Thời gian thực - hệ thống P8

Given a marking, atransition is enabled if the number of tokens in each of its input places is at least the number of arcs, n i , from the place to the transition.. An enabled transition

CHAPTER 8

TIMED PETRI NETS

Petri nets were developed as an operational formalism for specifying untimed current systems They can show concurrent activities by depicting control and dataflows in different parts of the modeled system As an operational formalism, a Petrinet gives a dynamic representation of the state of a system through the use of mov-ing tokens The original, classical, untimed Petri nets have been used successfully

con-to model a variety of industrial systems More recently, time extensions of Petri netshave been developed to model and analyze time-dependent or real-time systems Thefact that Petri nets can show the different active components of the modeled system

at different stages of execution or at different instants of time makes this formalismespecially attractive for modeling embedded systems that interact with the externalenvironment

A Petri net, or place-transition net, consists of four basic components: places, sitions, directed arcs, and tokens A place is a state the specified system (or part ofit) may be in The arcs connect transitions to places and places to transitions If anarc goes from a place to a transition, the place is an input for that transition and thearc is an input arc to that transition If an arc goes from a transition to a place, theplace is an output for that transition and the arc is an output arc from that transition.More than one arc may exist from a place to a transition, indicating the input place’smultiplicity A place may be empty, or may contain one or more tokens The state of

tran-a Petri net is defined by the number of tokens in etran-ach pltran-ace, known tran-as the mtran-arking

and represented by a marking vector M M[i] is the number of tokens in place i.

212

Copyright ¶ 2002 John Wiley & Sons, Inc.

ISBN: 0-471-18406-3

UNTIMED PETRI NETS 213

Graphically, circles denote places, bars represent transitions, arrows denote arcs,and heavy dots represent tokens

As an operational formalism, a Petri net shows a particular state of the systemand evolves to the next state according to the following rules Given a marking, atransition is enabled if the number of tokens in each of its input places is at least the

number of arcs, n i , from the place to the transition We select n i tokens as enablingtokens

An enabled transition may fire by removing all enabling tokens from its inputplaces and by putting in each of its output places one token for each arc from thetransition to that place If the number of input arcs and output arcs differs, the tokenswill not be conserved If two or more transitions are enabled, any transition mayfire The choice of the next-firing transition is nondeterministic Each firing of atransition changes the marking and thus produces a new system state Note that anenabled transition may fire, but is not forced (required) to fire

Example Three-process mutual exclusion problem: Figure 8.1 shows the Petri

net of the solution to a three-process mutual exclusion problem There are 10 places

in this net, three for each of the three tasks, and one “shared” among the three tasks

n2

t

1

n1 cs1

T

t t

A dot in place P ni means that task T i is in the non-critical region A dot in place P r i means that task T i is in the requesting (trying) region A dot in place P csimeans that

task T i is in the critical section There are nine transitions in this net, three for each

of the three tasks The figure illustrates the state of the Petri net in which all three

tasks are requesting to enter the critical section This is indicated by dots in P r 1 , P r 2,

and P r 3

There are three enabled transitions in this net, t cs1 , t cs2 , and t cs3, since the input

places of each transition contain tokens The dot in place P mutex indicates that onetoken (privilege) is available to grant to one task to enter and execute the criticalsection The task to obtain this privilege is selected nondeterministically Suppose

task T1is selected, then the transition t cs1 fires by removing the tokens from both

of its input places and then putting a token in its output place P cs1, indicating that

task T1is executing the critical section Note that transitions t cs2 and t cs3 are now

disabled since the token in P mutex has been removed by the firing of t cs1

After task T1finishes executing its critical section, it goes back to its non-critical

region This is modeled by firing transition t n1, which removes the token in input

place P cs1 , and then putting a token in its output place P n1and a token in its output

place P mutex Now either T2and T3may be selected to enter the critical section since

transitions t cs2 and t cs3become enabled

Given an initial state, the reachability set of a Petri net is the set of all states

reachable from the initial state by a sequence of transition firings To construct thereachability graph corresponding to a reachability set, we can represent each state by

a node and add a directed edge from state s1to state s2if firing a transition enabled

in state s1leads the net to state s2

Classical Petri nets cannot express the passage of time, such as durations and

time-outs The tokens are also anonymous and thus cannot model named items They

also lack hierarchical decomposition or abstraction mechanisms to properly modellarge systems To model realistic real-time systems, several extended versions ofPetri nets have been proposed to deal with timing constraints There are basicallytwo approaches: one associates the notions of time to transitions and the other asso-ciates time values to places

[Ramchandani, 1974] associated a finite firing time to each transition in a

classi-cal Petri net to yield timed Petri nets (TdPNs) More precisely, the firing of a

transi-tion now takes time and a transitransi-tion must fire as soon as it is enabled TdPNs havebeen used mainly for performance evaluation Shortly thereafter, [Merlin and Farber,1976] developed a more general class of nets called time Petri nets (TPNs) These

are Petri nets with labels: two values of time expressed as real numbers, x and y, are associated with each transition where x < y x is the delay after which and y is the

deadline by which to fire the enabled transition A TPN can model a TdPn but notvice versa

PETRI NETS WITH TIME EXTENSIONS 215

8.2.1 Timed Petri Nets

A TdPN is formally defined as a tuple(P, T, F, V, M0, D) where

P is a finite set of places;

T is a finite, ordered set of transitions t1, , t m;

B is the backward incidence function B : T × P → N, where N is tghe set of

nonnegative integers;

V : F → (P, T, F) is the arc multiplicity;

D : T → N assigns to every transition t I a nonnegative real number N indicating the duration of the firing of t I; and

M0is the initial marking

A TdPN follows the following earliest firing schedule transition rule: An enabled transition at a time k must fire at this time if there is no conflict Transitions with

no firing durations (D (t) = 0) fire first When a transition starts firing at time t it

removes the corresponding number of tokens from its input places at time t and adds the corresponding number of tokens to its output places at time k + D(t) At any

time, a maximal set of concurrently enabled transitions (maximal step) is fired

8.2.2 Time Petri Nets

A TPN is formally defined as a tuple (P , T, B, F, M0, S) where

P is a finite set of places;

T is a finite, ordered set of transitions t1, t2, , t m;

B is the backward incidence function B : T × P → N, where N is the set of

nonnegative integers;

F is the forward incidence function F : T × P → N;

M0is the initial marking function M0: P → N;

S is the static interval mapping

S : T → Q∗× (Q∗∪ ∞), where Q∗is the set of positive rational numbers.

[Merlin and Farber, 1976] specifies timing constraints on a transition t i usingconstrained static rational values as follows

Static Firing Interval: Supposeα i Sandβ i Sare rational numbers, then

S (t i ) = (α i S , β i S ),

where 0≤ α S < ∞, 0 ≤ β S ≤ ∞, and α S ≤ β Sifβ S = ∞ or α S < β Sifβ S = ∞.The interval(α i S , β i S ) is the static firing interval for transition t i, indicated by the

superscript S, where α i S is the static earliest firing time (EFT) andβ Sis the static

latest firing time (LFT) In general, for states other than the initial state, the firing tervals in the firing domain will be different from the static intervals These dynamiclower and upper bounds are denotedα i andβ i, respectively, and are called simplyEFT and LFT, respectively.

in-Both the static and dynamic lower and upper bounds are relative to the instant at

which t i is enabled If t i is enabled at timeθ, then while t i is continuously enabled,

it must fire only in the time interval betweenθ + α i S(orθ + α i) andθ + β i S(or

θ + β i)

For modeling real-time systems, EFT corresponds to the delay before a transitioncan be fired, and LFT is the deadline by which a transition must fire In Merlin’smodel, time can be either discrete or dense Also, the firing of a transition happensinstantaneously; that is, firing a transition takes no time

If there is no time interval associated with a transition, this transition is a classicalPetri net transition and the time interval can be defined asα i S = 0, β i S = ∞.This indicates that an enabled transition may fire, but is not forced (required) to fire.Therefore, TPNs are timed restrictions of Petri nets

TPN States: A state S of a TPN is a pair (M, I ) where M is a marking, and I is a

firing interval set which is a vector of possible firing times

For each transition enabled by marking M, a corresponding entry exists of the form (EFT,LFT) in I Since the number of transitions enabled by a marking varies, the number of entries in I also varies as the Petri net runs If the enabled transitions are ordered (numbered) in I , then entry i in I is the i th transition in the set of transitions enabled by M.

Example For the example Petri net in Figure 8.1, M = P r 1 (1), P r 2 (1), P r 3 (1),

P mutex (1) Four places are marked, each containing one token There are three

en-abled transitions: t cs1 , t cs2 , and t cs3 Suppose I has the following three time interval

entries:(1, 6) (2, 7) (3, 8) Transition t cs1 may fire at any time between 1 and 6

Transition t cs2 may fire at any time between 2 and 7 Transition t cs3may fire at anytime between 3 and 8 Note that as soon as one transition fires, the other two becomedisabled

state S = (M, I ), a subset of the set of all enabled transitions may fire owing to the EFT and LFT timing restrictions on these transitions Formally, a transition t i is

firable from state S at time θ + δ iff both of the following conditions hold:

1 t i is enabled by marking M at time θ under the usual enabling condition of

classical Petri nets; that is,∀p(M(p) ≥ B(t i , p)); and

2 δ is at least EFT of t i and at most the minimum of the LFTs of all transitions

enabled by M; that is, EFT of t i ≤ δ ≤ min(LFTs of t k enabled by M ).

PETRI NETS WITH TIME EXTENSIONS 217

The reason for condition (2) is as follows Suppose t j is the transition with the

smallest LFT among all enabled transitions Then t j must fire at timeδ = LFT j if

no other enabled transition has fired, modifying the marking and thus the state of theTPN

The firing of a transition t i at relative timeδ leads the TPN to a new state S =

(M, I), which can be derived as follows:

1 The new marking M is derived with the usual Petri nets rule:∀pM(p) =

M(p) − B(t i , p) + F(t i , p).

2 To derive the new set of time intervals I, we first remove from I the intervals

associated with the transitions that are disabled after firing t i Note that t i isalso diabled after its firing Then we shift the remaining time intervals byδ

towards the origin of times, truncating them if necessary to obtain nonnegativevalues This corresponds to incrementing time byδ Finally, we add to I the

static intervals of the newly enabled transitions, yielding I Thus the domain

of the new state is the product of the time intervals of the remaining enabledtransitions and those of the newly enabled transitions

We use the following notation to denote that transition t i is firable from state S at

timeδ and its firing leads to state S:

be-Example For the example Petri net in Figure 8.1,

M0= P r 1 (1), P r 2 (1), P r 3 (1), P mutex (1).

I0= (1, 8)(2, 7)(3, 6).

Therefore, any one of the three transitions t cs1 , t cs2 , t cs3 may fire according to the

following timing restrictions Transition t cs1may fire in the period between relativetime 1 (the EFT of (1,8)) and relative time 6 (the minimum of the LFTs (6,7,8) of the

intervals for the three enabled transitions) Similarly, transition t cs2 may fire in theperiod between relative time 2 (the EFT of(2, 7)) and relative time 6; and transition

t cs3may fire in the period between relative time 3 (the EFT of (3, 6)) and relative

time 6 The choice of which transition to fire is nondeterministic

Thus at any time δ1within the infinite number of real values in interval(1, 6),

firing t cs1 leads to state S1= (M1, I1):

M1= p cs1 (1), p r 2 (1), p r 3 (1) and

I1= (1, 2).

Notice transitions t cs2 and t cs3 have been disabled by the firing of t cs1and thus

their associated time intervals are removed from I Also, transition t cs1is disabled

after its own firing Transition t n1 has enabled t cs1and so the associated time interval

8.2.3 High-Level Timed Petri Nets

High-level timed Petri nets (HLTPNs), or time environment/relationship nets(TERNs) [Ghezzi et al., 1991], integrate functional and temporal descriptions inthe same model In particular, HLTPNs provide features that can precisely modelthe identities of a system’s components as well as their logical and timing propertiesand relationships A HLTPN is a classical Petri net augmented with the followingfeatures

For each place, a restriction exists on the type of tokens that can mark it; forexample, each place has one or more types If any type of token can mark a place,then this place has the same meaning as in a classical Petri net Each token has atime-stamp indicating its creation time (or birth date) and a data structure for storingits associated data

Each transition has a predicate that determines when and how the transition isenabled This is similar to a transition in TPNs but is more elaborate In HLTPNs, thispredicate expresses constraints based on the values of the data structures and time-stamps of the tokens in the input places A transition also has an action that specifiesthe values of the data to be associated with the tokens produced by the transitionfiring This action depends on the data and time-stamps of the tokens removed bythe firing Finally, a transition has a time function that specifies the minimum andmaximum firing times This function depends also on the data and time-stamps ofthe tokens removed by the firing Graphically, a transition is represented by a box orrectangle

PETRI NETS WITH TIME EXTENSIONS 219

environ-ment/relationship (ER) nets without timing extensions Tokens in ER nets areenvironments, functions that associate values to variables Each transition has anassociated action that specifies the types of tokens for enabling the transitions andthe types of tokens produced by the firing More precisely, in an ER net:

1 Tokens are environments or possibly partial functions on I D and V : I D → V , where I is a set of identifiers and V is a set of values ENV = V I Dis the set

of all environments

2 Each transition t has an associated action, which is a relationship: α(t) ⊆

ENVk (t)× ENVh (t) , where k (t) and h(t) are the cardinalities of the preset and

postset of transition t , respectively The weight of each arc is 1 Also, h (t) > 0

for all t The predicate of transition t , denoted π(t), is the projection of α(t)

on ENVk (t).

3 A marking M is an assignment of multisets of environments to places.

4 In a marking M, a transition t is enabled iff for every input place p i of t , at least one token env i exists such that the enabling tupleenv1, , env k (t)  ∈ π(t) More than one enabling tuple may exist for transition t , and a token may appear

in more than one enabling tuple

5 A firing is a triple x = enab, t, prod, where enab is the input tuple, prod is

the output tuple, andenab, prod ∈ α(t).

6 In a marking M, the firing enab, t, prod occurs by removing the enabling tuple enab from the input places of transition T and storing the tuple prod in the output places of transition T , thus producing a new marking, M.

7 A firing sequence starting from marking M0is a finite sequence of firings,

enab1, t1, prod1, · · · , enab n , t n , prod n , where t1is enabled in M0by enab1; each t i , i = 2, , n, is enabled in M i−1

by the firingenabi−1, t i−1, prod i−1 and its firing produces M i

Example Figure 8.2 shows a sample ER net, which consists of three places and one

transition with an action:

3 token = {<x, −1>, <y, 2>}

Figure 8.2 Sample ER net

enabling tuple for transition t Firing t produces an environment in place p3where

p3.x = −1 + 1 = 0 and p3.y = 2.

In the next section, we describe in detail time ER nets, the most recent of the threetime-extended Petri nets introduced here

To extend ER nets to specify the notions of time, a variable chronos is introduced

[Ghezzi et al., 1991] to represent the time-stamp of the token in each environment.This time-stamp gives the time when the token is produced The time-stamps of thetokens put in output places are produced by the actions associated with the transitionsand are based on the selected input enabling a tuple’s environments’ values

The variable chronos can take on nonnegative real numbers when used in a

con-tinuous time model, or nonnegative integers when used in a discrete time model.This concept of a time-stamp assigned to a token when it is produced is similar tothe time value given by the occurrence function in real-time logic and the time value

τ indicating the time of the corresponding event occurrence in timed languages and

automata An occurrence function assigns a time to the occurrence of an instance of

an event.τ denotes the occurrence time of an event ρ in the pair (ρ, τ).

To enforce time restrictions on chronos, we need the following axioms.

Local Monotonicity Axiom: Let c1 be the value of chronos in the environments

removed by (before) any firing, and let c2be the value of chronos in the environments

produced by (after) this firing Then, c1≤ c2

Constraint on Time-Stamps Axiom: The values of all elements of the tuple prod

in any firing x = enab, t, prod are equal to chronos This time of the firing is denoted as time(x).

TIME ER NETS 221

Firing Sequence Monotonicity Axiom: The times of the firings are monotonically

nondecreasing with respect to their occurrence in any firing sequence

Equivalent Firing Sequences: Given an initial marking M0, two firing sequences s and sare equivalent iff s is a permutation of s.

Time-Ordered Firing Sequence: A firing sequencet1, , t n is time-ordered in

an ER net satisfying the constraint on time-stamps axiom iff for every i , j, i < j → time (t i ) ≤ time(t j ).

For each firing sequence s with an initial marking M0in an ER net satisfying thelocal monotonicity axiom and the constraint on time-stamps axiom, a time-ordered

firing sequence sexists equivalent to s.

Time ER Net (TERN): An ER net satisfying both the local monotonicity axiom

and the constraint on time-stamps axiom, and with a variable chronos in every ronment, is a TERN

envi-Example Figure 8.3 shows a partial TERN for a smart traffic light system at an

in-tersection The traffic light for cars turns green when a car arrives at the inin-tersection

light turns green

1

Figure 8.3 Partial TERN for a smart traffic light system

A car arriving at the intersection is represented by a token in place p1(car(s) atintersection), with a time-stamp indicating the time when this car arrives and stops at

the intersection There may be no token in p1, indicating no car is at the intersection,

or there may be one or more tokens in p1, indicating one or more cars present atthe intersection Each token contains a variable indicating the position of the car atthe intersection This is useful in determining which token (car) to be selected formaking the next move, whether or not to cross the intersection The second choicemodels a car stalling (staying in the same position) due to mechanical problems orthe driver falling asleep

A token in place p2(no-pedestrian) means that no pedestrians crossing the section At most one token can be in this place

inter-The firing of transition t1models the car traffic light turning green If the light isalready green, then this transition keeps the light green This transition removes one

token from place p1when fired to indicate the car selected for crossing the section This car must be at the front of the queue of cars waiting at the intersection(indicated by the variable position of the car token), and the time interval betweenthe time when the light turns green and the current time cannot exceedδ1(so that theright of way is not monopolized by cars traveling on one street).δ1can be a constant

inter-or a function dependent on how busy the intersection is and the time of day Function

f1indicates how the status of the car changes when the light turns green and the car

is selected for further action (the driver gets ready to release the brake and press theaccelerator):

act1= {p1, p2, p3|p3.chronos - turn green ≤ δ1

∧p3.car = p1.car

∧p3.car status = f1(p1, p2)}.

The firing of transition t2models a car moving forward and crossing the

inter-section, whereas the firing of transition t3models a car staying in the same position

without crossing the intersection Functions f2and f3model the state changes of thecar in these two scenarios, respectively:

act2= {p3, p4|p3.chronos ≤ p4.chronos

≤ turn green + δ1∧ p4.car status = f2(p3)}

act3= {p3, p5|p5.car status = f3(p3)}.

Example Suppose we have a partial TERN similar to the one in Figure 8.3 but with

the use of more timing features This TERN models clients’ requests for using aresource and the assignment of this resource to satisfy a client’s request

A client (or its request) arriving at the waiting center is represented by a token in

place p1(waiting center), with a time-stamp indicating the time when this client’s

request arrives There may be no token in p1, indicating no request is at the waiting

center, or one or more tokens in p , indicating one or more requests at the waiting

TIME ER NETS 223

center Each token contains a variable deadline, indicating the deadline by which to complete serving the request, and a variable valid interval, indicating the validity interval of the data in this request The variable deadline indicates the time instant after which the service of the request is no longer useful The variable valid interval

indicates the time interval within which the data is current; the data become obsoleteafter this validity interval The second endpoint of this validity interval is the data’sexpiration time The values of these variables determine which token (request) will

be selected for making the next move, whether or not to be assigned the resource.The second choice may model the resource controller not allocating the resource tothis request due to unforeseen problems

A token in place p2(resource center) means that the single resource is availablefor allocation At most one token can be in this place

The firing of transition t1 models the resource controller ready to allocate the

resource to a request This transition, when fired, removes one token from place p1

to indicate the request selected for using the resource The deadline of this selectedrequest must be less than the current time and the current time must still be withinthe validity interval of the request’s data (the current time cannot be greater than thedata’s expiration time):

act1= {p1, p2, p3|p3.chronos < p1.deadline ∧ p3.chronos

≤ p1.expiration time − p1.chronos ∧ p3.request

= p1.request ∧ p3.resource center status = f1(p1, p2)}.

The firing of transition t2models the resource controller, assigning the usage of

the resource to the selected request, whereas the firing of transition t3 models theresource controller not allocating the resource to the request due to unforeseen prob-lems The assignment and usage of the resource must happen before the deadline andthe expiration time of the selected request Also, due to buffering restrictions for arequest, this resource assignment must occur withinδ time units after the request is

selected for resource assignment:

act2= {p3, p4|p4.chronos < p3.deadline ∧ p4.chronos

≤ p3.expiration time − p3.chronos ∧ p4.request status = f2(p3)} act3= {p3, p5|p5.request status = f3(p3)}.

In untimed Petri nets, whether or not a transition is enabled depends on its inputplaces An enabled transition may or may not fire; it is not required to always fire.Hence, firing decisions are made locally The same is true for TERNs However,situations occur in which we have to specify that certain transitions must fire whenenabled and within a certain period, especially in real-time systems To handle thesecases, the Milano’s group [Ghezzi et al., 1991; Ghezzi, Morasca, and Pezze, 1994] in-

troduces the strong time model, where enabled transitions must fire To define strong

TERNs, we need the following definitions

Time-Ordered Firing Sequence: A firing sequencet1, , t n is time-ordered in

an ER net satisfying the constraint on time-stamps... time-stamps axiom, and with a variable chronos in every ronment, is a TERN

envi-Example Figure 8.3 shows a partial TERN for a smart traffic light system at an

in-tersection... class="text_page_counter">Trang 8

PETRI NETS WITH TIME EXTENSIONS 219

environ-ment/relationship (ER) nets without timing extensions