A deadlock prevention method for railway networks using monitors for colored Petri nets

A deadlock prevention method for railway networks using monitors for colored Petri nets Maria Pia Fanti Dip di Elettrotecnica ed Elettronica Politecnico di Bari, Italy fanti@deemailpolibait Abstract The real-time traffic control of railway networks authorizes movements of the trains and imposes safety constraints The paper deals with the real time traffic control focusing on deadlock prevention problem Colored Petri nets are used to model the dynamics of the railway network system: places represent tracks and stations, tokens are trains The prevention policy is expressed by a set of linear inequality constraints, called colored Generalized Mutual Exclusion Constraints that are enforced by adding appropriate monitor places Using digraph tools, deadlock situations are characterized and a strategy is established to define off-line a set of Generalized Mutual Exclusion Constraints that prevent deadlock An example shows in detail the design of the proposed control logic Keywords: Railway network system control, colored Petri nets, deadlock prevention Introduction The traffic control of Railway Network Systems (RNS) is a critical task in modern railway transportation The structure of the railway traffic planning and control can be divided in two main hierarchical levels [] The first level is the planning level that works off-line and constructs the traffic plan and timetable The second control level makes decisions in real-time and it has two tasks Firstly, this level analyzes perturbed situations In particular, the goal of the controller is to reduce delays and to make traffic return to planned paths when trains have deviations from the scheduled timetable [] Secondly, the real-time controller has to impose the satisfaction of safeness constraints to avoid collisions and deadlocks This paper focuses on the second task of the real-time controller The RNS is modelled with colored Petri nets (CPNs) [, ] that provide a powerful framework to the analysis and the definition of safeness constraints In the related literature, railway networks are modelled as discrete event systems [] that define a control design problem leading to a non-convex nonlinear optimization problem Moreover, in [8] the railway network is modelled by a Petri net and deadlock avoidance constraints are expressed as Generalized Mutual Exclusion Constraints (GMEC) However, the controller does not distinguish among the routes assigned to the trains, and -783-795-7/3/$7 c 3 IEEE Alessandro Giua, Carla Seatzu Dip di Ing Elettrica ed Elettronica Università di Cagliari, Italy {giua,seatzu}@dieeunicait when forks and joins are present in the network the marking does not describe completely the system state This paper overcomes this problem by using CPN to model the RNS structure and dynamics More precisely, places represent tracks and stations, while transitions are the control points where the train movements are enabled or inhibited Moreover, the trains travelling in the system are represented by colored tokens and their color is the assigned path To characterize deadlock situations we use some results obtained in the field of Automated Manufacturing Systems where deadlock has been widely studied [3, 4, 5, 6] We characterize deadlock states by using digraph tools that describe the interactions between trains and resources (ie, tracks and stations) In addition, a deadlock prevention strategy defines off-line the rules to prevent deadlock in advance In this framework, deadlock and collision prevention constraints are expressed by a set of linear inequality constraints, called colored GMEC A companion paper [7] rigorously defines colored GMEC and shows how the results obtained for GMEC applied to place/transition nets can be extended to colored Petri nets Hence, the controller takes the form of a set of colored monitor places that can be automatically computed An example shows the design technique of the proposed control logic The railway network system A RNS consists of three fundamental elements: railway lines, stations, vehicles (ie, trains, single engines, etc) travelling over these lines Let us consider the set V = {v,, v NV } that collects all the vehicles moving over the lines and the stations The railway lines are divided into several tracks and each track can be occupied by only one vehicle at a time In our framework, each station is described by a resource r i, for i =,, N S, where N S is the number of stations Moreover, each track of the RNS is viewed as a resource that vehicles can acquire and it is denoted by r i, for i = N S +,, N S + N T, where N T is the overall number of tracks Since each station is composed of one or more tracks, and each track can accommodate only one train at a time, a finite capacity C(r i ) is assigned to each station r i, for i =,, N S Moreover, each track r i has unit capacity, ie, C(r i ) = for all i = N S +,, N S + N T We also assume that the terminal stations of the train paths are connected to a virtual docking station r The docking station can accommodate all the trains in

r r r 3 r 4 r r 7 6 r 8 Figure : The railway network of Example the system, ie, C(r ) = Finally, we generically call resources or nodes the stations and the tracks Therefore, the set R = {r i, i =,, N S +N T } denotes the resource set of the system Other basic elements of the RNS are the control points where the trains are authorized to enter a generic node by the real-time traffic controller In addition, a path (or route) π k is assigned to each train v k V travelling in the system: each vehicle starts its travel from a station; it reaches a destination station and finally the docking station where a new path can be assigned to it More precisely, each path is described by the following sequence of resources that ends at the docking station: π k = (r k,, r knk, r ) The set A collects all the possible paths planned in the system Example Let us consider the railway composed by five stations r i, for i =,, 5, depicted in Figure The first station is a three track station, while the remaining ones have only two tracks, ie, C(r ) = 3 and C(r i ) = for i =, 3, 4, 5 All intermediate tracks r i, for i = 6, 9,, are single tracks, apart from r 7 and r 8 that represent two track segments This paper deals with the real-time traffic control level whose task is that of authorizing the movement of the trains and imposing safety constraints Such a control can be applied to railway tracks and to station tracks, and its main goal is that of avoiding deadlock and collisions in all subsystems 3 CPN and GMEC In this section we provide some background on colored Petri nets and generalized mutual exclusion constraints For more details we address the reader to the companion paper [7] 3 Overview of CPN A colored Petri net (CPN) is a bipartite directed graph represented by a quintuple N = (P, T, Co, P re, P ost) where P is the set of places, T is the set of transitions, Co : P T Cl is a color function that associates to each element in P T a non empty ordered set of colors in the set of possible colors Cl Therefore, for all p i P, Co(p i ) = {a i,, a i,,, a i,ui } Cl is the ordered set of possible colors of tokens in p i, and u i is the number of possible colors of tokens in p i Analogously, for all t j T, Co(t j ) = {b j,, b j,,, b j,vj } Cl is the ordered set of possible occurrence colors of t j, and v j is the number of possible occurrence colors in t j r In the following we assume that m = P and n = T Matrices P re and P ost are the pre-incidence and the post-incidence m n dimensional matrices respectively In particular, each element P re(p i, t j ) is a mapping from the set of occurrence colors of t j to a non negative multiset over the set of colors of p i, namely, P re(p i, t j ) : Co(t j ) N (Co(p i )), for i =,, m and j =,, n In the following we denote P re(p i, t j ) as a matrix of u i v j non negative integers, whose generic element P re(p i, t j )(h, k) is equal to the weight of the arc from place p i with respect to (wrt) color a i,h to transition t j wrt color b j,k Analogously, P ost(p i, t j ) : Co(t j ) N (Co(p i )), for i =,, m and j =,, n, and we denote P ost(p i, t j ) as a matrix of u i v j non negative integers The generic element P ost(p i, t j )(h, k) is equal to the weight of the arc from transition t j wrt color b j,k to place p i wrt color a i,h The incidence matrix C is an m n matrix, whose generic element C(p i, t j ) : Co(t j ) Z(Co(p i )), for i =,, m and j =, n In particular C(p i, t j ) = P ost(p i, t j ) P re(p i, t j ) For each place p i P, we define the marking m i of p i as a non negative multiset over Co(p i ) The mapping m i : Co(p i ) N associates to each possible token color in p i a non negative integer representing the number of tokens of that color that is contained in place p i, and m i = d Co(p m i) i(d) d In the following we denote m i as a column vector of u i non negative integers, whose h-th component m i (h) is equal to the number of tokens of color a i,h that are contained in p i The marking M of a CPN is an m-dimensional column vector of multisets, ie, M = [ m m m ] T Finally, we denote M = p i P m i the total number of tokens in the net at marking M regardless of their color A colored Petri net system N, M is a colored Petri net N with initial marking M A transition t j T is enabled wrt color b j,k at a marking M if and only if for each place p i P and for all h =,, u i, we have m i (h) P re(p i, t j )(h, k) If an enabled transition t j fires at M wrt color b j,k, then we get a new marking M where, for all p i P and for all h =,, u i, m i (h) = m i(h) + P ost(p i, t j )(h, k) P re(p i, t j )(h, k) We will write M[t j (k) M to denote that t fires at M wrt color b j,k yielding M 3 GMEC and monitors In the Petri nets framework a supervisory controller restricts the reachability set of the closed loop plant to a set of legal markings In many applications, the set of legal markings is expressed by a set of linear inequality Let D be a set A multiset (resp, non negative multiset) over D is defined by a mapping α : D Z (α : D N) and may be represented as = X d D α(d) d where the sum is limited to the elements such that α(d) Let Z(D) (resp, N (D)) denote the set of all multisets (resp, non negative multisets) over D The multiset " is the empty multiset such that for all d D, (d) =

constraints called Generalized Mutual Exclusion Constraints (GMEC) In [7] the notion of GMEC is extended to the case of colored Petri nets as follows Definition 3 ([7]) A GMEC is a couple (W, k) where W = [ w w m ], k Z(D), for all i, w i : Co(p i ) Z(D), and D is a set of colors different from Co(p i ), i =,, m The set of legal markings defined by (W, k) can be written as M(W, k) = M = m m m m i N (Co(p i )), W M } m i= w i m i k () Note that each term w i m i is a multiset that can be computed using the usual matrix algebra [7] Moreover, as discussed in detail in [7], a GMEC can be enforced by adding a monitor place p c and a systematic procedure can be used to compute the incidence matrix defining such a monitor place, as well as its initial marking Definition 3 ([7]) Given a colored Petri net system N p, M p,, with N p = (P, T, Co, P re p, P ost p ), and a GMEC (W, k) with k Z(D), the monitor that enforces this constraint is a new place p c with Co(p c ) = D, to be added to N p The resulting system is denoted N, M, with N = (P {p c }, T, Co, P re, P ost) Then N will have incidence matrix C = [ Cp C c ], where C c = W T C p () We are assuming that there are no selfloops containing p c in N, hence P re and P ost may be uniquely determined by C The initial marking of N, M is [ ] M M = p, m, where m c, = k W T M p, (3) c, We assume that the initial marking M p, of the system satisfies the constraint (W, k) In the case of controllable and observable transitions we can prove the following result Theorem 33 ([7]) Let N p, M p, be a CPN system, and (W, k) a colored GMEC Let N, M be the system with the addition of the monitor place p c The monitor place p c enforces the GMEC (W, k) when included in the closed loop system N, M The monitor place p c minimally restricts the behavior of the closed loop system N, M, in the sense that it prevents only transition firings that yield forbidden markings 4 The CPN model of the RNS In this paper we use colored Petri nets to model RNS In particular, places represent resources (stations and tracks), while the firing of transitions represent the flow of vehicles into the system The generic place p i P models resource r i R and there is a one to one relationship between resources and places, thus in the following we always refer to P as R (and to p i as r i ) Moreover, if there exists a link that goes from node r h to node r i, then in the CPN we introduce a transition t j such that t j r h and t j r i Note that each transition represents a control point where the controller can stop the trains or can authorize a train to move on Thus all transitions in the CPN model are assumed to be both controllable and observable A colored token in a place represents a vehicle in a resource The color of each token specifies the vehicle v k or, equivalently, the routing π k assigned to the train As an example, π k = (r h,, r q, r ) can be the path (ie the sequence of resources) assigned to the train v k Hence, for each r i R we have Co(r i ) = {π k π k contains r i }, and for each t j T such that t j r h and t j r i, we have Co(t j ) = {π k π k contains r h and r i in strict succession order} Example 4 Let us consider the RNS described in Example The corresponding CPN model is reported in Figure where place r represents the docking station Let us assume that four trains are travelling in the system, namely, v, v, v 3 and v 4 Moreover, let π = (r, r 6, r, r 7, r 3, r 9, r 4, r ), π = (r 4, r 9, r 3, r 8, r, r 6, r, r ), π 3 = (r, r 6, r, r,, r ), π 4 = (, r, r, r 6, r, r ) Therefore, by definition Co(r ) = {π, π, π 3, π 4 } for i =,,, 6, Co(r i ) = {π, π } for i = 3, 4, 9, Co(r 7 ) = {π }, Co(r 8 ) = {π }, Co(r i ) = {π 3, π 4 } for i = 5,, and Co(t j ) = {π, π 3 } for j =,, 9, Co(t j ) = {π, π 4 } for j = 3, 4,, Co(t j ) = {π 3 } for j = 3, 4, 7, Co(t j ) = {π 4 } for j = 5, 6,, Co(t j ) = {π } for j = 5, 6, 7, 8, 8, Co(t j ) = {π } for j = 9,,,, The pre and post-incidence matrices can be easily deduced by looking at the structure of the net and at the above paths definition As an example P re(r, t ) = P ost(r 6, t ) = π π 3 π π π 3 π 4 Now, let us assume that initially trains v and v 3 are in r, train v is in r 4 and train v 4 is in Thus the CPN system is initially at marking M p, = m, m, m, m 3, m 4, m 5, m 6, m, = π + π 3 π π 4 Using the matrix notation, each term m i, may be written as a column vector of dimension Co(r i ) As an Given a node x P T we denote as x and x the preset and the postset of x, respectively

t 4 t 3 t r 8 t t t 9 r r 6 r r 3 r 9 r4 t 5 t t r 7 t 6 t 7 t 8 t 9 t 3 t 4 t t 7 r t6 r t 5 t Figure : The CPN model of the RNS in Figure example, m, = t π [ π π, m 4, = 3 π 4 t 8 ] π 4 Capacity constraints As already said before, all tracks and stations have a finite capacity, apart from the docking station r that is a dummy node To ensure that each resource does not accommodate a number of trains that is greater than the corresponding capacity, we have to introduce appropriate capacity constraints More precisely, for all r i R \ {r }, with i =,, m, we have to impose that u i m i (π jh ) C(r i ) h= where Co(r i ) = {π j,, π jui } and u i = Co(r i ) The capacity constraints may be rewritten in terms of a single GMEC (W, k), that we call capacity GMEC The capacity GMEC will have as color set D = {z,, z m } because we need m capacity constraints, and is defined as follows: W = [ w w w m ], w = w i = π j π jui z z i z i z i+ z m k = [ C(r ) C(r m ) ] T Z(D) π i =,, m (4) Using the above theory, an appropriate monitor place can be added to the open loop net so as to ensure the satisfaction of the capacity constraints Example 4 Let us consider again the CPN system in Example 4 associated to the RNS described in Example In such a case we have m = and k = [ 3 ] T The incidence matrix of the monitor place is equal to C c = W C p where C p is the incidence matrix of the open loop net The incidence matrix of p c has the following structure, As an example, C c = [ C c (p c, t ) C c (p c, t 5 ) ] C c (p c, t ) = π π 3 z z z 3 z 4 z 5 z 6 z 7 z 8 z 9 z while all the other matrices C c (p c, t j ), j =,, 5, are omitted here for sake of brevity Finally, the monitor place p c is initialized at marking m c, = [ ] T 5 Deadlock prevention policy In this section we first provide some background on digraph theory Then we show how some theoretical results firstly obtained in the context of deadlock avoidance in Automated Manufacturing Systems [5, 6], can be used here to derive a deadlock prevention policy 5 Basic definitions A digraph is a couple D = (N, E) where N is the set of vertices and E is the set of edges [9] A path is a subdigraph of D composed by an alternating sequence of distinct vertices and arcs If D contains a path from r i to r j, then r j is said reachable from r i Moreover, if r j (r i ) is reachable from r i (r j ), then r i and r j are said mutually reachable A cycle of D is a nontrivial path in which all vertices are distinct except the first and the last one 3 A subdigraph D µ = (N µ, E µ ) of D is called strong if every two vertices of N µ are mutually reachable Finally, a strong component of D is a maximal strong subdigraph, ie, a strong subdigraph that is not contained in any other strong subdigraph of D Let us finally introduce a relation that is based on the order in which the resources in a RNS are used 3 What we call cycle is sometimes called elementary cycle

Definition 5 A resource r j immediately follows a resource r i with respect to path π k if π k = (, r i, r j ) This is also denoted r i k r j 5 Deadlock characterization Given a CPN describing a RNS, a deadlock corresponds to a marking from which all transitions enabled in the plant are disabled by the capacity GMEC: such a marking is said deadlock marking In this section we establish some necessary and sufficient conditions for deadlock occurrence based on the analysis of the digraphs associated to a colored Petri net Note that these results only apply to a CPN representing a RNS as described in Section 4 In the following however, for sake of simplicity, we will omit to precise this in the statement of all results simply referring to a CPN: we will also talk of places as resources, trains as colored tokens, etc We can now define two digraphs associated to a RNS represented by a CPN Definition 5 Given a colored Petri net N p = (R, T, Co, P re, P ost) we may associate to it two main digraphs The route digraph D R = (N R, E R ) describes the paths of all the trains travelling in the system Each vertex in this graph represents a resource, ie, N R = R while E R = {e ij ( π k A) r i k r j }, ie, an edge e i,j belongs to E R if there exists a path where r j follows r i The transition digraph D T (M p ) = (N R, E T (M p )), describes the interactions between trains and resources when the actual marking is M p Each vertex in this graph still represents a resource as in the route digraph, ie, N R = R, while E T (M p ) = {e ij ( π k A)m i π k, r i k r j }, ie, an edge e i,j belongs to E T (M p ) if there exists a train in resource r i at marking M p and r j is the next resource the train has to acquire Obviously, the arc set of the transition digraph changes as the marking is updated Example 53 Figure 3 shows digraph D R corresponding to the system and the CPN described in Examples and 4 Each edge of D R is labelled with the name of the path to which it correspond Moreover, for sake of simplicity, the node r is repeated in Figure 3 Assume that the four trains travelling in the system are in these positions: v in r 6, v and v 3 in r, and v 4 in r Hence, the CPN is at marking M p equal to m 6 = π, m = π + π 3, m = π 4, m i = elsewhere The corresponding transition digraph D T (M p ) is shown in Figure 4 To characterize deadlock markings we also need the following definition Definition 54 A strong component D µ = (N µ, E µ ) of D T (M p )is called a Maximal-weight Zero-outdegree Strong Component (MZSC for brevity) if the following properties hold true: r 8 pa pa4 pa pa pa r pa pa γ r pa pa γ γ3 γ4 γ5 3 pa pa r 3 pa pa r 6 r pa r pa r pa pa 7 3 9 4 3 pa pa pa γ pa 6 4 pa pa 3 4 r r r pa pa 3 3 γ7 Figure 3: Digraph D R for Example 53 r r 6 r pa r γ pa pa 3 r γ6 Figure 4: Digraph D T (M p ) for Example 53 r 8 r 7 (a) Maximal-weight: all the resources from N µ are busy, ie, the number of tokens in each place r i is equal to the maximal capacity of the place: m i = C(r i ) (b) Zero-outdegree: all the edges of D T (M p ) outgoing from vertices of N µ belong to E µ Remark 55 Note that the node r corresponding to the docking station can not be in a MZSC because it has an infinite capacity and all cycles containing it may be disregarded for deadlock analysis It is possible to give a simple characterization of an MZSC in terms of resources allocated to the trains at a given marking Definition 56 Given a strong subdigraph D µ = (N µ, E µ ) of D R and a marking M p, we denote the set of trains that occupy a resource of N µ and require a resource of N µ at next step as V (M p ) µ = {v k V ( r i, r j N µ ) m i π k, r i k r j, e i,j E µ } The following result holds Proposition 57 A necessary condition for a strong subdigraph D µ = (N µ, E µ ) of D R to be an MZSC in D T (M p ) is that V (M p ) µ = C(N µ ) where C(N µ ) = r i N µ C(r i ) is the sum of the capacities of the resources in N µ Proof First we observe that if D µ is a MZSC then (by the maximal-weight condition) the number of tokens in r 3 r 9 r 4

N µ at M p is equal to r i N µ m i = r i N µ C(r i ) = C(N µ ) Furthermore, each of these tokens corresponds to a train in the set of resources N µ that (by the zerooutdegree condition) requires at the next step a resource in N µ, ie, C(N µ ) = V (M p ) µ In [5] and [6] necessary and sufficient conditions for deadlock occurrence have been characterized in terms of digraph analysis Proposition 58 A marking M = [M T p m c ] T is a deadlock marking for a CPN with capacity constraint iff there exists at least one MZSC in D T (M p ) Proof The statement is a slightly different formulation of Theorem from [5] in terms of net marking rather that system state As such, it applies to CPN modelling RNS From proposition 57 and Proposition 58, the following Corollary is derived Corollary 59 If M = [M T p m c ] T is a deadlock marking for a CPN with capacity constraint, then there exists a strong component D µ = (N µ, E µ ) of D R such that V (M p ) µ = C(N µ ) Example 5 Let us consider again Example 53 and the transition digraph D T (M p ) in Figure 4 corresponding to the defined marking M p It is easy to verify that the strong component D µ = γ γ 6 = ({r 6, r, r }, {e 6,, e,, e,, e,6 }) of D R is an MZSC in D T (M p ) Moreover, we obtain: V (M p ) µ = {v, v, v 3, v 4 }, and V (M p ) µ = C(N µ ) = 4 53 Second level deadlocks By imposing constraints of the form V (M p ) µ C(N µ ) we can prevent any strong component of D R from becoming an MZSC in the transition digraph However, avoiding a deadlock marking is not sufficient to guarantee the liveness of the CPN Indeed, it is possible that some critical states are reached that are not deadlocks, but they necessary evolve to a deadlock marking in the next step: these states are called Second Level Deadlocks (SLD) [5] Clearly, if a SLD marking is reached, then a controller that has been designed to prevent reaching a deadlock marking for the original net will create a new deadlock marking We discuss in this subsection how it may be possible to also prevent a SLD A SLD can be characterized in terms of a particular interaction among the cycles of D R that can be represented by a new digraph Definition 5 Given a colored Petri net with route digraph D R = (N R, E R ) we define the second level digraph DR = (N, ER ) such that: the set of vertices N = {γ, γ,, γ N } is equal to the set of cycles of D R that do not contain the dummy node 4 r ; an edge e u,s belongs to E R if: 4 The dummy node r has infinity capacity and all cycles containing it may be disregarded for deadlock analysis as mentioned in remark 55 γ γ γ γ γ 3 γ 4 γ 5 γ 6 γ 7 Figure 5: Digraph D R obtained from digraph D R in Figure 3 γ 3 i) γ u and γ s have only one vertex in common (say r j ) with capacity C(r j ) = ; ii) there exists a path π k A such that r i k r j k r h requiring resources r i, r j, r h in strict order of succession, with e i,j γ u and e j,h γ s Now let γu be a cycle in DR (second level cycle) From the previous definitions it follows that a subset of cycles of D R (say Γ u ) is associated with vertices of γu So, the capacity of γu can be defined as C(γ u) = r {γ γ Γ u} C(r) ie, as the sum of the capacities of all the resources in Γ u Finally, let Γ indicate the subset of cycles of DR, enjoying the following property: γu Γ iff the corresponding set Γ u collects cycles that are all disjoint except for one vertex of unit capacity, common to all of them For each γu Γ and for each marking M p we introduce the following set: V (M p ) γ u = {v k V at marking M p the token representing v k is in r Γ u } As shown by the following proposition easily derived from the results proved in [5], the set Γ plays an important role in defining SLD conditions Proposition 5 If M = [M T p m c ] T is a SLD marking for a CPN with capacity constraint, then there exists in D R a second level cycle γ u Γ such that: V (M p ) γ u = C(γ u) Example 53 Considering the cycles of D R depicted in Figure 3, the second level cycles of DR are derived and shown in Figure 5 We suppose that the four trains in the system are in the following state: v and v are in with π = π = (, r, r, r 6, r, r ), v 3 and v 4 are in r with π 3 = π 4 = (r, r 6, r, r,, r ) Hence, the CPN is at marking M p where m = π 3, m 5 = π 4, and m i = elsewhere The solid lines in Figure 6 depicts the transition digraph D T (M p ) For convenience, Figure 7 also depicts the second transitions (dashed lines) in the residual paths of the trains The described marking exhibits a SLD for the CPN Indeed, the second level cycle γ3 Γ is in second level deadlock condition, were γ3 corresponds to the cycle set Γ u = γ 6 γ 7 = ({r, r, }, {e,, e,5, e 5,, e, })

r r 6 r r pa 3 pa 3 r γ6 γ7 Figure 6: Digraph D T (M p ) for Example 53 Hence, the necessary condition of Proposition 5 is verified, ie, V (M p ) γ 3 = {v, v, v 3, v 4 } = C(γ 3) = 4 54 Deadlock prevention Corollary 59 and Proposition 5 establish the deadlock and SLD prevention conditions on the marking of the CPN To establish a direct relation among V (M p ) µ, where D µ = (N µ, E µ ) is a strong subdigraph of D R, and the marking of the CPN, the following index set is defined: H µ (r i ) = {h a i,h Co(r i ) Co(r k ) with e i,k E µ and r k N µ for each r i N µ } A controller will prevent reaching a deadlock or a SLD marking if it can enforce the following deadlock prevention GMEC: for each strong subdigraph D µ of D R V (M p ) µ = m i (h) C(N µ ) r 8 r 7 r i N µ h H µ (r i ) for each γ u Γ of D R V (M p ) γ u = r i N Γ u r 3 r 9 r 4 (5) m i C(γ u) (6) Note that being the number of trains in the system always limited (say N max ) it may happen that some of the constraints (5) and (6) are trivially verified because N max C(N µ ) or N max C(γ u) Obviously, the deadlock prevention strategy can be simplified by neglecting such constraints The GMEC given by Equations (5) and (6) restrict the reachability set of the closed loop plant, to avoid deadlock and SLD However, the imposed GMEC can eventually lead to a situation similar to a deadlock, which is known as restricted deadlock (RD) because the constraint for SLD may create in turn higher level deadlocks The following proposition establishes the conditions that must be verified to obtain a RD free closed loop system Proposition 54 If M = [M T p m c ] T is a RD marking for a CPN with capacity constraint, then one of the following two conditions are verified: a) there exist at least two cycle sets Γ and Γ of D R corresponding to the cycles γ, γ Γ such that V (M p ) γ = C(γ ) and V (M p ) γ = C(γ ) ; b) there exists at least a cycle set Γ of D R corresponding to γ Γ and a cycle γ of D R such V (M p ) γ = C(γ ) and V (M p ) γ = C(γ ) Proof If M p is a RD marking of the closed loop system, the restricted deadlock is not determined by the GMEC in Equation (5) because M p is not a SLD marking Hence, one of the following conditions is verified a) There exist at least two constraints defined by Equation (6) that determine the RD marking, say V (M p ) γ < C(γ) and V (M p ) γ < C(γ) More precisely there is a transition t j that is disabled by the constraint V (M p ) γ < C(γ) and a transition t j that is disabled by the constraint V (M p ) γ < C(γ) Hence, there exists an edge e v,q E R, corresponding to transition t j, such that r v Γ and r q Γ, and V (M p ) γ = C(γ) Analogously, there exists an edge e i,m E R, corresponding to transition t j, such that r i Γ and r m Γ, and V (M p ) γ = C(γ) This proves the first condition b) There exists at least one constraint defined by Equation (6) (say V (M p ) γ < C(γ) ) and one constraint defined by Equation (5) (say V (M p ) γ < C(γ ) ) that cause the RD marking More precisely there is a transition t j that is disabled by the constraint V (M p ) γ < C(γ) and a transition t j that is disabled by the constraint V (M p ) γ < C(γ ) Hence, there exists an edge e v,q E R, corresponding to transition t j, such that r v Γ and r q Γ, and V (M p ) γ = C(γ) Analogously, there exists an edge e i,m E R, corresponding to transition t j, such that r i γ and r m γ, and V (M p ) γ = C(γ ) This proves the second condition We define the following parameters: { C = C(γ i ) + C(γj ) }, C = min γ i,γ j Γ,i j { min C(γ i ) + C(γ j ) }, γi Γ,γ j D R while C = min{c, C } Corollary 55 If M p, < C, the closed loop system with the monitors that enforce the deadlock prevention GMEC in Equations (5) and (6) is deadlock free Proof Follows from Proposition 54, because M p, is not a RD marking The following example enlightens the proposed prevention strategy Example 56 Let us consider again the CPN in Figure To obtain the deadlock prevention GMEC, we have to determine the sets V (M p ) γv associated with cycle γ v with v =,, 7, the set V (M p ) µ associated with the strong component D µ = γ γ 6 =

({r 6, r, r }, {e 6,, e,, e,, e,6 }) of D R (see Figure 3) and the sets V (M p ) γ u with u =,, 3 associated with the second level cycles γu Γ of DR with u =, 3 Considering the previously defined sets, the following conditions are imposed by the prevention policy Note that we suppose four trains in the system, and we do not consider the always-verified constraints (for example the constraint V (M p ) γ 4) V (M p ) γ 3 m (π ) + m (π 3 )+ () m 6 (π ) + m 6 (π 4 ) 3 V (M p ) γ m (π ) + m (π 4 )+ () m 6 (π ) + m 6 (π 3 ) V (M p ) γ4 m 3 (π ) + m 9 (π ) (3) V (M p ) γ5 m 4 (π ) + m 9 (π ) (4) V (M p ) γ6 m (π 3 ) + m (π ) (5) V (M p ) γ7 m 5 (π ) + m (π ) (6) V (M p ) γ γ 6 3 m (π ) + +m (π 3 )+ (7) m (π 4 ) + m 6 (π )+ m 6 (π 3 ) + m (π ) 3 V (M p ) γ 3 m 3 (π ) + m 3 (π )+ (8) m 4 (π ) + m 4 (π ) +m 9 (π ) + m 9 (π ) 3 V (M p ) γ 3 3 m (π ) + m (π )+ (9) m (π 3 ) + m (π 4 )+ m 5 (π ) + m 5 (π )+ m (π ) + m (π ) 3 Moreover, we obtain C = min{6, 5} = 5 Since the initial marking is such that M p, < C, the resulting closed loop system is deadlock and RD free The above 9 constraints can be rewritten in terms of a single GMEC (W, k ), that we call deadlock prevention GMEC The deadlock prevention GMEC will have as color set D = {z,, z 9} because we have to impose 9 constraints, and is defined as follows: W = [ w w w ] w = k = [ 3 3 3 3 ] T Z(D ) As an example, we report here the numerical values of w and w 3, while the other w i s are omitted for sake of brevity: w = π π π 3 π 4 z z z 3 z 4 z 5 z 6 z 7 z 8 z 9 w 3 = π π z z z 3 z 4 z 5 z 6 z 7 z 8 z 9 Note that each matrix w i has as many rows as the number of constraints (ie, 9 rows) and as many columns as the number of colors that may be contained in place r i Moreover, by looking at matrix w we may observe that its first row is null because the marking m is not involved in the first constraint On the contrary, the non null elements in its second row, relative to π and π 4 are due to the fact that m (π ) and m (π 4 ) are involved in the second constraint The value is due to the fact that is the associated coefficient in the corresponding linear constraint 6 Conclusions In this paper, we provide a Colored Petri Net model to describe a Railway Network System and to derive the traffic controller The introduced framework allows us to define a supervisor controller guaranteeing safeness and deadlock freeness in the railway traffic control system Starting from the analysis of deadlock on the basis of digraph tools, a deadlock prevention strategy is defined and expressed by a set of linear inequality constraints Moreover, we have shown how collision and deadlock prevention constraints can be expressed as colored GMEC and the controller can be realized by a set of monitor places References [] B De Schutter, T van den Boom, Model predictive control for railway networks, IEEE/ASME Int Conf on Advanced Intelligent Mechatronics, Como, Italy, July [] AA Desrochers, RY Al-Jaar, Applications of Petri nets in manufacturing systems, New York, IEEE Press, 995 [3] J Ezpeleta, JM Colom, J Martinez, A Petri net based deadlock prevention policy for flexible manufacturing systems, IEEE Trans on Robotics and Automation, Vol, No, pp 73-84, 995 [4] MP Fanti, B Maione, S Mascolo, B Turchiano, Control policies conciliating deadlock avoidance and flexibility in FMS resource allocation, ETFA95, INRIA/IEEE Symp on Emerging Technologies and Factory Automation, Paris, France, October 995 [5] MP Fanti, B Maione, S Mascolo, B Turchiano, Event based feedback control for deadlock avoidance in flexible production systems, IEEE Trans on Robotics and Automation, Vol 3, No 3, pp 347-363, 997 [6] MP Fanti, B Maione, B Turchiano, Deadlock avoidance in flexible production systems with multiple capacity resources, Studies in Informatics and Control, Vol 7, No 4, pp 343-364, 998 [7] MP Fanti, A Giua, C Seatzu, A deadlock prevention method for railway networks using monitors for colored Petri nets, 3 IEEE Int Conf on Systems, Man and Cybernetics, Washington, USA, October 3 [8] A Giua, C Seatzu, Liveness enforcing supervisors for railway networks using ES PR Petri nets, Int Workshop on Discrete Event Systems, WODES, Zaragoza, Spain, October [9] F Harary, RZ Norman, D Cartwright, Structural models: an introduction to the theory of directed graphs, John Wiley & Sons, Inc New York, 965 [] K Jensen, Colored Petri nets: basic concepts, analysis methods and practical use, Vol, New York Springer, 99 [] M Missikoff, An object-oriented approach to an information and decision support systems for railway traffic control, Emerging Application of Artificial Intelligence, Vol, pp 5-4, 998 [] EAG Weits, Simulation of railway traffic control, Int Trans Operational Research, Vol 5, No 6, pp 46-469, 998