• Aucun résultat trouvé

Case Study: Petri nets

Dans le document Symbolic model-checking with Set Rewriting (Page 88-92)

tok4 Pm4 tredo4 Pback4

tback4 Pout4 tin4 P4

tsync423 P3 P2 Pm3

tredo3 Pback3 tback3 tok3

Pout3

Pm2

tredo2 Pback2

tback2 tok2

Pout2 tsync123

Pm1 tredo1 Pback1

tback1 tok1

Pout1

tout1 P1

Figure6.4 – KanbanPetriNet

contexts) take their new context from the state. Thus, the state becomes a container for the different contexts. For example, in Fig. 6.3 we have a subexpression that treats a data type operation. To treat this operation, we first transform the state to a temporary state (temporary expression). The temporary expression is then treated using thecontext awarestrategy. Finally, once the computation in the temporary state is finished we combine the result of the context with the original context.

6.3.4 Translating Entire Formalisms

To translate entire formalism we proceed transition by transition,i.e.,we compile each transition to a strategy. To simplify the process of translation we do it in two steps.

First, we define a set of simple operations on the state of the system. We give the semantics of these operations using simple SOS rules. These SOS rules are easily translated to strategies. Second, we give the semantics of high level formalisms by compilation to the basic operations we defined in step one.

6.4 Case Study: Petri nets

Petri nets(PNs) [Rei85] is a well known formalism to describe concurrent processes using a graphical notation. A PNis composed of places and transitions. Each place can contain a positive number of tokens. Over the execution of aPNthe number of tokens in each place evolves, thus, the number of tokens in each place represent the state of the system. The transitions describe how the number of tokens in each state varies from one state to the other. When the current state is changed using a transition, we say that the transition isfired.

Graphically, aPNis represeted by abigraph. A bigraph is a graph whose vertices can be divided into two disjoint sets Pand T, with P∩T, s.t. every edge connects an element ofPwith a vertex ofT. We present an example of aPNin Fig. 6.4. The circles represent the places and the rectangles represent the transitions. The tokens are represented inside the places by the black circles.

70 Chapter 6. Semantics Using Set Rewriting

nat zero: nat s: nat 7→ nat pname P1: pname

P2: pname

...

mapping empty: mapping

map: pname, nat, mapping 7→ mapping

Table6.2 – Term signature forPetri net markings

6.4.1 Abstract Syntax

PNshave a simple syntax. Formally, aPNis ann-tuplehP,T,in,out,m0iwherePis a finite set of places, T is a finite set of transitions, andin andoutare respectively the preand postconditions (in curried form)in:T →(P→ N) andout:T →(P→N).

The marking (state) is a mapping from places to integers: m : P → N. We use the notation Mto denote the set of functions fromPtoN(P→ N).

6.4.2 Abstract Dynamic Semantics

EachPNtransition describe (as the name says) a transition. The semantics of a tran-sition can be given by the following general rule:

t: m≥in(t)

m→t m−in(t)+out(t) (6.2)

where m,m1,m2 ∈ M, m is a state of the system, m1 ≥ m2 is true if and only if

∀p∈P : m1(p)≥m2(p), and (m1+m2) : p7→m1(p)+m2(p). We present an example of a concrete rule in Example6.4.1.

Example 6.4.1 Let us consider transitiontok4in Fig.6.4. We have that its semantics is represented by the following simpleSOSrule:

tok4: m(Pm4)≥ 1

m→m[Pout4 =m(Pout4)+1][Pm4=m(Pm4)−1]

The notation m[a=b]presented in Def.3.1.6.

6.4.3 Describing the State

As the previous section states, the state of a PNis described by a mappingm. In our framework we describe the state as a term, thus we need to provide a signature to describe the set of all possible states.

We propose to use the signature in Table6.2. The first thing to notice is that we have to define all types and their respective semantics. For the case ofPNswe use the classical Peano Axiomatization [Pea89,Wik14].

6.4. Case Study: Petri nets 71 There is a sort for natural numbers, a sort for places and a sort representing a map.

Natural numbers are encoded as terms being eitherzero, orsuc(t)wheretis an integer term. For clarity, integer terms are often replaced by plain integers. For instance, the initial state of aPNwith three places ismap(P1, 0, map(P2, 5, map(P3, 0, empty))).

mapingis an inductive structure, which allows to define generic strategies to read and modify it.

6.4.4 Basic Operations on the state

To compute the semantics of a transition we need to be able to do three operations in the state: testp,n,decp,n, andincp,n.

The functions are formally defined as follows:

testp,n : M → {true,false} :m7→m(p)≥ n decp,n : M → M

:m7→m[p= m(p)−n]

incp,n : M → M

:m7→m[p= m(p)+n]

Thus, we can rewrite theSOSrule of Equation (6.2) as:

t=

V

p∈Ptestp,in(t)(p)(m) P={p1, . . . ,pn0}

m→ decp1,in(t)(p1)◦ · · · ◦decpn0,in(t)(pn0)◦incp1,in(t)(p1)◦ · · · ◦incpn0,in(t)(pn0)(m) (6.3) This rule can be translated to our strategies framework in a straightforward manner as shown in Section 6.3.2. The user only needs to define the translation of the three operations. We present an example of the translation in Example6.4.2.

Example 6.4.2 We write the the rule presented in Example6.4.1using the operations defined in this section.

tok4 : testPm4,1(m)

decPm4,1◦incPout4,1(m)

6.4.5 Compile Function

Given a PN, we give a compile function for a transition. Indeed, since we have a generic simpleSOSto describe the semantics of transitions, we only need to provide

72 Chapter 6. Semantics Using Set Rewriting thepCompandaCompfunctions. We present them here:

pComp:testp,in(t)(p)(m)7→ {

checkLocp ={map(p, $x, $m) {

map(p, $x, $m)};

testStratp,n ={map(p,compInt(n), $m) {

map(p,compInt(n), $m)}; applyTo(S1,S2)=IfThenElse(S1,

S2,

One(applyTo(S1,S2),3));

applyTo(checkLocp,testStratp,in(t)(p))} where thecompIntfunction is defined as follows:

compInt:N→ TΣ : 17→s($x)

:n7→s(compInt(n−1))

The function returns a declaration and a strategy. The strategyapplyTois a recur-sive strategy. It first checks if it can apply its first parameter and if it can then applies the second one. If it cannot, then it calls itself recursively on the third subterm. One defines also two auxiliary strategies. ThecheckLocstrategy, which verifies that one is at the correct location and thetestStratstrategy that actually does the test. Of course, the genericapplyTostrategy is completely reusable in our framework.

Using almost the same approach, we can define theaCompfunction to transform actions to rewrite strategies. Indeed theaCompis very similar to thepCompfunction.

We just need to replacetestStratbyactStrat, we illustrate it as follows1: aComp:decp,n(m)7→ {

decStratp,n ={map(p,compInt(n), $m) {

map(p, $x, $m)};

applyTo(checkLocp,decStratp,in(t)(p))}

The compilation ofincp,nis left as exercise to the reader as it is almost the same as fordec. An example of the full compilation of a transition is given in Example6.4.3.

We also present the complete translation of thePNfrom Fig. 6.4in AppendixA.

In that translation, we directly merge the mapping and the names of the places. Thus, instead of having a termmap(P1, 0, empty), we have directlyP1(0, empty).

Example 6.4.3 We present the complete translation of the transition tok4. The first step is to translate the three primitives testPm4,1, decPm4,1, and incPout4,1. We have the

1We omit previously declared functions to improve readability

6.5. Case Study DiViNE 73

Dans le document Symbolic model-checking with Set Rewriting (Page 88-92)