marking{buildPlaces(MRi); MRest}) buildRule(R)
new metadata
if *** for deleted places
freeOfMarking(∀p∈PLi | MRest)∧
*** for places of deleted transitions emptyNeighbourForPlace(∀p∈PLi\PRi |
pre{MTupleRest1} | post{MTupleRest2})∧
calculate new metadata .
5 Correctness of Model Checking for Maude
Definition 18 (Surjective mapping between states ofLTSRPNandLTSMNC). Given a recon-figurable Petri net(N0,R)withN0 = (P0, T0,pre0,post0,pname0,tname0,cap0, M0)and Ras in Def. 6 and the corresponding Maude modules NET and RULE as in Theorem 1. Further, the label transition system is given by LTSRPN with Def. 15 and LTSMNC by Def. 16. So that there is a mapping map : SMNC → SRPN for some states s ∈ SMNC of Def. 12 with s = net(Places, Transitions, Pre, Post, Markings) | Rule Int Int IDPoolby
map(s) = [(N, M)]and
• P ={p|pis an atomic element in buildPlace−1(Places)}
• T ={t|tis an atomic element in buildTransition−1(Transitions)}
• pre:T →PL defined by pre(t)=buildPlace−1(place); if
Transitions=transitions{T : t(tname | x)}and Pre=pre{MT,(t(tname | x)→place)}
• post:T →PL defined by post(t)=buildPlace−1(place); if
Transitions=transitions{T : t(tname | x)}and Post=post{MT,(t(tname | x)→place)}
• pname:P →AP defined bypname(p) =label; if
Places=places{P , p(label | x | x)}
• tname :T →AT defined bytname(t) =label; if
Transitions=transitions{T : t(label | x)}
• cap:P →Ndefined by cap(p) =capacity; if
Places=places{P , p(str | x | capacity)}
• cap:P →ωdefined by cap(p) =w; if
Places=places{P , p(str | x | w)}
• M ={m|mis an atomic element in buildMarking−1(M arkings)}
Based on Def. 18, the following Lemma 8 and Lemma 9 define the linked states of both transition systems. Lemma 8 is used to link states fromSMNCtoSRPN, whereby the Lemma 9 link states the inverted direction fromSRPNtoSMNC.
Lemma 7(map of the initial state). (N, M0)∈map(initial)is given by map as defined in Def. 18
Proof of Lemma 7. Giveninitial as defined by Def. 12 as initial = net(Places, Tran-sitions, Pre, Post, Markings), then there is a [(N0, M0)] as defined by Def. 6 with N0 = (P0, T0,pre0,post0,pname0,tname0,cap0, M0)so that:
• P0is defined by the inverse function of Lemma 1 withbuildPlace−1so that P0 ={p|pis a atomic element inbuildPlace−1(Places)}
• T0is defined by the inverse function of Lemma 2 withbuildTransition−1so that T0 ={t|tis a atomic element inbuildTransition−1(Transitions)}
• pre0is defined by the inverse function of Lemma 3 withbuildPre−1so that pre0:T →PL defined bypre(t)=buildPlace−1(place); if
Transitions=transitions{T : t(tname | x)}and Pre=pre{MT,(t(tname | x)→place)}
• post0is defined by the inverse function of Lemma 4 withbuildPost−1so that post0:T →PL defined bypost(t)=buildPlace−1(place); if
Transitions=transitions{T : t(tname | x)}and Post=post{MT,(t(tname | x)→place)}
• pname0is defined by Def. 5 withpname :P →AP so thatpname(p) =label; if Places=places{P , p(label | x | x)}
• tname0 is defined by Def. 5 withtname:T →AT so thattname(t) =label; if Transitions=transitions{T : t(label | x)}
5 Correctness of Model Checking for Maude
• cap0is defined by Def. 5 withcap:P →Nw+so that:
– cap(p) =capacity; if
Places=places{P , p(str | x | capacity)}
– cap(p) =w; if
Places=places{P , p(str | x | w)}
• M0is defined by the inverse function of Lemma 1 withbuildPlace−1so that M ={m|mis a atomic element inbuildMarking−1(TMarkings)}
Lemma 8(map as function). map:SMNC→SRPNis a function given by map as defined in Def.
18
Proof of Lemma 8. For eachs∈SMNCthere is oner ∈SRPNwithmap(s) =r.
Basis:For the initials0 ∈SMNCexists by Lemma 7 an initial stater0 ∈SRPN
Induction hypothesis:Let be given a statesn∈SMNCwithsn=net(Places, Transitions, Pre, Post, Markings) | Rule Int Int IDPool, so thatmap(sn) =rn= [(N, M)]withN = (P, T,pre,post,pname,tname,cap, M) Induction step (n→n+ 1):For each follower statesn+1∈SMNCwithsn l
−
→sn+1∈ trMNCthere is arn+1∈SRPNwithrn−→l rn+1 ∈trRPNandmap(sn+1) =rn+1so thatl can be applied by:
• Firing bysn−−−−−→tname(ts) sn+1as in Def. 16 withsn+1 =net(Places, Transitions, Pre, Post, Markings0) | Rule Int Int IDPooland by the isomorphism class of Def. 9 there is also arn−−−−−→tname(tr) rn+1 as in Def. 15 withrn+1 = [(N, M0)]so that
– Activation:
If marking{PreValue ; M} can be rewritten by the rewrite rule [fire] defined in Def. 7 and Listing 4, then the PreValue forts is less or equal than the marking ofsn. Hence, ispre⊕(tr) ≤ Mr (line one of Def. 7) andrn
tname(tr)
−−−−−→ rn+1 ∈ trRPNdue toM[triM0 inN with rn+1 = [N, M0],tname(ts) =tname(tr)andtname(tr)∈ARPN.
– Capacity limitation:
If (PreValue ; M) plus PostValuecan be rewritten by the
rewrite rule[fire]defined in Def. 7 and Listing 4, then the Post-Valuefor each place used byts is less or equal than the capacity and M+post⊕(tr)≤capfortr(line two of Def. 7)
– New marking:
Ifcalc(((PreValue ; M) minus PreValue) plus Post-Value)can be rewritten by the rewrite rule[fire]defined in Def. 7 and Listing 4, then the following markingMarkings0is given and the marking forrn+1is calculated byM0 = (Mr pre⊕(tr))⊕post⊕(tr).(line three of Def. 7)
• Transformation bysn
rname(rs)
−−−−−→sn+1as in Def. 16 withsn+1=net(Places, Transitions, Pre, Post, Markings0) | Rule Int Int IDPooland the isomorphism class of Def. 9 there is also arn
rname(rr)
−−−−−→rn+1as in Def. 15 withrn+1 = [(N0, M0)]so that
– match:
If sn can be rewritten by the rewrite rule[rname] defined in Def. 11 and Listing 5, then is theLa subset ofsn. Hence, there is an occurrence o:L→N defined in Def. 15 byrrandrn
rname(rr)
−−−−−→rn+1 ∈trRPNas well asrname(rs) =rname(rr).
– freeOfMarkingapplies for each deleted placep*MRest, as defined in Def. 11 by the identification condition in Def. 10
– emptyNeighbourForPlaceapplies for each deleted placepno oc-currence inPreandPost, as defined in Def. 11 by the dangling condition in Def. 10
5 Correctness of Model Checking for Maude
Lemma 9(map as surjective function). map:SRPN→SMNCis a surjective function given by map as defined in Def. 18
Proof of Lemma 9. For eachr∈SRPNthere is ones∈SMNCwithmap(s) =r Basis:For the initialr0∈SRPNexists by Theorem 1 an initial states0 ∈SMNC
Induction hypothesis:Let be given a statern∈SRPNwithrn= [N, M]so that there is asn∈SMNCwithmap(sn) =rn= [(N, M)]of Def. 18 andN = (P, T,pre,post, pname,tname,cap, M).
Induction step (n→n+ 1):For each follower statern+1∈SRPNwithrn l
−
→rn+1∈ trRPNthere is asn+1 ∈SMNCwithsn−→l sn+1 ∈trMNCandmap(sn+1) =rn+1so that lcan be applied by:
• Firing byrn −−−−−→tname(tr) rn+1 ∈ trRPNas in Def. 15 withrn+1 = [(N, M0)]there is by Def. 16 also asn −−−−−→tname(ts) sn+1 ∈ trMNC withsn+1 =net(Places, Transitions, Pre, Post, Markings0) | Rule Int Int IDPoolso that
– Activation:
Ifpre⊕(tr)≤Mr(line one of Def. 7) andrn
tname(tr)
−−−−−→rn+1 ∈trRPNdue to M[triM0 inN withrn+1 = [N, M0], thentris activated. Hence, mark-ing{PreValue ; M}can be rewritten by the rewrite rule[fire]
defined in Def. 7 and Listing 4, so that PreValue for ts is the less or equal than the marking of sn as well astname(ts) = tname(tr) and tname(tr)∈ARPN.
– Capacity limitation:
If M +post⊕(tr) ≤ cap fortr, then thePostValue is less or equal than the capacity for each place used byts(line two of Def. 7). Hence, (PreValue ; M) plus PostValue can be rewritten by the rewrite rule[fire]defined in Def. 7 and Listing 4,
– New marking:
If the following marking forrn+1is calculated byM0 = (Mr pre⊕(tr))⊕ post⊕(tr)(line three of Def. 7), thencalc(((PreValue ; M) mi-nus PreValue) plus PostValue)can be rewritten as the fol-lowing markingMarkings0 by the rewrite rule[fire]defined in Def.
7 and Listing 4.
• Transformation byrn−−−−−→rname(rr) rn+1∈trRPNas in Def. 15 withrn+1= [(N0, M0)]
there is by Def. 16 also asn−−−−−→rname(rs) sn+1∈trMNCwithsn+1 =net(Places, Transitions, Pre, Post, Markings0) | Rule Int Int ID-Poolso that
– match:
If there is an occurrenceo:L→Ndefined in Def. 15 byrrandrn−−−−−→rname(rr) rn+1 ∈trRPN, thensncan be rewritten by the rewrite rule[rname]defined in Def. 11 and Listing 5 byL⊆sn.
– freeOfMarkingapplies for each deleted placep*MRest, as defined in Def. 11 by the gluing condition
– emptyNeighbourForPlaceapplies for each deleted placep*Pre∧
p*Postas defined in Def. 11 by the gluing condition
Remark 4. The function map in Lemma 9 is not injective due to the isomorphism class in Def.
9.
Theorem 2(Bisimulation ofLTSRPNandLTSMNC). LTSRPNand LTSMNCare bisimilar as defined in Def. 2 by map in Def. 18
Proof of Theorem 2. For each relation defined bymapof Def. 18, which consists ofs∈SMNC andr ∈SRPNwithmap(s) =r= [N, M], we have:
• s→s0: For eacha∈AMNCthere ismap(s) = randr −→a r0 ∈trRPN, due tos−→a s0 ∈ trMNCand the mapping of Lemma 8 and Lemma 9 there ismap(s0) =r0by Lemma 8 and Lemma 9.
• r →r0: For eacha∈AMNCthere ismap(s) =rands−→a s0 ∈trMNC, due tor −→a r0 ∈ trRPNand the mapping of Lemma 8 and Lemma 9 there ismap(s0) =r0by Lemma 8 and Lemma 9.
So that a bisimulation betweenLTSRPNandLTSMNCis defined by the map function.
5 Correctness of Model Checking for Maude