Controller Synthesis of Time Petri Nets Using Stopwatch

Abstract

Scheduling is often a difficult task specially in complex systems. Few tools are targeted at both modeling and scheduling of the systems. In controller synthesis, a scheduler is seen as a controller to manage shared resources and timing requirements of a system. This paper proposes a time Petri net-based approach for controller synthesis and finding a scheduler using stopwatch. The solution suggested here is particularly interesting for preemptive scheduling purposes. This paper deals with time Petri nets with controllable and uncontrollable transitions and assumes that a controllable transition can be suspended and retrieved when necessary. In fact, the paper supposes that every controllable transition can be associated with stopwatch. With this hypothesis, the objective is to model a system by time Petri nets and calculate subintervals where the system violates the given property. Then, the controller associates the corresponding controllable transitions with stopwatch to suspend them in their bad subintervals. The interesting advantage of this solution is that this approach synthesizes an ordinary time Petri net model before adding stopwatch. Therefore, complicated computations and overapproximations required during controller synthesis of time Petri nets associated with stopwatch are avoided.

1. Introduction

A scheduler is a kind of controller that manages shared resources and timing specifications of the system. In the concept of controller synthesis, actions are partitioned into two disjoint sets, controllable and uncontrollable. Controllable actions are those that can be managed by the controller (forced to happen or prevented from happening). Uncontrollable actions are those that the controller has no control on. As an example, an internal counter in a digital system progresses with each clock cycle until it captures a predefined value and is reset after then. In a multitasking system, a newly arrived task waits for accessing resources. After accessing the required resources, each task spends its execution time and then releases the resources. If the task is periodic, it stays in a passive state before its next arrival. Process arrival depends on its period and its termination depends on the execution time. Then, both process arrival and termination of execution are uncontrollable, whereas access to the shared resources and starting the execution are controllable [1].

In order to manage shared resources among different periodic tasks with different levels of priority, the solution is to suspend a task with the lower priority and let the others with the higher priorities execute and use the resources. Then, the suspended task is retrieved until it finishes its execution. When a task is suspended, the execution time is not progressing. This behavior is modeled by stopwatch.

Stopwatch is an extension of timed models to facilitate modeling of interruption and resumption of a job. Once an interrupt happens, a task is suspended. Later, it is retrieved and continued from where it was interrupted. During the interruption, the clock of interrupted task is stopped while other clocks progress normally. The idea of stopwatch has been discussed and extended to timed automata (TA) as well as time petri nets (TPN) and some types of TA and TPN associated with stopwatch are already introduced [2–5]. In stopwatch, we may have some states whose clocks keep progressing, while in some other states the clock is stopped and keeps the value it had before being interrupted as if the clock has a memory and after being retrieved it continues with its previous value.

In a multitasking real-time system with interruptible tasks and shared resources, a suitable scheduler is necessary to manage the resources and to prevent blocking and deadlock. The scheduler guarantees the well functionality of the system in terms of respecting deadline, priority, and similar constraints. Each task cannot start execution until the required resources are available. A task releases the occupied resources after finishing its execution.

In multitasking systems, tasks are categorized to periodic, aperiodic, and sporadic [6].

(i) Periodic Task. Periodic tasks arrive in regular intervals. Worst-case and best-case execution time is of the specifications defined for periodic tasks. Deadline is the other characteristic defined for these tasks with respect to their worst-case execution time. Deadline in periodic tasks can be either soft or hard. A critical deadline is called hard deadline whereas meeting a soft deadline is not critical.

(ii) Aperiodic Task. Tasks with irregular interarrivals are called aperiodic. Aperiodic tasks are usually associated with soft deadlines.

(iii) Sporadic Task. Aperiodic tasks with a minimum interarrival are called sporadic. Sporadic tasks are associated with hard deadlines.

A periodic task may have the following three states [7].

(i) Waiting. Once a periodic task arrives, it should wait for required resources.

(ii) Execution. When all required resources are available, the task starts its execution and spends its execution time in this state.

(iii) Passive. After being executed, the task releases the required resources and waits until its next arrival. The time between two consecutive task arrivals is equal with the given period.

In a multitasking system with periodic tasks, the scheduler should manage the shared resources in a way that the predefined period for the tasks is respected. On the other hand, some of the tasks may be associated with a deadline or priority. In that case, the scheduler should suspend the execution of a task with lower priority and let the higher priority tasks to use the resources. Once the tasks with higher priority are executed, the other tasks with lower priorities are retrieved and continue their execution. This behavior is called preemptive scheduling.

In the field of controller synthesis, a scheduler is seen as a controller [7, 8]. The scheduler should manage the shared resources and starts execution of each task in a way that the timing constraints, deadlines, and priorities are respected. Arrival of each task is due to its period and then is uncontrollable. Execution time is also predefined and then is uncontrollable. The only controllable action is the starting of an execution. In preemptive scheduling, a task can be suspended during its execution and leave the resources to some other task with a higher priority.

One solution is to model the system with time Petri nets associated with stopwatch. In this context, each task execution is modeled by a transition equipped with stopwatch and then the corresponding controller is synthesized to manage suspension and resumption of each task such that the corresponding timing constraints are respected. As we will see in this paper, one problem with this solution is that the state space of time Petri nets associated with stopwatch is not exact and requires some overapproximation.

The other problem is that time Petri nets associated with stopwatch does not preserve the boundedness property. Let 𝒩₁ be a time Petri net, 𝒩₂ be a time Petri net associated with stopwatch, and SCG shows the corresponding state class graph, the following relation holds: 𝒩₁isbounded⟺SCGof𝒩₁isfinite. (1)

This condition is not always true for a time Petri net associated with stopwatch. In other terms, 𝒩₂isbounded⇏SCGof𝒩₂isfinite. (2)

Indeed, if the number of reachable markings in a time Petri net associated with stopwatch is finite, the number of state classes is not necessarily finite [3]. These limitations hinder the controller synthesis of time Petri nets with stopwatch.

In this paper, we suggest an alternative solution. We propose to synthesize a time Petri net without stopwatch where the transitions corresponding to the task executions are considered controllable. We extract the controller (i.e., scheduling strategy) and then add the stopwatch to model the controlled system (the system and its scheduler). In fact, we suggest to implement the synthesized controller by means of stopwatch.

In the following, we discuss how the algorithm suggested in [9] for controller synthesis of time Petri nets is used for scheduling purposes to synthesize a controller for interruptible tasks. The algorithm of [9] is permissive and the computed controller is restricting time intervals making the system to satisfy the given properties. In this paper, we suggest to suspend a task during its bad subinterval. This approach is useful for preemptive scheduling purposes where safety properties correspond to meeting deadlines, priorities, preventing deadlock for shared resources, and so forth.

In this paper, we use a synthesized controller (output of the algorithm of [9] in particular), and we show how to control the system using stopwatch. In order to implement the controller by means of stopwatch, we assume that it is possible to associate each controllable transition with a stopwatch so as to suspend or resume it whenever needed.

The rest of this paper is organized as follows. Section 2 is dedicated to time Petri nets, their definition, and semantics. Section 3 presents a literature review on different stopwatch Petri nets. Section 4 has a brief survey on the solution proposed in [9]. Section 5 synthesizes a controller using stopwatch. Section 6 presents an example of a multitasking system. Finally, Section 7 gives the conclusion and future work.

2. Time Petri Nets

A time Petri net (TPN) is a Petri net augmented with time intervals associated with transitions. This paper focuses on the classical semantics, called intermediate semantics in [10], in the context of monoserver and strong semantics [11]. Formally, a TPN is a tuple (𝑃,𝑇,Pre,Post,𝑀₀,Is) where (i)𝑃 and 𝑇 are finite sets of places and transitions such that (𝑃∩𝑇=∅). (ii)Pre and Post are the backward and the forward incidence functions (Pre,Post∶𝑃×𝑇→ℕ, where ℕ is the set of nonnegative integers). (iii)𝑀₀ is the initial marking (𝑀₀∶𝑃→ℕ). (iv)Is is the static interval function (Is∶𝑇→ℚ⁺×(ℚ⁺∪{∞})),ℚ⁺ is the set of nonnegative rational numbers. Is associates with each transition 𝑡 an interval called the static firing interval of 𝑡. Bounds ↓Is(𝑡) and ↑Is(𝑡) of the interval Is(𝑡) are the minimum and maximum firing delays of 𝑡, respectively.

In a controllable time Petri net, transitions are partitioned into controllable and uncontrollable transitions, denoted by 𝑇_𝑐 and 𝑇_𝑢, respectively (with 𝑇_𝑐∩𝑇_𝑢=∅ and 𝑇=𝑇_𝑐∪𝑇_𝑢). For the sake of simplicity and clarification, in this paper the controllable transitions are depicted as white bars, while the uncontrollable ones as black bars.

A TPN, is called bounded if for every reachable marking 𝑀, there is a bound 𝑏∈ℕ^𝑝 where 𝑀≤𝑏 holds. In this condition, 𝑝 stands for the number of places in 𝑃.

Let 𝑀 be a marking and 𝑡 a transition. Transition 𝑡 is enabled for 𝑀 if and only if all required tokens for firing 𝑡 are present in 𝑀, that is, ∀𝑝∈𝑃,𝑀(𝑝)≥Pre(𝑝,𝑡). Firing of 𝑡 leads to the marking 𝑀^′ defined by: ∀𝑝∈𝑃,𝑀^′(𝑝)=𝑀(𝑝)−Pre(𝑝,𝑡)+Post(𝑝,𝑡). We denote En(𝑀) the set of transitions enabled for 𝑀, that is, En(𝑀)={𝑡∈𝑇∣∀𝑝∈𝑃,Pre(𝑝,𝑡)≤𝑀(𝑝)}. For 𝑡∈En(𝑀), we denote CF(𝑀,𝑡) the set of transitions enabled in 𝑀 but in conflict with 𝑡, that is, CF(𝑀,𝑡)={𝑡^′∈En(𝑀)∣𝑡^′=𝑡∨∃𝑝∈𝑃,𝑀(𝑝)<Pre(𝑝,𝑡^′)+Pre(𝑝,𝑡)}. Let 𝑡∈En(𝑀) and 𝑀^′ the successor marking of 𝑀 by 𝑡; a transition 𝑡^′ is said to be newly enabled in 𝑀^′ if and only if 𝑡^′ is not enabled in the intermediate marking (i.e., 𝑀−Pre(⋅,𝑡)) or 𝑡^′=𝑡. We denote New(𝑀^′,𝑡) the set of transitions newly enabled 𝑀^′, by firing 𝑡 from 𝑀; that is, New(𝑀^′,𝑡)={𝑡^′∈En(𝑀^′)∣𝑡=𝑡^′∨∃𝑝∈𝑃,𝑀^′(𝑝)−Post(𝑝,𝑡)<Pre(𝑝,𝑡^′)}.

The TPN state is defined as a pair (𝑀,Id), where 𝑀 is a marking and Id is a firing interval function (Id∶En(𝑀)→ℚ⁺×(ℚ⁺∪{∞})). The initial state is (𝑀₀,Id₀) where 𝑀₀ is the initial marking and Id₀(𝑡)=Is(𝑡), for 𝑡∈En(𝑀₀). Let (𝑀,Id) and (𝑀^′,Id^′) be two states of the TPN model, 𝜃∈ℝ⁺ and 𝑡∈𝑇. The transition relation → over states is defined as follows. (i)(𝑀,Id)→−^𝜃(𝑀^′,Id^′), also denoted by (𝑀,Id)+𝜃, if and only if the state (𝑀^′,Id^′) is reachable from state (𝑀,Id), after 𝜃 time units, that is, ⋀_{𝑡′∈En(𝑀)}𝜃≤↑Id(𝑡^′),𝑀^′=𝑀, and ∀𝑡^′′∈En(𝑀^′),Id^′(𝑡^′′)=[Max(↓Id(𝑡^′′)−𝜃,0),↑Id(𝑡^′′)−𝜃]. (ii)(𝑀,Id)→−^𝑡(𝑀^′,Id^′) if and only if the state (𝑀^′,Id^′) is reachable from the state (𝑀,Id) by immediately firing transition 𝑡, that is, 𝑡∈En(𝑀),↓Id(𝑡)=0, ∀𝑝∈𝑃,𝑀^′(𝑝)=𝑀(𝑝)−Pre(𝑝,𝑡)+Post(𝑝,𝑡), and ∀𝑡^′∈En(𝑀^′),Id^′(𝑡^′)=Is(𝑡^′), if 𝑡^′∈New(𝑀^′,𝑡), and Id^′(𝑡^′)=Id(𝑡^′), otherwise.

The TPN state space is the structure (𝒬,→,𝑞₀), where 𝑞₀=(𝑀₀,Id₀) is the initial state of the TPN and 𝒬={𝑞∣𝑞−→₀^∗𝑞}(−→^∗ being the reflexive and transitive closure of the relation → defined above) is the set of reachable states of the model. A run in the TPN state space (𝒬,→,𝑞₀), of a state 𝑞∈𝒬, is a maximal sequence 𝜌=𝑞−−→₁^𝜃1𝑞₁+𝜃−→₁^𝑡1𝑞−−→₂^𝜃2𝑞₂+𝜃−→₂^𝑡2𝑞₃,…, such that 𝑞₁=𝑞. By convention, for any state 𝑞_𝑖, the relation 𝑞→−_𝑖⁰𝑞_𝑖 holds. The sequence 𝜃₁𝑡₁𝜃₂𝑡₂… is called the timed trace of 𝜌. The sequence 𝑡₁𝑡₂,…, is called the firing sequence (untimed trace) of 𝜌. A marking 𝑀 is reachable if and only if ∃𝑞∈𝒬 s.t. its marking is 𝑀. Runs (resp., timed/untimed traces) of the TPN are all runs (resp., timed/untimed traces) of the initial state 𝑞₀.

To use enumerative analysis techniques with time Petri nets, their generally infinite state spaces are abstracted. Abstraction techniques construct by removing some irrelevant details, a finite contraction of the state space of the model, which preserves properties of interest. For best performances, the contraction should also be the smallest possible and computed with the minimal resources in terms of time and space. The preserved properties are usually verified using standard analysis techniques on the abstractions [12]. Several state space abstraction methods have been proposed in the literature for time Petri nets (the state class graph (SCG) [13], the zone based graph (ZBG) [14], etc.). They may differ in the characterization of states (interval or clock states), the state agglomeration criteria, the abstract states representation, the preserved properties (markings, linear or branching properties), and their size.

These abstractions are finite for all bounded time Petri nets. However, abstractions based on clocks are less interesting than the interval-based abstractions when only linear properties are of interest. Indeed, abstractions based on clocks do not enjoy naturally the finiteness property for bounded TPN with unbounded intervals as it is the case for abstractions based on intervals. The finiteness is enforced using an approximation operation, which may involve some overhead computation. The algorithm of [9] is based on the state class graph method.

2.1. The State Class Graph Method

In the state class graph method [13], all states reachable by the same firing sequence from the initial state are agglomerated in the same node and considered modulo the relation of equivalence defined by: two sets of states are equivalent if and only if they have the same marking and the same firing domain (the firing domain of a set of states is the union of the firing domains of its states). All equivalent sets are agglomerated in the same node called a state class defined as a pair 𝛼=(𝑀,𝐹), where 𝑀 is a marking and 𝐹 is a formula which characterizes the firing domain of 𝛼. For each transition 𝑡_𝑖 enabled in 𝑀, there is a variable 𝑡_𝑖, in 𝐹, representing its firing delay. 𝐹 can be rewritten as a set of atomic constraints of the form  𝑡_𝑖−𝑡_𝑗≤𝑐,   𝑡_𝑖≤𝑐 or −𝑡_𝑗≤𝑐, where 𝑡_𝑖, 𝑡_𝑗 are transitions, 𝑐∈ℚ∪{∞}, and ℚ is the set of rational numbers. (for economy of notation, we use operator ≤ even if 𝑐=∞):

Each domain is expressed by the canonical form that is usually encoded by a difference bound matrix (DBM) [15]. The canonical form of 𝐹 is encoded by the DBM 𝐷 (a square matrix) of order |En(𝑀)|+1 defined by: ∀𝑡_𝑖,𝑡_𝑗∈En(𝑀)∪{𝑡₀},𝑑_𝑖𝑗=(≤,Sup_𝐹(𝑡_𝑖−𝑡_𝑗)), where 𝑡₀ (𝑡₀∉𝑇) represents a fictitious transition whose delay is always equal to 0 and Sup_𝐹(𝑡_𝑖−𝑡_𝑗) is the largest value of 𝑡_𝑖−𝑡_𝑗 in the domain of 𝐹. Its computation is based on the shortest path Floyd-Warshall's algorithm and is considered as the most costly operation (cubic in the number of variables in 𝐹). The canonical form of a DBM makes some operations over formulas like the test of equivalence easier. Two formulas are equivalent if and only if the canonical forms of their DBMs are identical.

The initial state class is 𝛼₀=(𝑀₀,𝐹₀), where 𝐹₀=⋀_{𝑡𝑖∈En(𝑀0)}↓Is(𝑡_𝑖)≤𝑡_𝑖≤↑Is(𝑡_𝑖). Let 𝛼=(𝑀,𝐹) be a state class and 𝑡_𝑓 a transition and succ(𝛼,𝑡_𝑓) the set of states defined by: succ(𝛼,𝑡_𝑓)={𝑞^′∈𝒬∣∃𝑞∈𝛼,∃𝜃∈ℝ⁺s.t.𝑞→−^𝜃𝑞+𝜃−−→^𝑡𝑓𝑞^′}. The state class 𝛼 has a successor by 𝑡_𝑓 (i.e., succ(𝛼,𝑡_𝑓)≠∅), if and only if 𝑡_𝑓 is enabled in 𝑀 and can be fired before any other enabled transition; that is, the following formula is consistent: 𝐹∧(⋀_{𝑡𝑖∈En(𝑀)}𝑡_𝑓≤𝑡_𝑖). A formula 𝐹 is consistent if and only if there is, at least, one tuple of values that satisfies, at once, all constraints of 𝐹. In this case, the firing of 𝑡_𝑓 leads to the state class 𝛼^′=(𝑀^′,𝐹^′)=succ(𝛼,𝑡_𝑓) computed as follows [13]. (1)∀𝑝∈𝑃,𝑀^′(𝑝)=𝑀(𝑝)−Pre(𝑝,𝑡_𝑓)+Post(𝑝,𝑡_𝑓). (2)𝐹^′=𝐹∧(⋀_{𝑡𝑖∈En(𝑀)}𝑡_𝑓−𝑡_𝑖≤0). (3)Replace in 𝐹^′ each 𝑡_𝑖≠𝑡_𝑓, by (𝑡_𝑖+𝑡_𝑓). (4)Eliminate by substitution 𝑡_𝑓 and each 𝑡_𝑖 of transition conflicting with 𝑡_𝑓 in 𝑀. (5)Add constraint ↓Is(𝑡_𝑛)≤𝑡_𝑛≤↑Is(𝑡_𝑛), for each transition 𝑡_𝑛∈New(𝑀^′,𝑡_𝑓).

Formally, the SCG of a TPN model is a structure (𝒞𝒞,→,𝛼₀), where 𝛼₀=(𝑀₀,𝐹₀) is the initial state class, ∀𝑡_𝑖∈𝑇,𝛼−→^𝑡𝑖𝛼^′ iff 𝛼^′=succ(𝛼,𝑡_𝑖)≠∅ and 𝒞𝒞={𝛼∣𝛼−→₀^∗𝛼}. The SCG is finite for all bounded TPNs and preserves linear properties [16]. Let 𝛼=(𝑀,𝐹) be a state class and 𝜔∈𝑇⁺ a sequence of transitions firable from 𝛼. We denote succ(𝛼,𝜔) the state class reachable from 𝛼 by firing successively transitions of 𝜔. We define inductively this set as follows: succ(𝛼,𝜔)=𝛼,if𝜔=𝜖  and succ(𝛼,𝜔)=succ(succ(𝛼,𝜔^′),𝑡_𝑖), if 𝜔=𝜔^′⋅𝑡_𝑖.

As an example, Figure 2 shows the state class graph of the TPN presented at Figure 1. Its state classes are reported in Table 1.

Table 1 

The state classes of the TPN presented at Figure 2.

Figure 1 

A simple Petri net with 𝑇𝑐={𝑡1}.

Figure 2 

The state graph of the TPN presented at Figure 1.

Let 𝜔 be a sequence of transitions firable from 𝛼, the same transition may be newly enabled several times. To distinguish among different enablings of the same transition 𝑡_𝑖, we denote 𝑡^𝑘_𝑖 for 𝑘>0 the transition 𝑡_𝑖 (newly) enabled by the 𝑘th transition of the sequence; 𝑡⁰_𝑖 denotes the transition 𝑡_𝑖 enabled in 𝑀. Let 𝜔=𝑡^𝑘1₁,…,𝑡^𝑘𝑚_𝑚∈𝑇⁺ with 𝑚>0 be a sequence of transitions firable from 𝛼 s.t. succ(𝛼,𝜔)≠∅. We define Fire(𝛼,𝜔) the largest subclass 𝛼^′ of 𝛼 (i.e., 𝛼^′⊆𝛼) s.t. 𝜔 is firable from all its states, that is, Fire(𝛼,𝜔)={𝑞₁∈𝛼|∃𝜃₁,…,𝜃_𝑚,𝑞−−→₁^𝜃1𝑞₁+𝜃−−→₁^𝑡𝑘11𝑞₂,…,𝑞_𝑚+𝜃−−_𝑚^{𝑡𝑘𝑚𝑚}−→𝑞_𝑚+1}.

3. Literature Review

The idea of suspension and resumption of a task in a system is modeled in different ways in timed automata and time Petri nets [2–4, 17, 18]. In [2], the authors have introduced stopwatch automata (SWA) as a subclass of timed linear hybrid automata. In stopwatch automata, an additional binary variable is defined to show the rate of time progression. The clocks may have two velocities (time derivation): zero or one. Zero signifies stopped while one signifies normal progress. If clocks are running, they progress with a global rate, identical to all nonstopped clocks of the model. The authors have shown that stopwatch automata is as expressive as timed languages.

In [3], the authors have introduced inhibitor hyperarcs to interrupt an enabled transition. Once a place 𝑝 connected to a transition 𝑡 via an inhibitor arc is marked, the transition 𝑡 is suspended and stops firing. In other words, once an inhibitor arc is enabled, the corresponding transition is interrupted. They have called these nets IHTPN (time Petri nets with inhibitor hyperarcs). In Figure 3, 𝑡₁ is enabled. As soon as 𝑃₂ is marked, firing 𝑡₁ is suspended. Note that an inhibitor hyperarc is not graphically presented by a classical arrow; instead, it is depicted with an empty circle at the extreme of the edge.

Figure 3 

A simple example of time Petri nets with inhibitor hyperarc. 𝑡1 is active if 𝑝2 is not marked, otherwise it is suspended.

In [17], the authors have discussed an extension of time Petri nets adapted for scheduling. This extension is called scheduling extended time Petri nets (SETPN). SETPN is suitable to model concurrent tasks and shared resources with fixed priority. The behavior of scheduler is implicitly included in the model and the scheduler is not modeled as a separate agent.

In [17], time Petri nets are associated with two more properties 𝛾 and 𝜔 standing for resource allocation and priority, respectively. As an example, suppose two different concurrent tasks sharing the same resource (𝛾 is identical for both). Although both transitions are enabled, the one with a higher priority is active while the other is suspended. For each marking 𝑀, a function Act determines whether 𝑀 is active or not.

The time Petri nets presented in [17] assign both priority and resources to places. It is particularly suitable for scheduling approaches. State space analysis is done mapping scheduling Petri nets to hybrid automata (state class stopwatch automata). The advantage of this solution is using an automated tool like HYTECH [19] already existing for manipulation of hybird automata.

Another extension of time Petri nets called preemptive time Petri nets is discussed in [18]. Preemptive time Petri nets are suitable for scheduling and preemptive approaches. In Preemptive time Petri nets, resource and priority are characteristics of transitions while in SETPN they were assigned to places. The preemptive time Petri nets as well as scheduling extended time Petri nets are adapted specifically for scheduling purposes with fixed priority rather than general cases of interruption and resumption of some tasks. A more generalized model comes in [4, 5].

Another stopwatch model comes in [4, 5]. Post- and Pre-initialized stopwatch Petri nets (SWPN) [4, 5] also model interruption and retrieving of tasks. In such stopwatch Petri nets, transitions are partitioned into two disjoint subclasses 𝑇=𝑇_int∪𝑇_no-int where 𝑇_int is the set of interruptible transitions and 𝑇_no-int is the set of noninterruptible transitions. Stopwatches can suspend enabled interruptible transitions. For each transition 𝑡_𝑖, there is a function 𝑣(𝑡_𝑖) representing the value of its associated stopwatch. If 𝑡_𝑖∈𝑇_int, 𝑣(𝑡_𝑖) signifies the time elapsed since 𝑡_𝑖 was first enabled, whereas if 𝑡_𝑖∈𝑇_no-int, 𝑣(𝑡_𝑖) represents the time elapsed since 𝑡_𝑖 was last enabled. A transition is called firable if it is enabled (𝑀>Pre(𝑡_𝑖)) and ↓Is(𝑡_𝑖)≤𝑣(𝑡_𝑖)≤↑Is(𝑡_𝑖).

In contrary with IHTPN where a marked place suspended an enabled transition, in this model stopwatch consumes some tokens to disable an enabled transition. It is implemented by means of some extra places/transitions. A stopwatch transition is in conflict with an interruptible transition. Thus, consuming a token can suspend an interruptible enabled transition. With this model, an interrupt is unpredictable and we do not know when it happens. In fact at any time, the interruptible task and the interrupt both have equal chance to happen. The simple Petri nets of Figure 4 reported from [4] are a simple example of SWPN of an interruptible task.

Figure 4 

An interruptible task modeled by SWPN, reported from [4].

Let 𝑡_𝑖 be a transition and 𝑀 a marking, 𝑡_𝑖 is called: (i)enabled. If 𝑀≥Pre(𝑡_𝑖) denoted by 𝑡_𝑖∈En(𝑀); (ii)firable. If 𝑡_𝑖∈En(𝑀)∧↓Is(𝑡_𝑖)≤𝑣(𝑡_𝑖)≤↑Is(𝑡_𝑖), denoted by 𝑡_𝑖∈Firable(𝑀); (iii)suspended. If Pre(𝑡_𝑖)>𝑀∧𝑣(𝑡_𝑖)>0, denoted by 𝑡_𝑖∈susp(𝑀).

The notion ↑enabled(𝑡_𝑖,𝑀,𝑡_𝑘) indicates that 𝑡_𝑖 is newly enabled by firing of 𝑡_𝑘 at marking 𝑀.

The new concept Preinitialization defined in this model refers to noninterruptible transitions. For every 𝑡_𝑖∈𝑇_no-int, 𝑡_𝑖 is firable if 𝑣(𝑡_𝑖) has already been initialized when 𝑡_𝑖 becomes enabled. In other words, 𝑣(𝑡_𝑖)=0 when 𝑡_𝑖∈↑enabled(𝑡_𝑖,𝑀,𝑡_𝑘).

The concept, postinitialization is defined for interruptible transitions. When an interruptible transition is fired the associated 𝑣(𝑡_𝑖) is initialized (𝑣(𝑡_𝑖)=0). Figures 5 and 6 reported from [4] show the difference between time evolution in an interruptible transition and a noninterruptible transition. In these figures, the notions 𝐸,𝐷, and 𝐹 stand for enabling, disabling, and firing of a transition, respectively.

Figure 5 

Time elapses, 𝑡𝑖 is an interruptible transition.

Figure 6 

Time elapses, 𝑡𝑖 is a noninterruptible transition.

In brief, according to the types of transitions, two types of clock initialization are defined. (i)Preinitialization. Given a transition 𝑡_𝑖∈𝑇_no-int where 𝑇_no-int is the set of noninterruptible transitions, clock initialization is called preinitialization happening when 𝑡_𝑖 is recently enabled. As soon as a transition becomes enabled, its associated clock is initialized. (ii)Postinitialization. Given a transition 𝑡_𝑖∈𝑇_int where 𝑇_int is the set of interruptible transitions, clock initialization is called post-initialization happening after firing 𝑡_𝑖; it means that the transition initializes the clock after being fired. Post-initialization is dependent on transition firing.

In [4], continuous and discrete transitions are defined as follows.

Let 𝑑∈ℝ⁺, a continuous transition is denoted by (𝑀,𝑣)→−^𝑑(𝑀,𝑣^′) iff ∀𝑡_𝑖∈𝑇: (i)𝑣^′(𝑡_𝑖)=𝑣(𝑡_𝑖), if the transition 𝑡_𝑖 is not enabled;(ii)𝑣^′(𝑡_𝑖)=𝑣(𝑡_𝑖)+𝑑 if 𝑡_𝑖 is enabled;(iii)𝑀≥Pre(𝑡_𝑖)⇒𝑣^′≤↑Is(𝑡_𝑖).

And a discrete transition is denoted by (𝑀,𝑣)−→^𝑡𝑖(𝑀^′,𝑣^′) iff ∀𝑡_𝑖∈𝑇: (i)𝑡_𝑖∈Firable(𝑀), (ii)𝑀^′=𝑀−Pre(𝑡_𝑖)+Post(𝑡_𝑖), (iii)𝑣^′(𝑡_𝑖)=0 if 𝑡_𝑖∈𝑇_int (postinitialization), (iv)∀𝑡_𝑘∈𝑇,𝑣^′(𝑡_𝑘)=(a)0 if 𝑡_𝑘∈↑enabled(𝑡_𝑘,𝑀,𝑡_𝑖); (preinitialization) (b)𝑣(𝑡_𝑖) Otherwise.

In order to perform further timing analysis, the same as scheduling extended time Petri nets of [17], the SWPN is transformed to hybrid automaton. In addition, a forward algorithm is suggested to compute reachable states.

If the number of stopwatches increases, for example if all of the transitions are interruptible, the complexity of calculation will highly increase. Scheduling time Petri nets and preemptive time Petri nets are both subclasses of stopwatch Petri nets. An ordinary TPN is also a SWPN where 𝑇_int=∅.

After having a survey on different stopwatch Petri nets available in the literature, in the following, we will have a brief review on the algorithm of [9] and then investigate how to integrate stopwatch in the controller synthesis approach of [9].

4. Safety Controller Synthesis Approach Proposed in [9]

Let 𝒩 be a TPN with controllable and uncontrollable transitions (𝑇=𝑇_𝑐∪𝑇_𝑢) and a set of markings to be avoided (bad). For a safety property, the approach proposed in [9] (see Algorithms 1 and 2) consists of exploring, on-the-fly and path by path, the state class graph of the TPN 𝒩 while collecting the bad sequences and the losing states (sequences or states that lead to bad markings). The list Passed is used to retrieve the set of state classes processed so far, their bad sequences, and their losing subclasses. For a given state class 𝛼 and a bad sequence 𝜔 feasible from 𝛼, the function Fire is used to compute forwardly all states of 𝛼 which lead by a sequence of transitions to an undesirable marking (i.e., a losing subclass of 𝛼). The function explore receives parameters 𝛼 being the class under process, 𝑡 the transition leading to 𝛼, and 𝒞 the set of traveled classes in the current path. Succinctly, it recursively computes the bad sequences of 𝛼 (from bad sequences of its successors) and verifies whether or not 𝛼 can be controlled so as to avoid its bad sequences. It returns the set of bad sequences if they cannot be avoided from 𝛼. Otherwise, it returns an empty set, which means that 𝛼 can be controlled (i.e., 𝛼 has no bad sequences or there is at least one controllable transition 𝑡_𝑐 such that its firing interval in 𝛼 can be restricted so as to avoid reaching bad states). The restriction of the interval of 𝑡_𝑐 in 𝛼 is obtained by subtracting from its interval in 𝛼, intervals of 𝑡_𝑐 in its bad subclasses.

Function main (TPN 𝒩, Markings bad) Where 𝒩 is a TPN bad is a set of bad markings. Let  𝑇𝑐  be the set of controllable transitions of  𝒩  and 𝛼0  the initial state class of  𝒩. Passed=∅ If  (explore(𝛼0,𝜖,{𝛼0})≠∅)  then    {Controller does not exist}    return end if for all ((𝛼,Ω,LI)∈Passed) do   Ctrl[𝛼]=⋃(𝑡𝑐,𝑡𝑠,BI)∈LI{(𝑡𝑐,𝑡𝑠,INT(𝛼,𝑡𝑐−𝑡𝑠)−BI)} end for (∗Remarks:) 𝛼=(𝑀,𝐹); En𝑐(𝑀)=En(𝑀)∩𝑇𝑐; En0𝑐(𝑀)=En𝑐(𝑀)∪{𝑡0}; New𝑐(𝑀,𝑡)=New(𝑀,𝑡)∩𝑇𝑐; New(𝑀0,𝜖)=En(𝑀0); 𝑡0 is a fictitious transition whose time variable is fixed at 0. Dep(𝛼,𝑡,LI)≡ ∃(𝑡𝑐,𝑡𝑠,BI)∈LI,𝑡𝑐∉New(𝑀,𝑡)∧(𝑡𝑠∉New(𝑀,𝑡)∨ INT(𝛼,𝑡𝑐−𝑡0)⊆⋂̸𝐼∈BI(𝐼⊕INT(𝛼,𝑡𝑠−𝑡0)))

Algorithm 1 

On-the-fly algorithm for the safety control of TPN-Part I.

Function Traces explore (Class α, Trans 𝑡, Classes 𝒞) if (∃Ω,LI𝐬.𝐭.(𝛼,Ω,LI)∈Passed ) then  if (Ω≠∅∧Dep(𝛼,𝑡,LI)) then    return {𝑡⋅𝜔∣𝜔∈Ω}  end if  return  ∅ end if if (𝑀∈bad) then  return {𝑡} end if Traces Ω=∅; for all 𝑡′∈En(𝑀)  s.t  succ(𝛼,𝑡′)≠∅∧succ(𝛼,𝑡′)∉𝒞 do  Ω = Ω∪explore(succ(𝛼,𝑡′),𝑡′,𝒞∪{succ(𝛼,𝑡′)}) end for  {Ω  contains all bad sequences of  α.} if  (Ω=∅) then  Passed=Passed∪{(𝛼,∅,∅)}  return  ∅ end if LI={(𝑡𝑐,𝑡𝑠,BI)∣(𝑡𝑐,𝑡𝑠)∈En𝑐(𝑀)×En0𝑐(𝑀)∧   BI=⋃𝜔∈ΩINT(Fire(𝛼,𝜔),𝑡𝑐−𝑡𝑠)⊂INT(𝛼,𝑡𝑐−𝑡𝑠)} Passed=Passed∪{(𝛼,Ω,LI)} if  (Dep(𝛼,𝑡,LI)) then  return {𝑡⋅𝜔∣𝜔∈Ω} end if return ∅

Algorithm 2 

On-the-fly algorithm for the safety control of TPN-Part II.

This approach tries to control the system behavior starting from the last to the first state class of bad paths. If it fails to control a state class of a path, so as to avoid all bad state classes, the algorithm tries to control its previous state classes. If it succeeds to control a state class, there is no need to control its predecessors. The aim is to limit as little as possible the behavior of the system (more permissive controller).

In [20], we have proven that this approach gives the maximally permissive controller and if it fails to compute the controller then the controller does not exist. We have also investigated the hardness complexity of the approach step by step.(i)The complexity of computing BI of a state class (in worst case) is 𝑂(𝐾×𝐿×𝑛_𝑡²) where 𝐾 is the number of paths starting from the state class and leading to bad markings, 𝐿 is the maximal length of such paths, and 𝑛_𝑡 is the number of transitions in the model. (ii)The complexity for computing Dep relation used in Algorithms 1 and 2 is 𝑂(|LI|×𝑚×|BI|), where 𝑚 is the number of places in the model (complexity of testing New(𝑀,𝑡)).

In [14], the authors have discussed the completeness complexity for bounded TPNs. They have proven that model checking of TPN-TCTL formula on a bounded TPN is PSPACE-complete.

Let us explain this approach, by means of an example. Consider the TPN shown at Figure 1, its state class graph presented at Figure 2 and its state classes reported in Table 1. Suppose that only 𝑡₁ is controllable (i.e., 𝑇_𝑐={𝑡₁}) and we want to avoid reaching markings where places 𝑝₁ and 𝑝₃ are both not marked (i.e., state classes 𝛼₄ and 𝛼₆) by choosing appropriately the firing intervals of 𝑡₁. For this example, we have 𝑇_𝑐={𝑡₁}, bad={𝑝₂,𝑝₄}, Passed=∅, and 𝛼₀=(𝑝₁+𝑝₂,0≤𝑡₁≤4∧2≤𝑡₂≤3).

The process starts by calling explore(𝛼₀,𝜖,{𝛼₀}) (see Figure 7). Since 𝛼₀ is not in Passed and its marking is not forbidden, explore is successively called for the successors of 𝛼₀: explore(𝛼₁,𝑡₁,{𝛼₀,𝛼₁}) and explore(𝛼₂,𝑡₂,{𝛼₀,𝛼₂}). In explore of 𝛼₁, function explore is successively called for 𝛼₃ and 𝛼₄. In explore of 𝛼₃, function explore is called for the successor 𝛼₆ of 𝛼₃ by 𝑡₃: explore(𝛼₆,𝑡₃,{𝛼₀,𝛼₁,𝛼₃,𝛼₆}. For the successor of 𝛼₃ by 𝑡₄ (i.e., 𝛼₀), there is no need to call explore as it belongs to the current path. Since 𝛼₆ has a forbidden marking, explore of 𝛼₆ returns to explore of 𝛼₃ with {𝑡₃}, which, in turn, adds (𝛼₃,{𝑡₂𝑡₃},∅) to Passed and returns to explore of 𝛼₁ with {𝑡₂𝑡₃}.

Figure 7 

Applying Algorithms 1 and 2 on the TPN at Figure 1 for AG not 𝑝1+𝑝3=0.

In explore of 𝛼₁, function explore is called for 𝛼₄ (explore(𝛼₄,𝑡₃,{𝛼₀,𝛼₁,𝛼₄})). This call returns, to explore of 𝛼₁, with {𝑡₃}, since 𝛼₄ has a forbidden marking. In explore of 𝛼₁, the tuple (𝛼₁,{𝑡₂𝑡₃,𝑡₃},∅) is added to Passed and {𝑡₁𝑡₂𝑡₃,𝑡₁𝑡₃} is returned to explore of 𝛼₀. Then, explore of 𝛼₀ calls explore(𝛼₂,𝑡₂,{𝛼₀,𝛼₂}), which in turn calls explore(𝛼₅,𝑡₁,{𝛼₀,𝛼₂,𝛼₅}). Since 𝛼₅ has only one successor (𝛼₀) and this successor belongs to the current path, the call of explore for 𝛼₅ adds (𝛼₅,∅,∅) to Passed and returns to explore of 𝛼₂ with ∅, which, in turn, returns to explore of 𝛼₀.

After exploring both successors of 𝛼₀, in explore of 𝛼₀, we get in Ω={𝑡₁𝑡₂𝑡₃,𝑡₁𝑡₃} the set of bad paths of 𝛼₀. As the state class 𝛼₀ has a controllable transition 𝑡₁, its bad subclasses are computed: Fire(𝛼₀,𝑡₁𝑡₂𝑡₃)={(𝑝₁+𝑝₂,0≤𝑡₁≤2∧2≤𝑡₂≤3∧1≤𝑡₂−𝑡₁≤3) and Fire(𝛼₀,𝑡₁𝑡₃)=(𝑝₁+𝑝₂,0≤𝑡₁≤1∧2≤𝑡₂≤3∧2≤𝑡₂−𝑡₁≤3)}. The firing interval of 𝑡₁ in 𝛼₀ ([0,4]) is not covered by the union of intervals of 𝑡₁ in bad subclasses of 𝛼₀ ([0,2]∪[0,1]≠[0,4]). Then, (𝛼₀,{𝑡₁𝑡₂𝑡₃,𝑡₁𝑡₃},{(𝑡₁,𝑡₀,{[0,2]})}) is added to Passed. As 𝑡₁ is newly enabled, the empty set is returned to the function main, which concludes that a controller exists. According to the list Passed, 𝛼₀ needs to be controlled (Ctrl[𝛼₀]={(𝑡₁,𝑡₀,{[0,4]−[0,2]})}). For all others, there is nothing to do.

5. Controller Synthesis and Stopwatch

In this section, we consider time Petri nets with controllable/uncontrollable transitions and show how such a system is controlled by associating some of the controllable transitions with stopwatch. First, we apply the on-the-fly algorithm of [9] and calculate the appropriate controller. Then, instead of restricting time intervals of corresponding controllable transitions, we associate them with stopwatch. In fact, we suspend some transition during its bad subinterval to control a system so as to satisfy a given property.

We consider the inhibitor hyperarcs of [3]. The controller shall suspend a controllable transition in its bad subinterval and retrieve it otherwise. Let us remember the example of Figure 1 with the state class graph of Figure 2 and Table 1. We have seen that in order to prevent the system entering the forbidden state classes 𝛼₄ and 𝛼₆, the controller should prevent 𝑡₁ from firing before ]2,4]. Thus, an inhibitor hyperarc is added to the transition 𝑡₁. This inhibitor hyperarc connects 𝑡₁ to a place called 𝑝_susp. At the beginning, this place is marked and then 𝑡₁ is suspended. At [2,2] the token of 𝑝_susp is consumed and the corresponding hyperarc becomes disabled. The controllable transition 𝑡₁ is now firable again. The token is returned to place 𝑝_susp after 𝑡₁ is fired. Thus, the controller suspends 𝑡₁ during its bad subinterval and resumes it after then. At the beginning, all clocks are initialized to zero. Then, time elapses but in [0,2], this transition is suspended and hence its clock does not elapse anymore. Later at time [2,2], this transition is retrieved and becomes active. We do not need to delay it anymore, that is why the lower bound of the interval associated with 𝑡₁ is modified to 0. Now the clock starts elapsing. Within 2 time units 𝑡₁ should be fired (i.e., when the actual time of the general clock of the system reaches to 4). Then, the interval associated with 𝑡₁ in a controlled TPN associated with stopwatch is [0,2]. Figure 8 represents the clock evaluation of the transition 𝑡₁. The controlled Petri nets of this example are presented in Figure 9.

Figure 8 

Clock evaluation of 𝑡1 in the controlled TPN of Figure 9.

Figure 9 

Time Petri net of Figure 1, controlled by inhibitor hyperarcs (𝑇𝑐={𝑡1}).

In summary, our goal is to synthesize the state class graph of the system through Algorithms 1 and 2 (see [9]) and calculate bad subintervals of the corresponding controllable transitions. Then, suspend the appropriate controllable transitions during their bad subintervals. Note that in [9], we were restricting and limiting time intervals while in this approach the idea is to delay and suspend them. In this research, we suppose every controllable transition can be associated with a stopwatch if needed. As explained earlier in Section 1, in a multitasking system with periodic tasks only execution of a task is controllable. Then, those transitions modeling the task executions are considered controllable and consequently could be suspended and retrieved.

Above, we have shown how to control a system when the bad subinterval is at the beginning of the firing interval. What if the acceptable subinterval is at the beginning and bad subintervals are after? Consider the example of Figure 10. A controllable transition 𝑡₁ is associated with firing interval [𝑎,𝑏]. Suppose that, based on Algorithms 1 and 2, the subinterval [𝑎,𝛼₁] is acceptable while ]𝛼₁,𝑏] is a bad subinterval, where 𝑎≤𝛼₁<𝑏. The controlled time Petri nets are presented in Figure 11. Figure 12 represents the clock evaluation of 𝑡₁ and shows how the new interval associated with 𝑡₁ is calculated. In [0,𝑎[, 𝑝_susp is marked and 𝑡₁ is neither active nor enabled. Meanwhile, at the time 𝑎, 𝑡_𝑟1 becomes enabled and is fired consuming the token in 𝑝_susp. Thus, right at 𝑎, the transition 𝑡₁ becomes active and its associated clock starts elapsing. Note that associated stopwatch delays 𝑡₁ for 𝑎 time units and we do not want to delay it anymore; then, the lower bound of the new associated interval in controlled TPN is 0. After 𝛼₁ time units, 𝑡_𝑟2 is fired, and 𝑝_susp becomes marked again. Consequently, 𝑡₁ is suspended.

Figure 10 

A simple time Petri net (𝑇𝑐={𝑡1}).

Figure 11 

The controlled TPN of Figure 10 using inhibitor hyperarcs (𝑇𝑐={𝑡1}). Forbidden interval is ]𝛼1,𝑏] where 𝑎≤𝛼1<𝑏.

Figure 12 

Clock evaluation of 𝑡1 in the controlled TPN of Figure 10. Forbidden interval is ]𝛼1,𝑏] where 𝑎≤𝛼1<𝑏.

Consider the same example of Figure 10 and this time suppose that Algorithms 1 and 2 give the following output.

[𝑎,𝛼₁[ is acceptable, [𝛼₁,𝛼₂[ is a bad subinterval, [𝛼₂,𝑏] is acceptable where the condition 𝑎<𝛼₁<𝛼₂≤𝑏 holds. With the same idea, the controlled Petri nets are presented in Figure 13 and the clock evaluation of 𝑡₁ is shown in Figure 14.

Figure 13 

A simple time Petri net controlled by inhibitor hyperarcs (𝑇𝑐={𝑡1}); the bad subinterval is [𝛼1,𝛼2[ where 𝑎<𝛼1<𝛼2≤𝑏.

Figure 14 

Clock evaluation of 𝑡1 in a controlled TPN of Figure 10. The forbidden interval is ]𝛼1,𝛼2] where 𝑎<𝛼1<𝛼2≤𝑏.

5.1. Why Inhibitor Hyperarcs?

We have shown, how to achieve a controlled model from an uncontrolled time Petri nets by adding inhibitor hyperarcs. One question is why among different types of stopwatch inhibitor hyperarcs are chosen? Is it possible to use another stopwatch model? The answer is yes; but, inhibitor hyperarcs provide more flexibility and less complication. Let us see if this idea is feasible using other types of Petri nets with stopwatch.

We consider the post- and preinitialized Petri nets proposed in [4, 5] for stopwatch and try to control a model where a controllable transition associated with time interval [𝑎,𝑏] has a bad subinterval [𝑎,𝛼]. Based on our hypothesis, the controller should suspend the controllable transition at [𝑎,𝑎] and resume it at [𝛼,𝛼]. The characteristic of post and pre-initialized Petri nets is that they consume the same token of the original model and in addition, the exact time when the model becomes suspended is unknown as stopwatch transition and original transition have the same chance for firing. At the first glance, the idea is feasible by adding one place and two transitions. However, there are some issues. We explain the problem through an example.

We consider the same example of Figure 1. The suggested controlled model using post and pre-initialized Petri nets comes in Figure 15. The controllable transition 𝑡₁ is associated with stopwatch. The stopwatch interrupts the task at [0,0] and resume it at [2,2]. The problem is at [0,0], both transitions 𝑡₁ and 𝑡_sus are enabled with equal chance of firing whereas, in order to have a controlled model, 𝑡_sus should fire at [0,0] before 𝑡₁. Thus, the controller fails unless if we modify the interval associated to 𝑡₁ to ]0,2] which is not of interest in this approach.

Figure 15 

Controlling the example of Figure 1 using stopwatch of [4]. The controller fails.

The other alternative is presented at Figure 16. An auxiliary place 𝑝_𝑠 solves the problem. Hence, using the stopwatch Petri nets suggested in [4, 5], it is not easy to give a general solution to control a model considering the output of Algorithms 1 and 2. In addition, the resulting controlled nets are more complicated. For example, in case the controllable transition is associated with the interval [𝑎,𝑏] where its bad subinterval is [𝛼,𝑏] and 𝑎≤𝛼 then, the controlled model becomes complicated.

Figure 16 

Controlled model of Figure 1 using stopwatch of [4].

6. Illustrative Example

Suppose the multitasking system depicted in Figure 17 with the following specifications: four tasks 𝑇₁,𝑇₂,𝑇₃, and 𝑇₄ are being executed. Two tasks 𝑇₃ and 𝑇₄ are uncontrollable. The task 𝑇₁ is periodic with a period of [6,6] and then, its start execution is controllable. Suppose that starting execution of 𝑇₂ is also controllable. 𝑇₄ is depended to 𝑇₂ and 𝑇₃ meaning that it can be executed only when 𝑇₂ and 𝑇₃ are executed. Two tasks 𝑇₁ and 𝑇₂ share a common resource. On the other hand, 𝑇₁ enters through a single capacity buffer. It means that if 𝑇₁ is not executed by the end of its period, the system will block. In Figure 7, tasks are modeled by tokens and the execution of each task 𝑇_𝑖 is shown by the transition 𝑡_𝑖. If 𝑇₁ is not executed by the end of its period the system enters the state Block, and, 𝑡₅ is the transition to be avoided. Delay is a place modeling the behavior of the buffer considering the period of the task 𝑇₁. And finally, 𝑇₁ executes within [2,2] time units, 𝑇₂ in [2,3], 𝑇₃ within [5,6] and 𝑇₄ in [0,1].

Figure 17 

A periodic system with 𝑇𝑐={𝑡1,𝑡2}.

The state class graph of the model is given in Figure 18 and Table 2 shows the state class informations. Based on the state class graph of the system, the state classes 𝛼₄,𝛼₈,𝛼₁₃,𝛼₁₄,𝛼₁₈,𝛼₂₀, and 𝛼₂₃ are forbidden. Let us briefly trace the algorithm on the state class graph. First, we follow the algorithm on the left branch where the state classes 𝛼₄,𝛼₈, and 𝛼₁₃ are located. The algorithm starts from 𝛼₀ and is executed recursively to 𝛼₁, then 𝛼₃, 𝛼₇ and finally reaches to 𝛼₁₃ with a forbidden marking. Then, it comes back to 𝛼₇ with {𝑡₅} and to 𝛼₃ with {𝑡₄𝑡₅}. The other successor available from 𝛼₃ is 𝛼₈ which is also forbidden. Till now there is no enabled controllable transition to avoid these classes and the algorithm continues returning back to 𝛼₁ with {𝑡₃𝑡₄𝑡₅,𝑡₃𝑡₅}. The other successor available from 𝛼₁ is 𝛼₄ which is also forbidden. Thus, it returns back to 𝛼₀ with {𝑡₂𝑡₃𝑡₄𝑡₅,𝑡₂𝑡₃𝑡₅,𝑡₂𝑡₅}. The other successor available from 𝛼₀ is 𝛼₂ which is safe and the algorithm continues to 𝛼₅,𝛼₉,𝛼₁₅,𝛼₁₉, and finally 𝛼₁₈ which is a forbidden state. Then, it goes back to 𝛼₁₉ with {𝑡₅} and consequently to 𝛼₁₅ with {𝑡₂𝑡₅}. The other successors available from 𝛼₁₅ are the forbidden state 𝛼₂₀ and 𝛼₂ which is already under processing. Note that two enabled controllable transitions are available at 𝛼₁₅, but the controller cannot act at this level because 𝑡₅ may fire before 𝑡₁ or 𝑡₂ and lead to a forbidden state. Then, the algorithm continues and returns back to 𝛼₉ with {𝑡₄𝑡₂𝑡₅,𝑡₂𝑡₅} where no controllable transition is available. Consequently, the algorithm continues and returns back to 𝛼₅ and finally reaches to 𝛼₂ where newly enabled controllable transitions are available. Till now the path to be avoided at 𝛼₂ includes {𝑡₂𝑡₃𝑡₄𝑡₂𝑡₅,𝑡₂𝑡₃𝑡₄𝑡₅}.

Table 2 

State classes of the TPN presented at Figure 17.

Figure 18 

The state class graph of the TPN presented at Figure 17.

The procedure is similar for the other path available from 𝛼₂ including 𝛼₆ and its successors. The forbidden state reachable through this path is 𝛼₂₃ and in order to avoid this forbidden state, the controller can act at 𝛼₂₁ with two enabled controllable transitions. So, nothing is returned to 𝛼₂ from this path. Having a closer look to the state class graph and the output of the algorithm, we conclude that at each state where 𝑡₁ and 𝑡₂ are newly enabled and the controller should act (i.e., 𝛼₀,𝛼₂, and 𝛼₂₁), the controller should force 𝑡₁ to fire before 𝑡₂ (i.e., 𝑡₂−𝑡₁>0). In other words, 𝑡₂ should not be active at [2,2]. It is sufficient to add an inhibitor hyperarc to deactivate 𝑡₂ at [2,2]. The controller cannot act at the state class 𝛼₁₅ as discussed earlier and has nothing to do at the state class 𝛼₆ (the permissive controller will act later at the state class 𝛼₂₁). Note that a state class like 𝛼₁₄ which is reachable through a forbidden state (𝛼₈) is not processed by the algorithm as it is supposed to be avoided in the controlled system. The controlled model using inhibitor hyperarcs is given at Figure 19.

Figure 19 

Controlled model of Figure 17 using inhibitor hyperarcs.

Our model is now safe. Yet some challenges exist. Look at the state class graph of the model presented at Figure 18. In some paths one task is executed frequently while others are still waiting. For example, see the paths leading to 𝛼₁₇. Although the system is not blocked, some of the tasks cannot be executed. A good scheduler had better to perform different tasks alternatively. We may want to consider alternation, particular sequences, add a deadline for each task or other possible policies. And finally, we may ask if it is possible to restrict the execution time of a task even if it is in its safe subinterval? Then, while synthesizing a scheduler, we can add more constraints and scheduling policies beyond “safe states.” Further researches are required to answer these questions.

7. Conclusion

In this paper, we have extended the approach discussed in [9] to time Petri nets with stopwatch and have suggested to associate the controllable transitions with stopwatch in order to prevent their bad subintervals. We have proposed that in case a controller (like a scheduler) cannot restrict time intervals associated with controllable transitions, the controllable transitions can be suspended in their bad subintervals. Synthesizing a time Petri net associated with stopwatch is complicated and needs some overapproximations. Besides, time Petri nets associated with stopwatch do not preserve the boundedness property. In this paper, we have suggested a more effective alternative. We synthesize a time Petri net without stopwatch and then, equip the controllable transitions with stopwatch where necessary. With this assumption, every controllable transition can be suspended in its bad subinterval and resumed otherwise. Amongst different types of stopwatch, our solution is based on inhibitor hyperarcs.

The approach suggested in this paper is particularly useful at design level for preemptive scheduling purposes, managing shared resources and critical sections. This is a good starting point for further researches on scheduling and to calculate automatically a scheduler in a multitasking system. It is interesting to see how the approach can be applied in a more general case with a variable number of tasks and dependencies. Consider different scheduling policies are challenging and are worth to be considered in further studies.