Formal Verification of Petri Nets with Names

Abstract

Petri nets with name creation and management have been recently introduced so as to make Petri nets able to model the dynamics of (distributed) systems equipped with channels, cyphering keys, or computing boundaries. While traditional formal properties such as boundedness, coverability, and reachability, have been thoroughly studied for this class of Petri nets, formal verification against rich temporal properties has not been investigated so far. In this paper, we attack this verification problem. We introduce sophisticated variants of first-order $\mu$-calculus to specify rich properties that simultaneously account for the system dynamics and the names present in its states. We then analyse the (un)decidability boundaries for the verification of such logics, by considering different notions of boundedness. Notably, our decidability results are obtained via a translation to data-centric dynamic systems, a recently devised framework for the formal specification and verification of business processes working over relational database with constraints. In this light, our results contribute to the cross-fertilization between areas that have not been extensively related so far.

A From \(\nu \)-PNs to DCDSs

We define a translation function $\tau$ that, given a marked $\nu$-PN $\overline{N}=(P,T,F,m_0)$, produces a DCDS $\tau (\overline{N})=\langle \mathcal {D}_N,\mathcal {P}_N\rangle$, whose execution semantics faithfully reproduces that of $\varGamma _{\overline{N}}$. The data layer of $\tau (N)$ is $\mathcal {D}_N=\langle \mathcal {C}_N,\mathcal {R}_N,\mathcal {E}_N,\mathcal {I}_0^N\rangle$, where:

• 1. $\mathcal {C}_N=Id\cup T\cup P\cup Var$

• 2. $\mathcal {R}_N$ contains:

  • $p_i /2$ for each $p_i\in P$

  • $NewID /5= NewID (\mathsf {t},\mathsf {p},\mathsf {v},\mathsf {d},\mathsf {id})$

  • $FL /0$

• 3. $\mathcal {E}_N$ is constituted by the following constraints:

  • $\mathcal {E}_1$ and $\mathcal {E}_2$ ensure that the new identifiers from $NewID$ are unique:

    $$\begin{aligned} \mathcal {E}_1 =\forall id. NewID (\_,\_,\_,id,\_) \wedge \bigvee _{p_i\in \mathcal {R}_N} p_i(id,\_) \rightarrow \bot \end{aligned}$$
    $$\begin{aligned} \mathcal {E}_2 = \begin{array}[t]{rl} \forall id,t,p,v,n,t',p',v',n'. &{} NewID (t,p,v,id,n) \wedge NewID (t',p',v',id,n') \\ &{}\qquad \rightarrow t = t' \wedge p = p' \wedge v = v' \wedge n = n' \end{array} \end{aligned}$$

  • $\mathcal {E}_3$ and $\mathcal {E}_4$ ensure the uniqueness of the fresh names stored in $NewID$ (here $\varUpsilon _N$ contains all the fresh variables present in N):

    $$\begin{aligned} \mathcal {E}_3 =\forall n.\bigvee _{\mathsf {c} \in \varUpsilon _N} NewID (\_,\_,\mathsf {c},\_,n) \wedge \bigvee _{i \in \{1,\ldots ,5\}} p_i(\_,n) \rightarrow \bot \end{aligned}$$
    $$\begin{aligned} \mathcal {E}_4 = \begin{array}[t]{rl} \forall n_1,n_2.\bigvee \limits _{\mathsf {\nu _1},\mathsf {\nu _2} \in \varUpsilon _N, \mathsf {\nu _1}\ne \mathsf {\nu _2}} &{}\Bigl ( NewID (\_,\_,\mathsf {\nu _1},\_,n_1) \wedge NewID (\_,\_,\mathsf {\nu _2},\_,n_2)\\ &{}\qquad \rightarrow n_1 \ne n_2\Bigr ) \end{array} \end{aligned}$$

• 4. for each $p\in P$ such that $M_0(p)\ne \emptyset$, $\mathcal {I}_0^N$ is containing the following set of facts:

  $$\begin{aligned} \Bigl \lbrace p (\mathsf {id}^p_k,\mathsf {d}):&\mathsf {d}\in M_0(p),\, \mathsf {id}^p_k\in X_p\subset \mathbb {N},\,\forall i,j,. i\ne j \text { we have }\mathsf {id}^p_i\ne \mathsf {id}^p_j,\\&\text {and } \forall p,p^\prime . X_p\cap X_{p^\prime }=\emptyset \Bigr \rbrace \end{aligned}$$

Fig. 4.

Marked $\nu$-PN representing all possible infinite data words with labels $\{\sigma _1,\sigma _2\}$.

The process layer of $\tau (N)$ is $\mathcal {P}_N=\langle \mathcal {F}_N,\mathcal {P}_N,\rho _N\rangle$, where:

• 1. $\mathcal {F}_N$ includes the following non-deterministic services:

  • a new id generator $genID (\mathsf {t},\mathsf {p},\mathsf {v},\mathsf {i})$,

  • a fresh data generator $genFresh (\nu )$.

• 2. Sets of process and action components $\rho _N$ and $\mathcal {A}_N$ are constructed as follows:

  • for each transition $t\in T$ we define (i) a process

    $$\begin{aligned} \bigwedge _{CA^1_G}(p_j(id_k^j,v)\wedge id_k^j\ne id_m^j)\wedge \lnot FL \mapsto gen_t(\vec {v},\vec {id}), \end{aligned}$$

  where $CA^1_G=\Big \lbrace p_j\in ^\bullet t,\, m,k\in \{1,\ldots ,|pre(t,p_j)|\},\,m\ne k,\, v\in pre(t,p_j)\Big \rbrace$ is the guard condition, and (ii) a corresponding action $gen_t(\vec {v},\vec {id})=$

  $$\begin{aligned} \{\begin{array}[t]{rcl} p_j(id,n) \wedge \bigwedge \nolimits _{i \in I_{p_j}} id \ne id_i^j &{} \rightsquigarrow &{} \{p_j(id,n)\}\quad \text {for} p_j \in {^\bullet t}\\ &{}&{} \left. \text { and } I_{p_j}=\{1,\ldots ,|pre(t,p_j)|\}\right\} \\ p_i(id,n) &{} \rightsquigarrow &{} \{p_i(id,n)\} \quad \text {for} p_i \in P\setminus {^\bullet t}\\ true &{} \rightsquigarrow &{}\{ NewID (\mathsf {t},\mathsf {p_k},\mathsf {x}, genID(\mathsf {t},\mathsf {p_k},\mathsf {x},\mathsf {num_{\mathsf {x}}}) ,v):A_1\},\\ \\ true &{} \rightsquigarrow &{}\{ NewID (\mathsf {t},\mathsf {p_k},\mathsf {\nu }, genID(\mathsf {t},\mathsf {p_k},\mathsf {\nu },\mathsf {1}) ,\\ &{}&{} {\{}genName(\mathsf {\nu })):A_2\},\\ true &{}\rightsquigarrow &{} FL ~\}, \end{array} \end{aligned}$$

  where $A_1$ and $A_2$ are two conditions which are defined as follows:

  • (a) $A_1=\Big \lbrace p_k\in t^\bullet ,\mathsf {x}\in post(t,p_j) \setminus \varUpsilon , \mathsf {num_{\mathsf {x}}} = \{1,\ldots ,post(t,p_j)(var)\} \Big \rbrace$,

  • (b) $A_2=\Big \lbrace p_k\in t^\bullet , \nu \in post(t,p_j)\cap \varUpsilon \}\Big \rbrace$;

  • define an additional action

  $$\begin{aligned} transf () = \{\begin{array}[t]{rcl} p_i (id,n) &{} \rightsquigarrow &{} \{ p_i (id,n)\} \qquad \text { for } p_i \in P\\ NewId (\_,\mathsf {p_j},\_,id,n) &{} \rightsquigarrow &{} \{ p_j (id,n)\} \qquad \text { for } p_j \in P ~\} \end{array} \end{aligned}$$

  and a condition-action rule corresponding to it:

  $$\begin{aligned} FL \mapsto transf () \end{aligned}$$