Search

We extend workflow Petri nets wf-nets with discrete prices, by associating a price to the execution of a transition and to the storage of tokens. We first define the safety and the soundness problems for priced wf-nets. A priced wf-net is safe if no execution costs more than a given budget. The soundness problem is that of deciding whether the workflow can always terminate properly, where in the priced setting “properly” also means that the execution does not cost more than a given threshold. Then, we study safety and soundness of resource-constrained workflow nets rcwf-nets, an extension of wf-nets for the modeling of concurrent executions of a workflow, sharing some global resources. We develop a framework in which to study safety and soundness for priced rcwf-nets, that is parametric on the cost model. Then, that framework is instantiated, obtaining the cases in which the sum, the maximum, the average and the discounted sum of the prices of all instances are considered. We study the decidability and the complexity of these properties, together with their relation.

Transient secure association has been widely accepted as a possible alternative to traditional authentication in the context of Ubiquitous Computing. Two components in a distributed system with transient secure association may share a master-slave relationship, which creates a hierarchical but dynamic structure of components. In this paper we develop several formal models for distributed systems with transient secure association, with incremental expressive power, all based on Petri nets. The first model, that we call transient secure association (TSA) systems, considers finitely many components. Then we consider a small extension of TSA systems, in which slaves are initialized whenever a master-slave relation is broken. Last, we define unbounded TSA (uTSA) systems, for which the number of components is not bounded. For each of the defined formalisms, we establish a link to a known class of Petri nets, thus inheriting the corresponding (un)decidability results from them.

We combine two of the existing approaches to the study of concurrency by means of multiset rewriting: multiset rewriting with existential quantification (MSR) and constrained multiset rewriting. We obtain ν-MSR, where we rewrite multisets of atomic formulae, in which terms can only be pure names, where some names can be restricted. We consider the subclass of depth-bounded ν-MSR, for which the interdependence of names is bounded. We prove that they are strictly Well Structured Transition Systems, so that coverability, termination and boundedness are all decidable for depth-bounded ν-MSR. This allows us to obtain new verification results for several formalisms with name binding that can be encoded within ν-MSR, namely polyadic ν-PN (Petri nets with tuples of names as tokens), the π-calculus, MSR or Mobile Ambients.

We prove several decidability and undecidability results for ν-PN, an extension of P/T nets with pure name creation and name management. We give a simple proof of undecidability of reachability, by reducing reachability in nets with inhibitor arcs to it. Thus, the expressive power of ν-PN strictly surpasses that of P/T nets. We encode ν-PN into Petri Data Nets, so that coverability, termination and boundedness are decidable. Moreover, we obtain Ackermann-hardness results for all our decidable decision problems. Then we consider two properties, width-boundedness and depth-boundedness, that factorize boundedness. Width-boundedness has already been proven to be decidable. Here we prove that its complexity is also non-primitive recursive. Then we prove undecidability of depth-boundedness. Finally, we prove that the corresponding “place version” of all the boundedness problems is undecidable for ν-PN. These results carry over to Petri Data Nets.

Pure names are identifiers with no relation between them, except equality and inequality. In previous works we have extended P/T nets with the capability of creating and managing pure names, obtaining ν-PNs and proved that they are strictly well structured (WSTS), so that coverability and boundedness are decidable. Here we use the framework recently developed by Finkel and Goubault-Larrecq for forward analysis for WSTS, in the case of ν-PNs, to compute the cover, that gives a good over approximation of the set of reachable markings. We prove that the least complete domain containing the set of markings is effectively representable. Moreover, we prove that in the completion we can compute least upper bounds of simple loops. Therefore, a forward Karp-Miller procedure that computes the cover is applicable. However, we prove that in general the cover is not computable, so that the procedure is non-terminating in general. As a corollary, we obtain the analogous result for Transfer Data nets and Data Nets. Finally, we show that a slight modification of the forward analysis yields decidability of a weak form of boundedness called width-boundedness, and identify a subclass of ν-PN that we call dw-bounded ν-PN, for which the cover is computable.

In this paper we study decidability of several extensions of P/T nets with name creation and/or replication. In particular, we study how to restrict the models of RN systems (P/T nets extended with replication, for which reachability is undecidable) and ν-RN systems (RN extended with name creation, which are Turing-complete, so that coverability is undecidable), in order to obtain decidability of reachability and coverability, respectively. We prove that if we forbid synchronizations between the different components in a RN system, then reachability is still decidable. Similarly, if we forbid name communication between the different components in a ν-RN system, or restrict communication so that it is allowed only for a given finite set of names, we obtain decidability of coverability. Finally, we consider a polyadic version of ν-PN (P/T nets extended with name creation), that we call pν-PN, in which tokens are tuples of names. We prove that pν-PN are Turing complete, and discuss how the results obtained for ν-RN systems can be translated to them.

Mobile Synchronizing Petri Nets (MSPN's) are a model for mobility and coordination based on coloured Petri Nets, in which systems are composed of a collection of (possibly mobile) hardware devices and mobile agents, both modelled homogenously. In this paper we approach their verification, for which we have chosen to code MSPN's into rewriting logic. In order to obtain a representation of MSPN systems by means of a rewrite theory, we develop a class of them, that we call ν-Abstract Petri nets (ν-APN's), which are easily representable in that framework. Moreover, the obtained representation provides a local mechanism for fresh name generation. Then we prove that, even if ν-APN's are a particular class of MSPN systems, they are strong enough to capture the behaviour of any MSPN system. We have chosen Maude to implement ν-APN's, as well as the translation from MSPN's to ν-APN's, for which we make intensive use of its reflective features.

We study dynamic networks of infinite-state timed processes, modelled as unbounded Petri nets. These processes can evolve autono-mously, synchronize with each other (e.g., in order to gain access to some shared resources) and be created or become garbage dynamically. We introduce dense time in two different ways. First, we consider that each token in each process carries a real valued clock. We prove that this model can faithfully simulate Turing-complete formalisms and, in particular, safety properties are undecidable for them. Second, we consider locally-timed processes, where each process carries a single real valued clock. For them, we prove decidability of safety properties by a non-trivial instantiation of the framework of Well-Structured Transition Systems.

We study dynamic networks of infinite-state timed processes, where each process is a Petri net carrying a single real valued clock. We compare their expressiveness with other models within the class of Well-Structured Transition Systems, using coverability languages. We prove that unbounded places are a strict resource, meaning that extra unbounded places provides strictly with extra expressiveness. Also, we prove that if no unbounded places are allowed, then the obtained model is equivalent to Timed Petri nets. We conclude that dynamic networks of Timed Petri Nets are strictly more expressive than Timed Petri Nets.

We apply language theory to compare the expressive power of infinite-state models that extend Petri nets with features like coloured tokens and/or whole place operations. Specifically, we consider extensions of Petri nets in which tokens carry pure names dynamically generated with special @n-transitions (@n-PN) and compare their expressiveness with transfer and reset nets with black indistinguishable tokens (Affine Well-Structured Nets), and nets in which tokens carry data taken from a linearly ordered domain (Data nets and CMRS). All these models are well-structured transition systems. In order to compare these models we consider the families of languages they recognize, using coverability as the accepting condition. With this criterion, we prove that @n-PNs are in between AWNs and Data Nets/CMRS, but equivalent to an extension of @n-PN with whole-place operations. These results extend the currently known classification of the expressive power of well-structured transition systems. Finally, we study several problems regarding (coverability) languages of AWN and @n-PN.

We extend workflow Petri nets (wf-nets) with discrete prices, by associating a price to the execution of a transition and, more importantly, to the storage of tokens. We first define the soundness problem for priced wf-nets, that of deciding whether the workflow can always terminate properly, where in the priced setting "properly" also means that the execution does not cost more than a given threshold. Then, we study soundness of resource-constrained workflow nets (rcwf-nets), an extension of wf-nets for the modeling of concurrent executions of a workflow, sharing some global resources. We develop a framework in which to study soundness for priced rcwf-nets, that is parametric on the cost model. Then, that framework is instantiated, obtaining the cases in which the sum, the maximum, the average and the discounted sum of the prices of each all instances are considered. We study the relations between these properties, together with their decidability.

International audience; Workflow Petri nets (wf-nets) are an important formalism for the modeling of business processes. For them we are typically interested in the soundness problem, that intuitively consists in deciding whether several concurrent executions can always terminate properly. Resource-Constrained Workflow Nets (rcfw-nets) are wf-nets enriched with static places, that model global resources. In this paper we prove the undecidability of soundness for rcwf-nets when there may be several static places and in which instances are allowed to terminate having created or consumed resources. In order to have a clearer presentation of the proof, we define an asynchronous version of a class of Petri nets with dynamic name creation. Then, we prove that reachability is undecidable for them, and reduce it to dynamic soundness in rcwf-nets. Finally, we prove that if we restrict our class of rcwf-nets, assuming in particular that a single instance is sound when it is given infinitely many global resources, then dynamic soundness is decidable by reducing it to the home space problem in P/T nets for a linear set of markings.

Pure names are identifiers with no relation between them, except equality and inequality. In previous works we have extended P/T nets with the capability of creating and managing pure names, obtaining ν-APNs and proved that they are strictly well structured (WSTS), so that coverability and boundedness are decidable. Here we use the framework recently developed by Finkel and Goubault-Larrecq for forward analysis for WSTS, in the case of ν-APNs, to compute the cover, that gives a good over approximation of the set of reachable markings. We prove that the least complete domain containing the set of markings is effectively representable. Moreover, we prove that in the completion we can compute least upper bounds of simple loops. Therefore, a forward Karp-Miller procedure that computes the cover is applicable. However, we prove that in general the cover is not computable, so that the procedure is non-terminating in general. As a corollary, we obtain the analogous result for Transfer Data nets and Data Nets. Finally, we show that a slight modification of the forward analysis yields decidability of a weak form of boundedness called width-boundedness.

We apply language theory to compare the expressive power of models that extend Petri nets with features like colored tokens and/or whole place operations. Specifically, we consider extensions of Petri nets with transfer and reset operations defined for black indistinguishable tokens (Affine Well-Structured Nets), extensions in which tokens carry pure names dynamically generated with special ν-transitions (ν-APN), and extensions in which tokens carry data taken from a linearly ordered domain (Data nets and CMRS). These models are well-structured transitions systems. In order to compare these models we consider the families of languages they recognize, using coverability as accepting condition. With this criterion, we prove that ν-APNs are in between AWNs and Data Nets/CMRS. Moreover, we prove that the family of languages recognized by ν-APNs satisfies a good number of closure properties, being a semi-full AFL. These results extend the currently known classification of the expressive power of well-structured transition systems with new closure properties and new relations between extensions of Petri nets.

We revise multiset rewriting with name binding, by combining the two main existing approaches to the study of concurrency by means of multiset rewriting: multiset rewriting with existential quantification and constrained multiset rewriting. We obtain ν-MSRs, where we rewrite multisets of atomic formulae, in which some names may be restricted. We prove that ν-MSRs are equivalent to a class of Petri nets in which tokens are tuples of pure names, called pν-APNs. Then we encode π-calculus processes into ν-MSRs in a very direct way, that preserves the topology of bound names, by using the concept of derivatives of a π-calculus process. Finally, we discuss how the recent results on decidable subclasses of the π-calculus are independent of the particular reaction rule of the π-calculus, so that they can be obtained in the more general framework of ν-MSRs. Thus, those results carry over not only to the π-calculus, but to any other formalism that can be encoded within it, as pν-APNs.

In this paper we consider ν-MSR, a formalism that combines the two main existing approaches for multiset rewriting, namely MSR and CMRS. In ν-MSR we rewrite multisets of atomic formulae, in which some names may be restricted. ν-MSR are Turing complete. In particular, a very straightforward encoding of π-calculus process can be done. Moreover, pν-PN, an extension of Petri nets in which tokens are tuples of pure names, are equivalent to ν-MSR. We know that the monadic subclass of ν-MSR is a Well Structured Transition System. Here we prove that depth-bounded ν-MSR, that is, ν-MSR systems for which the interdependance of names is bounded, are also Well Structured, by following the analogous steps to those followed by R. Meyer in the case of the π-calculus. As a corollary, also depth-bounded pν-PN are WSTS, so that coverability is decidable for them.

In previous works we defined *** -APNs, an extension of P/T nets with the capability of creating and managing pure names. We proved that, though reachability is undecidable, coverability remains decidable for them. We also extended P/T nets with the capability of nets to replicate themselves, creating a new component, initially marked in some fixed way, obtaining g-RN systems. We proved that these two extensions of P/T nets are equivalent, so that g-RN systems have undecidable reachability and decidable coverability. Finally, for the class of the so called *** -RN systems, P/T nets with both name creation and replication, we proved that they are Turing complete, so that also coverability turns out to be undecidable. In this paper we study how can we restrict the models of *** -APNs (and, therefore, g-RN systems) and *** -RN systems in order to keep decidability of reachability and coverability, respectively. We prove that if we forbid synchronizations between the different components in a g-RN system, then reachability is still decidable. The proof is done by reducing it to reachability in a class of multiset rewriting systems, similar to Recursive Petri Nets. Analogously, if we forbid name communication between the different components in a *** -RN system, or restrict communication to happen only for a given finite set of names, we obtain decidability of coverability.

Transient Secure Association has been widely accepted as a possible alternative to traditional authentication in the context of Ubiquitous Computing. We develop a formal model for the Resurrecting Duckling Policy that implements it, called TSA systems, which is based on Petri Nets, thus obtaining amenable graphical representations of our systems. We prove that TSA specifications have the same expressive power as P/T nets, so that coverability, that can be used to specify security properties, is decidable for TSA systems. Then we address the problem of implementing TSA systems with a lower level model that only relies on the secure exchange of keys. If we view these systems as closed then our implementation is still equivalent to P/T nets. However, if we consider an open framework then we need a mechanism of fresh name creation to get a correct implementation. This last model is not equivalent to P/T nets, but the coverability problem is still decidable for them.

We study the relationship between name creation and replication in a setting of infinite-state communicating automata. By name creation we mean the capacity of dynamically producing pure names, with no relation between them other than equality or inequality. By replication we understand the ability of systems of creating new parallel identical threads, that can synchronize with each other. We have developed our study in the framework of Petri nets, by considering several extensions of P/T nets. In particular, we prove that in this setting name creation and replication are equivalent, but only when a garbage collection mechanism is added for idle threads. However, when simultaneously considering both extensions the obtained model is, a bit surprisingly, Turing complete and therefore, more expressive than when considered separately.

Several years before the popularization of the Internet, Mark Weiser proposed the concept of ubiquitous computing with the purpose of enhancing the use of computers by making many computers available throughout the physical environment, but making them effectively invisible to the user. Nowadays, such idea affects all areas of computing science, including both hardware and software. In this paper, a formal model for ubiquitous systems based on Petri nets is introduced and motivated with examples and applications. This simple model allows the definition of two-level ubiquitous systems, composed of a collection of processor nets providing services, and a collection of process nets requesting those services. The modeled systems abstract from middleware details, such as service discovery protocols, and security infrastructures, such as PKI’s or trust policies, but not from mobility or component compatibility.

In recent papers we have introduced Mobile Synchronizing Petri Nets, a new model for mobility based on coloured Petri Nets. It allows the description of systems composed of a collection of (possibly mobile) hardware devices and mobile agents, both modelled in a homogenous way and abstracting from middleware details. Our basic model introduced a colour to describe localities, but still lacked appropriate primitives to deal with security, and in fact it was equivalent to P/T nets. Then, we introduced the primitives to cope with security: a new colour for identifiers, basically corresponding to the natural numbers, that are created by means of a special transition. This mechanism allows us to deal with authentication issues. In this paper we discuss the expressiveness of the extended model with the authentication primitives. More specifically, we study several instances of the classical reachability and coverability problems. Finally, we also study a more abstract version of the mechanism to create identifiers, using abstract names, close to those in the π-calculus or the Ambient Calculus. We have proved that both models are strictly in between P/T nets and Turing machines.

The term Ubiquitous Computing was coined by Mark Weiser almost two decades ago. Despite all the time that has passed since Weiser's vision, ubiquitous computing still has a long way ahead to become a pervasive reality. One of the reasons for this may be the lack of widely accepted formal models capable of capturing and analyzing the complexity of the new paradigm. We propose a simple Petri Net based model to study some of its main characteristics. We model both devices and software components as a special kind of coloured Petri Nets, located in locations, that can move to other locations and synchronize with other co-located nets, offering and requesting services. We obtain an amenable model for ubiquitous computing, due to its graphical representation. We present our proposal in a progressive way, first presenting a basic model where coordination is formalized by the synchronized firing of pairs of compatible transitions that offer and request a specific service, and ad hoc networks are modeled by constraining mobility by the dynamic acquisition of locality names. Next, we introduce a mechanism for the treatment of robust security properties, namely the generation of fresh private names, to be used for authentication properties.