D can be expressed as the solution set of a system of inequalities such that a distinct variable exists for each transition enabled by marking M:

D = t | A · t ≥ b,

where A is a matrix, b is a vector of constants, and t is a vector of variables corresponding to the enabled transitions.

A state class contains all possible firing times that may happen from a given reachable marking. With this definition of a state class, we can compactly express the firing domain of the initial state class. The initial class contains the initial state and shows the initial marking as well as the initial static intervals. Whereas expressions of intervals for states are simple, expressions of domains for state classes represent complex relationships between the firing times of several transitions.

8.5.1 Determining Fireability of Transitions from Classes

Since a state class is an aggregate of many related states, we need to define new conditions for firing transitions from a class. Again assume that transition t (i) is the ith transition enabled by marking M, then t (i) is fireable from class C = (M, D) iff the following two conditions hold:

1.t (i) is enabled by marking M, that is, p(M( p) ≥ B(t (i), p)).

2.The firing interval corresponding to t (i) must satisfy the following augmented system of inequalities:

A · t ≥ b

t (i) ≤ t ( j) for all j, j = i

where t ( j) is also the firing interval related to the jth component of vector t. Thus the firing of t (i) must occur before the minimum of all LFTs corresponding to all enabled transitions. A system of inequalities is needed to express these complex relationships since using only the EFTs and LFTs of

the transitions cannot adequately express condition (2).

Example. For the example Petri net in Figure 8.1, the initial class C0 is:

M0 = Pr 1, Pr2, Pr3, Pmutex,

D0 = (all solutions to)1 ≤ δcs1 ≤ 8, 2 ≤ δcs2 ≤ 7, 3 ≤ δcs3 ≤ 6.

Furthermore, the following inequalities must be satisfied to fire tcs1:

δcs1 ≤ δcs2, δcs1 ≤ δcs3.

228 TIMED PETRI NETS

Similarly, tcs2 can fire if

δcs2 ≤ δcs1, δcs2 ≤ δcs3

and tcs3 can fire if

δcs3 ≤ δcs1, δcs3 ≤ δcs2.

Suppose transition tcs1 fires, then the next class C1 is

M1 = Pcs1, Pr 2, Pr 3,

D1 = 1 ≤ δn1 ≤ 2.

We can determine all possible firing times for transitions, including those that remain enabled after a firing, by changing the variables resulting from the translation in the augmented system, as follows. Suppose tcs2 fires at relative time δcs1F . After firing tcs1, the other two enabled transitions tcs2 and tcs3 are disabled. To illustrate this complex scenario, suppose tcs2 and tcs3 remain enabled. This is possible if Pmutex

To derive the firing times of the next state class and show the relationships between the firing times of tcs2 and tcs3, we eliminate δcs1F from inequalities (6)

8.5.2 Deriving Reachable Classes

To construct the reachability graph of classes rather than simple states for a Petri net, we first describe the rules for deriving the next class reachable from a given class by firing a transition.

Given a domain D, the following procedure derives domain D .

1.Add the fireability conditions for transition t ( f ) to the system of inequalities defining domain D, that is, A·t ≥ b, yielding the following augmented system:

A · t ≥ b

t ( f ) ≤ t ( j) for all j, j = f.

Then express all times related to variables t ( f ), j = f , as the sum of the time of the fired transitions t ( f ) and of a new variable t ( j) defined as

t ( j) = t ( j) − t ( f ) for all j, j = f,

and remove variable t ( f ) from the system by deriving new firing intervals and the corresponding constraint relationships as shown earlier. This change of variables yields the following system:

A · t ≥ b

0 ≤ t .

Variables A and b are derived from A and b, respectively, the equations defining the new variables. Fourier’s method is then used to eliminate variable t ( f ).

2.Remove all variables corresponding to the transitions disabled by the firing

of t ( f ) while maintaining the relationships they imply using a similar technique as in (1). These transitions are enabled by M but not enabled by M(·) − B(t ( f ), ·) before computing the new marking.

3.Augment the system of inequalities with new variables such that there is one for each newly enabled transition. These variables are defined to belong to

their static firing intervals. These newly enabled transitions are enabled by M − B(t ( f ), ·) and enabled by M . The final system of inequalities is

A · t ≥ b .

A variable for each transition is enabled by marking M , and the solution set of this system defines D .

8.6 MILANO GROUP’S APPROACH TO HLTPN ANALYSIS

The Politecnico di Milano group, headed by Ghezzi (with original members Mandrioli, Morasca, and Pezze, and later Morzenti, San Pietro, and Silva), sought to develop

230 TIMED PETRI NETS

comprehensive tools to specify and validate large systems using HLTPNs and more recently a logic called TRIO.

Initially, [Ghezzi et al., 1991] do not introduce new analysis techniques, but rather state that HLTPNs/TERNs can be readily analyzed by executing specifications. As with non-timed Petri nets, this is done by first providing an initial marking and then executing a given HLTPN specification to explore the nets’ behaviors. However, this is specification testing and can only uncover potential errors, but cannot guarantee the absence of errors if all possible execution paths are not checked. Furthermore, the number of states to be explored increases drastically with the introduction of time and may be infinite.

Ghezzi et al. also suggest analyzing specifications by first defining general properties of nets which state desirable (or undesirable) behaviors of the specified system, and then employing the specification to prove (or disprove) these properties as theorems. However, most of these properties are undecidable.

More recently, the Milano group developed a tool called Cabernet to support the specification and validation of real-time systems based on HLTPNs. While the underlying analysis mechanism is still mainly based on executing specifications, Cabernet is a more integrated tool compared to others in that it supports the specification of control, data, functionality, and time using HLTPNs. Designers can edit, execute, and analyze HLTPNs using Cabernet’s kernel engine.

Cabernet can perform timed reachability analysis by exploring a time reachability tree. To avoid the problem of exploring a potentially infinite-state reachability tree, it restricts the exploration up to a specified time deadline. Using the axiom stating that time eventually increases, and a suit of symbolic execution techniques, makes the set of states in the timed reachability tree finite. This is practical in proving safety and liveness properties limited to a finite time interval in real-time systems.

To make the analysis more efficient, Cabernet can focus on a specific firing model that may ignore one or more features such as data, functionality, and time. Statecharts/STATEMATE also offers a similar capability in specifying and analyzing state systems. Thus the designer can readily customize Cabernet for a given application. Another feature of Cabernet is that it provides net decomposition, which allows the designer to refine a high-level specification to a detailed one via property-preserving transformation. The correctness of these transformations can be verified by the tool in constant time.

8.6.1 Facilitating Analysis with TRIO

Since verifying even basic properties of time ER nets is undecidable, the Milano group [Ghezzi, Mandrioli, and Morzenti, 1990] introduced a logic called TRIO to facilitate the analysis. TRIO is a first-order logic extended with a temporal domain allowing basic arithmetic and the temporal operator Dist. In this regard, TRIO is similar to Jahanian and Mok’s RTL, which is also a first-order logic augmented with the occurrence function to assign time to occurrences of events and actions.

Given a formula F, Dist(F, t) means that F holds at a time instant t time units from the current time (when this sentence is stated). If the Dist operator is not used