1. Predictability Verification with Petri Net Unfoldings
Agnes Madalinski1 and Victor Khomenko2
1Faculty of Engineering Science, University Austral de Chile
2School of Computing Science, Newcastle University, UK 1 1 1 1 1

2. Predictability
First, I would like to outline the concept of fault diagnosis.
In a system a fault might occur. In order to diagnose a fault the system is observed
via sensor readings or controller commands. Having detected, localised and
identified faults and action to repair or reconfigure the system can be performed.
Thus:
diagnosis ...
diagnosability ...
We are interested in the diagnosability property. 2 2 2

3. detection, localisation
Concept of fault diagnosis
observations
diagnosis
system
faults
actions
(repair, reconfigure)
detection, localisation
and identification
of faults
diagnosis: task of explaining an occurrance of a fault given an observation of the system’s behaviour
First, I would like to outline the concept of fault diagnosis.
In a system a fault might occur. In order to diagnose a fault the system is observed
via sensor readings or controller commands. Having detected, localised and
identified faults and action to repair or reconfigure the system can be performed.
Thus:
diagnosis ...
diagnosability ...
We are interested in the diagnosability property.
predictability: the possibility of predicting a fault before it actually occurs by monitoring the visible behaviour 3 3 3

4. Predictability system diagnosis assumptions:‏
a fault is predictable if it is always possible to predict its occurrence by observing the visible actions of the system
observations
diagnosis
system
o1, o2
fault will occur
assumptions:‏
the system has finitely many reachable states
the system is deadlock-free
any infinite execution has infinitely many occurrences of observable transitions (i.e. the system is divergence-free)
After a sequence of observable events one would like to know if a fault occurred,
however, we might need to observe a little longer in order to make an accurate statement.
A system ... 4 4 4

5. System model labelled Petri net N=(P,T,,M0,O,U,ℓ)‏
O set of observable transition labels
U set of unobservable transition labels
ℓ : T → O  U
F  U set of fault transition labels
not predictable w.r.t. f
We use labelled Petri nets to model the system, where the transitions
are labelled as observable and unobservable transitions labels.
We assume that faults are unobservable otherwise it would be
trivial to diagnose observable faults.
In this simple example the transition labelled “a” is
observable and the others are unobservable including the fault “f”.
O = {a,b,c}
U = {u, f}
F = {f} 5 5 5 5

6. Witness of predictability violation
A witness of predictability violation is a pair of traces such that:
can be finite or infinite; the rest of this trace after f is not important o3 o1 o2 f
no faults ∞
synchronisation on observable, no faults
no synchronisation required 6 6 6 6

7. Building the verifier

8. Building the verifier – two copies

9. Building the verifier – remove f2

10. Building the verifier – sync. producta b c f
synchronisation

11. Building the verifier – switcha b c f
synchronisation
desynchronisation

12. Building the verifier – switcha b c f
synchronisation
desynchronisation

13. Model checking
‏reduce the problem of predictability to LTL-X model checking by building a verifier
property to check:
existence of an infinite trace of the verifier containing a fault f
such a trace can be mapped to a witness of predictability violation ◊f

14. Experimental results
predictability is a new field – mostly theoretical work, no benchmarks, no tools
we created three series of scalable benchmarks
based on producer-buffer-consumer system
each benchmark has predictable and non-predictable variants
used parallel LTL-X model checking based on unfoldings
showed the feasibility of the proposed approach
good levels of parallelisation can be achieved

15. Conclusions and future work
proposed a better way of verifying predictability
previous work: de-synchronise dynamically, use a customised algorithm
our work: de-synchronise statically, use a general- purpose algorithm
moving from theory to practical verification
the method can be trivially generalised to high-level Petri nets:
the verifier construction can be lifted to HL nets
parallel LTL-X model checking based on unfoldings works for HL nets too