by π[k] ρ k 1 b b b we denote the run σ0 0 r σ1 1 r... r σk r β1 r β2 r... (i.e, the run obtined by joining π[k] nd ρ). The bove definitions pply to discrete runs in n nlogous wy. Next, we introduce the following definition (see lso Fig. 2): σ0 0 σ1 1 σ2 σk σk 2 σk 1 k 1 k 2 π: 0 π : σ0 k 2 1 σ1 σ2 σk 2 k 1 σk 1 σ k 0 ). If i T, then 0i = i ; the sttes of Fig. 2. Neighbour prefix of π[k] (denoted π[k] 0 π[k] nd π[k] relted by n re linked by dshed lines. Definition 4 (Neighbour prefix). Let π := σ0 0 r σ1 1 r... be run in Mr (N ), nd let π 0 := σ00 r σ10 r... be n integer run. For k IN, the prefix 0 0 π[k] is neighbour prefix of π[k] (denoted π[k] n π[k] ) for ech i = 0,..., k it holds σi0 n σi, i T 0i T, nd if i, 0i T then 0i = i. Intuitively, neighbour prefix visits neighbour sttes of these in π[k], nd the corresponding steps of these prefixes re either both firings of the sme trnsition, or both pssges of time (possibly of derent lengths). In order to show tht Mn (N ) cn replce Mr (N ) in ACTL /ECTL verifiction we shll prove the following lemm: Lemm 2. The models Mr (N ) nd Mn (N ) re simultion equivlent. Proof. It is obvious from Lemm 1 tht Mr (N ) simultes Mn (N ), with the reltion R1 Σ Σn defined s R1 = {(σ, σ 0 ) σ = σ 0 }.

10 24 PNSE 12 Petri Nets nd Softwre Engineering Let R r (N ) nd R n (N ) denote respectively the sets of ll the dense σ 0 -runs (discrete σ n 0 -runs) of the net N. In order to prove tht M n (N ) sim M r (N ) we shll show tht the reltion R Σ n Σ given by R = {(σ, σ) π R r (N ) π R n (N ) k IN s.t. σ = π(k) σ = π (k) π [k] n π [k] j k G (σ j, π ) = G (σ j, π) } is simultion from M n (N ) to M r (N ). Intuitively, the sttes σ, σ re relted by R if they both re rechble from the initil stte of N in k steps for some nturl k, on runs π, π such tht π [k] is neighbour prefix of π [k] nd for ech j k the totl time pssed long π [j] is the floor of tht pssed long π [j]. It is obvious tht (σ 0 n, σ 0 ) R due to equlity of these sttes. Next, consider σ, σ such tht (σ, σ) R. Assume tht the runs justifying this reltion (for some k) re of the form π := σ 0 0 r σ 1 1 r... nd π := σn 0 = σ 0 0 n σ 1 1 n... respectively, nd tht σ i = (m i, clock i ), σ i = (m i, clock i) for ech i IN (which implies lso the nottion σ = (m k, clock k ) nd σ = (m k, clock k) used below). if σ t r γ for trnsition t T nd stte γ = (m γ, clock γ ), then from σ n σ (nd therefore fire(σ) fire(σ )) the trnsition t cn be fired t σ s well, leding to stte ξ = (m ξ, clock ξ). Let ρ be σ-run of the form σ t r γ r... (i.e., σ-run whose first step is σ t r γ), nd let ρ be σ -run of the form σ t n ξ n... (i.e., σ -run whose first step is σ t n ξ; see Fig. 3). We shll show tht (π[k] ρ ) [k+1] n (π [k] ρ) [k+1] nd π [k] ρ γ π : σ 0 σ 1 σ h α = σ = σ k π [k] σ 0 σ 1 α = σ h σ = σ k π : ρ δ ξ Fig. 3. Reltion between π, π, ρ nd ρ in the proof of Lemm 2. tht G (ξ, π [k] ρ ) = G (γ, π [k] ρ). In order to prove (π [k] ρ ) [k+1] n (π [k] ρ) [k+1] it is sufficient to show tht ξ n γ. It is obvious tht the mrkings m γ nd m ξ re equl, nd tht newly_en(m k, t) = newly_en(m k, t). Next, consider t en(m γ ). If t newly_en(m k, t) then the vlue of its clock in γ is the sme s in σ (since firing of t does not influence the vlue of the clock of t ). In turn, if

11 A. Jnowsk et l.: Checking Brnching Time Properties of Time Petri Nets 25 t newly_en(m k, t) then the vlues of its clock in γ nd in ξ re equl to 0. Thus, from the fct tht for σ, σ we hve clock k (t) clock k(t) clock k (t) we hve lso clock γ (t) clock ξ(t) clock γ (t), which implies ξ n γ. the condition G (ξ, π [k] ρ ) = G (γ, π [k] ρ) holds in n obvious wy ( G (ξ, π [k] ρ ) = G (σ, π ) = G (σ, π) = G (γ, π [k] ρ) s the step consisting in firing trnsition is ssigned the time 0). if σ δ r γ for time δ IR + nd stte γ = (m γ, clock γ ), then let ρ be σ-run σ δ r γ r... (i.e., σ-run of the first step σ δ r γ; see Fig. 3), nd let π [k] ρ denote the run σ 0 0 r σ 1 1 r... k 1 δ r σ k r γ r... (i.e, the run obtined by joining π [k] nd ρ). Next, ssume δ = G (γ, π [k] ρ) G (σ, π ) (which is n integer vlue due to G (σ, π ) IN). We shll show first tht the time δ cn pss t σ, leding to stte ξ = (m ξ, clock ξ). To show tht δ cn pss t σ notice tht nd tht δ = G (γ, π [k] ρ) G (σ, π [k] ρ), G (σ i, π) = G (σ i, π [k] ρ) for ech i = 0,..., k. Moreover, we hve tht clock γ (t) = clock k (t) + δ Lft(t) for ech t en(m k ). Consider trnsition t en(m k ) (where en(m k ) = en(m k) = en(m γ )). Let h be n index long π [k] pointing to stte (denoted α) t which t becme enbled most recently, nd let h be n index long π [k] pointing to stte (denoted α ) t which t becme enbled most recently. From the fct tht π [k] n π [k] we hve h = h (for ech j k 1 the corresponding j-th steps of π [k] nd π [k] re either both firings of the sme trnsition or both time pssings, which implies tht for ech i k trnsition t becomes enbled in π(i) it becomes enbled in π (i)). From the definitions of clock, clock it is esy to see tht nd clock k (t) = G (σ, π) G (α, π), clock γ (t) = G (γ, π [k] ρ) G (α, π) clock k(t) = G (σ, π ) G (α, π ) Moreover, it holds clock k(t) + δ = G (σ, π ) G (α, π ) + δ = G (σ, π ) G (α, π ) + G (γ, π [k] ρ) G (σ, π ) = G (γ, π [k] ρ) G (α, π ) def. of R nd h=h = G (γ, π [k] ρ) G (α, π).

12 26 PNSE 12 Petri Nets nd Softwre Engineering From clock γ (t) Lft(t) we hve clock γ (t) Lft(t), nd from the property b b we get clock k(t) + δ = G (γ, π [k] ρ) G (α, π) G (γ, π [k] ρ) G (α, π) = clock γ (t) Lft(t); Thus, we hve tht clock k(t) + δ Lft(t) for ech t en(m k ), nd therefore the time δ cn pss t σ. Next, let ρ be σ -run of the form σ δ n ξ n.... We shll show tht (π[k] ρ ) [k+1] n (π [k] ρ) [k+1] nd tht G (ξ, π [k] ρ ) = G (γ, π [k] ρ). In order to prove (π [k] ρ ) [k+1] n (π [k] ρ) [k+1] it is sufficient to show tht ξ n γ. It is obvious tht the mrkings of these sttes re equl. Consider t en(m). We show tht clock γ (t) clock ξ(t) clock γ (t). Let α, α, h, h be defined s in the previous prt of the proof (see the 8th line of the previous item). Similrly s before, from the definitions of clock, clock we hve tht nd tht clock γ (t) = G (γ, π [k] ρ) G (α, π), clock ξ(t) = G (σ, π ) + δ G (α, π ). From the property b b (for, b IR + with b) we hve clock γ (t) = G (γ, π [k] ρ) G (α, π) G (γ, π [k] ρ) G (α, π) h=h nd def. of R = G (γ, π [k] ρ) G (σ, π )+ G (σ, π ) G (α, π ) = G (γ, π [k] ρ) G (σ, π )+ G (σ, π ) G (α, π ) = δ + G (σ, π ) G (α, π ) = clock ξ(t). From the property b b we hve clock k(t) + δ = G (γ, π [k] ρ) G (α, π) G (γ, π [k] ρ) G (α, π) = clock γ (t) Next, we hve G (ξ, π [k] ρ ) = G (σ, π )+δ = G (σ, π )+ G (γ, π [k] ρ) G (σ, π ) = G (γ, π [k] ρ), which ends the proof. Therefore, we cn formulte the following theorem: Theorem 2. Let M r (N ) nd M n (N ) be respectively dense nd discrete model for time Petri net N, nd let ϕ be n ACTL (ECTL ) formul. The following condition holds: M r (N ) = ϕ M n (N ) = ϕ. Proof. Follows from Theorem 1 nd Lemm 2 in strightforwrd wy. It should lso be explined tht in the cse of timed systems (nd therefore lso TPNs) with the dense-time semntics, logics without the next-step opertor re usully used, due to problems with intepreting the next step in the cse of continuous time. However, Thm. 2 considers more generl logics, in cse one would interpret the next-step opertor over n rbitrry pssge of time.

13 A. Jnowsk et l.: Checking Brnching Time Properties of Time Petri Nets 27 p1 p2 t1 [0,1] t2 [1,2] Fig. 4. A net It should be noticed tht the reltion R used in our proof cnnot be used to prove bisimultion between the models, i.e., their equivlence w.r.t. the CTL properties, since the integer run π justifying σ Rσ nd the dense run π occurring in the reltion do not need to brnch in the sme wy. Thus, lthough one cn prove tht ech trnsition t which cn be fired t σ cn be fired t σ s well, the reverse does not hold. To see n exmple of the bove consider the net shown in Fig. 4 nd its runs: the dense one: π := (p 1, (0, 0)) 0.5 r (p1, (0.5, 0)) t1 r (p2, (0, 0)) 0.6 r (p2, (0, 0.6)) r... nd the discrete one (denoted π ), built in the wy shown in [5] nd used in our proof in the definition of R (i.e., stisfying π [3] n π [3] nd G (σ j, π ) = G (σ j, π) for ech j 3): π := (p 1, (0, 0)) 0 n (p1, (0, 0)) t1 n (p2, (0, 0)) 1 n (p2, (0, 1)) n.... It is esy to see tht in π(3) we hve clock(t2) = 0.6, which mens tht t2 cnnot be fired t this stte, while in π (3) we hve clock(t2) = 1, which mens tht the trnsition t2 is firble. 6 Experimentl Results In order to show tht using discrete-time models insted of the dense ones cn be profitble, we performed some tests, using s n exmple n implementtion of SAT-bsed bounded model checking (BMC) for subclss of TPNs (i.e., distributed time Petri nets) with the discrete-time semntics nd the logic ACTL X used in [4], nd its modifiction for the dense-time cse prepred for the current pper. BMC is technique pplied minly to serching for counterexmples for universl properties, using model truncted up to some specific depth k. The formuls used by the method re then negtions of these expressing properties to be tested. So, in our cse they re formuls of ECTL X. The first system we consider is the Generic Pipeline Prdigm Petri net model (GTPP) shown in Fig. 5. It consists of three prts: Producer producing dt (P rodredy) or being inctive, Consumer receiving dt (ConsRedy) or being inctive, nd chin of n intermedite Nodes which cn be redy for receiving dt (Node i Redy), processing dt (Node i P roc), or sending dt (Node i Send). The exmple cn be scled by dding more intermedite nodes. The prmeters, b, c, d, e, f re used to djust the time properties of Producer, Consumer, nd of the intermedite Nodes. The formuls considered re EGEFConsReceived, EG(P rodredy ConsRedy) nd EFNode 1 Send.

14 28 PNSE 12 Petri Nets nd Softwre Engineering ProdRedy Node1Redy Node2Redy NodenRedy ConsRedy [, b] [c, d] [c, d] [c, d] [c, d] [c, d] [, b] Node1Proc Node2Proc NodenProc [e, f] [e, f] [e, f] Node1Send Node2Send NodenSend Fig. 5. A net for Generic Timed Pipeline Prdigm The next system tested is the stndrd Fischer s mutul exclusion protocol (Mutex). The system consists of n time Petri nets, ech one modelling process, plus one dditionl net used to coordinte the ccess of the processes to the criticl sections. A TPN modelling the system for n = 2 is presented in Fig. 6 In this cse we hve tested the formul EGEF(crit 1... crit n ). setx0_1 setx1 [0, ) [0, ] idle1 strt1 trying1 setx1 copy1 [0, ] [0, ) witing1 enter1 [δ, ) criticl1 [0, ] setx1 copy2 plce 1 plce 0 plce 2 setx2 copy2 [0, ] idle2 [0, ) strt2 trying2 [0, ] setx2 copy1 [0, ] setx2 witing2 enter2 [δ, ) criticl2 setx0_2[0, ) Fig. 6. A net for Fischer s mutul exclusion protocol for n = 2 The results re presented in Fig. 7 9 for GTPP, nd in Fig. 10 for Mutex. It cn be seen tht in ll the cses we re ble to verify systems contining more components (indicted in the column n) thn when discrete models re used, nd the totl time (bmct +stt ) nd the memory required (mx(bmcm, stm)) re usully smller for the discrete-time cse (the columns with IN : ). In some cses the derences re quite substntil, but there re lso exmples in which the time nd the memory used re similr for both the semntics. However, one

15 A. Jnowsk et l.: Checking Brnching Time Properties of Time Petri Nets 29 n k LL IR: bmct+stt IR: mx(bmcm,stm) IN: bmct+stt IN: mx(bmcm,stm) Fig. 7. Comprison of the results for GTPP nd the formul EGEFConsReceived n k LL IR: bmct+stt IR: mx(bmcm,stm) IN: bmct+stt IN: mx(bmcm,stm) Fig. 8. Comprison of the results: GTPP, the formul EG(P rodredy ConsRedy) cn see tht the noticeble derences occur in the cses in which the length of the witness for the formul (k) or the number of pths required to check this formul (LL) grow together with the size of the system, mking the verifiction more expensive. 7 Conclusions nd Further Work We hve shown tht the result of Popov, stting tht integer time steps re sufficient to test rechbility of mrkings in time Petri nets, cn be extended to testing ECTL nd ACTL properties. We hve focused on 1-sfe TPNs for simplicity of the presenttion, but it is esy to see tht the result pplies lso to generl time Petri nets: neither the definitions of mrking nd of enbledness of trnsition, nor the wy multiple enbledness of trnsitions is hndled do influence the proof.

16 30 PNSE 12 Petri Nets nd Softwre Engineering n k LL IR: bmct+stt IR: mx(bmcm,stm) IN: bmct+stt IN: mx(bmcm,stm) Fig. 9. Comprison of the results: GTPP, the formul EFNode1Send n k LL IR: bmct+stt IR: mx(bmcm,stm) IN: bmct+stt IN: mx(bmcm,stm) Fig. 10. Comprison of the results: mutex, the formul EGEF(crit 1... crit n) Our experimentl results show tht considering the discrete semntics while verifying properties of dense-time nets cn be profitble. Due to this, in our further work we re going to check whether discrete-time semntics cn be used when testing other clsses of properties of the dense-time Petri net systems (e.g., CTL X).

17 A. Jnowsk et l.: Checking Brnching Time Properties of Time Petri Nets 31 References 1. U. Goltz, R. Kuiper, nd W. Penczek. Propositionl temporl logics nd equivlences. In Proc. of the 3rd Int. Conf. on Concurrency Theory (CONCUR 92), volume 630 of LNCS, pges Springer-Verlg, O. Grumberg nd D. E. Long. Model checking nd modulr verifiction. In Proc. of the 2nd Int. Conf. on Concurrency Theory (CONCUR 91), volume 527 of LNCS, pges Springer-Verlg, A. Jnowsk, W. Penczek, A. Półrol, nd A. Zbrzezny. Towrds discrete-time verifiction of time Petri nets with dense-time semntics. In Proc. of the Int. Workshop on Concurrency, Specifiction nd Progrmming (CS&P 11), pges Bilystok University of Technology, A. Mȩski, W. Penczek, A. Półrol, B. Woźn-Szcześnik, nd A. Zbrzezny. Bounded model checking pproches for verificton of distributed time Petri nets. In Proc. of the Int. Workshop on Petri Nets nd Softwre Engineering (PNSE 11), pges University of Hmburg, L. Popov. On time Petri nets. Elektronische Informtionsverrbeitung und Kybernetik, 27(4): , L. Popov-Zeugmnn. Essentil sttes in time Petri nets. Informtik-Bericht 96, Humboldt University, L. Popov-Zeugmnn. Time Petri nets stte spce reduction using dynmic progrmming. Journl of Control nd Cybernetics, 35(3): , L. Popov-Zeugmnn nd D. Schltter. Anlyzing pths in time Petri nets. Fundment Informtice, 37(3): , 1999.