Interpreted hierarchical Petri nets in digital controller design Текст научной статьи по специальности «Математика»

КОМПЬЮТЕРНАЯ ИНЖЕНЕРИЯ И ТЕХНИЧЕСКАЯ ДИАГНОСТИКА

UDC 519.714.5

INTERPRETED HIERARCHICAL PETRI NETS IN DIGITAL CONTROLLER DESIGN1

ANDRZEJEWSKIG, KARATKEVICHA.G.________

This paper presents an interpreted hierarchical Petri net model for formal specification of digital controllers in hardware/software co-design platform. The selected attributes of mentioned model for using in real reactive systems are described, and a new method for net analysis is proposed. The analysis concerns deadlock detection. Two methods of analysis, dynamic (a generalization of the stubborn set method) and static (based on solving the logical equations), are proposed.

Introduction

Design of modern reactive systems requires a model which allows formal describing of many important properties. There are such attributes as hierarchy, concurrency, and possibility of using internal signals, history of subsystems or time dependencies. Known models support these properties in various ways. We selected interpreted hierarchy Petri nets [ 1, 2] as a model of formal specification of digital controllers in our packet of tools for design of hybrid systems compound of hardware and software parts. Petri net is a model in which concurrency is its natural property. Existing apparatus of formal verification of selected properties for classical flat nets makes this model very convenient in comparison to others. But there is a necessity of developing other verification methods for practical using of HPN model.

Hierarchical Petri nets

Def. 1. A hierarchical Petri Net (HPN) is a tuple:

HPN = (P, T, F, S, ©, x, T, А а, є, x)

where:

1. P is a finite non-empty set of places. In the “flat” nets the capacity function к : P ^ N u {да} describes the maximum number oftokens in place p . For reactive systems Vp є P к(р) = 1.

2. T is a finite non-empty set of transitions. N = P u T is a set of nodes.

1 — This work was supported by Polish Committee of Scientific Research (KBN) grant no 4 T11C 006 24.

74

3. F is a finite non-empty set of arcs, such that: F = Fo u Fe u F;, where Fo : Fo c (P x T) u (T x P) is a set of ordinary arcs, Fe :Fe c (P x T) is a set of enabling arcs, F; : F; c (P x T) is a set ofinhibitor arcs. In the flat” nets the weight function та : F ^ N describes the number of tokens which can be moved at the same time through arc f . For reactive systems Vf є F та(р) < 1. According to this, an extra-specification of arcs is possible: Vf є Fo : ra(f) = 1, Vf є Fe u F; : ra(f) = 0 .

4. S is a finite non-empty set of signals, such that: S = X и Y и L , where X, Y and l mean sets of input, output and internal signals, respectively.

5. © is a discrete time scale, which is a set of numbers assigned to ordered discrete values of time.

6. x :P ^ 2N is a hierarchy function, describing a set of immediate sub-nodes of place p . The expression y* denotes a transitive-reflexive closure ofx function, such that for each p є P the following predicates hold:

- p ex*(p),

- x(p) ex*(p),

- p'eX*(p) ^X(p’) £X*(p).

A place p is called a basic place if x(p) = 0 .

1. у : P ^ {true, false} is a Boolean history function, assigning a history attribute to every place p , such that X(p) ^ 0 . For basic places the function is not defined.

2. X : N ^ 2s is a labeling function, assigning expressions created from elements of set S to nodes from N . The following rules are suggested: places may be labeled only by subsets of Y u L (a label action means an action assigned to a place), the label of transition may be composed of the following elements:

cond — created on set Y u L u {true, false} , being a Boolean expression imposed as a condition to transition t and generated by operators: not, or and and, the absence of cond label means cond=true;

abort—created as a cond, but being in a different logical relation with respect to general condition for transition t enabling, represented graphically by # at the beginning of expression, absence of abort label means abor=false;

action — created on set Y u L , meaning action assigned to transition t , represented graphically by / at the beginning of expression.

1. a : P ^ {true, false} is an initial marking function, assigning the attribute of an initial place to every place pOP. Initial places are graphically distinguished by a dot (mark) in circles representing these places.

2. є :P ^ {true, false} is a final marking function, assigning the attribute of a terminal place to every place

РИ, 2005, № 1

p є P . Terminal places are graphically distinguished by ' inside circles representing these places.

3. x: N ^ © is a time function, assigning numbers from the discrete scale of time to each element from the set of nodes N .

Let t0 mean a moment of activation of a node n є N . The function x(n) assigns a number to the node n at the moment 90 : x(n, 90) = 9 , where 9є0 . In further instants the number is decremented and at the moment 90 +9 it accomplishes value 0: x(n, 90 +9) = 0 .

Behavior of the HPN

The behavior of a net is determined by movement of tokens. The rules of their movement are defined by conditions of transition enabling and action assigned to transition firing. We propose some additional definitions which can simplify description of HPN behavior.

Let p є P is a place of a hierarchical Petri net.

Def. 3 A place p is called a macroplace if it is not a basic place: x(p)^ 0 .

Def. 4 A set of input places of transition t is ptin(o), such that: Ptin(o) = {p є P : (p, t) є Fo }.

Def. 5. A set of enabling places of transition t is Ptin(e):

P”(e) = {p є P : (p, t) є Fe} .

Def. 6. A set of inhibitor places of transition t is Ptin(l): Ptln(l) = {p є P : (p, t) є FJ .

Def. 7. A set of output places of transition t is Ptout : Pt0ut = {p є P : (t,p) є Fo}.

Def. 8. The function ac : P ^ {true, false} is called a place activity function. Its value is true for each place that has a token, otherwise it is false.

Def. 9. The place p is the lowest ancestor of a node n', if n'e x(p); it is denoted as la(n') = p .

Def. 10. Let N1 denote a set of nodes n1 = %(p), and let F1 denote set of all arcs joining nodes belonging to N1 . Then Z1 is a subnet assigned to the macroplace p, such that: Z1 = N1 + F1 . All subnets assigned to macroplaces are required to be disjoint (no common nodes and arcs).

Def. 11. Ppend is a set of final places of a subnet assigned to macroplace p, such that: ^ e(p) = true ^ p є Pp .

Def. 13 § : P ^ P is a function of the set of terminal places, such that for macroplace p it returns its set of terminal places: |(p) = Ppnd .

The expression denotes a transitive-reflexive closure

of £ function, such that for each p є P and %(p) ^0 the following predicates hold:

- l(p) (p),

- p'e|*(p) ^S(p') cS*(p).

Def. 14 A final marking of a subnet is such a marking, which contains all terminal places of that subnet.

The conditions of transition t enabling

3 la(t) = p ^ ac(p) = true peP , (1a)

V ac(p) = true pePin(o) uP;n(e) , (1b)

V ac(p) = false pePin(i) , (1c)

cond(t) = true , (1d)

V' (, x(p) ^ 0 ^ pePtin(o) V (ac(p') = true л x(p') = 0), p'e§*(p) (1e)

V x(p) = 0 pePtin(o) , (1f)

abort(t) = true . (1g)

Note: From all conditions (1a-g) the following logical expression can be composed (the general condition): abc(def v g), that means a possibility of enabling transition t without satisfying conditions d , e and f , if g is true. This situation is known as preemption.

The actions assigned to transition t firing

V ac(p) := false

pePin(o) ,

V %(p) Ф 0 ^ V ac(p') := false

pePtln(o) p'£X*(p) ,

V V s := false

pePtm(o) seactlon(p) ,

V %(p) Ф 0 ^ V V s := false

pePtin(o) p'ex*(p) seactlon(p') ,

x(t) = 0 ^ V ac(p) := true

pePtout ,

V x(p) ^ 0 ^ ( V ac(la(p')) = true

p^Ptout p'^x*(p)

and y(la(p')) = false ^ ac(p') := a(p'))

V x(p) ^ 0 ^ ( V ac(la(p')) = true л

pePtout p'ex*(p)

Ay(la(p')) = true л 3 ac(p") = false ^

p"ei;(la(p')) (2g)

ac(p') := ac(p',te))

V x(p) ^0^ ( V ac(la(p')) = true л

p^Ptout p'^x*(p)

Ay(la(p')) = true л V ac(p") = true

p"e§(la(p')) (2h)

^ ac(p') := a(p'))

(2a)

(2b)

(2c)

(2d)

(2e)

(2f)

- p є (p),

V V s := true

pePtout seaction(p)

РИ, 2005, № 1

75

pV”Z<P) .0-

( V ac<p') = true ^ V s := true) (2j)

P'eX*<P) seaction<p')

X<t, Iq) =

V s := true in the range < iq , iq + p +1 > (2k)

seaction(t)

where ac(p,te) means the activity function of place p at an instant, in which the token left the place la(p) .

Note: Actions (2e-j) are performed when x(t) = 0. Action (2k) is performed during all activity time of transition t .

An important feature of the model is its intuitive graphical representation similar to the statecharts from UML diagrams (fig.1.).

Fig. 1. An example of HPN (automatic washer controller from [2])

In general an interpreted hierarchical Petri net is an oriented graph with two kinds of nodes connected by arcs. Places are represented by circles and they are used to represent states in modeled system. Active places are marked by tokens that are presented as dots inside places. Places distinguished by ' represent terminal states of a subnet. Transitions are represented by thick beams and they are used to modeling actions assigned to changes of system state. Macroplace is a place distinguished by double circle. With each macroplace a subnet is associated, which activity depends on presence of a token in this macroplace. An expansion of macroplace (subnet) is defined inside rounded rectangle.

Three sets of signals are associated with the net: i , O and l , meaning sets of inputs, outputs and internal signals, respectively. Signals from the sets I and O are accessible on every level of hierarchy. Signals from the set l can be of local or global range depending on point of their declarations.

With the nodes the labels are associated. The labels correspond to the subsets of the set S = I и O и L. A label assigned to place P is compound of signal names

76

separated by commas and it denotes the set of active signals when place p is active.

Transition’s label is compound of three elements: cond, abort and action. Two first of them are specified as logical expressions and they denote the conditions of transition t enabling, weak and strong respectively (1d, 1g). Strong condition (abort) is preceded by # and is used for preemption of all input macroplaces of transition t. The action element is specified as a place’s label, but set of signals associated with this element is active only during one clock cycle.

Often a situation occurs in which internal states on selected hierarchy levels must be remembered. In HPN

it is implemented by ascribing history attribute {H} to selected macroplace. When token leaves such macro, the marking of the corresponding subnet is remembered. And after macro reactivation tokens are inserted into lately active places. For user convenience there is added a possibility of history attribute ascribing to all subordinated macros. Operator {H *} is used for that.

With places the time parameters are associated. Ascribing of time t from discrete scale of time to place p determines minimal activity time of this place. This means that output transition of place p will be enabled only after time l, starting from the moment of place p. activation. This solution provides great practical possibilities of describing the strongly time dependent systems.

Verification of interpreted hierarchical Petri nets

When a formal model is used in design process, it is important to have possibility of formal verification of the systems described by this model. And verification of the concurrent systems is much more complicated than of the sequential ones. On the other hand, presence of hierarchy simplifies verification, because analysis of a hierarchical system in certain respect can be reduced to analysis of its components.

The main properties of the correct, “well-formed” concurrent control systems are the following [1, 2, 7].

1. Liveness (for every reachable global state, any transition becomes enabled after some sequence of input events; any local state is entered after some sequence of input events).

2. Lack of deadlock states (a live system has no global deadlocks, but not vice versa).

3. Safeness (the system should never enter the local state already active).

4. Consistency (the concurrent branches should never attempt to assign different values to the same signal or variable at the same time).

5. Determinism (the conflicting transitions should have the orthogonal conditions of firing).

6. All the input, output and internal signals should be used.

РИ, 2005, № 1

The last two properties can be easily (in polynomial time) checked. To check consistency one has to know concurrency relation between the transitions, which in general case requires constructing the full reachability space, but can be performed easier in many practical cases. For example, if the subnets from which the hierarchical net consists belong to the class of EFC-nets, concurrency relation can be calculated in polynomial time [8]. And when this relation is known, consistency can be checked quickly.

And even if those nets do not necessary belong to the class of EFC-nets, but each subnet is relatively small (a usual case in practical applications), then the concurrency relation between places can be quickly obtained for each subnet, and the concurrency relation for the whole net can be easily (in polynomial time) calculated from those partial results. However, first, such analysis does not take into account internal signals and time parameters, and second, for a non-EFC net concurrency relation between transitions does not follow directly from the concurrency relation between places.

On the other hand, some simple variants of interpreted Petri net models can describe only consistent systems — for example, that is the case if in the model described in this paper the expressions specifying actions associated with the places and transitions of the net will be restricted to be the elementary conjunctions of Boolean variables (without negation). Such a model, however simple, is rather convenient and powerful enough for describing the simple logical control algorithms.

Liveness, safeness and lack of deadlocks are the properties difficult to check, because they cannot be checked locally (a net may have a local fragment implying that this net is not live or unsafe, but lack of such fragments does not mean that the net is live and safe). Their analysis requires taking into account the whole net or at least a subnet.

Our investigation of practical examples shows that the most important of complex verification tasks for HPNs is deadlock detection. Below the deadlock detection for HPNs is considered.

Dynamic analysis

There are two kinds of subnets in a hierarchical net: with the terminal places or without them [2]. Presence of hierarchy simplifies the analysis: if the system has no internal signals, the liveness of the whole system can be checked by checking all the nets separately; a net without terminal places should be live; a net with terminal places should be able to reach its terminal marking from all the reachable markings, and only the terminal places should be marked at the terminal marking (such property is called quasy-liveness in [7]). Such approach also works for the HPNs in which history attribute and abort conditions are used. If there are the internal signals, it should be taken into account that due to them even a structurally live system may have a deadlock.

There are various methods of liveness and safeness analysis, but most of them, such as the approaches of structural analysis, are efficient when the net structure satisfies certain restrictions. For example, analysis of the

concurrent algorithms which structure corresponds to the EFC nets can be performed in efficient way [9], because liveness and safeness properties for such nets can be checked in polynomial time, and for general Petri nets such checking requires exponential time.

Detecting of the reachable deadlock states can be performed in evident way by constructing reachability graph of a system or its part. But because of the state explosion problem multiple attempts have been made to simplify such analysis. The methods of the lazy state space construction have been developed [ 10]. The most popular of such methods is the so-called stubborn set method [6] in its multiple variants. This method allows detecting all the deadlocks by constructing a subgraph of reachability graph, avoiding interleaving. With some variations (or for special subclasses of the nets) it allows doing more. For the nets with single-token initial marking the stubborn set method allows checking liveness [4], for the EFC nets with single-token initial marking—liveness and safeness [11]. Another approach, in some respect similar to the stubborn set method and based on the net decomposition, allows checking liveness and safeness of a net with single-token initial marking [12].

We propose the next algorithm of liveness analysis, based on [3, 6] and adapted to the model described above. It constructs a reduced reachability graph of the HPN allowing detecting deadlocks. The algorithm is intended for a simplified model, without actions assigned to transitions. This limitation does not decrease impressiveness of the model, because a transition with an action can be replaced by two transitions and a place between them, to which the action is assigned.

Algorithm 1

Input: a HPN.

Output: the list of deadlocks.

1. Select in HPN a subnets that has not been checked yet (Q := {E}). If there is no such subnet, go to 5. Else repeat items 1.1-1.3 while Q grows.

1.1. If there is a subnet Eg Q and a subnet E'g Q such that s' and s are dependent on each other (due to an internal signal such that it is generated in s' and used in s or vice versa), add s' to Q .

1.2. If the lowest common ancestor (LCA) in the HPN hierarchy tree of all the subnets belonging to Q does not belong to Q itself, add it to Q .

1.3. For every two subnets s and s' belonging to Q, such that s is an ancestor of s', if there is a subnet E''gQ such thatЕ''є%*(E) and Е'є%*(E''), add s'' to Q.

2. Consider the net consisting of all the nets belonging to Q . Let all its initial places be marked according to the initial marking of the LCA. Construct a sub-graph of its reachability graph in the next way: for every marking m simulate firing of the enabled transitions

belonging to a set Ts constructed as described in 2.1.

РИ, 2005, № 1

77

If during the simulation a non-safe situation is detected, communicate “The net is not safe” and go to 5.

2.1. For a marking m select an enabled transition t; Ts := {t}. Expand the set Ts so that it would satisfy the next conditions:

2.1.1. Vt є Ts : ift is disabled, and not all of its input places have tokens, then 3p є Ptin : ac(p) = false , Tpm c Ts ;

Vt є Ts : if t is disabled, and all of its input places have tokens (cond(t) = false), then there is a prime implicent [15] d ofcond(t) such that d = false , for any signal x appearing in d without negation and any place p such that x є action(p):

1.1.1. Tpn c TS ; for any signal x appearing in d with negation and any place p such that x є action (p):

"-pout _ 'T

Tp c TS;

1.1.2. Vt є Ts : if t is enabled, then

Vt': (Ptin n Ptin * 0) ^ (t'e TS);

Fig. 2. An example of HPN with deadlock

Static analysis

Deadlock analysis can also be performed by solving logical equations. There are methods of characteristic functions calculation of Petri nets reachability set (see, for example, [13]), also for hierarchical Petri nets [14], usually based on BDD representations. Those methods do not take into account the internal signals.

1.1.3. Vt є Ts : let k t be an elementary conjunction of all the signals belonging to the set

( U action(p)) u ( U action(p)) such that every signal x

peP” pePtout

appears in kt without negation, if and only if x є U action(p). For every transition t' if there is

peP"

prime implicant k' of cond(t') such that kt л k' = false , then t'e Ts .

2. Check the constructed graph. Ifit contains the dead markings, in such markings only the terminal states should be marked; otherwise the net is not deadlock-free. Then add the detected dead markings to the list of deadlocks.

3. If there are the sub-nets not checked yet, go to 1.

4. The end.

The algorithm is a modification of A. Valmari’s stubborn set method [6]; conditions of stubborn sets ( Ts ) are complemented to take into account internal signals of the system. The algorithm detects global and some of local deadlocks.

Analysis of a simple system shown at Fig. 2 could be performed as follows. The top level of hierarchy and the macroplace P2 can be analyzed separately. Both of them are in fact FSMs, not depending on any signals from other components of the system, so their reachability graphs can be easily constructed, and no deadlocks are possible on that level. P3 and P4 should be analyzed together, because they depend on each other (item 1 of the algorithm). Attempt of constructing the reachability graph of the subsystem consisting of P3 and P4 immediately leads to the conclusion that the subsystem cannot leave its initial state because of a deadlock.

Suppose there is a live and safe Petri net £ with initial marking M0 and characteristic function of the state space Ch[M0>. Now suppose that the signals are added to the net, conditions are associated with the transitions, and actions with the places. How to answer the question, whether the deadlocks are possible in such system?

Ifa deadlock is possible, it is a root ofthe system of equations (3), where Ch[M(i -> is the characteristic function, tj...tn are the transitions of the net, si...sm є L, and cond'(t) is the condition of firing of transition t, depending on p and x. Notion pi is used instead of ac(pi).

Ch[M0 > =true

cond'(tj) v... v cond'(tn) = false

-si = v pi

x1eaction(pi) ...

sm = V pi

xmeaction(pi)

For the system shown in Fig. 2, the system of equations looks as follows (we do not use BDD here):

(pi © p2 )(p2 ^ (p3p4 © p5 )) = true

(p2 ^ p3p4p5) = true

p3 ^ (p6 p7 p8 v p6p7 p8 v p6 p7p8 ) = true

p3 ^ p6 p7 p8 = true

• p4 ^ (pTiopii vp9piopii vp9piopii) = true p4 ^ p9piopii = true (4)

pi Vp2p5 vp3p4(p7 Vp8)(pio Vpii) = false p6(si V s2 ) v p9 (s3 V s4) = false si = pio; s2 = pii; s3 = p7; s4 = p8

78

РИ, 2005, № 1

In (4) first 6 equations represent the first equation from (3) (characteristic function), next 2 equations represent second equation from (3) (conditions of transition enabling).

The only root of the system can be described by the

expression P1P2P3P4P5P6P7P8P9P10P11S1S2S3S4 • It corresponds to the same deadlock that was described in the previous chapter.

Conclusion

Interpreted hierarchical Petri net model described in this paper is a powerful and convenient tool of specification of control algorithms and can be used in computer-aided design oflogical controllers. It has been used and verified in the educational process in the University of Zielona Gyra in the course “embedded systems”. FPGA implementation and deeper verification of the described model will be the subject of further work. As for verification, the main effort we are going to develop analysis methods taking into account time dependencies in the model.

References: 1. Andrzejewski G. Hierarchical Petri Net as a Representation of Reactive Behaviors // Advanced Computer Systems — ACS’2001, Eighth International Conference, Szczecin, Poland, 2001, Part 2.P.145-154. 2. Andrzejewski G. Programowy model interpretowanej sieci Petriego dla potrzeb projektowania mikrosystemyw cyfrowych. Zielona Gyra: Uniwersytet Zielonogyrski, 2003. 109 p. 3. Karatkevich A., Andrzejewski G. Analiza wybranych wiasnoci interpretowanej sieci Petriego metod№ optymalnej symulacji // Materiaiy Pierwszej Krajowej Konferencji Elektroniki KKE’2002, Koiobrzeg — Dwirzyno, 2002, Vol. 2. P. 685-690. 4. Karatkevich A. To behavior analysis of a class of Petri nets / / Proceedings of 27th IFAC/ IFIP/IEEE Workshop on Real-Time Programming WRTP’2003, ,,agyw, Poland, 2003.- Elsevier Ltd, Oxford, UK, 2003. P. 33-38. 5. Staunstrup J. and others. Practical Verification of Embedded Software. // Computer, May 2000. P. 68-75. 6. ValmariA. State of Art Report: Stubborn Sets // Petri Nets Newsletter, No 46, GI, Bonn 1994, P. 614. 7. Закревский А.Д. Параллельные алгоритмы логического управления. Минск: Институт технической

кибернетики НАН Беларуси, 1999. 202 с. 8. Kovalyov A.V. Concurrency Relations and the Safety Problem for Petri Nets. // Applications and Theory of Petri Nets 1992, Proceedings, LNCS, Vol. 616, P. 299-309. 9. Zakrevskij

A. D. The analysis of concurrent logic control algorithms / LNCS, Fundamentals in Computational Theory, Springer Verlag, Vol. 278, 1987, P. 497-500. 10. HeinerM. Petri net based system analysis without state explosion // High Performance Computing ’98, Boston April 1998, P. 1-10. 11. Karatkevich A., Adamski M, Wegrzyn M. Rapid Correctness Analysis for Sequential Function Chart // 45. Internationales Wissenschaftliches Kolloquium, Technische University Ilmenau, Ilmenau, 2000. P. 679-684. 12. Zakrevskij A., Karatkevich A., Adamski M. A Method of Analysis of Operational Petri Nets// Proceedings of the Eight International Conference ACS’2001, Mielno, Poland, October 17-19, 2001. Kluwer Academic Publishers, Boston, 2002. P. 449-460. 13. Bilicski K. Application of Petri Nets in Digital Controller Design. PhD. Thesis. Bristol: University of Bristol, 1996. 14. Miczulski P. Algorithm for Calculating Petri Nets Hierarchical State Spaces Using the Connected System of Decision Diagrams/ To appear in: Design of Embedded Control Systems/ Eds. M. Adamski, A. Karatkevich, M. Wegrzyn. Kluwer Academic Publishers, 2004. 15. Самофалов К.Г., Романкевич А.М., Валуйский

B. H., Каневский Ю. С., Пиневич М.М. Прикладная теория цифровых автоматов. Киев: Вища шк., 1987.

Andrzejewski, Grzegorz, Ph.D., assistant professor of the University of Zielona Gyra, Poland. His current research interests include high level design of control systems, particularly hardware/software co-design on digital microsystem implementation platform. Address: Institute of Computer Eng. and Electronics, University of Zielona Gyra, ul. Podgyrna 50, 65-246 Zielona Gora, Poland. E-mail: [email protected] Phone: (+48 68) 3282 616.

Karatkevich, Andrei G., Ph.D., assistant professor of the University of Zielona Gyra, Poland. His current research interests include Petri net theory and its applications, especially to problems related to modelling and analysis of concurrent logical control algorithms and, generally, concurrent discrete systems. Address: Institute of Computer Eng. and Electronics, University of Zielona Gyra, ul. Podgyrna 50, 65-246 Zielona Gora, Poland. E-mail: [email protected]. Phone: (+48 68) 3282 708.

P^ 2005, № 1

79