Symbolic Verification of ECA Rules

Transcription

1 Symbolic Veification of ECA Rules Xiaoqing Jin, Yousa Lembacha, and Gianfanco Ciado Depatment of Compute Science and Engineeing, Univesity of Califonia, Riveside Abstact. Event-condition-action (ECA) ules specify a decision making pocess and ae widely used in eactive systems and active database systems. Applying fomal veification techniques to guaantee popeties of the designed ECA ules is essential to help the eo-pone pocedue of collecting and tanslating expet knowledge. The nondeteministic and concuent semantics of ECA ule execution enhance expessiveness but hinde analysis and veification. We then popose an appoach to analyze the dynamic behavio of a set of ECA ules, by fist tanslating them into an extended Peti net, then studying two fundamental coectness popeties: temination and confluence. Ou expeimental esults show that the symbolic algoithms we pesent geatly impove scalability. Keywods: ECA ules, temination, confluence, veification Intoduction Event-condition-action (ECA) [2] ules ae expessive enough to descibe complex events and eactions. Thus, this event-diven fomalism is widely used to specify complex systems [, 3], e.g., fo industial-scale management, and to impove efficiency when coupled with technologies such as embedded systems and senso netwoks. Analogously, active DBMSs enhance secuity and semantic integity of taditional DBMSs using ECA ules; these ae now found in most entepise DBMSs and academic pototypes thanks to the SQL3 standad [9]. ECA ules ae used to specify a system s esponse to events, and ae witten in the fomat on the occuence of a set of events, if cetain conditions hold, pefom these actions. Howeve, fo systems with many components and complex behavio, it may be difficult to coectly specify these ules. Temination, guaanteeing that the system does not emain busy intenally foeve without esponding to extenal events, and confluence, ensuing that any possible inteleaving of a set of tiggeed ules yields the same final esult, ae fundamental coectness popeties. While temination has been studied extensively and many algoithms have been poposed to veify it, confluence is paticulaly challenging due to a potentially lage numbe of ule inteleavings [2]. Reseaches began studying these popeties fo active databases in the ealy 90 s [2, 4,, 4], by tansfoming ECA ules into some fom of gaph and applying vaious static analysis techniques on it to veify popeties. These appoaches

2 42 PNSE 3 Peti Nets and Softwae Engineeing based on a static methodology woked well to detect edundancy, inconsistency, incompleteness, and ciculaity. Howeve, since static appoaches may not exploe the whole state space, they could easily miss some eos. Also, they could find scenaios that did not actually esult in eos due to the found eo states may not be eachable. Moeove, they had poo suppot to povide concete counteexamples and analyze ECA ules with pioities. [2] looked fo cycles in the ule-tiggeing gaph to dispove temination, but the cycle-tiggeing conditions may be unsatisfiable. [4] impoved this wok with an activation gaph descibing when ules ae activated; while its analysis detects temination whee pevious wok failed, it may still epot false positives when ules have pioities. [5] poposed an algebaic appoach emphasizing the condition potion of ules, but did not conside pioities. Othe eseaches [, 4] chose to tanslate ECA ules into a Peti Net (PN), whose nondeteministic inteleaving execution semantics natually model unfoeseen inteactions between ule executions. Howeve, as the analysis of the set of ECA ules was though stuctual PN techniques based on the incidence matix of the net, false positives wee again possible. To ovecome these limitations, dynamic analysis appoaches using model checking tools such as SMV [5] and SPIN [6] have been poposed to veify temination. While close to ou wok, these appoaches equie manually tansfoming ECA ules into an input scipt, assume a pioi bounds fo all vaiables, povide no suppot fo pioities, and equie the initial system state to be known; ou appoach does not have these limitations. [8] analyzes both temination and confluence by tansfoming ECA ules into Datalog ules though a tansfomation diagam ; this suppots ule pioity and execution semantics, but equies the gaph to be commutative and esticts event composition. Howeve, most of these woks show limited esults, and none of them popely addesses confluence; we pesent detailed expeimental esults fo both temination and confluence. UML Statechats [7] povide visual diagams to descibe the dynamic behavio of eactive systems and can be used to veify these popeties. Howeve, event dispatching and execution semantics ae not as flexible as fo PNs [3]. Ou appoach tansfoms a set of ECA ules into a PN, then dynamically veifies temination and confluence and, if eos ae found, povides concete counteexamples to help debugging. It uses ou tool SmAT, which suppots PNs with pioities to easily model ECA ules with pioities. Moeove, a single PN can natually descibe both the ECA ules as well as thei nondeteministic concuent envionment and, while ou MDD-based symbolic model-checking algoithms [8] equie a finite state space, they do not equie to know a pioi the vaiable bounds (i.e., the maximum numbe of tokens each place may contain). Finally, ou famewok is not esticted to temination and confluence, but can be easily extended to veify a boade set of popeties. The est of the pape is oganized as follows: Sect. 2 ecalls Peti nets; Sect. 3 intoduces ou syntax fo ECA ules; Sect. 4 descibes the tansfomation of ECA ules into a Peti net; Sect. 5 pesents algoithms fo temination and confluence; Sect. 6 shows expeimental esults; Sect. 7 concludes.

3 X. Jin, Y. Lembacha and G. Ciado: Symbolic Veification of ECA Rules 43 2 Peti Nets As an intemediate step in ou appoach, we tanslate a set of ECA ules into a self-modifying Peti net [6] (PN) with pioities and inhibito acs, descibed by a tuple (P, T, π, D, D +, D, x init ), whee: P is a finite set of places, dawn as cicles, and T is a finite set of tansitions, dawn as ectangles, satisfying P T = and P T. π : T N assigns a pioity to each tansition. D :P T N P N, D + :P T N P N, and D :P T N P N { } ae the making-dependent cadinalities of the input, output, and inhibito acs. x init N P is the initial making, the numbe of tokens initially in each place. Tansition t has concession in making m N P if, fo each p P, the input ac cadinality is satisfied, i.e., m p D (p, t, m), and the inhibito ac cadinality is not, i.e., m p < D (p, t, m). If t has concession in m and no othe tansition t with pioity π(t ) > π(t) has concession, then t is enabled in m and can fie and lead to making m, whee m p = m p D (p, t, m) + D + (p, t, m), fo all places p (ac cadinalities ae evaluated in the cuent making m to detemine the enabling of t and the new making m ). In ou figues, tk(p) indicates the numbe of tokens in p fo the cuent making, a thick input ac fom p to t signifies a cadinality tk(p), i.e., a eset ac, and we omit ac cadinalities, input o output acs with cadinality 0, and inhibito acs with cadinality. The PN defines a discete-state model (S pot, S init, A, {N t : t A}). The potential state space is S pot = N P (in pactice we assume that the eachable set of makings is finite o, equivalently, that thee is a finite bound on the numbe of tokens in each place, but we do not equie to know this bound a pioi). S init S pot is the set of initial states, {x init } in ou case (assuming an abitay finite initial set of makings is not a poblem). The set of (asynchonous) model events is A = T. The next-state function fo tansition t is N t, such that N t (m) = {m }, whee m is as defined above if tansition t is enabled in making m, and N t (m)= othewise. Thus, the next-state function fo a paticula PN tansition is deteministic, although the oveall behavio emains nondeteministic due to the choice of which tansition should fie when multiple tansitions ae enabled. 3 ECA syntax and semantics ECA ules have the fomat on events if condition do actions. If the events ae activated and the boolean condition is satisfied, the ule is tiggeed and its actions will be pefomed. In active DBMSs, events ae nomally poduced by explicit database opeations such as inset and delete [] while, in eactive systems, they ae poduced by sensos monitoing envionment vaiables [3], e.g., tempeatue. Many cuent ECA languages can model the envionment and distinguish between envionmental and local vaiables [2, 4, 6,, 4, 5]. Thus, we designed a language to addess these issues, able to handle moe geneal cases and allow diffeent semantics fo envionmental and local vaiables (Fig. ).

4 44 PNSE 3 Peti Nets and Softwae Engineeing env_vas := envionmental env_va loc_vas := local loc_va facto := loc_va env_va ( exp ) numbe tem := facto tem tem tem / tem exp := exp exp exp + exp tem el_op := = assignment := env_va into loc_va [, assignment] ead-only bounded natual ead-and-wite bounded natual / is intege division numbe is a constant N ext_ev_decl := extenal ext_ev [ activated when env_va el_op numbe ] [ ead (assignment) ] int_ev_decl := intenal int_ev ext_evs := ext_ev (ext_evs o ext_evs) (ext_evs and ext_evs) int_evs := int_ev (int_evs o int_evs) (int_evs and int_evs) condition := (condition o condition) (condition and condition) not condition exp el_op exp action := incease (loc_va, exp) decease (loc_va, exp) set (loc_va, exp) activate (int_ev) actions := action (actions seq actions) (actions pa actions) ext_ule := on ext_evs [if condition] do actions int_ule := on int_evs [if condition] do actions [with pioity numbe] system := [env_vas] + [loc_vas] [ext_ev_decl] + [int_ev_decl] [ext_ule] + [int_ule] Fig.. The syntax of ECA ules. Envionmental vaiables ae used to epesent envionment states that can only be measued by sensos but not diectly modified by the system. Fo instance, if we want to incease the tempeatue in a oom, the system may choose to tun on a heate, eventually achieving the desied effect, but it cannot diectly change the value of the tempeatue vaiable. Thus, envionmental vaiables captue the nondeteminism intoduced by the envionment, beyond the contol of the system. Instead, local vaiables can be both ead and witten by the system. These may be associated with an actuato, a ecod value, o an intemediate value descibing pat of the system state; we povide opeations to set (absolute change) thei value to an expession, o incease o decease (elative change) it by an expession; these expessions may depend on envionmental vaiables. Events can be combinations of atomic events activated by envionmental o intenal changes. We classify them using the keywods extenal and intenal. An extenal event can be activated when the value of an envionmental vaiable cosses a theshold; at that time, it may take a snapshot of some envionmental vaiables and ead them into local vaiables to ecod thei cuent values. Only the action of an ECA ule can instead activate intenal events. Intenal events ae useful to expess intenal changes o equied actions within the system.

5 X. Jin, Y. Lembacha and G. Ciado: Symbolic Veification of ECA Rules 45 These two types of events cannot be mixed within a single ECA ule. Thus, ules ae extenal o intenal, espectively. Then, we say that a state is stable if only extenal events can occu in it, unstable if actions of extenal o intenal ules ae being pefomed (including the activation of intenal events, which may then tigge intenal ules). The system is initially stable and, afte some extenal events tigge one o moe extenal ules, it tansitions to unstable states whee intenal events may be activated, tiggeing futhe intenal ules. When all actions complete, the system is again in a stable state, waiting fo envionmental changes that will eventually tigge extenal events. The condition potion of an ECA ule is a boolean expession on the value of envionmental and local vaiables; it can be omitted if it is the constant tue. The last potion of a ule specifies which actions must be pefomed, and in which ode. Most actions ae opeations on local vaiables which do not diectly affect envionmental vaiables, but may cause some changes that will conceivably be eflected in thei futue values. Thus, all envionmental vaiables ae eadonly fom the pespective of an action. Actions can also activate intenal events. Moeove, to handle complex action opeations, the execution semantics can be specified as any patial ode descibed by a seies-paallel gaph; this is obtained though an appopiate nesting of seq opeatos, to foce a sequential execution, and pa opeatos, to allow an abitay concuency. The keywod with pioity enfoces a pioity fo intenal ules. If no pioity is specified, the default pioity of an intenal ule is, the same as that of extenal ules. We now discuss the choices of execution semantics fo ou language, to suppot the modeling of eactive systems. The fist choice is how to couple the checking of events and conditions fo ou ECA ules. Thee ae (at least) two options: immediate and defeed. The event-condition checking is immediate if the coesponding condition is immediately evaluated when the events occu, it is defeed if the condition is evaluated at the end of a cycle with a pedefined fequency. One citical equiement fo the design of eactive systems is that the system should espond to extenal events fom the envionment [0] as soon as possible. Thus, we choose immediate event-condition checking: when events occu, the coesponding condition is immediately evaluated to detemine whethe to tigge the ule. We stess that defeed checking can still be modeled using immediate checking, fo example by adding an exta vaiable fo the system clock and changing pioities elated to ule evaluation to synchonize ule evaluations. Howeve, the dawback of defeed checking is that the design must toleate false ECA ule tiggeing o non-tiggeing scenaios. Since thee is a time gap between event activation and condition evaluation, the envionmental conditions that tigge an event might change duing this peiod of time, causing ules supposed to be tiggeed at the time of event activation to fail because the cuent condition evaluation ae now inconsistent. Anothe impotant choice is how to handle and model the concuent and nondeteministic natue of eactive systems. We intoduce the concept of batch fo extenal events, simila to the concept of tansaction in DBMSs. Fomally, the bounday of a batch of extenal events is defined as the end of the execution

6 46 PNSE 3 Peti Nets and Softwae Engineeing of all tiggeed ules. Then, the system stats to eceive extenal events and immediately evaluates the coesponding conditions. The occuence of an extenal event closes a batch if it tigges one o moe ECA ules; othewise, the event is added to the cuent batch. Once the batch closes and the ules to be tiggeed have been detemined, the events in the cuent batch ae cleaned-up, to pevent multiple (and eoneous) tiggeings of ules. Fo example, conside ECA ules a : on a do and ac : on (a and c) do, and assume that the system finishes pocessing the last batch of events and is eady to eceive extenal events fo the next batch. If extenal events occu in the sequence c, a,..., event c alone cannot tigge any ule so it begins, but does not complete, the cuent batch. Then, event a tigges both ule a and ac, and thus, closes the cuent batch. Both ules ae tiggeed and will be executed concuently. This example shows how, when the system is in a stable state, the occuence of a single extenal event may tigge one o moe ECA ules, since thee is no contention within a batch on using an extenal event: ule a and ac shae event a and both ules ae tiggeed and executed. If instead the sequence of events is a, c,..., event a by itself constitutes a batch, as it tigges ule a. This event is then discaded by the clean-up so, afte executing a and any intenal ule (ecusively) tiggeed by it, the system etuns to a stable state and the subsequent events c,... begin the next batch. Unde this semantic, all extenal events in one batch ae pocessed concuently. Thus, unless thee is a temination eo, the system will pocess all tiggeed ules, including those tiggeed by the activation of intenal events duing the cuent batch, befoe consideing new extenal events. This batch definition povides maximum nondeteminism on event ode, which is useful to discove design eos in a set of ECA ules. We also stess that, in ou semantics, the system is fozen duing ule execution and does not espond to extenal events. Thus, ule execution is instantaneous, while in eality it obviously equies some time. Howeve, fom a veification pespective, envionmental changes and extenal event occuences ae nondeteministic and asynchonous, thus ou semantic allows the veification pocess to exploe all possible combinations without missing eos due to the ode in which events occu and envionmental vaiables change. 3. Running example We now illustate the expessiveness of ou ECA ules on a unning example: a light contol subsystem in a smat home fo senio housing. Fig. 2 lists the equiements in plain English (R to R 5 ). Using motion and pessue sensos, the system attempts to educe enegy consumption by tuning off the lights in unoccupied ooms o if the occupant is asleep. Passive sensos emit signals when an envionmental vaiable value cosses a significant theshold. The motion senso measue is expessed by the boolean envionmental vaiable Mtn. The system also povides automatic adjustment fo indoo light intensity based on an outdoo light senso, whose measue is expessed by the envionmental vaiable ExtLgt {0,..., 0}. A pessue senso detects whethe the peson is asleep and is expessed by the boolean envionmental vaiable Slp.

7 X. Jin, Y. Lembacha and G. Ciado: Symbolic Veification of ECA Rules 47 envionmental Mtn, ExtLgt, Slp local lmtn, lextlgt, lslp, lgtstm, intlgts extenal SecElp ead (Mtn into lmtn, ExtLgt into lextlgt, Slp into lslp) MtnOn activated when Mtn = MtnOff activated when Mtn = 0 ExtLgtLow activated when ExtLgt 5 intenal LgtsOff, LgtsOn, ChkExtLgt, ChkMtn, ChkSlp (R ) When the oom is unoccupied fo 6 minutes, tun off lights if they ae on. on MtnOff if (intlgts > 0 and lgtstm = 0) do set (lgtstm, ) 2 on SecElp if (lgtstm and lmtn = 0) do incease (lgtstm, ) 3 on SecElp if (lgtstm = 360 and lmtn = 0) do ( set (lgtstm, 0) pa activate (LgtsOff ) ) 4 on LgtsOff do ( set (intlgts, 0) pa activate (ChkExtLgt) ) (R 2) When lights ae off, if extenal light intensity is below 5, tun on lights. 5 on ChkExtLgt if (intlgts = 0 and lextlgt 5) do activate (LgtsOn) (R 3) When lights ae on, if the oom is empty o a peson is asleep, tun off lights. 6 on LgtsOn do ( set (intlgts, 6) seq activate (ChkMtn) ) 7 on ChkMtn if (lslp = o (lmtn = 0 and intlgts ) ) do activate (LgtsOff ) (R 4) If the extenal light intensity dops below 5, check if the peson is asleep and set the lights intensity to 6. If the peson is asleep, tun off the lights. 8 on ExtLgtLow do ( set (intlgts, 6) pa activate (ChkSlp) ) 9 on ChkSlp if (lslp = ) do set (intlgts, 0) (R 5) If the oom is occupied, set the lights intensity to 4. 0 on MtnOn do ( set (intlgts, 4) pa set (lgtstm, 0) ) Fig. 2. ECA ules fo the light contol subsystem of a smat home. MtnOn, MtnOff, and ExtLgtLow ae extenal events activated by the envionmental vaiables discussed above. MtnOn and MtnOff occu when Mtn changes fom 0 to o fom to 0, espectively. ExtLgtLow occus when ExtLgt dops below 6. Extenal event SecElp models the system clock, occus evey second, and takes a snapshot of the envionmental vaiables into local vaiables lmtn, lextlgt, and lslp, espectively. Additional local vaiables lgtstm and intlgts ae used. Vaiable lgtstm is a time fo R, to convet the continuous condition the oom is unoccupied fo 6 minutes into 360 discetized SecElps events. Rule initializes lgtstm to wheneve the motion senso detects no motion and the lights ae on. The time then inceases as second elapses, povided that no motion is detected (ule 2 ). If the time eaches 360, intenal event LgtsOff is activated to tun off the lights and to eset lgtstm to 0 (ule 3 ). Vaiable intlgts acts as an actuato contol to adjust the intenal light intensity. Ou ECA ules contain intenal events to model intenal system actions o checks not obsevable fom the outside. LgtsOff, activated by ule 3 o 7, tuns the lights off and activates anothe check on outdoo light intensity though intenal event ChkExtLgt (ule 4 ). ChkExtLgt activates LgtsOn if lextlgt 5

8 48 PNSE 3 Peti Nets and Softwae Engineeing Mtn lmtn 5 Tg 6Tst lslp EnvMotOn if(tk(mtnon)=0) 0 tk(mtn) EnvMotOff if(tk(secelp)=0) tk(extlgt) SecElp lextlgt 6 intlight 4 Act 4 Tg 5 Tst ChkExtLgt CleanUp Act 2 Ready MtnOn ChkMtn lmtn 7Tst,2 6 Tg 7 LgtsOff 9 Act 3 MtnOff Tst lslp 2 CleanUp 2Tst 3 3 Ready 0 Tg 2 0 Act 2 3 Tg Act lmtn lgtstm lgtstm lgtstm intlgts CleanUp 5 Act LgtsOn 2 3Act2 LgtsOff EnvExtLgtInc Act intlgts 6 Tg 6 0 ExtLgt 2 0 CleanUp 6 EnvExtLgtDec 6Act Seq ExtLgtLow 0 if(tk(extlgt)=6 and tk(extlgtlow)=0) 6Tg Seq EnvAsleep 7 Tst, 0 Slp EnvAwake 0 if(tk(mtnoff)=0) EnvSecElp 7 Act tk(slp) Tst 4 4 Tg 2 intlgts CleanUp 2 Tst 3 Tst 0 if(tk(ready)=0) if(tk(ready)=0) if(tk(ready)=0) if(tk(ready)=0) 3 Tg 2 9 Tg Ready ChkSlp 0 Tg 0 Act 4 8 Act 8 Act 2 Tst 9 lslp Fig. 3. The PN fo ECA ules in Fig. 2. 8Tst 8 Tg 3 8 Tg 2 2 Tg 2 Act 3 Act 3 Tg if(tk(ready)=0) duplicate eset ac (ule 5 ). ChkSlp is activated by ule 8 to check whethe a peson is asleep. If tue, the event tigges an action that tuns the lights off (ule 9 ). Intenal event ChkMtn, activated by ule 6, activates LgtsOff if the oom is unoccupied and all lights ae on, o if the oom is occupied but the occupant is asleep (ule 7 ). 4 Tansfoming a set of ECA ules into a PN We now explain the pocedue to tansfom a set of ECA ules into a PN. Fist, we put each ECA ule into a egula fom whee both events and condition ae

9 X. Jin, Y. Lembacha and G. Ciado: Symbolic Veification of ECA Rules 49 disjunctions of conjunctions of events and elational expessions, espectively. All ules in Fig. 2 ae in this fom. While this tansfomation may in pinciple cause the expessions fo events and conditions to gow exponentially lage, each ECA ule usually contains a small numbe of events and conditions, hence this is not a poblem in pactice. Based on the immediate event-condition checking assumption, a ule is tiggeed iff tigge events condition holds. Next, we map vaiables and events into places, and use PN tansitions to model event testing, condition evaluation, and action execution. Any change of vaiable values is achieved though input and output acs with appopiate cadinalities. Additional contol places and tansitions allow the PN behavio to be oganized into phases, as shown next. ECA ules though 0 of Fig. 2 ae tansfomed into the PN of Fig. 3 (dotted tansitions and places ae duplicated and acs labeled if (cond) ae pesent only if cond holds). 4. Occuing phase This phase models the occuence of extenal events, due to envionment changes ove which the system has no contol. The PN fiing semantics pefectly matches the nondeteministic asynchonous natue of these changes. Fo example, in Fig. 3, tansitions EnvMotOn and EnvMotOff can add o emove the token in place Mtn, to nondeteministically model the pesence o absence of people in the oom (the inhibito ac fom place Mtn back to tansition EnvMotOn ensues that at most one token esides in Mtn). Fiing these envionmental tansitions might nondeteministically enable the coesponding extenal events. Hee, fiing EnvMotOn geneates the extenal event MtnOn by placing a token in the place of the same name, while fiing EnvMotOff geneates event MtnOff, consistent with the change in Mtn. To ensue that envionmental tansitions only fie if the system is in a stable state (when no ule is being pocessed) we assign the lowest pioity, 0, to these tansitions. As the system does not diectly affect envionmental vaiables, ule execution does not modify them. Howeve, we can take snapshots of these vaiables by copying the cuent numbe of tokens into thei coesponding local vaiables using making-dependent acs. Fo example, tansition EnvSecElp has an output ac to geneate event SecElp, and acs connected to local vaiables to pefom the snapshots, e.g., all tokens in lmtn ae emoved by a eset ac (an input ac that emoves all tokens fom its place), while the output ac with cadinality tk(mtn) copies the value of Mtn into lmtn. 4.2 Tiggeing phase This phase stats when tigge events condition holds fo at least one extenal ECA ule. If, fo ule k, events and condition consist of n d and n c disjuncts, espectively, we define n d n c test tansitions k Tst i,j with pioity P + 2, whee i and j ae the index of a conjunct in events and one in condition, while P is the highest pioity used fo intenal ules (in ou example, all intenal ules have default pioity P = ). Then, to tigge ule k, only one of these tansitions, e.g., 7 Tst, o 7 Tst,2, needs to be fied (we omit i and j if n d = n c = ). Fiing

10 50 PNSE 3 Peti Nets and Softwae Engineeing a test tansition means that the coesponding events and conditions ae satisfied and esults in placing a token in each of the tiggeed places k Tg,..., k Tg N, to indicate that Rule k is tiggeed, whee N is the numbe of outemost paallel actions (ecall that pa and seq model paallel and sequential actions). Thus, N = if k contains only one action, o an outemost sequential seies of actions. Inhibito acs fom k Tg to test tansitions k T st i,j ensue that, even if multiple conjuncts ae satisfied, only one test tansition fies. The fiing of test tansitions does not consume extenal events, thus we use double-headed aows between them. This allows one batch to tigge multiple ules, conceptually at the same time. Afte all enabled test tansitions fo extenal ules have fied, place Ready contains one token, indicating that the cuent batch of extenal events can be cleaed: tansition CleanUp, with pioity P +, fies and emoves all tokens fom extenal and intenal event places using eset acs, since all the ules that can be tiggeed have been maked. This ends the tiggeing phase and closes the cuent batch of events. 4.3 Pefoming phase This phase executes all actions of extenal ules maked in the pevious phase. It may futhe esult in tiggeing and executing intenal ules. Tansitions in this phase coespond to the actions of ules with pioity in [, P ], the same as that of the coesponding ule. An action activates an intenal event by adding a token to its place. This token is consumed as soon as a test tansition of any intenal ule elated to this event fies. This is diffeent fom the way extenal ules use extenal events. Intenal events not consumed in this phase ae cleaed when tansition CleanUp fies in the next batch. When all enabled tansitions of the pefoming phase have fied, the system is in a stable state whee envionmental changes (tansitions with pioity 0) can again happen and the next batch stats. 4.4 ECA ules to PN tanslation The algoithm in Fig. 4 takes extenal and intenal ECA ules R ext, R int, with pioities in [, P ], envionmental and local vaiables V env, V loc, and extenal and intenal events E ext, E int, and geneates a PN. Afte nomalizing the ules and setting P to the highest pioity among the ule pioities in R int, it maps envionmental vaiables V env, local vaiables V loc, extenal events E ext, and intenal events E int, into the coesponding places (Lines 5, 6, and 8). Then, it ceates phase contol place Ready, tansition CleanUp, and eset acs fo CleanUp (Lines 4-5). We use acs with making-dependent cadinalities to model expessions. Fo example, togethe with inhibito acs, these acs ensue that each vaiable v V env emains in its ange [v min, v max ] (Lines 8-0). These acs also model the activated when potion of extenal events (Line 7), ule conditions (Line 33), and assignments of envionmental vaiables to local vaiables (Lines 9-20 and lines 4-5). The algoithm models extenal events and envionmental changes (Lines -24); it connects envionmental tansitions such as t vinc and t vdec to thei coesponding extenal event places, if any, with an ac

11 X. Jin, Y. Lembacha and G. Ciado: Symbolic Veification of ECA Rules 5 TansfomECAintoPN (R ext, R int, V env, V loc, E ext, E int) nomalize R ext and R int into egula fom and set P to the highest ule pioity 2 ceate a place Ready to contol phases of the net 3 ceate tansition CleanUp with pioity P + and Ready [] CleanUp 4 fo each event e E ext E int do 5 ceate place p e and p e [tk(p e)] CleanUp 6 ceate place p v, fo each vaiable v V loc 7 fo each vaiable v V env with ange [v min, v max] do 8 ceate place p v and tansitions t vinc and t vdec with pioity 0 9 ceate t vdec [if(tk(p v) > v min) else 0] p v 0 ceate t vinc [] p v and p v [v max] t vinc fo each event e E ext activated when v op val, fo op { =} do 2 ceate t vinc [if(tk(p v) op val) else 0] p e 3 if e eads v V env into v V loc then 4 ceate p v [if(tk(p v) op val)tk(p v ) else 0] t vinc 5 ceate t vinc [if(tk(p v) op val)tk(p v) else 0] p v 6 fo each event e E ext activated when v op val, fo op { =} do 7 ceate t vdec [if(tk(p v) op val) else 0] p e 8 if e eads v V env into v V loc then 9 ceate p v [if(tk(p v) op val)tk(p v ) else 0] t vdec 20 ceate t vdec [if(tk(p v) op val)tk(p v) else 0] p v 2 fo each event e E ext without an activated when potion do 22 ceate t e and t e [if(tk(p e) = 0) else 0] p e 23 if e eads v V env into v V loc then 24 ceate p v [tk(p v )] t e and t e [tk(p v)] p v 25 fo each ule k R ext R int with n d event disjuncts, n c condition disjuncts, actions A, and pioity p [, P ] do 26 ceate tans. k Tst i,j,i [, n d ], j [, n c],w/pioity P + 2 if k R ext, else p 27 fo each event e in disjunct i do 28 ceate p e [] k Tst i,j 29 ceate k Tst i,j [] p e, if e E ext 30 fo each conjunct v val o v = val in disjunct j do 3 ceate p v [val + ] k Tst i,j 32 fo each conjunct v val o v = val in disjunct j do 33 ceate p v [val] k Tst i,j and k Tst i,j [val] p v 34 if actions A is (A pa A 2) then n a = 2 else n a =, A = A 35 fo each l [, n a] do 36 ceate places k Tg l and tansitions k Act l with pioity p 37 ceate k Tg l [] k Act l and k Tst i,j [] k Tg l 38 SeqSubGaph(A l, k Acl l, l, p) 39 fo each k R ext, i [, n d ], j [, n c] do 40 ceate k Tst i,j [if(tk(ready) = 0) else 0] Ready and k Tg [] k Tst i,j Fig. 4. Tansfoming ECA ules into a PN: a [k] b means an ac fom a to b with cadinality k; a [k] b means an inhibito ac fom a to b with cadinality k. whose cadinality evaluates to if the coesponding condition becomes tue upon the fiing of the tansition and the event place does not contain a token aleady, 0 othewise (e.g., the acs fom EnvExtLigDec to ExtLgtLow). Next, ules ae consideed (Lines 25-40). A ule with n d event disjuncts and n c condition disjuncts geneates n d n c testing tansitions. To model the paallelsequential action gaph of a ule, we use mutually ecusive pocedues (Fig. 5 and Fig. 6). Pocedue SeqSubGaph fist tests all atomic actions, such as set,

12 52 PNSE 3 Peti Nets and Softwae Engineeing PaSubGaph(Pas, Pe, p) Pas: paallel actions, Pe: pefix fo each l {, 2} do accoding to the syntax Pas 2 has two components 2 ceate place PeAct l Tg l Seq l and tansition PeAct l w/pioity p 3 ceate Pe [] PeAct l and PeAct l [] PeAct l Tg l Seq l 4 SeqSubGaph(Pas l, PeAct l Tg l Seq l, l, p); Fig. 5. Pocessing pa. SeqSubGaph(Seqs, Pe, i, p) Seqs: sequential actions, Pe: pefix if Seqs sets vaiable v to val then 2 ceate p v [tk(p v)] Pe and Pe [val] p v 3 else if Seqs inceases vaiable v by val then 4 ceate Pe [val] p v 5 else if Seqs deceases vaiable v by val then 6 ceate p v [val] Pe 7 else if Seqs activates an intenal event e then 8 ceate Pe [] p e 9 else if the outemost opeato of Seqs is pa then 0 PaSubGaph(Seqs, Pe, p) Recusion on paallel pat else if the outemost opeato of Seqs is seq then 2 SeqSubGaph(Seqs, Pe,, p) Seqs is the fist pat of Seq 3 ceate place PeTg i Seq and tansition PeAct iseq 4 ceate Pe [] PeTg i Seq and PeTg i Seq [] PeAct iseq 5 SeqSubGaph(Seqs 2, PeTg i Seq, 2, p) Seqs 2 is the second pat of Seq Fig. 6. Pocessing seq. incease, decease, and activate. Then, it ecusively calls PaSubGaph at Line 0 if it encountes paallel actions. Othewise, it calls itself to unwind anothe laye of sequential actions at Line 2 and Line 5 fo the two potions of the sequence. Pocedue PaSubGaph ceates contol places and tansitions fo the two banches of a paallel action and calls SeqSubGaph at Line 4. 5 Veifying popeties The fist step towads veifying coectness popeties is to define S init, the set of initial states, coesponding to all the possible initial combinations of system vaiables (e.g., ExtLgt can initially have any value in [0, 0]). One could conside all these possible values by enumeating all legal stable states coesponding to possible initial combinations of the envionmental vaiables, then stat the analysis fom each of these states, one at a time. Howeve, in addition to equiing the use to explicitly povide the set of initial states, this appoach may equie enomous untime, also because many computations ae epeated in diffeent uns. Ou appoach instead computes the initial states symbolically, thanks to the nondeteministic semantics of Peti nets, so that the analysis is pefomed once stating fom a single, but vey lage, set S init. To this end, we add an initialization phase that puts a nondeteministically chosen legal numbe of tokens in each place coesponding to an envionmental vaiable. This phase is descibed by a subnet consisting of a tansition InitEnd

13 X. Jin, Y. Lembacha and G. Ciado: Symbolic Veification of ECA Rules 53 InitEnd 4 Init InitExtLgt InitSlp ExtLgt Slp 4 InitMtn Mtn Fig. 7. The initialization phase fo the smat home example. with pioity P + 3, a place Init with one initial token, and an initializing tansition with pioity P +3 fo evey envionmental vaiable, to initialize the numbe of tokens in the coesponding place. Fig. 7 shows this subnet fo ou unning example. We initialize the Peti net by assigning the minimum numbe of tokens to evey envionmental vaiable place and leaving all othe places empty, then we let the initializing tansitions nondeteministically add a token at a time, possibly up to the maximum legal numbe of tokens in each coesponding place. When InitEnd fies, it disables the initializing tansitions, feezes the nondeteministic choices, and stats the system s nomal execution. This builds the set of initial states, ensuing that the PN will exploe all possible initial states, and avoids the ovehead of manually stating the PN fom one legal initial making at a time. Even though the oveall state space might be lage (it equals the union of all the state spaces that would be built stating fom each individual making), this is nomally not the case, and, anyway, having to pefom just one state space geneation is obviously enomously bette. Afte the initialization step, we poceed with veifying temination and confluence using ou tool SmAT, which povides symbolic eachability analysis and CTL model checking with counteexample geneation [7]. 5. Temination Reactive systems constantly espond to extenal events. Howeve, if the system has a livelock, a finite numbe of extenal events can tigge an infinite numbe of ule executions (i.e, activate a cycle of intenal events), causing the system to emain busy intenally, a fatal design eo. When geneating the state space, all legal batches of events ae consideed, due to the PN execution semantics, again avoiding the need fo an explicit enumeation, this time, of event batches. A set G of ECA ules satisfies temination if no infinite sequence of intenal events can be tiggeed in any possible execution of G. This can be expessed in CTL as EF(EG(unstable)), stating that thee is no cycle of unstable states eachable fom an initial, thus stable, state. Both taditional beadth-fist-seach (BFS) and satuation-based [9] algoithms ae suitable to compute the EG opeato. Fig. 8 uses satuation, which tends to pefom much bette in both time and memoy consumption when analyzing lage asynchonous systems. We encode tansitions elated to extenal

14 54 PNSE 3 Peti Nets and Softwae Engineeing bool Tem(mdd S init, mdd2 N int) mdd S ch StateSpaceGen(S init, N ext N int); 2 mdd S unst Intesection(S ch, ExtactUnpimed(N int)); 3 mdd S p EF(EG(S unst)); 4 if S p then etun false povide eo tace 5 else etun tue; mdd ExtactUnpimed(mdd2 p) p unpimed if p = then etun ; 2 if CacheLookUp(EXTRACTUNPRIMED, p, ) etun ; 3 foeach i V p.v do 4 mdd i 0; 5 if p[i] 0 then p[i] is the node pointed edge i of node p 6 foeach j V p.v s.t. p[i][j] 0 do 7 i Union( i, ExtactUnpimed(p[i][j])) 8 mdd UniqueTableInset({ i : i V p.v}); 9 CacheInset(EXTRACTUNPRIMED, p, ); 0 etun ; Fig. 8. Algoithms to veify the temination popety. events and envionmental vaiable changes into N ext. Thus, the intenal tansitions ae N int = N \N ext. Afte geneating the state space S ch using constained satuation [8], we build the set of states S unst by symbolically intesecting S ch with the unpimed, o fom, states extacted fom N int. Then, we use the CTL opeatos EG and EF to identify any nonteminating path (i.e., cycle). 5.2 Confluence Confluence is anothe desiable popety to ensue consistency in systems exhibiting highly concuent behavio. A set G of ECA ules satisfying temination also satisfies confluence if, fo any legal batch b of extenal events and stating fom any paticula stable state s, the system eventually eaches a unique stable state. We stess that what constitutes a legal batch b of events depends on state s, since the condition potion of one o moe ules might affect whethe b (o a subset of b) can tigge a ule (thus close a batch). Given a legal batch b occuing in stable state s, the system satisfies confluence if it pogesses fom s by tavesing some (nondeteministically chosen) sequence of unstable states, eventually eaching a stable state uniquely detemined by b and s. Checking confluence is theefoe expensive [2], as it equies veifying the combinations of all stable states eachable fom S init with all legal batches of extenal events when the system is in that stable state. A staightfowad appoach enumeates all legal batches of events fo each stable state, uns the model, and checks that the set of eachable stable states has cadinality one. We instead only check that, fom each eachable unstable state, exactly one stable state is eachable; this avoids enumeating all legal batches of events fo each stable state. Since

15 X. Jin, Y. Lembacha and G. Ciado: Symbolic Veification of ECA Rules 55 bool ConfExplicit(mdd S st, mdd S unst, mdd2 N int) foeach i S unst 2 mdd S i StateSpaceGen(i, N int); 3 if Cadinality(Intesection(S i, S st)) > then etun false; povide eo tace 4 etun tue; bool ConfExplicitImpoved(mdd S st, mdd S unst, mdd2 N int, mdd2 N ) mdd S fontie Intesection(RelPod(S st, N ), S unst); 2 while S fontie do if S fontie is empty, it exploes all S unst 3 pick i S fontie ; 4 mdd S i StateSpaceGen(i, N int); 5 if Cadinality(Intesection(S i, S st)) > then etun false; povide eo tace 6 else S fontie S fontie \ Intesection(S i, S unst); exclude all unstable states eached by i 7 etun tue; Fig. 9. Explicit algoithms to veify the confluence popety. bool ConfSymbolic(mdd S st, mdd S unst, mdd2 N int) mdd2 T C ConstaintedTansitiveClosue(N int, S unst); 2 mdd2 T C u2s FiltePimed(T C, S st); 3 etun CheckConf (T C u2s); bool CheckConf (mdd2 p) if p = then etun tue 2 if CacheLookUp(CHECKCONF, p, ) etun ; 3 foeach i V p.v, s.t. exist j, j V p.v, j j, p[i][j] 0, p[i[j ] 0 do 4 foeach j, j V p.v, j j s.t. p[i][j] 0, p[i[j ] 0 do 5 if p[i][j] = p[i][j ] etun false; Confluence does not hold 6 mdd f j ExtactUnpimed(p[i][j]); Result will be cached 7 mdd f j ExtactUnpimed(p[i][j ]); No duplicate computation 8 if Intesection(f i, f j ) 0 then etun false; 9 foeach i, j V p.v s.t. p[i][j] 0 do 0 if CheckConf (p[i][j]) = false etun false; CacheInset(CHECKCONF, p, tue); 2 etun tue; Fig. 0. Fully symbolic algoithm to veify the confluence popety. nondeteministic execution in pefoming phase is the main eason to violate confluence and the system is in unstable states in ou definition, checking the evolution stating fom unstable states will fulfill the pupose. The bute foce algoithm ConfExplicit in Fig. 9 enumeates unstable states and geneates eachable states only fom unstable states using constained satuation [8]. Then, it counts the stable states in the obtained set. We obseve that, stating fom an unstable stable u, the system may tavese a lage set of unstable states befoe eaching a stable state. If unstable state u is eachable, so ae the unstable states eachable fom it. Thus, the impoved vesion ConfExplicitImpoved fist picks an unstable state i and, afte geneating the states eachable fom i and veifying that they include only one stable state, it excludes all visited unstable states (Line 6). Futhemoe, it stats only fom states i in the fontie, i.e., unstable states eachable in one step fom stable

16 56 PNSE 3 Peti Nets and Softwae Engineeing Temination (time: sec, memoy: MB) Model S ch T t T c M p M f PN t PN c PN PN PN PN Confluence (time: min, memoy: GB, : out of memoy) Model S ch Best Explicit Symbolic T be M p M f T s M p M f PN c PN PN PN > PN > Table. Results to veify the ECA ules fo a smat home. states (all othe unstable eachable states ae by definition eachable fom this fontie). Howeve, we stess that these, as most symbolic algoithms, ae heuistics, thus they ae not guaanteed to wok bette than the simple appoaches. Next, we intoduce a fully symbolic algoithm to check confluence in Fig. 0. It fist geneates the tansition tansitive closue (TC) set fom N int using constained satuation [9], whee the fom states of the closue ae in S unst (Line ). The esulting set encodes the eachability elation fom any eachable unstable state without going though any stable state. Then, it filtes this elation to obtain the elation fom eachable unstable states to stable states by constaining the to states to set S st. Thus, checking confluence educes to veifying whethe thee exist two diffeent pais (i, j) and (i, j ) in the elation: Pocedue CheckConf implements this check symbolically. While computing TC is a an expensive opeation [9], this appoach avoids sepaate seaches fom distinct unstable states, thus is paticulaly appopiate when S unst is huge. 6 Expeimental esults Table epots esults fo a set of models un on an Intel Xeon 2.53GHz wokstation with 36GB RAM unde Linux. Fo each model, it shows the state space size ( S ch ), the peak memoy (M p ), and the final memoy (M f ). Fo temination, it shows the time used to veify the popety (T t ) and to find the shotest

17 X. Jin, Y. Lembacha and G. Ciado: Symbolic Veification of ECA Rules lgtstm = Tg = 6 lgtstm = LgtsOn= 6 Act Tst 6 5 Act lgtstm = 5Tst 5Tg = lgtstm = Tg Seq = 6 intlgts = 6 lgtstm = ChkMtn = intlgts = 6 6Act Seq 4 Act 2 7 Act 7 Tst,2 lgtstm = intlgts = 6 LgtsOff = lgtstm = intlgts = 6 7Tg = 4Tst lgtstm = intlgts = 6 Act lgtstm = lgtstm = 4 4Tg = ChkExtLgt= 4Tg = 4Tg 2= Fig.. A temination counteexample (elated to ules 4 to 7).... s ExtLgtLow = 0 s 0 ExtLgtLow = s ExtLgtLow = 0 2 intlgts = 0 ChkSlp=0 lslp =... intlgts = 0 ChkSlp=0 lslp =... intlgts = 6 ChkSlp= lslp =... Fig. 2. A confluence counteexample (elated to ules 8 and 9). counteexample (T c ). Fo confluence, it epots the best untime between ou two explicit algoithms (T be ) and fo ou symbolic algoithm (T s ). Memoy consumption accounts fo both decision diagams and opeation caches. Net PN t is the model coesponding to ou unning example, and fails the temination check. Even though the state space is not vey lage, counteexample geneation is computationally expensive [20] and consumes most of the untime. The shotest counteexample geneated by SmAT has a long tail consisting of 885 states and leads to the 0-state cycle of Fig. (only the nonempty places ae listed fo each state, and edges ae labeled with the coesponding PN tansition). Analyzing the tace, we can clealy see (in bold) that, when lights ae about to be tuned off due to the timeout, lmtn = 0, and the extenal light is low, ExtLgt 5, the infinite sequence of intenal events (LgtsOff, ChkExtLgt, LgtsOn, ChkMtn) ω pevents the system fom teminating. Thus, ules 4, 5, 6, and 7 need to be investigated to fix the eo. Among the possible modifications, we choose to eplace ule 5 with 5 : on ChkExtLgt if ((intlgts= 0 and lextlgt 5) and lmtn= ) do activate (LgtsOn), esulting in the addition of an input ac fom lmtn to 5 Tst. The new coected model is called PN c in Table, and SmAT veifies it holds the temination popety. We then un SmAT on PN c to veify confluence, and found 72,644 bad states. Fig. 2 shows one of these unstable states, s 0, eaching two stables states, s and s 2. Extenal event ExtLgtLow closes the batch in s 0 and tigges ule 8, which sets intlgt to 6 and activates intenal event ChkSlp, which in tun sets intlgt to 0 (we omit intemediate unstable states fom s 0 to s and to s 2 ). We coect ules 8 and 9, eplacing them with 8: on ExtLgtLow if lslp=0 do set (intlgt, 6) and 9: on ExtLgtLow if lslp= do set (intlgt, 0); esulting in model PN fc. Checking this new model against fo confluence, we find that the numbe of bad states deceases fom 72,644 to 24,420. Afte investigation, we detemine that the emaining poblem is elated to ules 2 and 3. Afte

18 58 PNSE 3 Peti Nets and Softwae Engineeing changing ule to on SecElp if ((lgtstm and lgtstm 359) and lmtn = 0) do incease (lgtstm, ), the model passes the check. This demonstates the effectiveness of counteexamples to help a designe debug a set of ECA ules. We then tun ou attention to lage models, which extend ou oiginal model by intoducing fou additional ules and inceasing vaiable anges. In PN and PN 2, the extenal light vaiable ExtLgt anges in [0, 20] instead of [0, 0]; fo PN 4, it anges in [0, 50]. PN 2 also extends the ange of the light time vaiable lgttm to [0, 720]; PN 3 to [0, 3600]. We obseve that, when veifying temination o confluence, the time and memoy consumption tends to incease as the model gows; also, ou symbolic algoithm scales much bette than the best explicit appoach when veifying confluence. Fo the elatively small state space of PN t, enumeation is effective, since computing TC is quite computationally expensive. Howeve, as the state space gows, enumeating the unstable states consumes excessive esouces. We also obseve that the supposedly impoved explicit confluence algoithm sometimes makes things wose. The eason may lie in the fact that a andom selection of a state fom the fontie has diffeent statistical popeties than fo the oiginal explicit appoach, and also in the fact that opeation caches save many intemediate esults. Howeve, both explicit algoithms un out of memoy on PN 3 and PN 4. Compaing the esults fo PN 3 and PN 4, we also obseve that lage state spaces might equie less esouces. With symbolic encodings, this might happen because the coesponding MDD is moe egula than the one fo a smalle state space. 7 Conclusion Veifying temination and confluence of ECA ule bases fo eactive systems is challenging due to thei highly concuent and nondeteministic natue. We poposed an appoach to veify these popeties using a self-modifying PN with inhibito acs and pioities. Ou appoach is geneal enough to give pecise answes to questions about othe popeties, cetainly those that can be expessed in CTL. As an application, we showed how a light contol system can be captued by ou appoach, and we veified temination and confluence fo this model using SmAT. In the futue, we would like to impove ou appoach in the following ways. The confluence algoithm must pefom constained state space geneation stating fom each unstable state, which is not efficient if S unst is lage. In that case, a simulation-based falsification appoach might be moe suitable, using intelligent heuistic sampling and seaching stategies. Howeve, this appoach is sound only if the entie set S unst is exploed. Anothe diection to extend ou wok is the inclusion of abstaction techniques to educe the size of the state space. Acknowledgement Wok suppoted in pat by UC-MEXUS unde gant Veification of active ule bases using timed Peti nets and by the National Science Foundation unde gant CCF

19 X. Jin, Y. Lembacha and G. Ciado: Symbolic Veification of ECA Rules 59 Refeences. D. J. Abadi, D. Caney, U. Çetintemel, M. Cheniack, C. Convey, S. Lee, M. Stonebake, N. Tatbul, and S. Zdonik. Auoa: a new model and achitectue fo data steam management. The VLDB Jounal, 2(2):20 39, A. Aiken, J. Widom, and J. M. Hellestein. Behavio of database poduction ules: temination, confluence, and obsevable deteminism. Poc. ACM SIGMOD, pp ACM Pess, J. C. Augusto and C. D. Nugent. A new achitectue fo smat homes based on ADB and tempoal easoning. Towad a Human-Fiendly Assistive Envionment, vol. 4, pp. 06 3, E. Baalis, S. Cei, and S. Paaboschi. Impoved ule analysis by means of tiggeing and activation gaphs. Rules in Database Systems, LNCS 985, pp E. Baalis and J. Widom. An algebaic appoach to static analysis of active database ules. ACM TODS, 25(3): , Sept E.-H. Choi, T. Tsuchiya, and T. Kikuno. Model checking active database ules unde vaious ule pocessing stategies. IPSJ Digital Couie, 2: , G. Ciado, R. L. Jones, A. S. Mine, and R. Siminiceanu. Logical and stochastic modeling with SMART. Poc. Modelling Techniques and Tools fo Compute Pefomance Evaluation, LNCS 2794, pp S. Comai and L. Tanca. Temination and confluence by ule pioitization. IEEE TKDE, 5: , K. G. Kulkani, N. M. Mattos, and R. Cochane. Active database featues in SQL3. Active Rules in Database Systems, pp Spinge, New Yok, E. A. Lee. Computing foundations and pactice fo cybe-physical systems: A peliminay epot. Technical Repot UCB/EECS , UC Bekeley, May X. Li, J. M. Maín, and S. V. Chapa. A stuctual model of ECA ules in active database. Poc. Second Mexican Intenational Confeence on Atificial Intelligence: Advances in Atificial Intelligence, pp Spinge, D. McCathy and U. Dayal. The achitectue of an active database management system. ACM SIGMOD Recod, 8(2):25 224, T. Muata. Peti nets: popeties, analysis and applications. Poc. of the IEEE, 77(4):54 579, Ap D. Nazaeth. Investigating the applicability of Peti nets fo ule-based system veification. IEEE TKDE, 5(3):402 45, I. Ray and I. Ray. Detecting temination of active database ules using symbolic model checking. Poc. East Euopean Confeence on Advances in Databases and Infomation Systems, pp Spinge, R. Valk. Genealizations of Peti nets. Mathematical foundations of compute science, LNCS 8, pp D. Vaó. A fomal semantics of UML statechats by model tansition systems. Poc. Int. Conf. on Gaph Tansfomation, pp Spinge, Y. Zhao and G. Ciado. Symbolic CTL model checking of asynchonous systems using constained satuation. Poc. ATVA, LNCS 5799, pp Y. Zhao and G. Ciado. Symbolic computation of stongly connected components and fai cycles using satuation. ISSE, 7(2):4 50, Y. Zhao, J. Xiaoqing, and G. Ciado. A symbolic algoithm fo shotest EG witness geneation. Poc. TASE, pp IEEE Comp. Soc. Pess, 20.