1 Gas Station and Cruise Control Specifications Ronnie Apcar Edwin Chiu Hasmik Jerejian November 2, 2000 CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian CSCI Formal Methods Concurrency Examples

2 n Concurrency Issues n Brief Tutorial of Petri Nets n The Gas Station Specification n The Cruise Control Specification n Concluding Remarks n Q&A CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Agenda

3 n Synchronization and Communication n Resource sharing n Deadlock n Starvation n Non-determinism CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Concurrency Issues

4 n What are Petri Nets? –Petri Nets are a graphical formalism for systems specification n Petri Nets are formed from finite sets of –Places –Transitions –Arrows connecting either places to transitions or transitions to places CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Tutorial of Petri Nets

5 n A Petri Net (PN) is given a state by marking its places. n Marking of a PN consists of assigning a nonnegative integer to each place. –Graphically, tokens are inserted in places of a PN n Input place - arrow goes from the place to the transtion n Output place - arrow goes from the transition to the place CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Tutorial of Petri Nets (2)

6 CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Tutorial of Petri Nets (3)

7 CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Tutorial of Petri Nets (4)

8 n A transition may have one or more Input and Output places n A transition is enabled if there is at least one token in each of its input places. n An Enabled transition may fire: – one token is removed from each input place and one token is inserted in each ouput place of the transition CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Tutorial of Petri Nets (5)

9 n A Petri Net as a four-tuple (P,T,I,O), where –P is a set of places –T is a set of transitions –I is an input function: n for places leading into a transition –O is an output function n for places leading out of a transition CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Tutorial of Petri Nets (6)

10 n Describing Concurrent Systems with PN –Transitions - model events or actions –Transition Firings - model occurrence of events or execution of actions –Presence of tokens - denote existence of some condition, that allow an event or action –Transitions are concurrent - if enabled, firing of one does not prevent others from firing CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Tutorial of Petri Nets (7)

11 n Starvation –a process never receives access to a needed resource n Deadlock –iff no transition is enabled in that marking n Live –no deadlock can ever occur CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Tutorial of Petri Nets (8)

12 n Limitations and extensions of Petri Nets –similar to FSMs (Finite State Machines), control- oriented model –tokens are anonymous n solution: assigning values to tokens –not possible to specify selection policy n solution: prioritizing transitions –timing issues - don’t take time into account n solution: Timed PN CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Tutorial of Petri Nets (9)

13 Assigning values to tokens - Predicates and Functions CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Tutorial of Petri Nets (10) t2t2 P2P2 P3P3 P4P4 P5P5 t1t1 P1P1 t 1 associations: P 2 > P 1 and P 4 := P 2 + P 1 t 2 associations: P 3 > P 2 P 4 := P 3 + P 2 P 5 := P 2 + P 3

14 CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Tutorial of Petri Nets (11) Producer-Consumer

15 CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Tutorial of Petri Nets (12) Producer-Consumer

16 n Assumptions –The gas filling process begins when a customer presses a nozzle, after which time the type of gas being filled cannot be changed. –The pump nozzle and common storage tank sensors continuously sense tank fill status. –When the set threshold of any one of the 3 common storage tanks is reached, all the pump nozzles associated with that storage tank are disabled. CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Assumptions Gas Station Example

17 n Assumptions –No more than one customer can be pulled up to a particular pump at any one time, thereby eliminating the previously specified race conditions. –Each pump’s meter provides the following information: n Amount of gas dispensed in gallons n Total price of amount of gas dispensed. CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Assumptions Gas Station Example (2)

18 CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Gas Station Example Tank Component Operator: Refill_Done Operator: Enable_Pump External: Refill_Status Operator: Schedule_Refill

19 CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Gas Station Example Operator Component Pump: Available Tank: Not_Empty Tank: Reactivate_Fueling External: Refill Event Tank: Refill_Detected Customer: Go_To_Operator Customer: At_Pump Serve

20 CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Gas Station Example Pump Component Customer: Pumping Customer: Change_Status Customer: Stop_Pumping Customer: Drive_Up Operator: Enable_Pump Customer: Drive_Away External: Tank_Full Not_Available Customer: Drive_Up

21 CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Gas Station Example Customer Component Pump: Available Operator: Available Operator: Available Pump: Change_Status Pump: Start_Fueling Tank: Not_Empty Operator: Enabled Pump: Nozzle_Sensor Operator: Customer_Paid Pump: Available Pump: Not_Available Operator: Serve Operator: Busy

22 CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Gas Station Example Example Linking Components

23 n Assumptions –The six CC actions are implemented as pairs of actions on three separate steering column turn levers: on/off, set speed/resume speed, and accelerate/decelerate. – Order of precedence for the CC actions: –on/off –set speed/resume speed –accelerate/decelerate. CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Assumptions Cruise Control Example

24 n Assumptions –When the cruise control system is enabled and either the accelerator pedal or brake pedal is depressed, the cruise control system is disabled and remains so until either set speed or resume speed is activated. –Cruising speed in uphill and downhill driving conditions is not maintained by the cruise control system, and thus not modeled in the following specification. CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Assumptions Cruise Control Example (2)

25 CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Cruise Control Example Engine Component CC: Turn_CC_Off CC: Turn_CC_On

26 CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Cruise Control Example Gas/Break Pedal Components CC: Disable_Cruising

27 CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Cruise Control Example Gas/Break Pedal Components Engine: On Gas/Break: Pressed

28 n Challenges –Enforcing a certain selection property –Maintaining global conditions throughout the system for all the states of the components –Modeling complex multiple concurrencies –Modeling data storage and access (e.g. Notion of variables in a programming language) CSCI 599 Formal Methods November 2, 2000 Concurrency Examples R. Apcar, E. Chiu, H. Jerejian Concluding Remarks