Helsinki

University

of

Technology

Department

of

Computer

Science

Digital

Systems

Laboratory

Otaniemi

Otakaari

SF

ESPOO

FINLAND

HELSINKI

UNIVERSITY

OF

TECHNOLOGY

DIGITAL

SYSTEMS

LABORATORY

Series

A

Research

Reports

ISSN

No.

March

ISBN

THE

MODELLING

AND

ANALYSIS

OF

A

HIGH

SPEED

DATA

BUS

WITH

PREDICATE/TRANSITION

NETS

Tino

Pyssysalo

Digital

Systems

Laboratory

Department

of

Computer

Science

Helsinki

University

of

Technology

Otaniemi

Finland

HELSINKI

UNIVERSITY

OF

TECHNOLOGY

DIGITAL

SYSTEMS

LABORATORY

Series

A

Research

Reports

ISSN

No.

March

ISBN

The

Modelling

and

Analysis

of

a

High

Speed

Data

Bus

with

Predicate/Transition

Nets

Tino

Pyssysalo

Abstract

In

this

work

predicate/transition

nets

-LRB-

Pr/T-nets

-RRB-

are

used

in

the

modelling

and

analysis

of

the

medium

access

control

algorithm

of

a

parallel

high

speed

data

bus

Frame

Synchronized

Ring

-LRB-

FSR-bus

-RRB-

Two

Pr/T-net

models

of

the

bus

are

presented

One

models

the

basic

operation

of

the

control

algorithm

The

other

is

an

extended

model

in

which

nodes

can

send

longer

frames

and

the

reception

of

a

frame

can

fail

The

analysis

of

the

nets

is

based

on

the

reachability

analysis

which

is

made

by

a

highly

advanced

Pr/T-net

reachability

analysis

tool

PROD

The

state

space

of

the

reachability

graph

grows

very

fast

with

respect

to

the

number

of

nodes

in

the

ring

The

state

space

explosion

is

tried

to

be

reduced

with

the

stubborn

set

and

symmetry

methods

The

stubborn

set

method

reduces

the

number

of

reachable

states

almost

Symmetry

method

is

not

so

efficient

These

results

show

how

effective

these

methods

can

be

Analytical

models

and

simulations

have

been

used

in

the

analysis

of

the

FSR-bus

With

these

methods

it

has

not

been

possible

to

prove

whether

the

bus

can

deadlock

or

whether

the

bus

is

fair

In

this

work

these

properties

are

successfully

proved

with

PROD

Other

important

results

concern

the

performance

of

the

FSR-bus

in

terms

of

waiting

times

of

the

nodes

The

longest

waiting

path

and

the

situation

in

which

the

waiting

occurs

are

examined

with

PROD

It

is

found

that

in

some

circumstances

a

node

has

to

wait

quite

long

to

get

access

to

the

bus

which

is

undesirable

in

real

time

applications

Printing

TKK

Monistamo

Otaniemi

Helsinki

University

of

Technology

Phone

-LCB-

Department

of

Computer

Science

Digital

Systems

Laboratory

Telex

htkk

sf

Otaniemi

Otakaari

Telefax

-LCB-

-LCB-

SF

-LCB-

ESPOO

FINLAND

E-mail

lab@hutds.hut.fi

i

Contents

Introduction

Modelling

and

Analysing

Concurrent

and

Distributed

Systems

Syntax

of

Predicate/Transition

Nets

Analysis

of

Predicate/Transition

Nets

State

Space

Explosion

Stubborn

Set

Method

Symmetry

Method

Reachability

Analysis

Tool

PROD

General

about

PROD

Using

PROD

Reachability

Graph

Generation

Query

Language

Frame

Synchronized

Ring

Structure

of

the

Bus

Frame

Structure

Operation

of

the

Bus

Medium

Access

Control

Algorithm

Pr/T-Net

Model

of

the

Bus

Basic

Predicate/Transition

Net

Markings

of

the

Net

Transitions

of

the

Net

Extended

Pr/T-Net

with

Credit

Size

and

Retransmit

Bit

Markings

of

the

Extended

Model

Transitions

of

the

Extended

Model

ii

Analysis

of

the

Algorithm

Deadlocks

Fairness

Waiting

Times

of

the

Nodes

Request

Waiting

Time

Bus

Access

Waiting

Time

Problems

in

Analysis

Attacks

against

State

Space

Explosion

Query

Running

Times

Conclusions

References

Appendix

A

Source

Listing

of

the

C

Program

for

onding

the

Longest

Path

Appendix

B

Basic

Net

Description

of

the

FSR-Bus

Appendix

C

Extended

Net

Description

of

the

FSR-Bus

Introduction

The

need

of

computation

power

is

continuously

increasing

In

large

database

systems

multimedia

and

real

time

applications

the

increasing

computation

demands

are

achieved

by

distributing

computation

tasks

among

several

communicating

processors

An

example

of

such

a

distributed

system

is

a

telecommunication

protocol

where

each

individual

node

of

a

network

obeys

some

communication

rules

so

that

the

whole

network

of

processors

performs

the

computation

task

together

It

is

very

diOEcult

to

verify

the

operation

of

distributed

systems

Such

systems

rarely

have

only

one

execution

path

but

there

are

many

possible

operation

sequences

which

the

system

can

execute

For

example

it

is

impossible

to

determine

the

order

of

actions

of

individual

processors

Distributed

systems

can

be

modelled

with

formal

abstract

models

with

which

the

essential

behaviour

of

a

system

can

be

more

easily

verioed

Reachability

analysis

is

an

eOEcient

method

of

veriocation

for

distributed

systems

In

the

reachability

analysis

a

reachability

graph

of

an

abstract

model

of

the

system

is

generated

The

graph

consists

of

all

the

reachable

states

of

the

system

and

actions

leading

from

one

state

to

another

Using

the

reachability

analysis

it

is

easy

to

check

if

certain

properties

hold

in

the

system

or

ond

for

example

every

terminal

state

of

a

system

Unfortunately

reachability

graphs

of

many

practical

systems

are

intractably

large

-LRB-

state

space

explosion

-RRB-

The

number

of

reachable

states

grows

very

fast

with

respect

to

some

system

parameter

for

example

a

number

of

nodes

in

a

communication

network

Many

methods

have

been

proposed

with

which

a

partial

reachability

graph

can

be

used

in

the

veriocation

of

a

system

One

example

of

a

distributed

system

is

the

Frame

Synchronized

Ring

-LRB-

FSR

bus

-RRB-

-LSB-

-RSB-

The

FSR-bus

is

a

high

throughput

data

bus

for

high

speed

multiprocessor

applications

which

include

high

speed

packet

switching

real

time

video

compression

multimedia

coding

and

processing

of

security

algorithms

The

FSR-bus

has

been

developed

in

Telecommunications

Laboratory

of

Technical

Research

Centre

of

Finland

since

The

main

goal

of

the

research

program

is

to

develop

a

cost-eoeective

and

eOEcient

interconnection

network

that

could

be

used

in

many

high

speed

applications

In

this

work

the

medium

access

control

algorithm

-LRB-

MAC

algorithm

-RRB-

of

the

FSR-bus

is

modelled

and

analysed

with

predicate/transition

nets

-LRB-

Pr/T-nets

-RRB-

The

validation

and

performance

analysis

of

the

MAC

protocol

has

been

studied

with

analytical

models

and

simulations

However

the

complexity

of

the

protocol

makes

analytical

approaches

inaccurate

With

simulation

the

correctness

fairness

and

performance

of

the

FSR-bus

can

be

examined

in

a

natural

way

The

choice

between

dioeerent

operation

sequences

is

typically

random

so

the

errors

found

with

simulation

may

be

hard

to

locate

and

repeat

Furthermore

there

is

a

possibility

that

certain

types

of

errors

are

not

found

at

all

due

to

randomness

With

simulations

and

analytical

models

it

has

not

been

possible

to

prove

that

the

FSR-bus

does

not

deadlock

or

that

the

MAC

algorithm

is

fair

Pr/T-nets

ooeer

an

additional

way

to

study

the

correctness

and

fairness

of

the

FSR-bus

The

usefulness

of

Pr/T-nets

lies

in

the

ease

of

human

comprehension

of

graphic

description

and

sophisticated

theory

behind

the

nets

A

highly

advanced

reachability

analysis

tool

PROD

-LSB-

-RSB-

is

used

in

generating

the

reachability

graphs

of

predicate/transition

nets

PROD

has

been

developed

by

a

group

of

researchers

of

Digital

Systems

Laboratory

and

students

of

Helsinki

University

of

Technology

Many

reduction

methods

to

reduce

the

size

of

the

state

space

have

been

implemented

in

PROD

so

reachability

graphs

of

large

systems

can

be

generated

easily

and

fast

with

it

PROD

includes

a

graph

query

program

probe

with

which

queries

about

the

properties

of

the

system

can

be

made

With

probe

it

is

possible

to

search

for

nodes

or

event

sequences

satisfying

some

given

property

The

goals

of

this

work

include

the

following

ffl

An

abstract

Pr/T-net

model

of

the

FSR-bus

is

developed

With

reachability

analysis

and

PROD

terminal

nodes

of

the

system

are

searched

for

It

is

proved

that

the

FSR-bus

can

not

deadlock

The

number

of

nodes

in

the

FSR-bus

is

initially

two

and

is

increased

until

the

reachability

graph

contains

so

many

states

that

the

disk

space

-LRB-

Mbytes

-RRB-

runs

out

ffl

Because

the

size

of

the

reachability

graph

grows

very

fast

with

respect

to

the

number

of

nodes

in

the

bus

some

methods

are

used

to

reduce

the

size

of

the

reachability

graph

These

methods

include

stubborn

set

method

symmetry

method

and

bit

packing

Using

these

methods

the

size

of

the

reachability

graph

is

tried

to

be

reduced

so

that

the

number

of

nodes

in

the

bus

could

be

increased

in

the

analysis

It

is

examined

how

eoeectively

these

methods

work

in

practice

i.e.

how

much

space

and

time

they

need

to

generate

the

reduced

reachability

graphs

ffl

It

is

studied

whether

the

fairness

of

the

FSR-bus

can

be

proved

with

probe

queries

If

it

is

found

possible

the

queries

are

constructed

and

proofs

are

given

If

the

FSR-bus

is

fair

the

nodes

that

are

ready

to

send

get

always

access

to

the

bus

after

a

onite

waiting

time

ffl

If

the

fairness

of

the

FSR-bus

can

be

proved

actual

waiting

paths

of

the

nodes

are

examined

It

is

tried

to

ond

the

situation

in

which

a

node

has

the

longest

waiting

time

from

the

moment

it

gets

ready

to

send

to

the

moment

it

gets

access

to

the

bus

In

addition

it

is

studied

how

long

a

node

has

to

wait

in

the

worst

case

before

it

can

issue

a

service

request

if

the

bus

is

occupied

and

the

node

is

ready

to

send

The

correctness

of

the

FSR-bus

has

not

been

proved

yet

With

simulations

no

error

situations

have

been

found

but

there

is

still

a

possibility

that

the

bus

does

not

operate

in

a

proper

way

If

the

correctness

of

the

FSR-bus

i.e.

the

bus

is

fair

and

does

not

deadlock

can

be

proved

with

PROD

the

result

will

have

a

great

signiocance

The

bus

is

useless

in

most

applications

to

which

it

was

originally

developed

if

the

medium

access

control

algorithm

includes

errors

The

results

concerning

the

waiting

times

of

the

nodes

are

important

too

If

long

waiting

times

are

usual

in

the

bus

that

is

used

in

real

time

applications

lots

of

data

will

be

lost

or

at

least

delayed

In

Section

it

is

discussed

how

concurrent

and

distributed

systems

can

be

modelled

and

analysed

The

syntax

semantics

and

some

examples

of

the

abstract

model

used

in

this

work

Pr/T-nets

are

given

Stubborn

set

method

and

symmetry

method

that

are

used

to

avoid

the

state

space

explosion

are

presented

A

simple

example

of

their

usefulness

is

given

The

reachability

analysis

tool

PROD

and

its

features

are

presented

in

Section

It

is

explained

how

to

model

and

analyse

Pr/T-nets

with

PROD

The

basics

of

the

probe

graph

query

language

are

presented

and

examples

of

its

usage

are

given

Frame

Synchronization

Ring

is

presented

in

Section

The

structure

and

operation

of

the

bus

are

explained

The

AEow

diagram

of

the

medium

access

control

algorithm

of

the

bus

is

shown

The

Pr/T-net

model

of

the

FSR-bus

is

developed

in

Section

Two

dioeerent

models

are

developed

The

orst

one

is

basically

similar

to

the

MAC

protocol

of

the

FSR-bus

The

second

model

is

an

extension

of

a

basic

model

It

includes

credit

size

some

error

situations

and

retransmissions

of

packets

The

analysis

methods

and

results

are

presented

in

Section

A

source

listing

of

a

C

program

that

onds

the

longest

path

from

a

set

of

paths

generated

by

PROD

is

seen

in

Appendix

A

In

Appendix

B

a

PROD

net

description

of

the

predicate/transition

net

model

of

the

Frame

Synchronized

Ring

is

given

The

net

description

of

the

extended

model

of

the

bus

is

given

in

Appendix

C.

Modelling

and

Analysing

Concurrent

and

Dis

tributed

Systems

Concurrent

and

distributed

systems

consist

of

many

communicating

processes

or

processors

Frame

Synchronized

Ring

bus

-LRB-

FSR-bus

-RRB-

is

one

example

of

a

distributed

system

because

the

data

AEow

control

of

the

bus

is

distributed

among

the

nodes

connected

to

the

bus

When

the

number

of

processing

units

increases

it

becomes

too

complex

to

verify

the

operation

of

these

systems

without

any

abstract

formal

models

and

analysis

tools

Several

methods

have

been

developed

with

which

it

is

easy

to

model

concurrent

and

distributed

systems

and

verify

if

certain

properties

hold

in

abstract

models

of

these

systems

For

example

process

algebras

net

theory

and

speciocation

languages

are

widely

used

in

modelling

and

analysing

distributed

systems

In

this

work

predicate/transition

nets

-LRB-

Pr/T-nets

-RRB-

are

used

in

modelling

and

analysis

of

a

medium

access

control

algorithm

of

a

distributed

data

bus

The

usefulness

of

Pr/T-nets

lies

in

the

ease

of

human

comprehension

of

graphic

description

and

sophisticated

theory

behind

the

nets

which

enables

powerful

simulation

and

interpretation

methods

Syntax

of

Predicate/Transition

Nets

An

introduction

to

the

formalism

of

predicate/transition

nets

is

now

given

The

following

deonitions

are

based

on

the

deonitions

in

-LSB-

-RSB-

and

-LSB-

-RSB-

A

structure

is

a

tuple

of

objects

R

-LRB-

D

fk

Rn

-RRB-

where

D

is

a

non-empty

set

of

individuals

called

the

domain

or

carrier

of

R

the

fi

are

functions

in

D

and

the

Rj

are

relations

in

D

An

example

of

a

structure

is

the

structure

of

whole

numbers

which

is

denoted

by

Z

-LRB-

Z

:-RRB-

Note

that

the

domain

of

the

structure

is

often

denoted

by

the

same

letter

as

the

structure

In

this

work

no

other

structures

than

the

structure

of

whole

numbers

are

used

Deonition

For

each

n

a

set

of

n-ary

operators

-LRB-

function

symbols

-RRB-

and

a

set

of

n-ary

predicates

-LRB-

relation

symbols

-RRB-

of

the

structure

R

form

the

vocabulary

of

the

orst-order

language

L

that

consists

of

two

kinds

of

expressions

terms

and

formulae

A

set

of

well-formed

terms

is

denoted

by

Lt

and

a

set

of

well-formed

formulae

by

Lf

In

addition

there

is

a

set

of

variable

symbols

V

disjoint

from

operators

and

predicates

Expressions

are

built

in

the

following

way

Lt

ffl

A

variable

is

a

term

ffl

If

f

-LRB-

n

-RRB-

is

a

n-ary

operator

and

vn

are

terms

then

f

-LRB-

vn

-RRB-

is

a

term

ffl

No

other

expression

is

a

term

Lf

ffl

if

and

are

terms

then

is

an

atomic

formula

ffl

If

P

-LRB-

n

-RRB-

is

a

n-ary

predicate

and

vn

are

terms

then

vn

is

an

atomic

formula

ffl

If

and

are

formulae

then

and

-LRB-

-RRB-

are

formulae

ffl

If

x

is

a

variable

and

p

is

a

formula

then

-LRB-

-RRB-

p

is

a

formula

ffl

No

other

expression

is

a

formula

Deonition

If

L

is

a

orst-order

language

a

class

LC

-LRB-

n

-RRB-

of

symbolic

sums

of

tuples

of

length

n

for

each

n

is

deoned

in

the

following

way

ffl

The

constant

is

in

LC

-LRB-

n

-RRB-

ffl

If

vn

are

terms

then

the

n-tuple

vni

is

in

LC

-LRB-

n

-RRB-

ffl

If

are

in

LC

-LRB-

n

-RRB-

then

-LRB-

-RRB-

is

in

LC

-LRB-

n

-RRB-

ffl

If

l

is

in

LC

-LRB-

n

-RRB-

and

z

is

a

non-negative

integer

then

zl

is

in

LC

-LRB-

n

-RRB-

ffl

No

other

expression

is

in

LC

-LRB-

n

-RRB-

A

set

of

symbolic

sums

of

an

arbitrary

set

A

is

denoted

by

LC

-LRB-

A

-RRB-

The

set

of

all

onite

tuples

of

an

arbitrary

set

A

is

denoted

by

A

Sn

An

Now

the

deonition

of

predicate/transition

nets

is

given

Deonition

Let

L

be

a

orst-order

language

A

predicate/transition

net

-LRB-

Pr/T-net

-RRB-

is

a

NL

hN

A

where

ffl

N

is

an

underlying

directed

net

N

hS

T

F

i

where

S

is

a

set

of

places

T

is

a

set

of

transitions

-LRB-

S

T

;-RRB-

and

F

-LRB-

S

T

-RRB-

-LSB-

-LRB-

T

S

-RRB-

is

a

AEow

relation

from

places

to

transitions

and

conversely

ffl

A

is

the

annotation

of

N

A

-LRB-

AN

AS

AT

AF

-RRB-

where

AN

R

is

a

orst-order

structure

for

L

called

the

support

of

N

AS

is

a

bijection

between

the

set

of

places

and

the

set

of

variable

predicates

that

assigns

to

each

place

an

arity

The

arity

is

the

size

of

the

tuples

in

a

place

AT

T

Lf

assigns

to

each

transition

a

well-formed

formula

A

formula

is

called

a

oring

condition

-LRB-

selector

or

gate

of

the

transition

-RRB-

All

the

variables

that

are

outside

the

scope

of

quantioers

and

must

appear

in

some

symbolic

sum

that

AF

assigns

to

the

arc

that

hits

the

transition

AF

assigns

to

each

arc

a

symbolic

sum

of

tuples

of

terms

of

Lt.

The

arities

of

all

the

symbolic

sums

of

tuples

in

an

arc

must

equal

to

the

arity

of

a

place

which

the

arc

hits

ffl

S

LC

-LRB-

A?N

-RRB-

is

the

initial

marking

of

the

net

N

It

assigns

to

each

place

a

symbolic

sum

of

tuples

of

the

carrier

of

the

structure

AN

The

size

of

the

tuples

must

equal

to

the

arity

of

a

place

Graphically

places

are

represented

as

circles

transitions

as

boxes

and

the

AEow

relation

by

directed

arcs

between

the

respective

circles

and

boxes

Tuples

in

the

places

determine

the

arity

of

a

place

The

orst-order

logical

formulae

of

the

selectors

are

written

inside

the

boxes

Symbolic

sums

for

example

ha

bi

ha

yi

are

written

inside

the

circles

when

they

represent

markings

or

near

the

arcs

when

they

represent

arc

expressions

An

example

of

a

Pr/T-net

is

seen

in

Figure

In

Figure

a

Pr/T-net

model

of

an

incorrect

solution

to

the

dining

philosophers

problem

of

three

philosophers

is

shown

In

this

problem

there

are

some

philosophers

sitting

and

thinking

around

a

table

Eventually

each

of

the

philosophers

will

become

hungry

In

order

to

eat

a

philosopher

needs

two

forks

Between

every

two

philosophers

there

is

a

fork

so

every

philosopher

can

not

eat

simultaneously

Every

philosopher

has

access

only

to

the

fork

on

his

left

hand

side

and

the

one

on

his

right

hand

side

The

problem

is

to

ond

a

protocol

which

every

philosopher

obeys

and

according

to

which

thinking

and

eating

alternate

smoothly

The

problem

is

similar

to

that

where

some

processes

use

some

scarce

resources

so

that

every

process

can

not

have

access

to

the

resources

simultaneously

The

incorrect

solution

seen

in

Figure

goes

as

follows

Initially

every

philosopher

is

thinking

The

symbolic

sum

of

tuples

of

arity

one

in

places

thinking

and

forks

indicates

that

initially

every

philosopher

is

thinking

and

no

forks

have

been

taken

Because

every

philosopher

is

initially

thinking

places

eating

and

withLeft

are

empty

When

a

philosopher

gets

hungry

he

orst

takes

a

fork

on

his

left

hand

side

unless

another

philosopher

has

taken

it

before

him

The

symbolic

sum

hxi

near

the

arcs

that

hit

the

transition

takeLeft

indicates

that

a

philosopher

number

x

tries

to

get

a

fork

number

x

After

the

philosopher

has

successfully

got

the

fork

he

tries

to

get

the

fork

on

his

right

hand

side

-LRB-

a

fork

number

-LRB-

x

-RRB-

mod

-RRB-

When

he

has

got

two

forks

he

begins

to

eat

After

eating

a

philosopher

puts

two

forks

he

has

used

back

onto

the

table

and

begins

to

think

again

The

modulo

operator

is

denoted

by

j

hxi

inside

the

circles

of

the

net

represents

the

action

of

the

philosopher

number

x

If

the

philosopher

x

is

eating

place

eating

contains

hxi

-LRB-

and

possible

some

other

tuples

-RRB-

Note

that

empty

symbolic

sums

in

a

marking

and

tautologies

in

a

selector

-LRB-

for

example

x

x

in

a

transition

takeLeft

in

Figure

-RRB-

are

usually

omitted

in

the

graphical

presentation

of

a

Pr/T-net

thinkingwithLefteatingforkstakeRightputDowntakeLeft

<x>

<x>

<x>

<x>

<x>

<x>

x

-LRB-

x

-RRB-

-LRB-

x

-RRB-

<x>

Figure

Pr/T-net

of

the

dining

philosophers

problem

of

three

philosophers

Analysis

of

Predicate/Transition

Nets

Reachability

analysis

is

a

powerful

method

of

veriocation

for

concurrent

and

distributed

systems

With

reachability

analysis

it

is

easy

to

check

if

a

system

has

any

terminal

nodes

or

if

certain

properties

hold

in

a

system

Reachability

analysis

is

based

on

generating

the

reachability

graph

for

a

formal

model

of

a

system

-LRB-

for

example

a

Pr/T-net

-RRB-

The

reachability

graph

consists

of

a

set

of

vertices

V

and

a

set

of

edges

E.

Vertices

are

all

the

states

reachable

from

the

initial

state

of

the

system

and

the

edges

are

the

actions

leading

from

one

state

to

another

In

this

work

the

semantics

for

the

Pr/T-nets

is

deoned

by

a

reachability

graph

with

single

transition

steps

That

means

interleaving

semantics

is

used

x

x

x

x

x

x

x

x

x

x

x

x

x

x

x

x

x

x

x

x

x

x

-LCB-

t

f

-RCB-

-LCB-

t

w

f

-RCB-

-LCB-

t

w

f

-RCB-

-LCB-

t

w

f

-RCB-

-LCB-

t

e

f

-RCB-

-LCB-

t

w

f

-RCB-

-LCB-

t

w

f

-RCB-

-LCB-

t

e

f

-RCB-

-LCB-

t

w

f

-RCB-

-LCB-

t

w

e

-RCB-

-LCB-

t

e

f

-RCB-

-LCB-

t

w

e

-RCB-

-LCB-

w

-RCB-

-LCB-

t

w

e

-RCB-

Figure

Reachability

graph

of

the

Pr/T-net

of

the

dining

philosophers

problem

The

following

deonitions

concerning

the

reachability

graph

of

the

Pr/T-nets

are

based

on

the

deonitions

in

-LSB-

-RSB-

and

-LSB-

-RSB-

If

a

formula

E

has

variables

outside

the

scope

of

quantioers

and

it

is

called

open

and

otherwise

closed

or

a

proposition

The

occurrences

of

variables

in

a

single

term

are

always

outside

the

scope

of

quantioers

and

such

a

term

is

always

open

Closed

terms

are

compound

names

of

individuals

Variables

that

are

outside

the

scope

of

quantioers

are

called

free

and

can

be

replaced

by

terms

in

expressions

Deonition

Let

xn

vn

be

a

substitution

where

xi

are

variables

and

vi

are

terms

If

E

is

an

expression

E

E

xn

vng

designates

the

result

when

every

free

occurrence

of

xi

is

substituted

by

vi

in

an

expression

E.

E

is

called

the

instance

of

E.

Any

closed

expression

E

has

an

interpretation

R

-LRB-

E

-RRB-

that

is

determined

by

the

interpretation

of

its

subexpressions

terms

operators

predicates

and

constants

The

structure

R

assigns

to

each

closed

term

an

individual

of

R

and

to

each

closed

formula

the

truthvalue

-LRB-

true

or

false

-RRB-

For

example

in

the

structure

Z

the

interpretation

of

an

constant

is

Z

-LRB-

-RRB-

which

is

and

the

interpretation

of

an

expression

-LRB-

-RRB-

is

Z

-LRB-

-RRB-

which

is

false

Deonition

If

every

operator

fm

and

every

predicate

Pn

of

orst-order

language

L

denotes

an

m-ary

function

of

the

structure

R

designated

by

fR

and

n-ary

relation

of

the

structure

R

designated

by

PR

respectly

a

structure

R

is

called

a

structure

for

L

or

a

L-structure

Deonition

Let

L

be

a

orst-order

language

R

a

L-structure

and

OE

a

formula

of

L.

OE

is

said

to

be

valid

in

R

if

and

only

if

each

closed

instance

of

OE

is

true

in

R

That

is

denoted

by

R

j

OE

For

example

in

the

structure

of

whole

numbers

Z

j

-LRB-

-RRB-

Deonition

If

R

j

-LRB-

AT

-LRB-

t

-RRB-

-RRB-

-LRB-

an

expression

which

is

the

result

when

all

the

free

variables

in

the

oring

condition

of

the

transition

t

are

substituted

by

is

true

in

the

L-structure

of

R

-RRB-

and

the

closed

arc

expression

AF

-LRB-

s

t

-RRB-

and

AF

-LRB-

t

s

-RRB-

have

an

interpretation

the

instance

of

the

transition

t

is

called

feasible

Let

be

a

substitution

x

Then

the

instance

of

a

transition

takeLeft

of

the

Pr/T-net

in

Figure

is

feasible

because

Z

j

-LRB-

x

x

-RRB-

-LRB-

x

-RRB-

Furthermore

all

arc

expressions

of

those

arcs

that

hit

the

transition

have

an

interpretation

which

is

Deonition

Let

N

be

a

Pr/T-net

M

and

t

its

marking

and

its

transition

respectly

and

a

substitution

of

t

At

marking

M

a

feasible

instance

t

is

enabled

denoted

by

M

-LSB-

t

i

if

S

-LSB-

R

-LRB-

AF

-LRB-

s

t

-RRB-

-RRB-

R

-LRB-

M

-LRB-

s

-RRB-

-RRB-

R

-LRB-

AF

-LRB-

t

s

-RRB-

-RRB-

R

-LRB-

M

-LRB-

s

-RRB-

-RRB-

-LRB-

-RRB-

In

Figure

a

feasible

instance

-LRB-

x

x

-RRB-

-LRB-

x

-RRB-

of

the

transition

takeLeft

is

enabled

in

the

initial

marking

because

for

every

input

place

of

the

transition

and

for

every

output

place

of

the

transition

For

other

places

equation

-LRB-

-RRB-

holds

because

an

empty

set

is

a

subset

of

an

empty

set

and

intersection

of

an

empty

set

and

an

arbitrary

set

is

an

empty

set

Deonition

Let

N

be

a

Pr/T-net

M

and

M

its

markings

t

its

transition

and

t

a

feasible

instance

of

t

An

instance

t

enabled

at

M

can

ore

to

marking

M

denoted

by

M

-LSB-

t

iM

if

S

R

-LRB-

M

-LRB-

s

-RRB-

-RRB-

R

-LRB-

M

-LRB-

s

-RRB-

-RRB-

nR

-LRB-

AF

-LRB-

s

t

-RRB-

-RRB-

-LSB-

R

-LRB-

AF

-LRB-

t

s

-RRB-

-RRB-

-LRB-

-RRB-

If

the

enabled

instance

-LRB-

x

x

-RRB-

-LRB-

x

-RRB-

of

the

transition

takeLeft

is

ored

in

the

initial

marking

of

the

net

in

Figure

a

new

marking

is

reached

at

which

is

removed

from

places

thinking

and

forks

and

added

to

the

place

withLeft

Now

a

reachability

graph

of

a

Pr/T-net

can

be

deoned

Deonition

The

reachability

graph

of

a

Pr/T-net

is

a

hV

Ei

where

V

is

the

set

of

vertices

and

E

is

the

set

of

edges

The

initial

marking

V

If

M

V

and

M

-LSB-

t

iM

then

M

V

and

hM

t

ff

M

i

E

There

are

no

other

elements

in

V

and

E

The

deadlock

or

the

terminal

node

in

the

reachability

graph

is

deoned

as

follows

Deonition

A

marking

M

is

dead

if

T

of

the

feasible

instance

t

is

enabled

-LRB-

M

-LSB-

t

i

-RRB-

The

vertex

representing

the

dead

marking

in

the

reachability

graph

is

called

a

terminal

node

or

a

deadlock

In

Figure

the

reachability

graph

of

the

Pr/T-net

in

Figure

is

seen

The

graph

has

vertices

and

edges

Note

the

terminal

node

where

every

philosopher

has

taken

the

fork

from

his

left

hand

side

So

the

marking

in

the

terminal

node

is

fwithLeft

of

the

transitions

is

enabled

because

places

forks

and

eating

are

empty

State

Space

Explosion

The

main

problem

with

reachability

analysis

is

state

space

explosion

The

size

of

the

state

space

may

grow

faster

than

exponentially

with

respect

to

the

size

of

a

system

conoguration

If

the

main

purpose

of

the

analysis

is

to

search

for

terminal

nodes

it

is

not

necessary

to

generate

the

complete

state

space

Many

methods

have

been

proposed

to

avoid

generating

the

complete

state

space

Two

methods

used

in

this

work

are

symmetry

method

-LSB-

-RSB-

and

Antti

Valmari

's

stubborn

set

method

-LSB-

-RSB-

These

methods

generate

a

reduced

reachability

graph

of

place/transition

nets

-LRB-

P/T-nets

-RRB-

which

are

low-level

Petri

nets

Every

Pr/T-net

can

be

represented

by

an

equivalent

P/T

net

When

the

symmetry

method

or

the

stubborn

set

method

are

applied

to

Pr/T-nets

a

Pr/T-net

is

unfolded

into

a

P/T-net

either

method

is

applied

to

a

P/T-net

and

the

state

space

information

of

the

reachability

graph

of

the

P/T-net

is

folded

back

into

the

Pr/T-net

level

In

Section

it

is

explained

how

a

Pr/T-net

is

unfolded

into

a

P/T-net

Stubborn

Set

Method

In

the

stubborn

set

method

the

number

of

the

states

inspected

during

the

generation

of

the

state

space

is

tried

to

be

reduced

while

still

onding

all

terminal

states

The

deonition

of

stubborness

is

given

in

-LSB-

-RSB-

Stubborn

set

is

a

subset

of

enabled

transitions

in

a

marking

Rather

than

oring

all

enabled

transitions

only

those

transitions

that

belong

to

the

stubborn

set

are

ored

So

if

the

stubborn

sets

include

only

a

few

of

all

enabled

transitions

oring

of

the

transitions

of

a

set

does

not

generate

as

many

successor

markings

as

oring

of

all

enabled

transitions

In

that

way

the

state

space

is

tried

to

be

reduced

The

idea

behind

the

stubborn

set

method

is

the

following

In

a

marking

M

the

set

of

transitions

T

is

tried

to

be

partitioned

into

two

sets

Ts

-LRB-

stubborn

set

-RRB-

and

T

s

-LRB-

dioeerence

of

the

set

of

all

transitions

of

the

net

and

the

stubborn

set

-RRB-

In

Ts

there

must

be

at

least

one

enabled

transition

t

and

any

path

oe

-LRB-

T

s

-RRB-

must

be

enabled

in

the

marking

M

Sets

should

be

constructed

so

that

the

transition

t

and

the

path

oe

commute

in

such

a

way

that

from

the

marking

M

it

is

possible

to

get

to

the

marking

M

by

orst

oring

the

transition

t

and

then

all

the

transitions

in

the

path

oe

or

by

orst

oring

all

the

transitions

in

oe

and

then

oring

the

transition

t

If

furthermore

it

can

be

guaranteed

that

oring

any

path

oe

T

s

can

not

enable

any

transition

in

the

set

Ts

there

is

no

need

to

generate

the

internal

markings

on

path

from

M

to

M

where

all

the

transitions

in

the

path

oe

are

ored

orst

and

then

the

transition

t

is

ored

If

a

terminal

node

can

be

found

by

generating

such

a

path

it

can

be

found

by

oring

some

enabled

transition

t

Ts

The

eOEciency

of

the

stubborn

set

method

depends

how

eoeectively

stubborn

sets

can

be

computed

in

markings

of

a

net

Several

algorithms

to

compute

the

set

of

enabled

transitions

of

a

stubborn

set

have

been

developed

Faster

algorithms

do

not

reduce

the

state

space

as

much

as

slower

algorithms

but

they

compute

the

stubborn

sets

more

quickly

In

this

work

the

eoeective

reduction

of

state

space

is

preferred

to

the

short

computation

time

That

is

why

the

so

called

deletion

algorithm

-LSB-

-RSB-

is

used

The

deletion

algorithm

onds

the

minimal

stubborn

set

in

the

sense

that

no

proper

subset

of

its

enabled

transitions

can

be

the

set

of

all

enabled

transitions

of

any

stubborn

set

in

time

O

-LRB-

aejT

-RRB-

where

T

is

the

set

of

transitions

-LRB-

jT

j

is

the

number

of

transitions

in

a

set

T

-RRB-

is

the

maximum

number

of

input

places

of

a

transition

and

ae

is

the

maximum

number

of

adjacent

transitions

of

a

place

-LSB-

-RSB-

Because

deletion

algorithm

onds

the

minimal

stubborn

set

the

reachability

graph

should

be

small

Stubborn

set

method

does

not

always

work

eOEciently

The

reachability

graph

of

the

Pr/T-net

in

the

Figure

generated

by

using

deletion

algorithm

in

computing

the

stubborn

sets

has

vertices

and

edges

Only

the

number

of

edges

could

be

reduced

in

this

case

x

-LCB-

t

f

-RCB-

-LCB-

t

w

f

-RCB-

x

x

x

x

-LCB-

t

e

f

-RCB-

-LCB-

t

w

f

-RCB-

x

x

-LCB-

t

w

e

-RCB-

-LCB-

w

-RCB-

x

x

Figure

Reachability

graph

of

the

Pr/T

in

Figure

generated

by

using

the

symmetry

method

Symmetry

Method

In

symmetry

method

one

marking

in

the

reachability

graph

represents

an

equivalence

class

of

markings

The

equivalence

classes

are

generated

by

an

equivalence

relation

that

is

called

a

symmetry

The

size

of

the

reachability

graph

can

often

be

signiocantly

reduced

because

many

concurrent

and

distributed

systems

are

fully

symmetrical

However

the

time

needed

to

generate

the

graph

may

not

decrease

at

all

since

the

time

saved

in

generating

the

smaller

reachability

graph

is

lost

in

computing

the

symmetries

The

reachability

graph

of

the

Pr/T-net

of

dining

philosophers

generated

by

using

the

symmetry

method

is

seen

in

Figure

The

number

of

vertices

and

edges

is

clearly

smaller

than

in

the

complete

state

space

reachability

graph

in

Figure

In

-LSB-

-RSB-

ove

dioeerent

types

of

symmetries

among

markings

have

been

presented

identity

shift

permutation

related

and

product

In

addition

to

the

identity

symmetry

two

symmetries

have

been

used

in

the

graph

of

Figure

The

orst

one

is

a

shift

in

which

a

philosopher

and

a

fork

number

n

are

described

by

a

philosopher

and

a

fork

number

-LRB-

n

-RRB-

mod

n

and

the

other

is

a

shift

where

a

philosopher

and

a

fork

number

n

are

described

by

a

philosopher

and

a

fork

number

-LRB-

n

-RRB-

mod

n.

For

example

all

the

markings

ft

w

f

ft

w

f

ft

w

f

belong

to

the

same

equivalence

class

which

the

marking

ft

w

f

represents

Reachability

Analysis

Tool

PROD

The

generation

of

the

reachability

graph

of

a

Pr/T-net

can

be

easily

automated

Advanced

automatic

analysis

tools

generate

a

graph

consisting

of

thousands

of

reachable

markings

in

a

few

second

With

good

analysis

tools

it

is

possible

to

interpret

the

state

space

Terminal

nodes

event

sequences

that

lead

from

the

initial

state

to

the

terminal

state

and

paths

satisfying

a

given

property

can

be

searched

for

General

about

PROD

PROD

-LSB-

-RSB-

is

a

highly

advanced

reachability

analysis

tool

for

predicate/transition

nets

It

has

been

developed

by

a

group

of

researchers

of

Digital

Systems

Laboratory

and

students

of

Helsinki

University

of

Technology

since

PROD

is

continuously

developed

and

new

features

are

added

to

it

PROD

has

a

graphical

Pr/T-net

editor

with

which

nets

can

be

drawn

easily

PROD

automatically

generates

the

reachability

graph

of

the

Pr/T-net

drawn

with

the

editor

Both

symmetry

method

and

stubborn

set

method

are

implemented

in

PROD

which

makes

it

a

powerful

analysis

tool

PROD

has

a

rich

query

language

for

inspecting

the

reachability

graph

With

query

language

states

or

paths

satisfying

given

properties

can

be

found

PROD

is

one

of

the

most

advanced

Pr/T-net

analysis

tools

in

the

world

Using

PROD

PROD

consists

of

a

graphical

Pr/T-net

editor

pred

net

description

language

preprocessor

prpp

a

program

computing

the

strongly

connected

components

of

the

reachability

graph

called

strong

a

graph

query

program

probe

and

a

batch

program

prod

PROD

is

the

name

of

the

whole

analysis

tool

prod

is

a

part

of

it

A

predicate/transition

net

that

is

analysed

is

drawn

with

pred

An

example

net

of

a

dining

philosophers

problem

is

seen

in

Figure

The

Pr/T-net

is

compiled

into

the

net

description

language

of

PROD

which

is

the

C

preprocessor

language

extended

with

net

description

directives

The

net

description

of

the

Pr/T-net

in

Figure

is

seen

below

Places

and

their

initial

markings

transitions

and

their

input

and

output

AEow

and

oring

conditions

-LRB-

gates

-RRB-

of

the

net

can

be

found

in

the

net

description

Empty

markings

and

tautologies

in

gates

are

not

seen

in

the

net

description

The

high

and

low

limits

of

the

tuples

of

the

places

must

be

given

-LRB-

-RRB-

is

an

abbreviation

of

the

symbolic

sum

when

N

is

three

The

number

of

philosophers

N

can

be

set

to

an

arbitrary

integer

value

without

changing

the

whole

net

description

The

net

description

is

compiled

into

an

executable

program

When

a

program

is

executed

it

generates

the

reachability

graph

of

the

net

With

command

line

options

stubborn

set

method

or

symmetry

method

can

be

applied

With

strong

the

strongly

connected

components

of

the

graph

can

be

computed

and

with

probe

queries

about

the

properties

of

the

graph

can

be

made

#define

N

#place

thinking

lo

-LRB-

-RRB-

hi

-LRB-

-LRB-

-RRB-

-RRB-

mk

-LRB-

-LRB-

-RRB-

-RRB-

#place

withLeft

lo

-LRB-

-RRB-

hi

-LRB-

-LRB-

-RRB-

-RRB-

#place

eating

lo

-LRB-

-RRB-

hi

-LRB-

-LRB-

-RRB-

-RRB-

#place

forks

lo

-LRB-

-RRB-

hi

-LRB-

-LRB-

-RRB-

-RRB-

mk

-LRB-

-LRB-

-RRB-

-RRB-

#trans

takeRight

in

-LCB-

withLeft

x.

forks

-LRB-

x

-RRB-

N.

-RCB-

out

-LCB-

eating

x.

-RCB-

#endtr

#trans

putDown

in

-LCB-

eating

x.

-RCB-

out

-LCB-

thinking

x.

forks

x.

-LRB-

x

-RRB-

N.

-RCB-

#endtr

#trans

takeLeft

in

-LCB-

thinking

x.

forks

x.

-RCB-

out

-LCB-

withLeft

x.

-RCB-

#endtr

x.

x.

x.

x.

x.

x.

x.

-LRB-

x

-RRB-

-LRB-

x

-RRB-

x.

Figure

Pr/T-net

of

the

dining

philosophers

problem

drawn

with

pred

Reachability

Graph

Generation

There

are

dioeerent

alternatives

how

a

reachability

graph

of

a

Pr/T-net

can

be

generated

with

PROD

It

is

possible

to

generate

the

complete

reachability

graph

stubborn

set

method

with

incremental

and

deletion

algorithms

or

symmetry

method

can

be

applied

The

incremental

algorithm

is

faster

than

the

deletion

algorithm

however

the

stubborn

sets

produced

by

it

may

contain

unnecessarily

many

enabled

transitions

Before

PROD

uses

stubborn

set

or

symmetry

method

it

unfolds

the

Pr/T-net

into

a

place/transition

net

-LRB-

P/T-net

-RRB-

PROD

applies

the

methods

to

the

P/T

net

and

probe

folds

the

information

of

the

reachability

graph

of

the

P/T-net

back

to

the

Pr/T-net

level

Predicate/transition

nets

can

be

thought

of

as

an

compressed

representation

of

equivalent

P/T-nets

In

P/T-nets

markings

are

represented

by

tokens

which

do

not

have

any

internal

structure

Every

arc

of

a

P/T-net

has

an

arc

weight

and

every

place

has

a

capacity

Arc

weight

indicates

how

many

tokens

are

swallowed

from

a

place

or

produced

to

a

place

when

a

transition

ores

Capacity

is

the

maximum

number

of

tokens

that

a

place

can

have

At

marking

M

the

transition

t

is

enabled

if

and

only

if

in

all

input

places

s

of

t

the

number

of

tokens

is

at

least

the

arc

weight

of

an

arc

leading

from

s

to

t

and

in

all

output

places

of

t

the

number

of

tokens

is

at

most

the

dioeerence

between

the

capacity

of

place

and

the

arc

weight

of

the

arc

leading

from

t

to

A

Pr/T-net

is

unfolded

to

a

P/T-net

in

the

following

way

ffl

For

every

place

of

the

Pr/T-net

as

many

places

are

generated

as

is

the

number

tuples

in

that

place

In

the

example

net

every

place

can

have

three

tuples

the

arity

of

which

are

So

the

unfolded

Pr/T-net

has

places

ffl

For

every

feasible

instance

of

every

transition

of

the

Pr/T-net

a

transition

and

arcs

are

generated

The

symbolic

sums

determine

the

arc

weights

There

are

three

substitutions

-LRB-

x

x

x

-RRB-

which

can

be

applied

to

every

transition

of

the

Pr/T-net

So

the

number

of

transitions

in

the

P/T-net

is

A

AEow

from

places

to

transitions

and

conversely

consists

of

which

are

substituted

by

a

constant

or

In

the

P/T-net

a

constant

can

be

replaced

by

a

single

token

because

the

number

of

the

philosopher

is

determined

by

the

transitions

the

philosopher

ores

So

every

arc

weight

is

ffl

The

initial

marking

of

the

Pr/T-net

determines

the

number

of

tokens

in

places

of

the

P/T-net

In

the

initial

marking

of

the

P/T-net

places

that

indicate

that

initially

all

philosophers

are

thinking

and

of

the

forks

is

in

use

have

a

token

ffl

Such

transitions

and

places

of

the

P/T-net

are

removed

to

which

there

is

not

a

directed

path

from

a

place

that

has

one

or

more

tokens

in

the

initial

marking

or

from

a

transition

that

has

no

input

places

In

Figure

the

unfolded

Pr/T-net

of

the

dining

philosophers

problem

is

seen

The

number

of

places

and

transitions

has

been

tripled

with

respect

to

the

number

of

places

and

transitions

of

the

Pr/T-net

Query

Language

The

reachability

graph

of

the

Pr/T-net

generated

by

PROD

can

be

examined

with

probe

Below

a

few

examples

of

simple

probe

queries

about

the

dining

philosophers

net

are

seen

The

prompt

of

probe

consists

of

the

number

of

current

node

followed

by

A

node

in

the

reachability

graph

is

a

reachable

marking

of

the

net

It

is

possible

to

go

to

any

node

in

the

graph

with

the

command

goto

and

to

look

what

marking

the

node

represents

with

the

command

look

The

orst

node

is

of

course

the

initial

marking

of

the

net

where

every

philosopher

is

thinking

and

all

three

forks

are

available

With

succ

command

the

enabled

transitions

and

successor

nodes

of

the

current

node

are

seen

There

are

three

possibilities

to

choose

a

successor

arrow

in

the

initial

node

Below

arrow

is

chosen

so

x

is

substituted

by

constant

and

the

transition

takeLeft

is

ored

After

oring

the

current

marking

changes

Figure

P/T-net

of

the

dining

philosophers

problem

#look

Node

belongs

to

strongly

connected

component

thinking

forks

#succ

Arrow

transition

takeLeft

precedence

class

x

to

node

Arrow

transition

takeLeft

precedence

class

x

to

node

Arrow

transition

takeLeft

precedence

class

x

to

node

Node

has

successor

arrows

#next

#look

Node

belongs

to

strongly

connected

component

thinking

withLeft

forks

With

statistics

useful

information

about

the

reachability

graph

can

be

seen

Number

of

nodes

is

the

number

of

generated

nodes

in

the

graph

Every

reachable

marking

is

not

necessarily

generated

because

the

graph

generation

can

be

interrupted

and

partial

reachability

graphs

can

be

examined

too

A

real

arrow

corresponds

to

a

ored

instance

of

a

non-fact

transition

A

node

is

terminal

if

it

does

not

have

any

successor

arrows

A

fact

arrow

corresponds

to

an

instance

of

a

fact

transition

Fact

transitions

are

used

to

present

undesirable

situations

so

enabled

instance

of

a

fact

transition

is

undesirable

In

the

Pr/T-net

of

dining

philosophers

no

fact

transitions

are

used

A

node

has

been

completely

processed

if

all

its

immediate

successor

arrows

are

created

A

graph

is

strongly

connected

if

and

only

if

there

is

a

path

from

each

node

to

all

other

nodes

From

terminal

node

there

is

not

a

path

to

any

node

so

the

number

of

strongly

connected

components

is

in

the

example

net

A

terminal

strongly

connected

component

is

trivial

if

and

only

if

it

is

a

terminal

node

or

the

whole

graph

showends

returns

the

marking

representing

the

terminal

node

#statistics

Number

of

nodes

Number

of

-LRB-

real

-RRB-

arrows

Number

of

terminal

nodes

Number

of

fact

arrow

source

nodes

Number

of

fact

arrows

Number

of

nodes

that

have

been

completely

processed

Number

of

strongly

connected

components

Number

of

nontrivial

terminal

strongly

connected

components

#showends

Node

belongs

to

strongly

connected

component

withLeft

path

end

nodes

#succ

Node

has

successor

arrows

With

query

command

nodes

and

paths

satisfying

given

properties

can

be

searched

for

In

the

orst

query

below

probe

searches

for

nodes

in

which

place

eating

is

empty

The

second

query

is

similar

to

the

orst

one

except

a

set

is

not

built

-LRB-

volatile

has

been

added

into

the

query

-RRB-

Queries

can

be

extended

to

multiple

lines

by

typing

n

at

the

end

of

each

line

The

verbosity

level

of

the

query

can

be

chosen

by

options

mute

verbose

and

superverbose

Finally

all

such

paths

from

the

initial

node

to

the

terminal

node

in

which

the

place

eating

is

empty

are

searched

for

The

paths

consist

of

markings

and

arrow

numbers

between

them

#query

node

eating

empty

paths

Built

set

#query

mute

volatile

node

eating

empty

paths

#query

dpath

-LRB-

eating

empty

false

-RRB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

paths

Built

set

Inonite

event

sequences

can

be

detected

with

dspan

and

dpath

queries

The

query

dspan

-LRB-

OE

true

-RRB-

false

returns

paths

in

every

node

of

which

formula

OE

is

true

and

which

have

an

end

cycle

dpath

-LRB-

OE

true

-RRB-

false

returns

all

such

paths

dspan

ignores

alternative

routes

but

is

guaranteed

to

detect

all

those

cycles

that

dpath

detects

Below

paths

which

contain

a

cycle

and

in

which

a

philosopher

number

is

continuously

thinking

are

detected

with

dspan

and

dpath

field

-LSB-

-RSB-

refers

to

the

orst

oeld

in

the

tuple

which

is

the

number

of

the

philosopher

in

the

example

#query

dspan

-LRB-

-LRB-

-LRB-

-LRB-

thinking

-RRB-

-LRB-

field

-LSB-

-RSB-

-RRB-

-RRB-

empty

-RRB-

true

-RRB-

false

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

-LSB-

paths

Built

set

#query

mute

dpath

-LRB-

-LRB-

-LRB-

-LRB-

thinking

-RRB-

-LRB-

field

-LSB-

-RSB-

-RRB-

-RRB-

empty

-RRB-

true

-RRB-

false

paths

Built

set

To

get

more

information

about

PROD

or

probe

see

-LSB-

-RSB-

Frame

Synchronized

Ring

The

Frame

Synchronized

Ring

-LRB-

FSR-bus

-RRB-

-LSB-

-RSB-

is

a

high

throughput

parallel

data

bus

which

is

developed

for

high

speed

multiprocessor

applications

in

a

research

project

in

the

Telecommunications

Laboratory

of

the

Technical

Research

Centre

of

Finland

In

the

future

real

time

network

applications

demand

more

and

more

computation

power

from

the

software

and

hardware

operating

with

the

applications

To

achieve

the

increasing

computing

demands

many

processors

have

to

be

connected

together

and

the

computation

have

to

be

parallelized

The

FSR-bus

is

a

high

throughput

solution

with

the

aid

of

which

the

processing

bottleneck

is

tried

to

be

removed

Areas

to

which

the

FSR-bus

will

be

applied

include

high

speed

packet

switching

in

computer

networks

multimedia

coding

real

time

video

compression

and

real

time

processing

of

security

algorithms

Structure

of

the

Bus

The

FSR-bus

belongs

to

the

category

of

slotted

rings

with

destination

release

policy

The

FSR-bus

consists

of

a

number

of

nodes

connected

together

with

a

parallel

data

bus

In

addition

to

the

data

bus

three

control

lines

connect

the

nodes

together

bus

clock

frame

synchronization

line

and

request

line

The

basic

structure

of

the

FSR-bus

is

seen

in

Figure

-LSB-

-RSB-

The

nodes

consist

of

a

ring

interface

with

receive

and

transmit

buoeers

Peripherals

that

use

the

bus

are

attached

to

the

nodes

through

a

interface

control

unit

Interface

control

units

are

implemented

using

programmable

gate

arrays

All

the

signals

in

the

data

bus

and

control

lines

are

synchronized

by

the

bus

clock

The

bus

clock

signal

is

fed

either

parallel

to

the

bus

as

in

Figure

or

directly

from

the

timing

block

to

every

node

Frame

synchronization

signal

is

used

as

an

indication

of

the

beginning

of

the

frame

The

nodes

send

requests

to

transmit

in

the

request

line

Note

that

the

transmit

direction

of

the

requests

is

opposite

to

that

of

the

data

bus

and

other

control

signals

The

frames

transmitted

by

the

nodes

consist

of

L

time

slots

Every

time

slot

is

as

many

bits

wide

as

there

are

parallel

lines

in

the

data

bus

The

optimum

number

of

time

slots

in

the

frame

equals

to

the

number

of

nodes

connected

to

the

bus

The

frames

are

transmitted

one

time

slot

at

a

time

controlled

by

the

bus

clock

The

time

period

that

it

takes

from

a

time

slot

to

get

from

an

output

of

one

node

to

the

output

of

the

next

node

is

called

a

bus

cycle

The

bus

timing

signals

-LSB-

-RSB-

are

shown

in

Figure

When

a

node

has

data

to

transmit

it

has

to

wait

for

the

frame

synchronization

signal

-LRB-

frame

pulse

-RRB-

before

it

can

start

the

transmission

The

frame

synchronization

signal

indicates

the

start

of

the

frame

and

it

circulates

around

the

ring

parallel

with

the

NODE

NODE

NODE

NODE

NODE

NODENODENODE

TIMING

BLOCK

FRAME

SYNC

LINE

N

BITS

WIDE

DATA

BUS

BUS

CLOCK

REQUEST

LINE

Figure

Block

diagram

of

the

FSR-bus

orst

time

slot

of

the

frame

First

time

slots

are

darkened

in

Figure

Frames

consist

of

seven

time

slots

Frame

Structure

The

frames

of

the

FSR-bus

are

constituted

of

oelds

The

size

of

the

oeld

in

time

slots

depends

on

the

application

The

orst

oeld

in

the

frame

is

reserved

for

the

protocol

control

information

Other

oelds

include

user

data

Depending

on

the

application

the

last

oeld

of

the

frame

can

include

user

data

or

control

information

In

the

noisy

environments

the

last

oeld

of

every

frame

could

include

for

example

the

frame

check

sequence

The

frame

structure

of

the

FSR-bus

is

seen

in

Figure

-LSB-

-RSB-

The

orst

oeld

in

the

frame

is

called

a

header

and

is

divided

into

several

TIME

SLOTS

BUS

CLOCK

FRAME

PULSES

Figure

Bus

timing

signals

suboelds

When

a

frame

passes

the

node

the

node

makes

the

decision

if

it

can

send

its

own

data

in

that

frame

by

examining

the

bits

in

the

header

The

orst

bit

in

the

header

indicates

if

the

incoming

frame

is

occupied

or

empty

If

the

same

frame

is

transmitted

to

more

than

one

node

the

group/single

bit

is

set

When

a

number

of

rings

are

connected

together

and

a

node

wants

to

send

data

to

the

node

connected

to

some

other

ring

ring

address

bits

are

used

The

transmitting

node

sets

the

address

of

the

receiver

into

destination/group

address

bits

The

source

address

suboeld

includes

the

address

of

the

sender

of

the

frame

When

a

frame

is

transmitted

from

one

ring

to

another

the

source

address

is

replaced

by

the

address

of

the

node

that

connects

the

rings

When

a

node

receives

a

frame

the

source

address

of

which

is

its

own

address

it

removes

the

frame

from

the

ring

In

that

way

frames

the

reception

of

which

are

failed

are

prevented

from

traveling

in

the

ring

forever

With

retransmit

bit

the

receiver

can

prevent

the

sender

from

removing

the

frame

If

the

receiver

is

temporarily

incapable

of

receiving

frames

it

can

set

the

retransmit

bit

and

try

to

receive

a

frame

later

The

rest

of

the

suboelds

in

the

header

are

application

dependent

With

start

and

end

of

packet

bits

the

transmitting

node

can

indicate

the

receiving

node

which

frame

is

the

orst

and

which

one

is

the

last

frame

in

the

packet

constituting

of

many

frames

Operation

of

the

Bus

The

nodes

connected

to

the

bus

have

the

control

of

the

bus

The

peripheral

attached

to

the

node

uses

the

bus

to

transmit

and

receive

data

When

a

peripheral

have

data

to

send

it

sends

the

data

to

the

transmit

buoeer

of

the

node

The

node

monitors

the

headers

of

by-passing

frames

in

order

to

detect

if

the

incoming

frame

is

available

to

the

node

-LRB-

empty

or

addressed

to

the

node

-RRB-

if

the

frame

is

to

be

deleted

or

if

the

frame

is

just

passing

the

node

When

the

node

receives

data

from

the

bus

it

copies

the

time

slots

of

the

frame

into

the

receiving

buoeer

and

removes

the

frame

from

the

bus

The

peripheral

reads

the

data

from

the

buoeer

The

rules

according

to

which

nodes

receive

data

transmit

data

and

require

service

from

the

bus

constitutes

the

medium

access

control

algorithm

-LRB-

MAC

protocol

-RRB-

of

the

FSR-bus

Medium

Access

Control

Algorithm

Every

node

of

the

FSR-bus

contains

the

control

logic

to

monitor

the

bypassing

frames

The

nodes

decide

if

they

can

use

the

bus

by

monitoring

the

control

signals

and

control

oelds

of

the

header

The

AEow

diagram

of

the

medium

access

control

algorithm

is

seen

in

Figure

-LSB-

-RSB-

EMPTY/OCCUPIED

SOURCE

ADDRESS

RETRANSMIT

EXTENSION

RING

ADDRESS

GROUP/SINGLE

DESTINATION/GROUP

ADDRESS

START

OF

PACKET

END

OF

PACKET

DATA

FRAME

HEADERDATADATADATADATADATADATADATATRAILER

Figure

Frame

structure

of

the

FSR-bus

When

a

node

has

data

to

send

it

has

to

wait

for

an

empty

frame

The

frame

is

empty

if

it

is

not

occupied

or

if

it

is

emptied

by

the

node

The

node

empties

the

frame

if

the

frame

is

addressed

to

it

or

if

the

source

address

of

the

frame

is

the

address

of

the

node

and

retransmit

bit

is

not

set

The

node

can

use

the

incoming

empty

frame

if

it

has

a

turn

Once

the

node

has

captured

the

empty

frame

and

started

the

transmission

it

continues

transmitting

as

long

as

it

receives

empty

frames

or

it

is

not

interrupted

by

requests

of

other

nodes

If

the

node

does

not

have

a

turn

it

must

wait

for

other

free

frames

or

until

it

gets

a

turn

The

node

gets

a

turn

if

there

are

no

earlier

or

simultaneous

on-going

requests

when

the

node

gets

ready

to

transmit

If

the

node

does

not

have

a

turn

it

must

wait

until

other

nodes

have

removed

their

requests

to

get

the

turn

If

the

node

is

ready

to

transmit

but

not

sending

and

it

receives

occupied

frames

it

can

send

its

own

request

if

it

has

a

turn

The

request

is

held

on

the

request

line

as

long

as

the

node

does

not

start

the

transmission

The

request

is

removed

at

the

instant

the

node

starts

transmitting

its

frame

If

the

node

does

not

have

a

turn

to

send

a

request

it

must

wait

until

other

nodes

have

removed

their

requests

When

the

node

receives

requests

from

other

nodes

it

either

passes

or

suspends

them

The

received

request

is

passed

if

the

node

receives

an

occupied

frame

and

the

node

is

not

holding

its

own

request

on

the

request

line

The

request

is

suspended

if

the

node

is

transmitting

receiving

an

empty

frame

or

the

node

is

sending

its

own

request

The

suspended

request

is

forwarded

when

the

node

stops

the

action

that

caused

the

suspension

When

the

request

is

forwarded

it

is

not

suspended

until

it

is

removed

by

the

requesting

node

SEND

HEADER

TRUE

TURN

TRUE

FALSE

TURN

TRUE

FALSE

YES

TURN

FALSE

FALSE

NO

YES

NO

YES

FALSE

TURN

TURN

YES

YES

YES

YES

YES

YES

YES

NO

NO

NO

NO

NO

NO

NONO

TURN

TRUE

TRUE

FALSE

YES

YES

YES

YES

NO

NO

NO

NO

FALSE

TRUE

FALSE

YES

NO

YES

NOHEADER

END

FALSE

START

SEND

HEADER

TRUE

Figure

Flow

diagram

of

the

medium

access

control

algorithm

Pr/T-Net

Model

of

the

Bus

Two

dioeerent

predicate/transition

net

models

of

the

Frame

Synchronized

Ring

have

been

developed

The

orst

model

includes

only

the

basic

features

of

the

ring

It

is

assumed

that

every

node

executes

the

MAC

algorithm

correctly

No

error

situations

have

been

taken

into

account

and

the

credit

size

is

always

If

the

node

is

transmitting

a

frame

it

can

not

immediately

start

transmitting

another

frame

if

other

nodes

send

requests

to

the

node

unless

the

credit

size

of

the

node

is

more

than

When

the

credit

size

is

the

node

can

transmit

frames

only

as

long

as

it

does

not

receive

requests

from

the

other

nodes

In

the

second

model

the

receiving

node

can

fail

and

the

credit

size

is

arbitrary

If

the

credit

size

is

C

every

node

can

send

at

least

C

frames

before

the

transmission

can

be

interrupted

by

requests

of

other

nodes

Two

Pr/T-net

models

are

tried

to

be

made

as

simple

as

possible

The

states

between

START

and

END

-LRB-

rectangulars

-RRB-

in

the

AEow

diagram

of

the

MAC

algorithm

have

been

omitted

in

the

Pr/T-nets

In

the

beginning

every

node

is

in

START

The

node

executes

the

algorithm

in

one

step

and

enters

the

state

END

The

bus

clock

signal

changes

the

state

of

every

node

back

to

START

This

decreases

the

number

of

reachable

states

in

the

reachability

analysis

The

transitions

of

the

Pr/T-net

could

be

combined

into

a

single

transition

to

further

decrease

the

number

of

reachable

markings

However

it

was

found

very

important

that

the

similarity

of

the

Pr/T-net

and

the

MAC

algorithm

could

be

easily

seen

by

comparing

the

graphical

representations

of

the

net

and

the

algorithm

Basic

Predicate/Transition

Net

The

structure

of

the

FSR-bus

is

clearly

seen

in

the

Pr/T-net

model

of

the

bus

in

Figure

The

places

of

the

net

correspond

the

components

of

the

bus

nodes

data

bus

frame

synchronization

line

and

request

line

The

place

BUS

includes

the

frame

synchronization

line

in

its

tuples

so

it

is

not

implemented

as

an

own

place

The

bus

clock

line

is

dioeerent

from

other

control

lines

of

the

FSR-bus

While

other

control

signals

are

set

into

some

value

and

possibly

changed

after

some

arbitrarily

long

time

bus

clock

cycles

regularly

It

is

not

necessary

to

save

the

value

of

the

clock

signal

because

only

the

actions

caused

by

the

signal

when

it

changes

are

interesting

That

is

why

the

bus

clock

signal

is

implemented

as

a

transition

Place

NODE

ADDRESSES

includes

the

address

of

every

node

in

the

ring

When

a

node

starts

transmitting

it

chooses

the

destination

address

randomly

from

that

place

Every

possible

situation

caused

by

alternative

destination

addresses

is

gone

through

in

the

reachability

analysis

of

the

Pr/T-net

NODESREQUEST_LINEBUSSend_if_syncSend_if_sync_and_no_requestsBus_occupi

edAlready_sendingNothing_to_sendBus_clock

req

rNSo

nNSo

nSSo

nSRo

nBOo

nASo

rASo

req

rBOo

req

rSRo

req

rSSo

bASo

bASi

bBOo

bus

bSRo

bus

bSSo

bus

NodesNext

-LRB-

Nodes

-RRB-

BusReqsNext

-LRB-

Reqs

-RRB-

bNSo

bus

nNSi

nASi

nSRi

nSSi

nBOi

Add

Add

Add

Add

req

Nex

t

-LRB-

Bus

-RRB-

Figure

Pr/T-net

model

of

the

FSR-bus

Markings

of

the

Net

Every

place

contains

as

many

tuples

in

symbolic

sums

as

there

are

nodes

in

the

ring

Tuples

in

place

NODES

are

n

BusClock

FrAvailable

ReadyToSend

Turn

NodeSending

TimeSlotsToSend

n

is

the

number

of

the

node

-LRB-

n

-LSB-

N

-RSB-

-RRB-

and

N

is

the

number

of

nodes

in

the

ring

BusClock

FrAvailable

ReadyToSend

Turn

and

NodeSending

are

binary

variables

They

contain

the

information

according

to

which

the

node

executes

the

medium

access

control

algorithm

Every

node

executes

the

algorithm

once

in

every

bus

cycle

BusClock

is

initially

and

is

set

to

when

the

node

has

executed

the

MAC

algorithm

When

the

bit

is

the

node

has

to

wait

for

the

bus

clock

signal

-LRB-

transition

Bus

clock

-RRB-

that

resets

BusClock

FrAvailable

indicates

whether

a

node

can

capture

and

use

the

incoming

frame

or

not

If

the

node

has

data

to

send

it

sets

its

ReadyToSend

to

If

the

node

has

a

turn

Turn

is

NodeSending

is

is

as

long

as

the

node

is

sending

a

frame

TimeSlotsToSend

is

a

counter

that

indicates

the

number

of

time

slots

in

the

frame

When

the

node

starts

transmitting

it

decreases

the

counter

every

time

it

sends

a

time

slot

When

the

counter

has

become

the

node

knows

it

has

sent

the

whole

frame

The

initial

value

of

the

counter

depends

on

N

and

the

credit

size

used

With

credit

size

TimeSlotsToSend

is

initially

set

to

the

value

N

The

header

does

not

decrease

the

number

of

time

slots

After

sending

N

time

slots

the

header

the

node

knows

the

next

time

slot

is

the

last

one

it

sends

Place

BUS

contains

n

Header

EmptyFrame

Address

n

is

the

number

of

the

input

bus

segment

of

the

node

number

n

-LRB-

n

-LSB-

N

-RSB-

-RRB-

Header

is

if

the

incoming

time

slot

is

a

header

If

the

incoming

time

slot

is

not

a

header

EmptyFrame

and

Address

are

always

So

ordinary

time

slots

do

not

carry

any

information

in

the

Pr/T-net

model

If

the

incoming

frames

are

not

empty

EmptyFrame

is

in

the

header

The

destination

address

is

seen

in

Address

if

the

time

slots

is

a

header

-LRB-

Address

-LSB-

N

-RSB-

-RRB-

Because

it

is

assumed

that

nodes

do

not

fail

in

the

Pr/T-net

model

of

Figure

source

address

is

not

included

in

any

tuple

In

this

model

all

transmitted

frames

are

received

and

removed

from

the

bus

properly

Place

REQUEST

LINE

includes

n

RequestIn

RequestOut

where

n

is

the

number

of

the

request

line

segment

-LRB-

n

-LSB-

N

-RSB-

-RRB-

RequestIn

is

if

the

node

is

receiving

requests

If

the

node

passes

requests

from

other

nodes

or

sends

its

own

request

RequestOut

is

set

to

Note

that

if

there

are

N

nodes

in

the

ring

the

Pr/T-net

model

of

the

ring

contains

request

line

segments

Because

the

order

of

executions

of

the

nodes

is

arbitrary

it

can

not

be

known

if

some

node

has

changed

the

value

of

its

output

request

before

the

previous

node

uses

this

value

When

a

node

is

not

ready

to

send

it

needs

both

its

input

and

output

requests

to

decide

if

it

can

reset

the

output

request

Every

node

has

to

have

access

to

both

request

values

so

that

other

nodes

can

not

change

the

values

while

they

are

executing

the

algorithm

The

symbolic

sum

in

place

NODE

ADDRESSES

consists

of

Add

where

Add

is

the

address

of

the

node

-LRB-

Add

-LSB-

N

-RSB-

-RRB-

The

initial

marking

of

the

net

is

seen

below

Initially

all

the

variables

of

the

nodes

are

zero

node

is

going

to

receive

an

empty

frame

-LRB-

the

frame

synchronization

signal

is

active

in

the

input

of

the

node

-RRB-

and

no

requests

are

circulating

in

the

ring

NODES

BUS

Transitions

of

the

Net

It

is

assumed

in

the

Pr/T-net

of

Figure

that

every

node

executes

the

MAC

algorithm

in

a

single

step

The

order

of

executions

of

the

nodes

is

arbitrary

This

assumption

can

be

done

because

the

result

of

the

execution

of

each

node

depends

only

on

its

local

variables

and

the

data

in

the

bus

segment

to

which

it

is

connected

When

a

node

executes

the

MAC

algorithm

it

replaces

the

values

of

its

data

bus

and

request

line

segments

and

its

own

variables

by

new

values

A

node

has

own

tuples

to

which

these

values

are

saved

No

other

node

can

change

the

values

of

these

tuples

Because

a

node

executes

the

MAC

algorithm

in

a

single

step

the

value

of

the

bit

FrAvailable

can

not

be

used

in

the

transitions

directly

If

FrAvailable

were

currently

and

a

node

received

an

occupied

header

not

addressed

to

it

the

transition

would

still

see

that

FrAvailable

is

even

though

it

should

be

So

whenever

it

is

tested

what

the

value

of

FrAvailable

is

it

must

be

separately

tested

what

are

the

values

of

Header

and

EmptyFrame

This

causes

complicated

arc

expressions

but

reduces

the

size

of

the

state

space

of

the

reachability

graph

of

the

net

If

Header

is

the

old

value

of

FrAvailable

must

be

used

The

Pr/T-net

model

of

the

FSR-bus

contains

six

transitions

As

already

mentioned

the

transition

Bus

clock

can

ore

only

when

the

bus

clock

bit

of

every

node

is

When

this

transition

ores

the

bus

clock

bits

are

reset

the

time

slot

in

the

input

of

the

node

is

transmitted

to

the

input

of

the

next

node

and

the

output

request

of

the

node

is

transmitted

to

the

input

request

of

the

previous

node

The

value

of

the

output

request

of

the

node

remains

unchanged

The

transition

Bus

clock

does

not

have

a

selector

The

action

caused

by

the

oring

of

the

transition

is

seen

below

In

Figure

arc

expressions

that

are

not

inside

and

represent

symbolic

sums

of

tuples

Symbolic

sums

consisting

of

one

tuple

are

inside

and

Nodes

Next

-LRB-

Nodes

-RRB-

Bus

Next

-LRB-

Bus

-RRB-

Reqs

Next

-LRB-

Reqs

-RRB-

The

AEow

diagram

in

Figure

is

divided

into

ove

parts

each

of

which

corresponds

a

transition

in

the

model

of

Figure

In

every

transition

except

Bus

clock

it

is

tested

if

the

incoming

time

slot

is

a

header

In

case

the

time

slot

is

a

header

the

frame

available

bit

is

set

or

reset

depending

on

that

if

the

incoming

frame

is

empty

or

not

If

a

node

is

not

ready

to

send

the

transition

Nothing

to

send

is

ored

The

transition

Already

sending

is

ored

if

a

node

is

ready

to

send

and

is

sending

a

frame

If

the

node

is

ready

to

send

but

is

not

sending

the

transition

Bus

occupied

is

ored

if

the

incoming

frame

is

not

empty

Otherwise

if

the

node

does

not

have

a

turn

the

transition

Send

if

sync

and

no

requests

is

ored

and

if

it

has

a

turn

the

transition

Send

if

sync

is

ored

Most

transitions

do

not

have

a

selector

The

conditions

when

a

transition

is

enabled

are

given

in

arc

expressions

The

arc

expressions

are

named

so

that

the

orst

letter

indicates

which

place

the

arc

connects

to

the

transition

-LRB-

n

NODES

b

BUS

and

r

REQUEST

LINE

-RRB-

The

next

two

letters

indicate

the

name

of

the

transition

-LRB-

NS

Nothing

to

send

AS

Already

sending

BO

Bus

occupied

SR

Send

if

sync

and

no

requests

and

SS

Send

if

sync

-RRB-

The

last

letter

indicates

if

the

arc

is

an

input

arc

i

or

an

output

arc

o

of

the

transition

When

the

transition

Nothing

to

send

ores

FrAvailable

is

set

to

if

the

incoming

frame

is

empty

-LRB-

and

the

incoming

time

slot

is

a

header

-RRB-

If

the

incoming

frame

is

addressed

to

the

node

the

node

empties

the

frame

by

resetting

the

EmptyFrame

and

Address

bits

The

output

request

is

set

to

if

there

are

incoming

requests

and

the

frame

is

not

available

Note

that

when

the

transition

ores

the

new

value

of

RequestOut

is

written

into

both

RequestIn

and

RequestOut

It

is

meaningless

what

the

value

of

RequestIn

is

after

the

transition

has

been

ored

because

before

the

bit

is

used

again

the

transition

Bus

clock

has

changed

its

value

The

new

value

of

RequestIn

is

copied

from

RequestOut

of

the

next

node

The

arc

expressions

of

the

transition

are

seen

below

The

space

bar

between

and

indicates

that

that

oeld

of

the

tuple

is

the

same

as

the

previous

oeld

of

the

tuple

nNSi

n

FrAvailable

nNSo

n

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

-RRB-

FrAvailable

bus

n

Header

EmptyFrame

Address

bNSo

n

Header

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

EmptyFrame

-RRB-

EmptyFrame

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

Address

-RRB-

Address

req

n

RequestIn

RequestOut

rNSO

n

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

-LRB-

-LRB-

-LRB-

RequestIn

RequestOut

-RRB-

-RRB-

RequestOut

-RRB-

RequestIn

-RRB-

-LRB-

-LRB-

FrAvailable

-RRB-

-LRB-

-LRB-

-LRB-

RequestIn

RequestOut

-RRB-

-RRB-

RequestOut

-RRB-

RequestIn

-RRB-

When

the

node

has

started

transmitting

it

continues

as

long

as

it

has

time

slots

to

send

When

the

transition

Already

sending

ores

the

number

of

time

slots

is

decreased

by

one

After

the

node

has

sent

all

its

time

slots

the

variables

ReadyToSend

Turn

and

NodeSending

are

reset

The

node

sends

only

time

slots

-LRB-

not

a

header

-RRB-

when

the

transition

is

ored

All

incoming

requests

are

suspended

The

transition

does

not

have

a

selector

The

arc

expressions

of

the

transition

are

seen

below

Note

that

some

expressions

are

the

same

as

in

the

transition

Nothing

to

send

nASi

n

FrAvailable

TimeSlotsToSend

nASo

n

FrAvailable

-LRB-

TimeSlotsToSend

-RRB-

-LRB-

TimeSlotsToSend

-RRB-

-LRB-

TimeSlotsToSend

-RRB-

-LRB-

TimeSlotsToSend

-RRB-

-LRB-

-RRB-

TimeSlotsToSend

bASi

n

bASo

n

rASo

n

The

bus

is

occupied

if

the

incoming

frame

is

not

empty

A

node

gets

a

turn

if

there

are

not

incoming

requests

RequestOut

is

true

if

a

node

sends

its

own

request

or

forwards

other

requests

Transitions

Nothing

to

send

Bus

occupied

Send

if

sync

and

Send

if

sync

and

no

requests

are

always

enabled

when

a

node

is

not

ready

to

send

If

other

transition

than

Nothing

to

send

is

chosen

ReadyToSend

is

set

to

and

kept

in

that

value

until

a

node

has

sent

every

time

slot

of

its

frame

If

the

node

has

nothing

to

send

ReadyToSend

remains

unchanged

The

decision

when

a

node

becomes

ready

to

send

could

be

made

in

a

number

of

ways

For

example

the

transition

Nothing

to

send

could

set

ReadyToSend

to

with

some

probability

when

it

is

ored

If

other

transitions

can

change

the

value

of

ReadyToSend

extra

markings

are

avoided

A

node

can

simultaneously

become

ready

to

send

and

send

a

header

If

only

the

transition

Nothing

to

send

could

change

ReadyToSend

there

would

always

be

an

extra

marking

in

which

a

node

becomes

ready

to

send

but

can

not

send

a

header

The

gate

of

the

transition

Bus

occupied

prevents

the

oring

if

the

incoming

frame

is

empty

The

arc

expressions

and

the

gate

are

seen

below

nBOi

n

FrAvailable

ReadyToSend

Turn

nBOo

n

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

-RRB-

FrAvailable

-LRB-

ReadyToSend

-RRB-

ReadyToSend

-LRB-

Turn

RequestIn

-RRB-

Turn

bBOo

n

Header

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

EmptyFrame

-RRB-

EmptyFrame

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

Address

-RRB-

Address

rBOo

n

-LRB-

Turn

RequestIn

-RRB-

RequestOut

gate

-LRB-

-LRB-

Header

-LRB-

EmptyFrame

n

Address

-RRB-

-RRB-

-LRB-

Header

FrAvailable

-RRB-

-RRB-

The

transition

Send

if

sync

and

no

requests

is

enabled

when

the

node

receives

an

empty

frame

but

it

does

not

have

a

turn

-LRB-

and

it

is

ready

to

send

but

not

sending

-RRB-

If

the

node

does

not

receive

requests

from

other

nodes

-LRB-

and

frame

synchronization

signal

is

active

-RRB-

it

can

start

transmitting

by

sending

a

header

The

destination

address

of

the

header

is

chosen

from

the

place

NODE

ADDRESSES

The

address

can

be

the

address

of

any

node

in

the

bus

The

node

resets

its

output

request

sets

all

its

binary

variables

to

and

sets

TimeSlotsToSend

to

N

if

it

can

start

transmitting

If

there

is

no

frame

synchronization

or

there

are

incoming

requests

the

node

can

not

send

a

header

In

that

case

node

gets

a

turn

and

resets

its

output

request

if

there

are

no

incoming

requests

Note

that

while

other

arc

expressions

in

Figure

are

abbreviations

of

tuples

Add

is

the

name

of

the

variable

Add

in

a

tuple

of

arity

The

gate

of

the

transition

does

not

allow

the

transition

to

ore

if

the

incoming

frame

is

not

empty

The

arc

expressions

and

the

gate

of

the

transition

are

seen

below

nSRi

n

FrAvailable

ReadyToSend

nSRo

n

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

-RRB-

FrAvailable

-LRB-

ReadyToSend

-RRB-

ReadyToSend

-LRB-

-LRB-

Header

RequestIn

-RRB-

-LRB-

Header

RequestIn

-RRB-

-RRB-

-LRB-

Header

RequestIn

-RRB-

-LRB-

Header

RequestIn

-RRB-

-LRB-

-RRB-

bSRo

n

-LRB-

Header

RequestIn

-RRB-

Header

-LRB-

Header

RequestIn

-RRB-

-LRB-

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

EmptyFrame

-RRB-

EmptyFrame

-RRB-

-LRB-

Header

RequestIn

-RRB-

Add

-LRB-

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

Address

-RRB-

Address

-RRB-

rSRo

n

-LRB-

-LRB-

Header

RequestIn

-RRB-

-LRB-

Header

RequestIn

-RRB-

-RRB-

RequestOut

gate

-LRB-

-LRB-

Header

-LRB-

EmptyFrame

n

Address

-RRB-

-RRB-

-LRB-

Header

FrAvailable

-RRB-

-RRB-

The

transition

Send

if

sync

is

enabled

when

the

node

has

data

to

send

but

it

is

not

sending

it

receives

an

empty

frame

and

it

has

a

turn

The

node

sends

a

header

the

number

of

time

slots

is

set

to

the

maximum

value

-LRB-

N

-RRB-

and

requests

from

other

nodes

are

suspended

The

arc

expressions

of

the

transition

are

seen

below

nSSi

n

FrAvailable

ReadyToSend

nSSo

n

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

-RRB-

FrAvailable

-LRB-

ReadyToSend

-RRB-

ReadyToSend

-LRB-

Header

-RRB-

-LRB-

Header

-RRB-

-LRB-

-RRB-

bSSo

n

-LRB-

Header

-RRB-

Header

-LRB-

Header

-RRB-

EmptyFrame

-LRB-

Header

-RRB-

Add

Address

rSSo

n

-LRB-

Header

-RRB-

RequestOut

The

complete

PROD

net

description

of

the

Pr/T-net

in

Figure

is

given

in

Appendix

B.

Extended

Pr/T-Net

with

Credit

Size

and

Retransmit

Bit

The

basic

model

in

Figure

is

now

extended

to

include

simple

error

situations

and

credit

size

greater

than

The

credit

size

can

be

changed

by

increasing

or

decreasing

the

variable

TimeSlotsToSend

It

is

assumed

that

the

number

of

time

slots

in

the

frame

is

equal

to

the

number

of

the

nodes

in

the

ring

The

orst

time

slot

a

node

sends

is

always

a

header

which

does

not

decrease

the

time

slot

counter

A

node

sends

the

last

time

slot

when

the

time

slot

counter

is

zero

So

when

the

credit

size

C

is

greater

than

one

the

number

of

time

slots

in

the

maximum

credit

is

C

-LRB-

N

-RRB-

where

N

is

the

number

of

the

nodes

in

the

ring

-LRB-

N

-RRB-

When

N

equals

to

one

credit

size

is

unnecessary

because

the

only

node

in

the

bus

can

begin

transmitting

whenever

it

has

data

to

send

Note

that

when

C

the

maximal

number

of

time

slots

of

the

basic

model

dioeers

from

that

of

the

extended

model

In

the

transition

Already

sending

of

the

extended

model

the

variables

of

a

node

are

reset

one

time

slot

earlier

than

in

the

basic

model

Two

error

situations

are

added

into

the

basic

model

In

the

orst

one

the

destination

node

is

permanently

uncapable

of

receiving

frames

and

the

source

node

has

to

remove

the

frame

it

has

sent

In

the

second

case

a

node

is

temporarily

uncapable

of

receiving

frames

When

for

example

the

receiving

buoeer

of

the

destination

node

overAEows

it

can

not

receive

the

incoming

frame

addressed

to

it

It

sets

the

retransmit

bit

and

the

source

node

retransmits

the

frame

immediately

if

it

has

credit

left

In

case

the

source

node

does

not

have

credit

left

it

can

be

assumed

that

the

next

frame

the

node

sends

is

a

retransmission

In

fact

it

does

not

matter

what

the

node

sends

because

in

the

model

the

frames

do

not

carry

data

Error

situations

can

occur

when

a

node

is

receiving

the

header

of

the

frame

If

the

node

has

succeeded

in

receiving

the

header

it

is

assumed

that

every

time

slot

that

belongs

to

that

frame

is

received

without

errors

The

Pr/T-net

model

of

the

FSR-bus

in

which

the

credit

size

is

greater

than

one

and

errors

occur

is

seen

in

Figure

Five

transitions

corresponding

dioeerent

parts

of

the

AEow

diagram

in

Figure

belong

to

the

ogure

but

are

omitted

for

clarity

Errors

can

not

occur

when

the

transitions

Already

sending

or

Bus

occupied

are

ored

because

it

is

assumed

that

errors

occurs

only

when

a

node

is

receiving

header

of

the

frame

Markings

of

the

Extended

Model

Places

NODES

REQUEST

LINE

and

NODE

ADDRESSES

include

the

same

kind

of

tuples

as

in

the

basic

model

The

place

BUS

includes

n

Header

EmptyFrame

DestinationAddress

SourceAddress

Retransmit

The

number

of

the

node

that

has

sent

the

frame

can

be

seen

in

SourceAddress

If

the

destination

node

fails

to

receive

the

header

of

the

frame

Retransmit

is

set

to

The

initial

marking

of

the

net

is

seen

below

C

is

the

credit

size

and

N

is

the

number

of

the

nodes

In

the

beginning

every

node

has

a

maximum

credit

size

no

requests

have

been

sent

and

the

bus

is

empty

The

credit

size

is

set

to

the

maximum

value

because

the

transition

Send

if

sync

and

no

requests

must

know

if

there

is

credit

left

before

it

can

ore

The

frame

synchronization

signal

is

in

the

input

of

the

node

number

NODES

-LRB-

-RRB-

C

-LRB-

-RRB-

BUS

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

Transitions

of

the

Extended

Model

The

transition

Bus

clock

is

similar

to

that

in

the

basic

model

except

the

arc

expression

to

and

from

the

place

BUS

must

now

consist

of

instead

of

When

a

node

is

not

ready

to

send

and

it

is

not

uncapable

of

receiving

frames

the

transition

Nothing

to

send

is

enabled

The

selector

of

the

transition

prevents

the

oring

if

the

node

has

sent

a

frame

the

reception

of

which

has

been

failed

because

in

that

case

a

node

has

data

to

send

-LRB-

the

failed

frame

-RRB-

Other

eoeects

caused

by

the

transition

are

the

same

as

in

the

basic

model

When

a

node

does

not

have

data

to

send

and

the

reception

of

a

frame

addressed

to

it

fails

the

transition

Nothing

to

send

RE

is

enabled

RE

is

an

abbreviation

of

receive

error

Again

the

node

can

not

be

the

source

address

because

in

that

case

it

has

data

to

send

When

the

transition

ores

Retransmit

is

set

to

in

the

arc

expression

BEo

-LRB-

bus

error

output

-RRB-

and

FrAvailable

is

set

to

-LRB-

Nodes

-RRB-

BusNext

-LRB-

Bus

-RRB-

ReqsNext

-LRB-

Reqs

-RRB-

rNSEo

req

BEi

BEo

nNSEo

nNSi

Send_if_sync_and_no_requests_RESend_if_sync_RE

req

req

req

req

Add

Add

Add

Add

nSREo

nSRi

nSSi

n

SSEo

BEi

BEo

BEo

BEi

Figure

Pr/T-net

model

of

the

FSR-bus

with

credit

size

and

retransmission

bit

When

a

node

has

data

to

send

but

it

is

not

sending

and

the

incoming

frame

is

not

available

the

transition

Bus

occupied

is

enabled

Note

from

the

selector

of

the

transition

that

the

node

can

not

be

the

receiver

of

a

frame

because

in

that

case

the

frame

is

available

If

the

node

is

the

source

of

the

frame

the

transition

ores

only

if

the

retransmit

bit

is

The

transition

Send

if

sync

and

no

requests

must

be

changed

so

that

requests

from

other

nodes

can

not

suspend

the

transmission

of

the

node

if

it

has

credit

left

-LRB-

time

slot

variable

is

greater

than

zero

-RRB-

The

transition

is

enabled

if

the

node

has

data

to

send

but

it

is

not

sending

yet

and

the

incoming

frame

is

empty

or

the

source

address

of

the

frame

is

the

address

of

the

node

and

retransmit

bit

is

If

the

node

has

credit

left

the

node

can

send

a

header

even

though

there

are

incoming

requests

When

the

credit

runs

out

and

the

node

receives

requests

from

other

nodes

it

can

not

capture

the

incoming

frame

Then

it

sets

its

credit

to

the

maximum

value

but

does

not

send

a

header

When

a

node

has

data

to

send

and

simultaneously

is

receiving

a

frame

addressed

to

it

a

receive

error

can

occur

Then

the

transition

Send

if

syncand

no

requests

RE

is

enabled

When

this

transition

ores

Retransmit

is

set

to

and

frame

is

not

available

to

the

node

any

more

The

transition

Send

if

sync

is

enabled

when

a

node

has

data

to

send

turn

and

frame

is

available

but

the

node

is

not

sending

yet

Even

though

the

incoming

frame

is

not

empty

the

transition

can

ore

if

the

node

is

the

source

node

of

the

frame

and

the

retransmit

bit

is

If

a

node

receives

a

header

addressed

to

it

when

the

transition

Send

if

sync

is

enabled

an

receive

error

can

occur

The

credit

size

is

then

increased

to

the

maximum

value

and

retransmit

bit

is

set

to

by

Send

if

sync

RE

Once

a

node

has

sent

a

header

the

transition

Already

sending

is

ored

as

many

times

as

there

are

time

slots

in

a

frame

-LRB-

not

including

a

header

-RRB-

Between

every

frame

Already

sending

must

not

be

enabled

even

though

TimeSlotsToSend

is

greater

than

If

a

node

has

credit

it

can

start

transmitting

a

new

frame

and

Already

sending

is

enabled

again

The

complete

PROD

net

description

of

the

Pr/T-net

in

Figure

is

given

in

Appendix

C.

Analysis

of

the

Algorithm

All

the

analysis

results

presented

in

this

Section

are

based

on

the

reachability

graph

of

the

Pr/T-net

model

of

the

Frame

Synchronized

Ring

The

reachability

graph

is

automatically

generated

by

PROD

With

query

language

probe

it

is

asked

if

certain

properties

hold

in

the

graph

The

reachability

graph

of

the

basic

Pr/T-net

model

of

the

FSR-bus

includes

vertices

and

edges

when

the

number

of

nodes

in

the

ring

-LRB-

N

-RRB-

is

-LRB-

From

now

on

a

vertex

or

a

state

means

a

marking

in

a

reachability

graph

and

a

node

means

a

node

in

the

FSR-bus

-RRB-

The

size

of

the

reachability

graph

grows

very

fast

in

respect

to

N

When

N

is

three

the

graph

includes

vertices

and

edges

and

when

N

is

four

the

graph

consists

of

vertices

and

edges

The

number

of

reachable

states

grows

very

fast

because

of

dioeerent

destination

addresses

to

which

nodes

can

send

frames

In

the

graphs

mentioned

above

a

complete

simulation

of

the

behaviour

of

the

FSR-bus

has

been

carried

out

If

it

is

assumed

that

a

node

can

send

frames

to

itself

only

which

is

the

longest

possible

path

a

frame

can

travel

in

the

ring

the

graph

consists

of

vertices

when

N

is

ove

The

shortest

path

a

frame

can

travel

is

a

path

form

a

node

to

its

immediate

successor

When

every

node

can

send

frames

only

to

its

immediate

successor

there

are

only

vertices

in

the

reachability

graph

with

six

nodes

in

the

ring

When

N

is

three

the

graph

where

every

node

sends

frames

to

itself

consists

of

vertices

and

if

every

node

send

frames

to

its

immediate

successor

only

there

are

vertices

in

the

reachability

graph

When

the

number

of

nodes

in

the

ring

was

larger

than

four

the

complete

reachability

graph

could

not

be

successfully

generated

The

number

of

reachable

states

was

more

than

two

million

and

the

disk

space

ran

out

It

took

about

four

days

to

generate

two

million

states

which

consumed

about

Mbytes

disk

space

Three

methods

were

used

for

reducing

the

size

of

the

reachability

graph

stubborn

set

method

symmetry

method

and

bit

packing

These

methods

will

be

discussed

further

in

Section

The

state

space

explosion

becomes

even

more

serious

problem

when

the

reachability

graph

of

the

Pr/T-net

in

Figure

is

generated

The

retransmit

bit

does

not

cause

the

explosion

but

the

greater

the

credit

size

the

larger

the

reachability

graph

With

ove

nodes

in

the

ring

and

credit

size

the

reachability

graph

contains

almost

ove

times

as

many

vertices

as

the

graph

in

which

the

credit

size

is

The

size

of

the

reachability

graph

generated

by

PROD

can

be

examined

with

the

command

statistics

Below

it

is

seen

the

sizes

of

the

graphs

of

the

basic

and

extended

models

when

N

N

and

N

Note

that

the

number

of

strongly

connected

components

in

the

basic

model

equals

to

that

in

the

extended

model

when

N

is

the

same

The

reason

why

there

are

more

that

one

strongly

connected

component

is

that

once

the

ring

has

been

set

running

some

initial

situations

can

never

occur

again

For

example

in

the

beginning

the

frame

available

bit

of

every

node

is

but

after

the

orst

bus

clock

signal

at

least

the

frame

available

bit

of

one

node

is

If

this

was

not

the

case

no

node

could

ever

send

a

frame

#statistics

Number

of

nodes

Number

of

-LRB-

real

-RRB-

arrows

Number

of

terminal

nodes

Number

of

nodes

that

have

been

completely

processed

Number

of

strongly

connected

components

Number

of

nontrivial

terminal

strongly

connected

components

Number

of

nodes

Number

of

-LRB-

real

-RRB-

arrows

Number

of

terminal

nodes

Number

of

nodes

that

have

been

completely

processed

Number

of

strongly

connected

components

Number

of

nontrivial

terminal

strongly

connected

components

Number

of

nodes

Number

of

-LRB-

real

-RRB-

arrows

Number

of

terminal

nodes

Number

of

nodes

that

have

been

completely

processed

Number

of

strongly

connected

components

Number

of

nontrivial

terminal

strongly

connected

components

Number

of

nodes

Number

of

-LRB-

real

-RRB-

arrows

Number

of

terminal

nodes

Number

of

nodes

that

have

been

completely

processed

Number

of

strongly

connected

components

Number

of

nontrivial

terminal

strongly

connected

components

Number

of

nodes

Number

of

-LRB-

real

-RRB-

arrows

Number

of

terminal

nodes

Number

of

nodes

that

have

been

completely

processed

Number

of

strongly

connected

components

Number

of

nontrivial

terminal

strongly

connected

components

Number

of

nodes

Number

of

-LRB-

real

-RRB-

arrows

Number

of

terminal

nodes

Number

of

nodes

that

have

been

completely

processed

Number

of

strongly

connected

components

Number

of

nontrivial

terminal

strongly

connected

components

Deadlocks

The

main

goal

of

this

work

was

to

ond

every

possible

deadlock

and

event

sequences

that

lead

to

deadlocks

that

might

occur

in

the

medium

access

control

algorithm

of

the

FSR-bus

There

are

two

dioeerent

cases

which

have

to

be

taken

into

account

Firstly

it

must

be

proved

that

the

MAC

algorithm

can

not

deadlock

because

of

some

kind

of

error

in

the

algorithm

So

every

node

can

always

execute

the

algorithm

after

the

bus

clock

pulse

Secondly

it

must

be

proved

that

the

bus

does

not

deadlock

The

situation

in

which

the

bus

operates

in

such

a

way

that

no

node

can

send

data

even

though

the

MAC

algorithm

of

every

node

operates

correctly

can

be

considered

a

deadlock

-LRB-

nothing

happens

in

the

bus

-RRB-

This

second

feature

is

tightly

related

to

the

fairness

of

the

algorithm

and

it

is

examined

further

in

Section

From

the

probe

queries

in

the

previous

section

it

is

easily

seen

that

there

are

no

terminal

nodes

in

the

reachability

graphs

of

Pr/T-net

models

of

the

FSR-bus

when

N

This

means

that

in

every

possible

situation

that

is

modelled

a

node

can

execute

the

MAC

algorithm

and

reach

a

reasonable

state

Because

the

Pr/T-net

models

the

correct

operation

of

the

MAC

algorithm

error

situations

due

to

for

example

noisy

environments

can

not

cause

deadlocks

in

the

reachability

analysis

So

every

new

state

that

is

generated

is

reasonable

For

example

a

situation

where

a

node

is

not

ready

to

send

but

it

has

a

turn

is

not

a

reasonable

state

even

though

it

may

occur

in

the

real

bus

So

whenever

the

nodes

operate

correctly

the

bus

can

not

deadlock

in

the

models

Intuitively

it

is

reasonable

to

assume

that

even

though

the

number

of

nodes

in

the

ring

is

increased

deadlocks

do

not

occur

Adding

a

node

into

the

ring

just

generates

a

new

tuple

into

the

places

of

the

Pr/T-net

New

tuples

obey

the

same

MAC

algorithm

as

other

nodes

only

the

number

of

possible

destination

addresses

increases

The

order

in

which

the

frames

and

requests

travel

from

node

to

node

changes

but

principally

the

whole

ring

operates

in

the

same

way

as

earlier

that

is

before

one

node

was

added

Proposition

There

are

no

terminal

nodes

in

the

reachability

graph

of

the

Pr/T-net

model

of

the

Frame

Synchronized

Ring

with

arbitrary

number

of

nodes

Proof

The

proposition

is

proved

by

contradiction

Let

the

number

of

nodes

in

the

Pr/T-net

in

Figure

be

N

and

let

us

assume

that

there

is

one

or

more

terminal

nodes

in

the

reachability

graph

of

the

net

The

deadlock

in

the

model

means

that

after

the

moment

the

deadlock

occurs

the

transition

Bus

clock

can

never

be

enabled

The

transition

is

enabled

if

and

only

if

the

bus

clock

bit

of

every

node

is

So

if

the

transition

is

not

enabled

at

least

one

of

the

bus

clock

bits

must

be

If

the

transition

is

ored

the

bus

clock

bit

of

every

node

is

set

to

A

node

can

execute

the

medium

access

control

algorithm

-LRB-

ore

one

of

the

ove

transitions

of

the

net

in

Figure

-RRB-

if

and

only

if

its

bus

clock

bit

is

After

the

execution

the

bus

clock

bit

is

so

the

node

can

not

execute

the

algorithm

again

before

the

transition

Bus

clock

is

ored

At

least

one

of

the

ove

transitions

corresponding

the

dioeerent

parts

in

the

MAC

algorithm

is

always

enabled

when

the

bus

clock

bit

of

a

node

is

In

the

AEow

chart

of

the

medium

access

control

algorithm

there

is

always

a

path

from

START

to

END

It

does

not

matter

which

branch

is

chosen

in

decision

diamonds

because

every

diamond

has

YES

and

NO

branches

So

it

is

impossible

that

no

transition

is

enabled

when

the

bus

clock

bit

is

When

every

node

has

once

executed

the

algorithm

the

Bus

clock

transition

becomes

enabled

which

leads

to

contradiction

with

our

assumption

that

there

are

terminal

nodes

in

the

reachability

graph

According

to

proposition

there

are

not

deadlocks

in

the

reachability

graph

of

the

Pr/T-net

model

of

the

FSR-bus

when

the

MAC

algorithm

is

executed

correctly

by

the

nodes

This

implies

that

the

FSR-bus

can

not

deadlock

This

is

very

important

result

because

now

it

is

known

that

every

deadlock

that

occurs

in

the

bus

is

caused

by

the

environment

The

environment

can

for

example

change

the

request

line

in

such

a

way

that

every

node

is

continuously

receiving

requests

In

such

a

situation

no

node

can

never

get

access

to

the

bus

Fairness

Fairness

is

closely

related

to

deadlocks

The

situation

where

a

node

never

gets

access

to

the

bus

can

be

considered

a

deadlock

In

fact

this

situation

is

a

livelock

where

a

node

waits

for

the

access

to

the

bus

forever

If

there

are

no

deadlocks

in

the

reachability

graph

of

the

FSR-bus

and

the

bus

can

be

proved

to

be

fair

then

the

MAC

algorithm

is

correct

According

to

-LSB-

-RSB-

the

FSR-bus

is

fair

if

every

node

having

data

to

send

gets

access

to

the

bus

after

a

onite

waiting

time

According

to

the

same

paper

the

fairness

can

be

deoned

by

properties

and

given

below

Property

A

node

that

has

issued

a

service

request

will

be

granted

to

get

access

to

the

bus

Property

Every

node

suspended

from

transmission

will

be

granted

to

issue

a

service

request

In

the

reachability

graph

property

means

that

on

every

path

starting

from

a

vertex

in

which

a

node

has

issued

a

service

request

a

node

will

eventually

get

access

to

the

bus

Property

is

easy

to

prove

by

contradiction

If

at

least

one

path

is

found

where

a

node

has

issued

a

request

but

can

never

get

the

access

to

the

bus

property

does

not

hold

The

reachability

graph

of

the

FSR-bus

consists

of

a

onite

number

of

vertices

So

a

path

in

which

a

node

has

to

wait

forever

must

include

a

cycle

A

cycle

is

a

path

the

orst

marking

of

which

equals

to

the

last

marking

When

property

is

negated

and

implication

is

changed

using

the

tautologies

-LRB-

A

-RRB-

B

-RRB-

-LRB-

A

B

:-LRB-

A

B

-RRB-

-RRB-

and

-LRB-

:-RRB-

as

in

orst-order

predicate

logic

the

negated

property

can

be

read

as

There

is

a

cycle

in

a

reachability

graph

starting

from

a

vertex

in

which

a

node

has

issued

a

service

request

and

in

this

cycle

a

node

will

never

get

access

to

the

bus

This

property

is

easily

proved

with

probe

The

sketch

of

proof

of

property

with

probe

goes

as

follows

ffl

First

such

vertices

in

the

reachability

graph

are

searched

for

where

a

node

in

the

bus

has

issued

a

service

request

A

node

has

issued

a

service

request

if

both

its

request

bits

are

Note

that

when

a

node

is

forwarding

requests

from

other

nodes

its

both

request

bits

are

too

So

it

is

also

proved

that

no

node

sends

requests

inonitely

long

time

Note

that

only

those

vertices

are

searched

in

which

the

bus

clock

bit

of

every

node

is

This

decreases

the

number

of

vertices

in

the

query

set

and

probe

computes

the

answer

faster

This

reduction

can

be

done

because

after

a

node

has

issued

a

request

its

bus

clock

bit

is

and

both

of

its

request

bits

are

So

it

does

not

matter

what

the

values

of

bus

clock

bits

of

other

nodes

are

-LRB-

Other

nodes

can

not

aoeect

the

requesting

node

-RRB-

The

easiest

situation

occurs

when

every

bus

clock

bit

is

ffl

From

these

vertices

of

the

reachability

graph

a

path

which

contains

a

cycle

and

in

which

a

node

can

not

get

access

to

the

bus

is

searched

for

A

node

do

not

get

access

to

the

bus

if

it

is

ready

to

send

but

the

node

sending

bit

is

ffl

If

such

a

path

is

found

it

is

possible

that

the

cycle

is

looped

forever

The

node

does

not

get

access

to

the

bus

the

negation

of

property

holds

and

the

property

does

not

hold

Property

is

proved

with

the

probe

query

seen

below

The

query

returns

every

cycle

in

which

a

node

has

issued

a

service

request

but

does

not

get

access

to

the

bus

If

probe

returns

an

empty

set

there

are

no

such

cycles

in

the

reachability

graph

and

property

holds

#define

-LRB-

-RRB-

query

volatile

node

-LRB-

-LRB-

-LRB-

-LRB-

-RRB-

-LRB-

field

-LSB-

-RSB-

-LRB-

-RRB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

-RRB-

-RRB-

empty

-RRB-

and

fire

-LRB-

-LRB-

-RRB-

-RRB-

true

-RRB-

and

dspan

-LRB-

-LRB-

-LRB-

-LRB-

NODES

-RRB-

-LRB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

-RRB-

-RRB-

empty

-RRB-

true

-RRB-

false

The

sketch

of

proof

of

property

is

quite

similar

to

that

of

property

Property

is

negated

and

it

is

proved

that

the

negation

of

the

property

does

not

hold

The

negation

of

property

can

be

read

as

There

is

a

cycle

in

the

reachability

graph

starting

from

a

vertex

in

which

a

node

is

suspended

and

in

this

cycle

a

node

can

never

issue

a

service

request

This

can

not

be

directly

proved

with

probe

because

there

are

three

dioeerent

reasons

why

a

node

does

not

issue

a

request

even

though

it

is

suspended

-RRB-

A

node

does

not

issue

a

service

request

if

it

gets

access

to

the

bus

before

it

has

issued

a

request

-RRB-

If

there

are

incoming

requests

the

node

can

not

issue

its

own

request

-RRB-

When

there

are

not

incoming

requests

it

may

be

possible

that

a

new

request

is

received

before

a

node

has

issued

its

own

request

The

sketch

of

proof

of

property

with

probe

goes

as

follows

ffl

First

such

vertices

of

the

reachability

graph

are

searched

for

where

a

node

in

the

bus

has

been

suspended

A

node

is

suspended

if

it

is

ready

to

send

but

it

does

not

send

anything

ffl

A

path

starting

from

these

vertices

is

searched

for

which

contains

a

cycle

and

in

which

-RRB-

a

node

does

not

send

a

frame

and

-RRB-

a

node

continuously

receives

requests

of

other

nodes

or

-RRB-

a

node

does

not

receive

requests

but

does

not

issue

its

own

request

ffl

If

such

a

path

is

found

it

is

possible

that

a

cycle

is

looped

forever

A

node

can

not

issue

a

service

request

the

negation

of

property

holds

and

property

does

not

hold

Property

can

be

proved

with

the

probe

query

seen

below

probe

answers

to

the

query

by

returning

every

cycle

in

which

a

node

is

suspended

a

node

continuously

receives

requests

from

other

nodes

a

node

never

sends

its

own

request

and

a

node

never

gets

access

to

the

bus

If

probe

returns

an

empty

set

a

suspended

node

either

sends

its

own

request

or

gets

access

to

the

bus

In

that

case

property

holds

#define

-LRB-

-RRB-

query

volatile

node

-LRB-

-LRB-

-LRB-

NODES

-RRB-

-LRB-

field

-LSB-

-RSB-

-LRB-

-RRB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

-RRB-

-RRB-

empty

-RRB-

and

dspan

-LRB-

-LRB-

-LRB-

-LRB-

-LRB-

-RRB-

-LRB-

field

-LSB-

-RSB-

-LRB-

-RRB-

-LRB-

field

-LSB-

-RSB-

-LRB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

-RRB-

-RRB-

-RRB-

-RRB-

empty

-RRB-

-LRB-

-LRB-

-LRB-

NODES

-RRB-

-LRB-

field

-LSB-

-RSB-

-LRB-

-RRB-

field

-LSB-

-RSB-

-RRB-

-RRB-

empty

-RRB-

-RRB-

true

-RRB-

false

Now

it

is

easy

to

prove

properties

and

The

properties

are

proved

for

every

node

in

the

model

consisting

of

four

nodes

So

if

every

node

which

is

ready

to

send

will

get

access

to

the

bus

in

a

onite

time

the

FSR-bus

is

fair

Proposition

The

Pr/T-net

model

of

the

FSR-bus

in

Figure

satisoes

the

properties

and

Proof

Let

us

assume

that

properties

and

does

not

hold

in

the

Pr/T

net

in

Figure

Then

probe

queries

ond

all

such

cycles

where

the

properties

do

not

hold

Because

such

paths

are

not

found

properties

and

do

hold

in

the

Pr/T-net

-LRB-

-RRB-

paths

-LRB-

-RRB-

paths

-LRB-

-RRB-

paths

-LRB-

-RRB-

paths

-LRB-

-RRB-

paths

-LRB-

-RRB-

paths

-LRB-

-RRB-

paths

-LRB-

-RRB-

paths

The

fairness

of

the

Pr/T-net

of

the

FSR-bus

implies

that

the

FSR-bus

is

fair

So

no

node

has

to

wait

forever

to

get

access

to

the

bus

Now

it

has

been

proved

that

the

bus

operates

correctly

Waiting

Times

of

the

Nodes

Even

though

the

fairness

of

the

FSR-bus

has

now

been

proved

it

does

not

give

us

much

information

about

the

performance

of

the

bus

A

node

that

is

ready

to

send

will

start

transmitting

its

data

in

a

onite

time

but

how

long

this

waiting

time

can

actually

be

In

real

time

applications

long

waiting

times

are

undesirable

because

delayed

frames

are

usually

lost

If

the

probe

queries

of

the

previous

Section

are

changed

so

that

they

do

not

detect

inonite

paths

but

do

detect

all

the

paths

where

a

node

is

waiting

it

should

be

possible

to

ond

for

example

the

maximal

waiting

time

of

a

node

When

a

node

becomes

ready

to

send

it

has

to

wait

for

a

turn

When

it

has

got

a

turn

it

has

to

wait

to

-RRB-

be

allowed

to

issue

a

service

request

and

-RRB-

get

access

to

the

bus

These

two

waiting

times

are

examined

separately

First

it

is

tried

to

ond

a

maximal

waiting

time

a

node

has

to

wait

from

the

moment

it

gets

ready

to

send

to

the

moment

it

can

send

a

service

request

Then

it

is

tried

to

ond

the

maximal

waiting

time

of

the

node

from

the

moment

it

gets

ready

to

send

to

the

moment

it

sends

the

header

All

waiting

times

are

measured

in

number

of

frames

passing

the

node

before

it

can

capture

a

frame

Request

Waiting

Time

When

a

node

becomes

ready

to

send

it

can

not

begin

transmitting

or

issue

its

service

request

at

once

if

there

is

heavy

traOEc

on

the

bus

The

maximal

time

a

node

has

to

wait

is

now

searched

with

probe

The

heuristic

to

ond

the

maximal

waiting

time

goes

as

follows

ffl

From

the

reachability

graph

of

the

Pr/T-net

such

vertices

are

searched

for

where

a

node

in

the

bus

is

ready

to

send

but

it

does

not

have

a

turn

and

it

is

not

sending

If

a

node

has

a

turn

it

can

issue

a

request

at

once

ffl

Paths

starting

from

these

vertices

are

examined

The

paths

on

every

vertex

of

which

except

the

last

one

a

node

does

not

issue

a

request

and

on

the

last

vertex

of

which

a

node

issues

a

request

are

saved

into

a

ole

ffl

The

longest

path

is

chosen

from

the

set

of

waiting

paths

saved

Below

two

macros

are

seen

with

which

every

waiting

path

where

a

node

is

waiting

to

get

a

turn

to

issue

its

service

request

is

found

The

macro

Wait

nodes

returns

every

vertex

in

which

a

node

is

ready

to

send

is

not

sending

and

does

not

have

a

turn

The

macro

Wait

paths

is

used

in

every

vertex

returned

by

Wait

nodes

Wait

paths

returns

every

path

on

every

vertex

of

which

except

the

last

one

the

request

bits

are

not

and

When

input

request

becomes

a

node

gets

a

turn

to

issue

its

request

The

longest

path

is

then

found

from

the

set

of

paths

generated

by

PROD

with

the

simple

C

program

given

in

Appendix

A

The

program

counts

the

number

of

transitions

on

the

path

The

longest

path

is

a

path

which

contains

the

largest

number

of

transitions

The

program

can

be

easily

extended

to

ond

all

equally

long

paths

or

for

example

ten

longest

paths

#define

-LRB-

n

-RRB-

query

node

-LRB-

-LRB-

-LRB-

NODES

-RRB-

-LRB-

field

-LSB-

-RSB-

-LRB-

n

-RRB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

-RRB-

-RRB-

empty

-RRB-

#define

-LRB-

n

-RRB-

query

dpath

-LRB-

-LRB-

-LRB-

-LRB-

-LRB-

NODES

-RRB-

-LRB-

field

-LSB-

-RSB-

-LRB-

n

-RRB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

-RRB-

-RRB-

empty

-RRB-

-LRB-

-LRB-

-LRB-

-RRB-

-LRB-

field

-LSB-

-RSB-

-LRB-

n

-RRB-

-LRB-

-LRB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

-RRB-

-RRB-

-RRB-

-RRB-

empty

-RRB-

-RRB-

true

-RRB-

-LRB-

-LRB-

-LRB-

-RRB-

-LRB-

field

-LSB-

-RSB-

-LRB-

n

-RRB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

-RRB-

-RRB-

empty

-RRB-

In

the

reachability

graph

of

the

Pr/T-net

model

of

the

FSR-bus

there

are

vertices

where

a

node

is

waiting

for

a

turn

to

issue

a

service

request

From

these

vertices

a

maximal

waiting

time

measured

in

by-passing

frames

is

four

which

is

the

same

as

the

number

of

the

nodes

in

the

ring

One

situation

in

which

the

longest

waiting

time

found

occurs

goes

as

follows

A

waiting

node

does

not

necessarily

have

to

be

node

Its

number

can

be

anything

as

long

as

the

order

of

the

nodes

does

not

change

The

possible

numberings

of

the

nodes

are

seen

in

Figure

The

rectangulars

represent

the

nodes

For

example

if

node

is

chosen

as

a

waiting

node

then

the

output

node

of

the

waiting

node

is

node

and

the

input

node

is

node

WAITS

DataRequest

Figure

Possible

numberings

of

the

nodes

ffl

Node

becomes

ready

to

send

when

its

both

request

out

and

request

in

bits

are

It

does

not

have

a

turn

Node

is

next

to

node

and

is

sending

requests

so

it

has

a

turn

The

requests

have

reached

the

previous

node

of

the

node

which

is

node

The

next

node

to

the

node

is

node

which

receives

an

empty

frame

and

the

frame

synchronization

signal

So

it

captures

the

frame

Node

has

become

ready

to

send

before

it

has

received

the

request

from

node

So

it

has

a

turn

ffl

Node

captures

a

frame

and

sends

it

to

itself

ffl

Node

has

a

turn

so

it

sends

a

frame

to

node

ffl

Node

sends

a

frame

to

itself

again

ffl

Node

has

been

sending

requests

so

it

gets

a

turn

to

send

next

ffl

When

node

removes

its

request

node

can

issue

its

request

So

it

had

to

wait

four

frames

to

get

a

turn

to

issue

a

request

Bus

Access

Waiting

Time

To

ond

the

maximal

waiting

time

from

the

moment

a

node

becomes

ready

to

send

to

the

moment

it

onally

gets

access

to

the

bus

all

possible

waiting

situations

have

to

be

taken

into

account

From

these

paths

the

maximal

path

is

found

by

the

C

program

shown

in

Appendix

A

There

are

totally

vertices

in

the

reachability

graph

where

a

node

is

waiting

to

get

access

to

the

bus

For

each

of

these

vertices

there

are

paths

at

the

last

vertex

of

which

a

node

begins

transmitting

It

was

found

too

time

and

space

consuming

to

go

through

all

these

alternatives

so

two

heuristics

were

used

to

ond

the

maximal

waiting

time

In

the

orst

heuristic

it

is

assumed

that

a

maximal

waiting

time

occurs

in

the

same

situation

when

a

node

has

to

wait

the

maximal

time

before

it

can

issue

its

service

request

The

second

heuristic

is

not

so

strong

It

is

assumed

that

a

maximal

waiting

time

occurs

when

a

node

orst

has

to

wait

a

turn

to

issue

a

service

request

-LRB-

perhaps

only

a

short

time

period

-RRB-

In

the

orst

heuristic

maximal

waiting

paths

were

searched

from

every

vertex

where

a

node

has

to

wait

a

maximal

time

to

get

a

turn

to

issue

a

request

The

paths

were

found

with

the

Waiting

time

query

seen

below

The

longest

waiting

path

found

was

nine

frames

In

the

second

heuristic

such

vertices

were

searched

for

where

a

node

could

not

issue

a

request

-LRB-

it

receives

requests

from

other

nodes

-RRB-

and

the

bus

was

not

empty

This

was

done

with

the

query

Waiting

vertices

seen

below

Waiting

vertices

returns

vertices

Paths

starting

from

these

vertices

were

examined

with

the

query

Waiting

time

and

longest

path

was

found

with

the

C

program

The

longest

path

found

was

ten

frames

and

one

such

path

is

the

following

-LRB-

waiting

path

for

node

-RRB-

Node

numbers

can

be

anything

as

long

as

the

order

does

not

change

as

in

Figure

ffl

Node

sends

a

frame

to

itself

so

frame

available

bit

of

every

other

node

is

Other

nodes

are

not

ready

to

send

ffl

Node

sends

a

frame

to

itself

again

but

now

nodes

and

become

ready

to

send

ffl

Node

becomes

ready

to

send

when

it

receives

a

frame

of

node

ffl

Node

sends

a

frame

to

itself

ffl

Node

gets

the

turn

So

an

empty

frame

passes

node

ffl

Node

sends

a

frame

to

itself

Node

gets

a

turn

to

issue

a

service

request

Node

had

to

wait

three

frames

before

it

could

issue

a

request

ffl

Node

sends

a

frame

to

node

ffl

Node

sends

a

frame

to

itself

ffl

Node

sends

a

frame

to

node

ffl

Node

sends

a

frame

to

itself

ffl

Node

sends

a

frame

to

node

ffl

Node

sends

a

frame

to

itself

ffl

Node

gets

access

to

the

bus

after

ten

by-passing

frames

Note

that

in

the

maximal

waiting

path

that

was

found

a

node

did

not

have

to

wait

a

maximal

time

to

get

a

turn

to

issue

a

service

request

This

explains

why

maximum

waiting

path

with

the

orst

heuristic

was

only

nine

frames

When

the

number

of

nodes

in

the

Pr/T-net

model

was

reduced

to

three

the

maximal

waiting

path

found

was

ove

frames

First

a

node

had

to

wait

two

frames

to

get

a

turn

to

issue

a

request

after

which

it

has

to

wait

three

additional

frames

to

get

access

to

the

bus

The

paths

were

searched

with

Waiting

time

macro

seen

below

where

the

number

of

time

slots

was

One

waiting

path

that

was

found

with

PROD

and

is

ove

frames

long

goes

as

follows

Node

is

waiting

to

get

access

to

the

bus

ffl

First

node

sends

a

frame

to

node

Node

is

not

ready

to

send

When

node

receives

a

frame

it

sends

a

frame

to

itself

Nodes

and

are

both

ready

to

send

ffl

Node

sends

a

frame

to

itself

ffl

An

empty

frame

passes

node

ffl

Node

sends

a

frame

to

itself

Node

gets

a

turn

and

issues

a

service

request

ffl

Node

sends

a

frame

to

node

ffl

Node

sends

a

frame

to

itself

ffl

Node

gets

access

to

the

bus

The

macro

Waiting

vertices

returns

every

vertex

of

the

reachability

graph

in

which

a

node

is

ready

to

send

does

not

have

a

turn

is

not

sending

the

input

request

line

of

the

node

is

and

the

node

receives

an

occupied

header

that

is

not

addressed

to

it

The

macro

Waiting

time

is

asked

in

the

vertices

found

by

Waiting

vertices

Waiting

time

returns

every

path

in

the

last

vertex

of

which

a

node

begins

transmitting

and

it

has

not

sent

any

time

slots

#define

-LRB-

-RRB-

query

volatile

node

-LRB-

-LRB-

-LRB-

-LRB-

NODES

-RRB-

-LRB-

field

-LSB-

-RSB-

-LRB-

-RRB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

-RRB-

-RRB-

empty

-RRB-

-LRB-

-LRB-

-LRB-

-RRB-

-LRB-

field

-LSB-

-RSB-

-LRB-

-RRB-

field

-LSB-

-RSB-

-RRB-

-RRB-

empty

-RRB-

-LRB-

-LRB-

-LRB-

BUS

-RRB-

-LRB-

field

-LSB-

-RSB-

-LRB-

-RRB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

-LRB-

-RRB-

-RRB-

-RRB-

empty

-RRB-

-RRB-

#define

-LRB-

-RRB-

query

dpath

-LRB-

-LRB-

-LRB-

-LRB-

NODES

-RRB-

-LRB-

field

-LSB-

-RSB-

-LRB-

-RRB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

-RRB-

-RRB-

empty

-RRB-

false

-RRB-

-LRB-

-LRB-

-LRB-

NODES

-RRB-

-LRB-

field

-LSB-

-RSB-

-LRB-

-RRB-

field

-LSB-

-RSB-

field

-LSB-

-RSB-

-RRB-

-RRB-

empty

-RRB-

The

longest

waiting

time

was

found

to

be

ten

by-passing

frames

in

the

model

of

four

nodes

When

a

model

consists

of

three

nodes

a

longest

waiting

time

found

was

only

ove

frames

However

Raatikainen

-LSB-

-RSB-

has

developed

an

equation

according

to

which

the

longest

waiting

time

is

frames

when

there

are

four

nodes

in

the

ring

and

each

frame

consists

four

time

slots

In

equation

-LRB-

-RRB-

the

orst

term

tells

the

number

of

frames

a

node

has

to

wait

to

get

access

to

the

bus

when

it

has

a

turn

The

third

term

tells

the

number

of

frames

a

node

has

to

wait

to

get

a

turn

to

issue

a

service

request

The

sum

expression

decreases

the

waiting

time

when

the

number

of

nodes

in

the

ring

is

larger

than

ove

TFR

is

the

number

of

time

slots

in

a

frame

and

can

be

omitted

if

only

by-passing

frames

are

counted

TQMAX

-LRB-

N

-RRB-

-LSB-

-LRB-

-RRB-

N

X

i

bN

c

-LRB-

i

-RRB-

N

-RSB-

TFR

N

-LRB-

-RRB-

It

was

found

that

the

longest

time

a

node

had

to

wait

to

get

a

turn

to

issue

a

request

was

four

frames

as

in

equation

-LRB-

-RRB-

The

longest

waiting

time

a

node

had

to

wait

to

get

access

to

the

bus

when

it

already

had

a

turn

was

seven

frames

as

in

equation

-LRB-

-RRB-

However

the

longest

waiting

times

never

occurred

in

the

same

waiting

situation

The

longest

waiting

time

occurred

when

a

node

had

to

wait

a

turn

to

issue

a

request

only

three

frames

One

reason

why

as

long

waiting

paths

as

in

equation

-LRB-

-RRB-

were

not

found

is

that

in

the

orst

heuristic

every

situation

in

which

a

node

has

to

wait

four

frames

to

get

a

turn

to

issue

a

request

were

not

detected

This

is

caused

by

the

fact

that

the

exact

time

when

a

node

issues

a

request

can

not

be

seen

in

the

reachability

graph

When

a

node

issues

a

request

both

request

bits

are

set

to

The

bits

are

too

if

a

node

continuously

receives

requests

from

other

nodes

and

can

not

issue

its

own

request

So

the

orst

or

the

last

frame

that

passes

the

node

is

easily

missed

The

maximal

waiting

times

of

the

nodes

are

studied

further

The

Pr/T-net

model

and

probe

queries

are

developed

so

that

equation

-LRB-

-RRB-

could

be

proved

with

PROD

However

it

is

very

interesting

to

see

that

there

can

be

quite

long

waiting

times

in

the

bus

In

the

real

bus

the

waiting

times

depend

on

the

traOEc

on

the

bus

The

situation

that

the

longest

maximal

waiting

time

occurs

is

rare

and

its

probability

decreases

when

the

number

of

the

nodes

in

the

ring

increases

Problems

in

Analysis

Though

all

the

goals

that

were

placed

in

Introduction

have

been

achieved

a

number

of

problems

arose

during

this

work

The

main

problem

in

the

reachability

analysis

was

the

state

space

explosion

The

largest

reachability

graph

which

could

be

successfully

generated

consisted

of

four

nodes

A

couple

of

methods

were

used

to

reduce

the

size

of

the

state

space

However

the

use

of

these

methods

was

found

frustrating

because

of

the

exponential

growth

of

the

computation

time

needed

to

generate

the

reachability

graph

When

the

number

of

reachable

states

increases

the

computation

time

needed

to

ond

an

answer

to

a

probe

query

increases

too

To

go

through

every

reachable

state

in

a

graph

consisting

of

about

one

hundred

thousand

vertices

takes

several

minutes

with

probe

It

easily

takes

a

couple

of

days

to

search

for

waiting

paths

in

reachability

graphs

Even

though

larger

reachability

graphs

could

be

generated

the

computation

time

to

answer

the

queries

could

become

unacceptably

long

Attacks

against

State

Space

Explosion

In

PROD

the

reachability

graph

generator

program

unfolds

a

Pr/T-net

into

a

P/T-net

-LRB-

place/transition

net

-RRB-

before

it

applies

the

stubborn

set

or

symmetry

method

There

was

not

enough

memory

to

unfold

the

Pr/T-net

of

the

FSR-bus

because

the

transition

Bus

clock

had

so

many

low

level

instances

Transition

Bus

clock

has

binary

variables

when

there

are

only

two

nodes

in

the

ring

So

there

are

feasible

substitutions

which

can

be

applied

to

the

variables

of

the

arc

expressions

of

the

transition

The

number

of

feasible

substitutions

increases

when

nodes

are

added

to

the

ring

The

transition

Bus

clock

was

replaced

by

two

transitions

Bus

clock

a

gave

the

clock

signal

to

the

data

bus

and

Bus

clock

b

to

the

request

line

as

seen

below

The

number

of

feasible

substitutions

was

reduced

to

But

an

extra

transition

increased

the

number

of

reachable

states

So

when

the

stubborn

set

method

was

applied

to

the

Pr/T-net

of

four

nodes

the

number

of

vertices

in

the

graph

was

-LRB-

-RRB-

and

the

number

of

edges

was

-LRB-

-RRB-

The

number

in

the

parenthesis

is

the

corresponding

number

of

the

reachability

graph

of

the

basic

model

The

computation

of

the

reachability

graph

with

stubborn

set

method

took

about

one

day

The

generation

of

all

the

vertices

took

a

couple

of

hours

If

the

method

reduced

the

size

of

the

graph

about

to

one

third

and

the

graph

with

ove

nodes

included

about

four

million

vertices

it

would

take

about

a

month

to

generate

the

reduced

reachability

graph

of

ove

nodes

However

it

could

be

seen

that

the

stubborn

set

method

greatly

reduced

the

number

of

edges

in

the

reachability

graph

even

though

the

number

of

reachable

states

did

not

reduce

as

much

as

it

was

hoped

#trans

in

-LCB-

BUS

NODES

-RCB-

out

-LCB-

BUS

NODES

-RCB-

#endtr

#trans

in

-LCB-

BUS

o

a

-RCB-

out

-LCB-

BUS

-LRB-

-LRB-

-RRB-

-RRB-

-LRB-

-LRB-

-RRB-

-RRB-

o

-LRB-

-LRB-

-RRB-

-RRB-

a

-LRB-

-RRB-

-LRB-

-RRB-

o

-LRB-

-RRB-

a

-RCB-

gate

-LRB-

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

#endtr

#trans

in

-LCB-

-RCB-

out

-LCB-

-RCB-

#endtr

When

symmetry

method

was

applied

in

addition

to

the

unfolding

problem

the

computation

of

symmetries

was

found

to

be

very

slow

It

took

almost

ove

days

to

compute

all

the

symmetries

in

the

model

of

three

nodes

The

reachability

graph

included

-LRB-

-RRB-

vertices

The

computation

of

symmetries

would

take

unacceptably

long

time

when

a

number

of

nodes

is

larger

than

three

The

generation

of

the

reachability

graph

does

not

take

a

very

long

time

when

of

the

methods

proposed

previously

is

used

It

is

possible

to

generate

more

than

million

states

in

one

day

With

the

third

method

that

was

applied

the

disk

space

needed

by

the

graph

was

tried

to

be

reduced

A

graph

consisting

of

four

million

vertices

can

be

generated

in

a

week

if

there

is

enough

disk

space

into

which

a

graph

can

be

saved

The

Pr/T-net

model

of

the

FSR-bus

contains

many

binary

variables

If

one

memory

word

is

used

to

express

the

markings

of

the

net

it

should

be

possible

to

generate

more

reachable

states

in

the

same

space

All

the

variables

in

the

places

NODES

REQUEST

LINE

and

BUS

were

joined

into

one

pair

NODEBUS

where

the

orst

oeld

was

the

number

of

the

node

and

the

second

oeld

included

all

its

variables

The

values

of

the

variables

are

examined

with

macros

that

do

bit

operations

Below

the

macros

places

and

one

transition

of

the

Pr/T-net

in

which

all

variables

are

packed

into

one

memory

word

are

seen

The

reduced

reachability

graph

took

about

of

the

disk

space

consumed

by

the

whole

reachability

graph

So

only

two

million

reachable

states

could

be

generated

before

the

disk

space

ran

out

The

complete

reachability

graph

could

not

be

generated

#define

-LRB-

n

-RRB-

-LRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

-RRB-

#define

-LRB-

n

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

#define

-LRB-

n

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

#define

-LRB-

n

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

#define

-LRB-

n

-RRB-

-LRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

-RRB-

#define

-LRB-

n

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

#define

-LRB-

n

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

#define

-LRB-

n

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

#define

-LRB-

n

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

#define

NISDEST

-LRB-

n

nb

-RRB-

-LRB-

-LRB-

-LRB-

n

-RRB-

-LRB-

nb

-RRB-

-RRB-

-LRB-

-LRB-

n

-RRB-

-LRB-

nb

-RRB-

-RRB-

-LRB-

-LRB-

n

-RRB-

-LRB-

nb

-RRB-

-RRB-

-LRB-

-LRB-

n

-RRB-

-LRB-

nb

-RRB-

-RRB-

-LRB-

-LRB-

n

-RRB-

-LRB-

nb

-RRB-

-RRB-

-RRB-

#define

BClock

-LRB-

n

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

#define

FrAvailable

-LRB-

n

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

#define

ReadyToSend

-LRB-

n

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

#define

Turn

-LRB-

n

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

#define

NodeSending

-LRB-

n

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

#define

RequestIn

-LRB-

n

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

#define

RequestOut

-LRB-

n

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

#define

Header

-LRB-

n

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

#define

EmptyFrame

-LRB-

n

-RRB-

-LRB-

-LRB-

n

-RRB-

-RRB-

int

OutNodeBits

#place

NODEBUS

lo

-LRB-

-RRB-

hi

-LRB-

-LRB-

-RRB-

-RRB-

mk

-LRB-

-LRB-

-RRB-

-RRB-

#place

lo

-LRB-

-RRB-

hi

-LRB-

-RRB-

mk

-LRB-

-LRB-

-RRB-

-RRB-

#trans

in

-LCB-

NODEBUS

n

NodeBits

-RCB-

out

-LCB-

NODEBUS

n

OutNodeBits

-RCB-

gate

-LRB-

Header

-LRB-

NodeBits

-RRB-

EmptyFrame

-LRB-

NodeBits

-RRB-

BClock

-LRB-

NodeBits

-RRB-

FrAvailable

-LRB-

NodeBits

-RRB-

ReadyToSend

-LRB-

NodeBits

-RRB-

Turn

-LRB-

NodeBits

-RRB-

NodeSending

-LRB-

NodeBits

-RRB-

-LRB-

-LRB-

NodeBits

-RRB-

-RRB-

-RRB-

comp

-LRB-

OutNodeBits

-RRB-

-LCB-

OutNodeBits

if

-LRB-

-LRB-

NodeBits

-RRB-

-RRB-

OutNodeBits

else

if

-LRB-

-LRB-

NodeBits

-RRB-

-RRB-

OutNodeBits

if

-LRB-

-LRB-

-LRB-

NodeBits

-RRB-

-RRB-

-RRB-

OutNodeBits

Accept

-LRB-

OutNodeBits

-RRB-

-RCB-

#endtr

of

three

methods

that

were

tried

to

reduce

the

state

space

was

not

eOEcient

enough

that

the

generation

of

the

reachability

graph

of

the

net

consisting

of

ove

nodes

would

have

been

succeeded

However

it

is

possible

to

join

all

the

transitions

of

the

net

into

one

transition

In

this

way

only

every

Nth

marking

of

the

net

would

be

generated

This

method

is

examined

further

Query

Running

Times

The

computation

time

of

a

query

can

be

greatly

reduced

if

the

answer

to

the

query

is

simply

YES

or

NO

It

took

about

eight

hours

for

probe

to

answer

the

query

of

property

and

about

hours

to

answer

the

query

of

property

Both

queries

returned

an

empty

set

Both

queries

had

to

be

asked

four

times

separately

for

every

node

number

-LRB-

and

-RRB-

In

the

queries

of

the

properties

no

methods

to

speed

up

to

computation

or

to

reduce

the

space

needed

by

the

computation

are

used

If

the

same

queries

were

used

to

prove

the

fairness

of

the

Pr/T-net

consisting

of

ove

nodes

the

computation

time

would

be

very

long

The

computation

time

increased

when

probe

searched

for

waiting

paths

-LRB-

probe

has

to

write

every

path

into

a

ole

-RRB-

Furthermore

all

the

waiting

paths

from

a

vertex

consumed

about

six

million

bytes

of

disk

space

That

is

why

it

was

found

impossible

to

go

through

all

waiting

situations

in

the

reachability

graph

of

four

nodes

To

generate

the

waiting

paths

for

one

vertex

took

about

twenty

minutes

So

to

generate

all

the

waiting

paths

would

take

more

than

days

With

two

heuristics

presented

in

Section

the

longest

waiting

path

was

found

from

a

set

containing

only

waiting

situations

The

queries

can

be

further

developed

to

ond

answers

more

quickly

However

query

running

times

were

not

found

unacceptably

long

Even

though

the

paths

could

be

found

more

faster

the

disk

space

needed

to

save

the

paths

would

run

out

One

way

to

reduce

the

number

of

paths

in

the

answer

set

is

to

add

more

conditions

into

the

queries

But

when

more

conditions

are

added

it

must

be

made

sure

that

the

desired

path

for

example

a

maximum

waiting

path

is

still

found

in

the

reachability

graph

Conclusions

In

this

work

predicate/transition

nets

were

used

in

the

modelling

and

analysis

of

the

medium

access

control

algorithm

of

the

Frame

Synchronized

Ring

Pr/T-nets

turned

out

to

be

a

suitable

choice

because

the

modelling

of

the

bus

was

fast

and

easy

with

them

compared

to

other

formalisms

for

example

process

algebras

and

temporal

logic

In

addition

the

analysis

is

very

diOEcult

and

time

consuming

with

temporal

logic

but

can

be

done

automatically

with

Pr/T-nets

The

analysis

of

the

bus

is

based

on

the

reachability

analysis

The

reachability

graphs

of

the

nets

were

generated

by

a

Pr/T-net

reachability

analysis

tool

PROD

With

PROD

it

was

proved

that

the

bus

can

not

deadlock

by

proving

that

there

are

no

terminal

nodes

in

the

reachability

graph

of

the

net

that

models

the

bus

Two

models

of

the

bus

were

developed

One

modelled

the

basic

operation

of

the

bus

and

the

algorithm

The

other

included

error

situations

in

which

a

reception

of

a

frame

failed

In

addition

the

nodes

of

the

other

model

had

credit

i.e.

they

could

send

more

than

one

frame

before

other

nodes

could

interrupt

them

by

sending

requests

It

was

proved

that

neither

of

these

models

includes

any

terminal

nodes

This

was

the

main

goal

of

this

work

The

developers

of

the

bus

and

in

the

future

the

users

of

the

bus

want

to

know

whether

the

bus

can

deadlock

However

the

property

has

not

been

proved

until

now

Even

though

the

probability

of

a

deadlock

were

negligible

one

deadlock

could

cause

unnecessary

and

even

dangerous

problems

in

real

time

applications

If

the

FSR-bus

were

used

in

packet

switching

all

alarm

messages

would

be

possibly

lost

in

an

emergency

situation

if

the

bus

deadlocked

That

is

why

it

is

very

important

that

it

has

been

proved

that

the

bus

does

not

deadlock

The

state

space

of

the

reachability

graph

grew

so

fast

that

only

a

reachability

graph

of

the

net

consisting

of

four

nodes

or

less

could

be

generated

The

state

space

explosion

of

the

reachability

analysis

was

tried

to

be

avoided

with

three

methods

stubborn

set

method

symmetry

method

and

bit

packing

Even

though

the

computation

time

of

the

reachability

graph

increases

when

these

methods

are

applied

they

turned

out

to

be

quite

eOEcient

With

stubborn

set

method

the

number

of

reachable

states

could

be

reduced

and

the

number

of

edges

as

much

as

in

the

Pr/T-net

of

four

nodes

In

the

bit

packing

all

the

variables

of

the

net

were

packed

into

one

memory

word

This

reduced

the

disk

space

consumed

by

the

reachability

graph

about

The

symmetry

method

was

not

as

eOEcient

as

two

other

methods

In

addition

the

computation

of

symmetries

was

slow

Unfortunately

the

state

space

grew

so

quickly

that

the

reachability

graph

of

the

net

consisting

of

ove

nodes

could

not

be

generated

with

any

of

these

methods

However

important

results

about

the

eOEciency

of

the

methods

were

obtained

The

fairness

of

the

FSR-bus

was

proved

with

probe

queries

The

FSR-bus

is

fair

if

every

node

which

is

ready

to

send

can

start

transmitting

after

a

onite

waiting

time

It

was

proved

that

the

reachability

graph

of

the

basic

Pr/T-net

of

the

FSR-bus

with

four

nodes

satisoes

these

properties

Fairness

is

an

important

property

of

a

communication

protocol

An

unfair

protocol

can

not

be

used

in

any

applications

The

property

that

the

FSR-bus

can

not

deadlock

and

the

fairness

constitute

the

main

results

of

this

work

Both

properties

have

been

tried

to

be

proved

with

simulations

and

analytical

models

Due

to

randomness

it

is

possible

that

some

event

sequence

never

occurs

in

simulations

Analytical

models

are

very

inaccurate

That

is

why

the

properties

have

not

been

able

to

be

proved

until

now

The

results

are

very

signiocant

because

now

one

can

be

sure

that

whenever

a

node

has

a

frame

to

send

it

can

not

deadlock

and

it

does

not

have

to

wait

forever

to

get

access

to

the

bus

In

real

time

applications

it

is

not

suOEcient

that

the

communication

protocol

is

fair

In

addition

it

is

important

that

nodes

do

not

have

to

wait

long

to

get

access

to

the

bus

When

waiting

times

become

long

enough

frames

are

delayed

and

they

are

received

too

late

A

receiver

has

made

a

decision

-LRB-

possibly

a

wrong

one

-RRB-

without

them

This

is

why

it

was

interesting

to

see

how

long

the

nodes

of

the

FSR-bus

actually

have

to

wait

Two

waiting

situations

were

examined

In

the

orst

one

it

was

studied

how

long

a

node

have

to

wait

before

it

can

issue

a

service

request

In

the

second

one

the

total

waiting

time

from

the

moment

a

node

becomes

ready

to

send

to

the

moment

a

node

starts

transmitting

was

examined

The

longest

waiting

time

that

was

found

in

the

orst

case

was

four

by-passing

frames

in

the

net

of

four

nodes

The

longest

total

waiting

time

that

was

found

was

ten

frames

It

is

not

proved

that

there

are

not

longer

waiting

paths

in

the

bus

because

all

waiting

situations

were

not

examined

Anyway

it

is

shown

that

in

suitable

situations

the

nodes

have

to

wait

long

to

get

access

to

the

bus

However

it

was

found

that

the

longest

queuing

situation

occurs

very

seldom

Acknowledgements

This

report

is

the

result

of

my

work

in

Digital

Systems

Laboratory

at

Helsinki

University

of

Technology

in

I

would

like

to

thank

professor

Leo

Ojala

for

giving

me

the

opportunity

to

do

this

work

I

would

also

like

to

thank

Pertti

Raatikainen

of

Telecommunications

Laboratory

of

Technical

Research

Centre

of

Finland

for

valuable

advice

and

comments

Raatikainen

has

spent

his

valuable

time

on

checking

the

Pr/T-net

of

the

FSR-bus

with

me

Juha

Zidbeck

has

given

me

many

valuable

comments

during

discussions

with

him

and

Pertti

Raatikainen

Johan

Lilius

Mikko

Tiusanen

and

Kimmo

Varpaaniemi

have

given

me

a

lot

of

ideas

and

comments

I

would

like

to

thank

them

all

This

work

was

funded

by

Telecom

Finland

References

-LSB-

-RSB-

Genrich

H.

J.

Predicate/Transition

Nets

Braner

W.

Reisig

W.

and

Rozenberg

G.

-LRB-

ed

-RRB-

Petri

Nets

Central

Models

and

Their

Properties

Advances

In

Petri

Nets

Part

I.

Lecture

Notes

in

Computer

Science

Berlin

Springer-Verlag

pp

-LSB-

-RSB-

Gr?nberg

P.

Tiusanen

M.

and

Varpaaniemi

K.

PROD?A

Pr/T-Net

Reachability

Analysis

Tool

Otaniemi

Digital

Systems

Laboratory

Helsinki

University

of

Technology

Series

B

Technical

Reports

No

p.

-LSB-

-RSB-

Harju

J.

and

Raatikainen

P.

Performance

of

the

FSR-bus

Proceedings

of

the

Second

Summer

School

on

Telecommunications

Lappeenranta

Lappeenranta

University

of

Technology

pp

-LSB-

-RSB-

Harju

J.

Raatikainen

P.

Reinikka

T.

and

Zidbeck

J.

Analysis

of

a

Link

Layer

Protocol

for

High

Speed

Data

Bus

IEEE

Conference

on

Local

Computer

Network

Minneapolis

USA

September

New

York

IEEE

Computer

Society

Press

pp

-LSB-

-RSB-

Jensen

K.

Coloured

Petri

Nets

Braner

W.

Reisig

W.

and

Rozenberg

G.

-LRB-

ed

-RRB-

Petri

Nets

Central

Models

and

Their

Properties

Advances

In

Petri

Nets

Part

I.

Lecture

Notes

in

Computer

Science

Berlin

Springer-Verlag

pp

-LSB-

-RSB-

Raatikainen

P.

and

Zidbeck

J.

Implementation

of

the

FSR-bus

a

new

high

speed

data

bus

solution

Proceedings

of

the

Second

Summer

School

on

Telecommunications

Lappeenranta

Lappeenranta

University

of

Technology

pp.

-LSB-

-RSB-

Raatikainen

P.

Zidbeck

J.

and

Flinck

H.

Frame

Synchronized

Ring

a

Bus

Concept

for

High

Speed

Processing

Applications

Integrated

Broadband

Communication

Networks

and

Services

-LRB-

IBCN&S

-RRB-

Conference

Proceedings

Copenhagen

Denmark

April

Copenhagen

Elsevier

Science

Publicers

pp.

-LSB-

-RSB-

Raatikainen

P.

and

Zidbeck

J.

Flow

diagram

of

the

FSR-bus

To

be

published

on

VTT

Publications

Series

later

this

year

-LSB-

-RSB-

Raatikainen

P.

Upper

bound

of

the

queuing

time

of

the

nodes

of

the

FSR-bus

To

be

published

on

VTT

Publications

Series

later

this

year

-LSB-

-RSB-

Rauhamaa

M.

A

Comparative

Study

of

Methods

for

EOEcient

Reachability

Analysis

Otaniemi

Digital

Systems

Laboratory

Helsinki

University

of

Technology

Series

A

Research

Reports

No.

p.

-LSB-

-RSB-

Reisig

W.

Petri

Nets

Berlin

Springer

Verlag

p.

-LSB-

-RSB-

Valmari

A.

Error

Detection

by

Reduced

Reachability

Graph

Generation

Proceedings

of

the

Ninth

European

Workshop

on

Application

and

Theory

of

Petri

Nets

Venice

pp.

-LSB-

-RSB-

Valmari

A.

Heuristics

for

Lazy

State

Generation

Speeds

up

Analysis

of

Concurrent

Systems

M?kel

M.

Linnainmaa

S.

and

Ukkonen

E.

-LRB-

ed

-RRB-

Proceedings

of

the

Finnish

Artiocial

Intelligence

Symposium

Vol

Helsinki

pp.

-LSB-

-RSB-

Varpaaniemi

K.

and

Rauhamaa

M.

The

Stubborn

Set

Method

in

Practice

Jensen

K.

-LRB-

ed

-RRB-

Application

and

Theory

of

Petri

Nets

International

Conference

SheOEeld

UK

June

Proceedings

Lecture

Notes

in

Computer

Science

Berlin

Springer-Verlag

pp.

Appendix

A

Source

Listing

of

the

C

Program

for

onding

the

Longest

Path

A

program

for

finding

the

longest

path

from

the

set

of

paths

generated

by

PROD

The

longest

path

is

a

path

that

contains

the

largest

number

of

transitions

The

program

takes

a

file

generated

by

PROD

as

an

input

The

input

file

consists

of

paths

separated

by

commas

The

path

that

contains

the

largest

number

of

transitions

is

written

into

the

output

file

#include

<stdio.h>

#include

<string.h>

#define

MAXSIZE

Maximum

path

length

void

main

-LRB-

int

argc

char

argv

-RRB-

-LCB-

FILE

in

out

char

buffer

-LSB-

MAXSIZE

-RSB-

char

longest

-LSB-

MAXSIZE

-RSB-

int

i

c

t

maxt

if

-LRB-

-LRB-

in

fopen

-LRB-

argv

-LSB-

-RSB-

r

-RRB-

-RRB-

-RRB-

-LCB-

fprintf

-LRB-

stderr

s

ca

n't

open

s

n

argv

-LSB-

-RSB-

-RRB-

exit

-LRB-

-RRB-

-RCB-

i

t

maxt

while

-LRB-

-LRB-

c

getc

-LRB-

in

-RRB-

-RRB-

EOF

-RRB-

-LCB-

if

-LRB-

c

-RRB-

-LCB-

Paths

are

separated

by

commas

buffer

-LSB-

i

-RSB-

-LRB-

char

-RRB-

c

i

if

-LRB-

c

-RRB-

indicates

a

transition

t

-RCB-

else

-LCB-

buffer

-LSB-

i

-RSB-

if

-LRB-

t

maxt

-RRB-

-LCB-

strcpy

-LRB-

longest

buffer

-RRB-

maxt

t

-RCB-

t

-RCB-

-RCB-

if

-LRB-

-LRB-

out

fopen

-LRB-

longest.log

w

-RRB-

-RRB-

-RRB-

-LCB-

fprintf

-LRB-

stderr

s

ca

n't

open

longest.log

n

-RRB-

-RCB-

else

-LCB-

i

while

-LRB-

longest

-LSB-

i

-RSB-

-RRB-

-LCB-

putc

-LRB-

longest

-LSB-

i

-RSB-

out

-RRB-

i

-RCB-

-RCB-

fclose

-LRB-

in

-RRB-

fclose

-LRB-

out

-RRB-

printf

-LRB-

d

n

maxt

-RRB-

-RCB-

Appendix

B

Basic

Net

Description

of

the

FSR-Bus

#define

N

#place

NODES

lo

-LRB-

-RRB-

hi

-LRB-

-RRB-

mk

-LRB-

-RRB-

#place

lo

-LRB-

-RRB-

hi

-LRB-

-RRB-

mk

-LRB-

-RRB-

#place

BUS

lo

-LRB-

-RRB-

hi

-LRB-

-RRB-

mk

-LRB-

-RRB-

#place

lo

-LRB-

-RRB-

hi

-LRB-

-RRB-

mk

-LRB-

-RRB-

#trans

in

-LCB-

Add

NODES

n

FrAvailable

ReadyToSend

BUS

n

Header

EmptyFrame

Address

n

RequestIn

RequestOut

-RCB-

out

-LCB-

Add

BUS

n

-LRB-

Header

-RRB-

Header

-LRB-

Header

-RRB-

EmptyFrame

-LRB-

Header

-RRB-

Add

Address

n

-LRB-

Header

-RRB-

RequestOut

-LRB-

Header

-RRB-

RequestOut

NODES

n

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

-RRB-

FrAvailable

-LRB-

ReadyToSend

-RRB-

ReadyToSend

-LRB-

Header

-RRB-

-LRB-

Header

-RRB-

-LRB-

-RRB-

-RCB-

gate

-LRB-

-LRB-

Header

-LRB-

EmptyFrame

n

Address

-RRB-

-RRB-

-LRB-

Header

FrAvailable

-RRB-

-RRB-

#endtr

#trans

in

-LCB-

Add

NODES

n

FrAvailable

ReadyToSend

BUS

n

Header

EmptyFrame

Address

n

RequestIn

RequestOut

-RCB-

out

-LCB-

Add

BUS

n

-LRB-

Header

RequestIn

-RRB-

Header

-LRB-

Header

RequestIn

-RRB-

-LRB-

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

EmptyFrame

-RRB-

EmptyFrame

-RRB-

-LRB-

Header

RequestIn

-RRB-

Add

-LRB-

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

Address

-RRB-

Address

-RRB-

n

-LRB-

-LRB-

Header

RequestIn

-RRB-

-LRB-

Header

RequestIn

-RRB-

-RRB-

RequestOut

-LRB-

-LRB-

Header

RequestIn

-RRB-

-LRB-

Header

RequestIn

-RRB-

-RRB-

RequestOut

NODES

n

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

-RRB-

FrAvailable

-LRB-

ReadyToSend

-RRB-

ReadyToSend

-LRB-

-LRB-

Header

RequestIn

-RRB-

-LRB-

Header

RequestIn

-RRB-

-RRB-

-LRB-

Header

RequestIn

-RRB-

-LRB-

Header

RequestIn

-RRB-

-LRB-

-RRB-

-RCB-

gate

-LRB-

-LRB-

Header

-LRB-

EmptyFrame

n

Address

-RRB-

-RRB-

-LRB-

Header

FrAvailable

-RRB-

-RRB-

#endtr

#trans

in

-LCB-

NODES

n

FrAvailable

ReadyToSend

Turn

BUS

n

Header

EmptyFrame

Address

n

RequestIn

RequestOut

-RCB-

out

-LCB-

BUS

n

Header

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

EmptyFrame

-RRB-

EmptyFrame

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

Address

-RRB-

Address

n

-LRB-

Turn

RequestIn

-RRB-

RequestOut

-LRB-

Turn

RequestIn

-RRB-

RequestOut

NODES

n

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

-RRB-

FrAvailable

-LRB-

ReadyToSend

-RRB-

ReadyToSend

-LRB-

Turn

RequestIn

-RRB-

Turn

-RCB-

gate

-LRB-

-LRB-

Header

-LRB-

EmptyFrame

n

Address

-RRB-

-RRB-

-LRB-

Header

FrAvailable

-RRB-

-RRB-

#endtr

#trans

in

-LCB-

NODES

n

FrAvailable

TimeSlotsToSend

BUS

n

n

RequestIn

RequestOut

-RCB-

out

-LCB-

BUS

n

n

NODES

n

FrAvailable

-LRB-

TimeSlotsToSend

-RRB-

-LRB-

TimeSlotsToSend

-RRB-

-LRB-

TimeSlotsToSend

-RRB-

-LRB-

TimeSlotsToSend

-RRB-

-LRB-

-RRB-

TimeSlotsToSend

-RCB-

#endtr

#trans

in

-LCB-

NODES

n

FrAvailable

BUS

n

Header

EmptyFrame

Address

n

RequestIn

RequestOut

-RCB-

out

-LCB-

BUS

n

Header

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

EmptyFrame

-RRB-

EmptyFrame

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

Address

-RRB-

Address

NODES

n

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

-RRB-

FrAvailable

n

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

-LRB-

-LRB-

-LRB-

RequestIn

RequestOut

-RRB-

-RRB-

RequestOut

-RRB-

RequestIn

-RRB-

-LRB-

-LRB-

FrAvailable

-RRB-

-LRB-

-LRB-

-LRB-

RequestIn

RequestOut

-RRB-

-RRB-

RequestOut

-RRB-

RequestIn

-RRB-

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

Address

-RRB-

-LRB-

-LRB-

-LRB-

RequestIn

RequestOut

-RRB-

-RRB-

RequestOut

-RRB-

RequestIn

-RRB-

-LRB-

-LRB-

FrAvailable

-RRB-

-LRB-

-LRB-

-LRB-

RequestIn

RequestOut

-RRB-

-RRB-

RequestOut

-RRB-

RequestIn

-RRB-

-RCB-

#endtr

#trans

in

-LCB-

BUS

NODES

-RCB-

out

-LCB-

BUS

NODES

-RCB-

#endtr

Appendix

C

Extended

Net

Description

of

the

FSR

Bus

#define

N

#define

C

#place

NODES

lo

-LRB-

-RRB-

hi

-LRB-

-LRB-

-RRB-

C

-LRB-

-RRB-

-RRB-

mk

-LRB-

-LRB-

-RRB-

C

-LRB-

-RRB-

-RRB-

#place

lo

-LRB-

-RRB-

hi

-LRB-

-LRB-

-RRB-

-RRB-

mk

-LRB-

-LRB-

-RRB-

-RRB-

#place

BUS

lo

-LRB-

-RRB-

hi

-LRB-

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

mk

-LRB-

-LRB-

-RRB-

-RRB-

#place

lo

-LRB-

-RRB-

hi

-LRB-

-RRB-

mk

-LRB-

-LRB-

-RRB-

-RRB-

#trans

in

-LCB-

Add

NODES

n

FrAvailable

ReadyToSend

TimeSlotsToSend

BUS

n

Header

EmptyFrame

DestinationAddress

SourceAddress

Retransmit

n

RequestIn

RequestOut

-RCB-

out

-LCB-

Add

BUS

n

Header

-LRB-

Header

-RRB-

EmptyFrame

-LRB-

Header

-RRB-

-LRB-

-LRB-

Retransmit

-RRB-

Add

DestinationAddress

-RRB-

-LRB-

Header

-RRB-

n

SourceAddress

n

-LRB-

Header

-RRB-

RequestOut

-LRB-

Header

-RRB-

RequestOut

NODES

n

-LRB-

Header

-RRB-

FrAvailable

-LRB-

ReadyToSend

-RRB-

ReadyToSend

-LRB-

Header

-RRB-

C

-LRB-

-RRB-

-RCB-

gate

-LRB-

-LRB-

Header

-LRB-

EmptyFrame

n

DestinationAddress

-LRB-

Retransmit

n

SourceAddress

-RRB-

-RRB-

-RRB-

-LRB-

Header

FrAvailable

-RRB-

-RRB-

#endtr

#trans

in

-LCB-

Add

NODES

n

FrAvailable

ReadyToSend

TimeSlotsToSend

BUS

n

Header

EmptyFrame

DestinationAddress

SourceAddress

Retransmit

n

RequestIn

RequestOut

-RCB-

out

-LCB-

Add

BUS

n

Header

-LRB-

Header

-LRB-

-LRB-

RequestIn

TimeSlotsToSend

-RRB-

TimeSlotsToSend

-RRB-

-RRB-

-LRB-

Header

-LRB-

-LRB-

RequestIn

TimeSlotsToSend

-RRB-

TimeSlotsToSend

-RRB-

-RRB-

-LRB-

-LRB-

Retransmit

-RRB-

Add

DestinationAddress

-RRB-

-LRB-

Header

-LRB-

-LRB-

RequestIn

TimeSlotsToSend

-RRB-

TimeSlotsToSend

-RRB-

-RRB-

n

n

-LRB-

-LRB-

Header

-LRB-

RequestIn

TimeSlotsToSend

-RRB-

-RRB-

-LRB-

Header

RequestIn

-RRB-

-RRB-

RequestOut

-LRB-

-LRB-

Header

-LRB-

RequestIn

TimeSlotsToSend

-RRB-

-RRB-

-LRB-

Header

RequestIn

-RRB-

-RRB-

RequestOut

NODES

n

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

DestinationAddress

-LRB-

Retransmit

n

SourceAddress

-RRB-

-RRB-

FrAvailable

-RRB-

FrAvailable

-LRB-

ReadyToSend

-RRB-

ReadyToSend

-LRB-

-LRB-

Header

-LRB-

RequestIn

TimeSlotsToSend

-RRB-

-RRB-

-LRB-

Header

RequestIn

-RRB-

-RRB-

-LRB-

Header

-LRB-

RequestIn

TimeSlotsToSend

-RRB-

-RRB-

-LRB-

Header

-RRB-

-LRB-

-LRB-

RequestIn

-RRB-

C

-LRB-

-RRB-

-LRB-

-LRB-

TimeSlotsToSend

-RRB-

C

-LRB-

-RRB-

TimeSlotsToSend

-RRB-

-RRB-

C

-LRB-

-RRB-

-RCB-

gate

-LRB-

-LRB-

Header

-LRB-

EmptyFrame

n

DestinationAddress

-LRB-

n

SourceAddress

Retransmit

-RRB-

-RRB-

-RRB-

-LRB-

Header

FrAvailable

-RRB-

-RRB-

#endtr

#trans

in

-LCB-

NODES

n

FrAvailable

ReadyToSend

Turn

TimeSlotsToSend

BUS

n

Header

EmptyFrame

DestinationAddress

SourceAddress

Retransmit

n

RequestIn

RequestOut

-RCB-

out

-LCB-

BUS

n

Header

-LRB-

n

SourceAddress

Retransmit

-RRB-

EmptyFrame

-LRB-

n

SourceAddress

Retransmit

-RRB-

DestinationAddress

-LRB-

n

SourceAddress

Retransmit

-RRB-

SourceAddress

Retransmit

n

-LRB-

Turn

RequestIn

-RRB-

RequestOut

-LRB-

Turn

RequestIn

-RRB-

RequestOut

NODES

n

-LRB-

Header

n

SourceAddress

Retransmit

-RRB-

FrAvailable

-LRB-

ReadyToSend

-RRB-

ReadyToSend

-LRB-

Turn

RequestIn

-RRB-

Turn

C

-LRB-

-RRB-

-RCB-

gate

-LRB-

-LRB-

Header

EmptyFrame

n

DestinationAddress

-LRB-

-LRB-

n

SourceAddress

Retransmit

-RRB-

n

SourceAddress

-RRB-

-RRB-

-LRB-

Header

FrAvailable

-RRB-

-RRB-

#endtr

#trans

in

-LCB-

NODES

n

FrAvailable

TimeSlotsToSend

BUS

n

n

RequestIn

RequestOut

-RCB-

out

-LCB-

BUS

n

n

NODES

n

FrAvailable

-LRB-

TimeSlotsToSend

N

TimeSlotsToSend

-LRB-

-RRB-

-RRB-

-LRB-

TimeSlotsToSend

N

TimeSlotsToSend

-LRB-

-RRB-

-RRB-

-LRB-

TimeSlotsToSend

N

TimeSlotsToSend

-LRB-

-RRB-

-RRB-

-LRB-

TimeSlotsToSend

-RRB-

-LRB-

-RRB-

TimeSlotsToSend

-RCB-

#endtr

#trans

in

-LCB-

NODES

n

FrAvailable

TimeSlotsToSend

BUS

n

Header

EmptyFrame

DestinationAddress

SourceAddress

Retransmit

n

RequestIn

RequestOut

-RCB-

out

-LCB-

BUS

n

Header

-LRB-

Header

EmptyFrame

-LRB-

n

DestinationAddress

-LRB-

n

SourceAddress

Retransmit

-RRB-

-RRB-

-RRB-

EmptyFrame

-LRB-

Header

EmptyFrame

-LRB-

n

DestinationAddress

-LRB-

n

SourceAddress

Retransmit

-RRB-

-RRB-

-RRB-

DestinationAddress

-LRB-

Header

EmptyFrame

-LRB-

n

DestinationAddress

-LRB-

n

SourceAddress

Retransmit

-RRB-

-RRB-

-RRB-

SourceAddress

-LRB-

Header

EmptyFrame

n

DestinationAddress

-RRB-

Retransmit

NODES

n

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

DestinationAddress

-LRB-

n

SourceAddress

Retransmit

-RRB-

-RRB-

-RRB-

FrAvailable

C

-LRB-

-RRB-

n

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

DestinationAddress

-LRB-

n

SourceAddress

Retransmit

-RRB-

-RRB-

-LRB-

-LRB-

-LRB-

RequestIn

RequestOut

-RRB-

-RRB-

RequestOut

-RRB-

RequestIn

-RRB-

-LRB-

-LRB-

FrAvailable

-RRB-

-LRB-

-LRB-

-LRB-

RequestIn

RequestOut

-RRB-

-RRB-

RequestOut

-RRB-

RequestIn

-RRB-

-LRB-

Header

-RRB-

-LRB-

-LRB-

EmptyFrame

n

DestinationAddress

-LRB-

n

SourceAddress

Retransmit

-RRB-

-RRB-

-LRB-

-LRB-

-LRB-

RequestIn

RequestOut

-RRB-

-RRB-

RequestOut

-RRB-

RequestIn

-RRB-

-LRB-

-LRB-

FrAvailable

-RRB-

-LRB-

-LRB-

-LRB-

RequestIn

RequestOut

-RRB-

-RRB-

RequestOut

-RRB-

RequestIn

-RRB-

-RCB-

gate

-LRB-

Retransmit

n

SourceAddress

-RRB-

#endtr

#trans

in

-LCB-

BUS

NODES

-RCB-

out

-LCB-

BUS

NODES

-RCB-

#endtr

#trans

in

-LCB-

NODES

n

FrAvailable

TimeSlotsToSend

BUS

n

n

SourceAddress

n

RequestIn

RequestOut

-RCB-

out

-LCB-

NODES

n

TimeSlotsToSend

BUS

n

n

SourceAddress

n

RequestIn

RequestIn

-RCB-

gate

-LRB-

n

SourceAddress

-RRB-

#endtr

#trans

in

-LCB-

BUS

n

n

SourceAddress

NODES

n

FrAvailable

ReadyToSend

TimeSlotsToSend

Add

n

RequestIn

RequestOut

-RCB-

out

-LCB-

BUS

n

n

SourceAddress

NODES

n

-LRB-

ReadyToSend

-RRB-

ReadyToSend

TimeSlotsToSend

Add

n

RequestIn

RequestOut

-RCB-

gate

-LRB-

n

SourceAddress

-RRB-

#endtr

#trans

in

-LCB-

BUS

n

n

SourceAddress

NODES

n

FrAvailable

ReadyToSend

TimeSlotsToSend

Add

n

RequestIn

RequestOut

-RCB-

out

-LCB-

BUS

n

n

SourceAddress

NODES

n

FrAvailable

-LRB-

ReadyToSend

-RRB-

ReadyToSend

C

-LRB-

-RRB-

Add

n

RequestIn

RequestOut

-RCB-

gate

-LRB-

n

SourceAddress

-RRB-

#endtr

concurrent and distributed systems
frame synchronized ring

predicate/transition nets
protocol verification
reachability analysis tools