The problem of formally analyzing properties of real-time systems is addressed. A method is proposed that allows specifying system properties in the TRIO language (an extension of temporal logic suitable to deal explicitly with the "time" variable and to measure it) and modeling the system as a timed Petri net. It is argued that such an approach is more general than analyzing program properties. The proof method is based on an axiomatization of timed Petri nets in terms of TRIO so that their properties can be derived as suitable theorems in much the same spirit as classical Hoare's method allows proving properties of programs coded in a Pascal-like language. The method is then exemplified through two classical "benchmarks" of the literature on concurrent and real-time systems, namely an elevator system and the dining philosophers problem. A thorough review of the related literature and a comparison thereof with the new method is also provided. Possible alternative methods, theoretical extensions, and practical applications are briefly discussed.
. IntroductionIn the field of sequential programming there are now several well understood methods suitable to prove program properties that are expressed through some-possibly formal-specification language. A classical example is Hoare's method, which aims at proving properties of Pascal-like programs stated in terms of a first-order theory. Although the practical application of such methods to real-life cases is still under debate, these are now well-established and are receiving increasing consensus even in the industrial world, at least for the analysis of the most critical parts of the most critical systems [56,38].The state of the art is less well-established in the case of the analysis of concurrent systems. In fact such systems are intrinsically more difficult to analyze, what turns out into more complex formalization of their semantics and less satisfactory and less adopted specification languages. The situation is even worse for real-time systems. By "real-time systems" here we mean those systems whose behavior does depend on execution speed, not systems with generic requirements for high performance [95, 1]. In such systems one more difficulty arises from the necessity of modeling explicitly the dependence of system behavior on the time variable, whereas this dependency is usually abstracted away in the modeling of computing systems. On the other hand, real-time systems-which include plant control systems, embedded applications, air traffic control systems, etc.-have quite often