Predictability Verification with Petri Net Unfoldings Agnes Madalinski1 and Victor Khomenko2 1Faculty of Engineering Science, University Austral de Chile 2School of Computing Science, Newcastle University, UK 1 1 1 1 1

Predictability First, I would like to outline the concept of fault diagnosis. In a system a fault might occur. In order to diagnose a fault the system is observed via sensor readings or controller commands. Having detected, localised and identified faults and action to repair or reconfigure the system can be performed. Thus: diagnosis ... diagnosability ... We are interested in the diagnosability property. 2 2 2

detection, localisation Concept of fault diagnosis observations diagnosis system faults actions (repair, reconfigure) detection, localisation and identification of faults diagnosis: task of explaining an occurrance of a fault given an observation of the system’s behaviour First, I would like to outline the concept of fault diagnosis. In a system a fault might occur. In order to diagnose a fault the system is observed via sensor readings or controller commands. Having detected, localised and identified faults and action to repair or reconfigure the system can be performed. Thus: diagnosis ... diagnosability ... We are interested in the diagnosability property. predictability: the possibility of predicting a fault before it actually occurs by monitoring the visible behaviour 3 3 3

Predictability system diagnosis assumptions:‏ a fault is predictable if it is always possible to predict its occurrence by observing the visible actions of the system observations diagnosis system o1, o2 fault will occur assumptions:‏ the system has finitely many reachable states the system is deadlock-free any infinite execution has infinitely many occurrences of observable transitions (i.e. the system is divergence-free) After a sequence of observable events one would like to know if a fault occurred, however, we might need to observe a little longer in order to make an accurate statement. A system ... 4 4 4

System model labelled Petri net N=(P,T,,M0,O,U,ℓ)‏ O set of observable transition labels U set of unobservable transition labels ℓ : T → O  U F  U set of fault transition labels not predictable w.r.t. f We use labelled Petri nets to model the system, where the transitions are labelled as observable and unobservable transitions labels. We assume that faults are unobservable otherwise it would be trivial to diagnose observable faults. In this simple example the transition labelled “a” is observable and the others are unobservable including the fault “f”. O = {a,b,c} U = {u, f} F = {f} 5 5 5 5

Witness of predictability violation A witness of predictability violation is a pair of traces such that: can be finite or infinite; the rest of this trace after f is not important o3 o1 o2 f no faults ∞ synchronisation on observable, no faults no synchronisation required 6 6 6 6

Building the verifier

Building the verifier – two copies

Building the verifier – remove f2

Building the verifier – sync. product a b c f synchronisation

Building the verifier – switch a b c f synchronisation desynchronisation

Building the verifier – switch a b c f synchronisation desynchronisation

Model checking ‏reduce the problem of predictability to LTL-X model checking by building a verifier property to check: existence of an infinite trace of the verifier containing a fault f such a trace can be mapped to a witness of predictability violation ◊f

Experimental results predictability is a new field – mostly theoretical work, no benchmarks, no tools we created three series of scalable benchmarks based on producer-buffer-consumer system each benchmark has predictable and non-predictable variants used parallel LTL-X model checking based on unfoldings showed the feasibility of the proposed approach good levels of parallelisation can be achieved

Conclusions and future work proposed a better way of verifying predictability previous work: de-synchronise dynamically, use a customised algorithm our work: de-synchronise statically, use a general- purpose algorithm moving from theory to practical verification the method can be trivially generalised to high-level Petri nets: the verifier construction can be lifted to HL nets parallel LTL-X model checking based on unfoldings works for HL nets too