Property Analysis of Gateway Refinement of Object-Oriented Petri Net with Inhibitor-Arcs-Based Representation for Embedded Systems

Abstract

This paper focuses on embedded system modeling, proposing a solution to obtain a refined net via the refinement operation of an extended Petri net. Object-oriented technology and Petri net with inhibitor-arcs-based representation for embedded systems (PIRES+) are combined to obtain an object-oriented PIRES+ (OOPIRES+). A gateway refinement method of OOPIRES+ is proposed, and the preservation of the liveness, boundedness, reachability, functionality, and timing of the refined net system is investigated. The modeling analysis of a smart home system is taken as an example to verify the effectiveness of the refinement method. The results can provide an effective way for the investigation of the refined properties of a Petri net system and a favorable means for large-scale complex embedded system modeling, which has broad application prospects.

1. Introduction

Embedded systems are the driving force behind the rapid development of the information technology industry and have widely penetrated and been integrated into every corner of the national economic and social development. As an industry leading the future economic boom, the research of the Internet of Things is also inseparable from embedded systems. Roberto et al. [1] introduced an event network SCIFI-II system, which can separate application components from the event brokers that connect components and realize the deployment of components in any environment. The design and manufacturing of embedded systems has become a hot research topic internationally. In order to improve the design and manufacturing efficiency of embedded systems, formal modeling and verification of the system are very important.

For embedded system modeling, there are usually two methods: the non-formal modeling method and the formal modeling method. Non-formal modeling methods can express certain functional characteristics of a system, but they cannot be validated using rigorous mathematical methods. Formal methods use symbols and mathematical language to describe the properties of a system, which can systematically describe and validate the system [2]. Common formal modeling methods mainly include the extended finite-state machine method [3], data flow diagram method [4], communication process method [5], Petri net method [6], entity relationship diagram method, object-oriented UML method [7], etc. These modeling methods describe the characteristics of embedded systems from different perspectives but do not form a unified standard. Due to their intuitive graphical expression ability and rigorous mathematical expression, Petri nets have a wide range of applications in the behavioral analysis of concurrent systems [8]. However, classical Petri nets lack a hierarchical structure, cannot fully describe data flows, and lack the concept of time [9], making it impossible to fully describe embedded systems.

In order to improve the modeling ability of Petri nets on embedded systems, domestic and foreign scholars have improved the classical Petri nets and proposed a variety of extension forms, such as colored Petri nets (CPNs) [10], time Petri nets [11], fuzzy Petri nets [12], logical delay Petri nets, PRES+ [13], etc. These extended forms of Petri nets enhance the ability to model and analyze embedded systems based on different application requirements, where PRES+ can capture real-time information and describe the hierarchical structure of the system.

In the field of embedded system modeling and analysis, research on the theory and application of PRES+ has achieved some results. Cortés et al. [13] proposed the concept of PRES+ and analyzed two embedded system PRES+ models. Karlsson et al. used PRES+ to accurately model and validate mobile phone systems and represented the embedded systems that need to be validated as PRES+ models [14]. They provided a model validation method for analyzing the system’s coverage and decidability [15]. By using the PRES+ and model transformation method, Bandyopadhyay et al. [16,17] verified the Very Large Scale Integrated (VLSI) system model. In order to improve the efficiency of PRES+ model verification, Xia et al. [18] modeled and analyzed the subsystem sharing system.

Although PRES+ has significantly improved the accuracy of embedded system modeling compared to classical Petri nets, there are still issues with the inability to describe event priorities and fully express complex program control and data flow. Adding inhibitor arcs to Petri nets can be used to control event sequences, adjust priority relationships between sequences, improve model analysis capabilities, and, to some extent, affect the expression of control flow and data flow. Therefore, adding inhibitor arcs to PRES+ can generate a PRES+ with inhibitor arcs (PIRES+, Petri net with inhibitor-arcs-based representation for embedded systems). Xia et al. [19] analyzed the refinement operation of the PIRES+ and applied it to the modeling and verification of the mobile communication systems.

As a system model, the PIRES+ can consider the system and behavior uniformly, but it is not easy to reflect the division of functional modules. The outstanding advantage of object-oriented technology lies in the use of object-oriented technology to divide the system into functional modules, effectively dividing the entire complex system into multiple simple subsystems and conducting corresponding modeling research. By combining object-oriented technology with Petri nets, an object-oriented Petri net (OOPN) can be obtained, which divides the entire system into multiple subsystem modules based on functional implementation, which is beneficial for modeling large-scale complex systems. There have been some research achievements in the analysis and modeling of the object-oriented Petri nets. Zhao et al. [20] proposed an extended-object-oriented petri net (EOOPN), supporting the description and evolution of components in the context of intelligent and cloud computing. Hu et al. [21] worked on a compression algorithm to convert an object-oriented generalized stochastic Petri net (OGSPN) into a generalized stochastic Petri net (GSPN).

However, as the complexity and scale of embedded systems increase, the number of system states will increase exponentially, highlighting the problem of “state space explosion”. Since the “state space explosion” problem of OOPIRES+ is NP-hard, it cannot be completely solved, but it can be alleviated through property preserving transformations. The commonly used Petri net transformation methods include refinement, synthesis, and reduction. Among them, refinement is a “top-down” modeling method. In the modeling of complex system modules, an abstract model is first established; then, it is refined layer by layer; and, finally, a refined model is obtained. When the refinement condition is satisfied, some important properties of the original Petri net system are preserved when the Petri net system is extended without the analysis of the reachable space. Therefore, refinement can alleviate the problem of “state space explosion”.

In recent years, extensive research has been conducted on the refinement and application of Petri nets. Padberg et al. [22] provided an overview of refinement methods for place/transition Petri net systems. Wang et al. [23] proposed a Petri net refinement method without reachability analysis. Based on the basic net system, Bernardinello et al. [24] proposed a refinement method for distributed systems. For the refinement operation of the place/transition net, Huang et al. [25] provided the conditions to keep the original net system’s liveness, boundedness, fairness, and other properties. Lakos et al. [26] provided three types of refinement operations for the colored Petri net (CPN). Based on the workflow net, Van Hee et al. [27] presented several refinement rules for preserving system reliability. For extended-time Petri nets, Mejia et al. [28] proposed a refinement operation mode.

Cortes et al. [13] extended PRES+ by introducing the definition of hierarchical structure and proposed some equivalent concepts of PRES+ and refinement methods to preserve complete equivalence. Xia et al. [19] proposed a PIRES+ refinement method and applied it to modeling network communication systems.

This paper proposes an object-oriented PIRES+ (OOPIRES+) and a gateway refinement operation for the formal modeling and analysis of the large-scale complex embedded systems. So far, there has been little research on the gateway refinement operations. Due to the crucial role of gateway refinement in the transmission and control of system data and information flows, it is necessary to conduct in-depth research on it. For the refinement operation of the OOPIRES+’s gateway, we studied the preservation of liveness, boundedness, reachability, functionality, and timing. This can greatly alleviate the “state space explosion” problem encountered in the modeling process of complex embedded systems. We applied this refinement operation to the modeling of smart home control systems, and we found that it has great guiding significance for the research of embedded system modeling.

The structure of this paper is as follows: Section 2 proposes the related concepts of OOPIRES+. Section 3 presents the gateway refinement operation of OOPIRES+ and investigates the preservation of liveness, boundedness, reachability, functionality, and timing. In Section 4, a smart home remote control system is modeled and analyzed by using the OOPIRES+ gateway refinement operation. Section 5 summarizes the contributions of the refinement method.

2. Relevant Concepts of OOPIRES+

This section provides the relevant concepts of OOPIRES+.

Definition 1 ([19]). 

$N=\left(P,T;F_I,F_O,I,M\right)$ is said to be a PIRES+ model, where $P=\left\{p_1,p_2,\dots ,p_m\right\}$ is the place set, $T=\left\{t_1,t_2,\dots ,t_n\right\}$ is the transition set, $F_I\subseteq P\times T$ is the input arc set, $F_O\subseteq T\times P$ is the output arc set, $I\subseteq P\times T$ is the inhibitor arc set, and M is the marking.

Definition 2 ([19]). 

For $\forall t\in T$, there exists a transition function, $f:\tau \left(p_1\right)\times \tau \left(p_2\right)\times \dots \times \tau \left(p_n\right)\to \tau \left(q\right)$, where $p_1,p_2,\dots ,p_n\in ·t$, $q\in t·$. For $\forall t\in T$, there exists a minimum transition delay, $d^{-}$, and a maximum transition delay, $d^{+}$, both of which are non-negative real numbers.

Figure 1 shows an example of the PIRES+ model.

Here, $\mathrm{P}=\left\{{\mathrm{p}}_1,{\mathrm{p}}_2,{\mathrm{p}}_3,{\mathrm{p}}_4,{\mathrm{p}}_5\right\}$, and $\mathrm{T}=\left\{{\mathrm{t}}_1,{\mathrm{t}}_2,{\mathrm{t}}_3,{\mathrm{t}}_4\right\}$; ${\mathrm{F}}_{\mathrm{I}}=\left\{\left({\mathrm{p}}_1,{\mathrm{t}}_1\right),\left({\mathrm{p}}_2,{\mathrm{t}}_2\right),\left({\mathrm{p}}_3,{\mathrm{t}}_3\right),\left({\mathrm{p}}_4,{\mathrm{t}}_4\right),\left({\mathrm{p}}_5,{\mathrm{t}}_4\right)\right\}$; ${\mathrm{F}}_{\mathrm{O}}=\left\{\left({\mathrm{t}}_1,{\mathrm{p}}_2\right),\left({\mathrm{t}}_1,{\mathrm{p}}_3\right),\left({\mathrm{t}}_2,{\mathrm{p}}_4\right),\left({\mathrm{t}}_3,{\mathrm{p}}_5\right),\left({\mathrm{t}}_4,{\mathrm{p}}_1\right)\right\}$; $\mathrm{I}=\left\{\left({\mathrm{p}}_2,{\mathrm{t}}_3\right)\right\}$; and ${\mathrm{M}}_0$ is the initial marking, where ${\mathrm{M}}_0\left({\mathrm{p}}_1\right)=\left\{〈4,0〉\right\}$ and ${\mathrm{M}}_0\left({\mathrm{p}}_2\right)={\mathrm{M}}_0\left({\mathrm{p}}_3\right)={\mathrm{M}}_0\left({\mathrm{p}}_4\right)={\mathrm{M}}_0\left({\mathrm{p}}_5\right)=\varnothing$. The transition functions of transitions ${\mathrm{t}}_1$, ${\mathrm{t}}_2$, ${\mathrm{t}}_3$, and ${\mathrm{t}}_4$ are ${\mathrm{f}}_1$, ${\mathrm{f}}_2$, ${\mathrm{f}}_3$, and ${\mathrm{f}}_4$, respectively. The transition delays of transitions ${\mathrm{t}}_1$, ${\mathrm{t}}_2$, ${\mathrm{t}}_3$, and ${\mathrm{t}}_4$ are $\left[{\mathrm{a}}_1,{\mathrm{b}}_1\right]$, $\left[{\mathrm{a}}_2,{\mathrm{b}}_2\right]$, $\left[{\mathrm{a}}_3,{\mathrm{b}}_3\right]$, and $\left[{\mathrm{a}}_4,{\mathrm{b}}_4\right]$, respectively.

Definition 3. 

An OOPIRES+ object subnet is a six-tuple $OPSN=\left(P,T;F,I,Q,W\right)$, where $P=\left\{p_1,p_2,\dots ,p_m\right\}$ is the place set of $OPSN$, represented by $OPSN\left(P\right)$; $T=\left\{t_1,t_2,\dots ,t_n\right\}$ is the transition set of $OPSN$, represented by $OPSN\left(T\right)$; $F$ represents the flow relationship of $OPSN$, including $F_I$ and $F_O$, where $F_I\subseteq \left(P\times T\right)\cup \left(Q\times T\right)$ is the set of input arcs and $F_O\subseteq \left(T\times P\right)\cup \left(T\times Q\right)$ is the set of output arcs; $I\subseteq P\times T$ is the inhibitor arc set of $OPSN$; and $Q=\left\{q_1,q_2,\dots ,q_r\right\}$ is the message place set of $OPSN$, represented by $OPSN\left(Q\right)$, including input place $Q_I$ and output place $Q_O$.

For each transition ($\mathrm{t}$), there are a transition function ($\mathrm{f}$) and a transition delay (${\mathrm{d}}^{-}$ and ${\mathrm{d}}^{+}$) associated with it. Object subnets are connected by the gateway, $\mathrm{g}$. Gateways are classified into input gateways and output gateways according to their positions relative to subnets. As the gateway can be used to preprocess data before flowing into the next object subnet, here, the gateway ($\mathrm{g}$) is also assigned the attributes of the gateway function, ${\mathrm{f}}_{\mathrm{g}}$, and the gateway delay, $\left[{\mathrm{d}}_{\mathrm{g}}^{-},{\mathrm{d}}_{\mathrm{g}}^{+}\right]$.

Figure 2 shows an example of the OOPIRES+ object subnet.

Here, $\mathrm{P}=\left\{{\mathrm{p}}_1,{\mathrm{p}}_2,{\mathrm{p}}_3,{\mathrm{p}}_4\right\}$, and $\mathrm{T}=\left\{{\mathrm{t}}_1,{\mathrm{t}}_2,{\mathrm{t}}_3,{\mathrm{t}}_4\right\}$; ${\mathrm{F}}_{\mathrm{I}}=\left\{\left({\mathrm{q}}_1,{\mathrm{t}}_1\right),\left({\mathrm{p}}_1,{\mathrm{t}}_2\right),\left({\mathrm{p}}_2,{\mathrm{t}}_3\right),\left({\mathrm{p}}_3,{\mathrm{t}}_4\right),\left({\mathrm{p}}_4,{\mathrm{t}}_4\right)\right\}$; ${\mathrm{F}}_{\mathrm{O}}=\left\{\left({\mathrm{t}}_1,{\mathrm{p}}_1\right),\left({\mathrm{t}}_1,{\mathrm{p}}_2\right),\left({\mathrm{t}}_2,{\mathrm{p}}_3\right),\left({\mathrm{t}}_3,{\mathrm{p}}_4\right),\left({\mathrm{t}}_4,{\mathrm{q}}_2\right),\right\}$; $\mathrm{I}=\left\{\left({\mathrm{p}}_2,{\mathrm{t}}_2\right)\right\}$; $\mathrm{Q}=\left\{{\mathrm{q}}_1,{\mathrm{q}}_2\right\}$, where ${\mathrm{q}}_1$ is the input message place, and ${\mathrm{q}}_2$ is the output message place; and ${\mathrm{g}}_1$ and ${\mathrm{g}}_2$ are the input gateway and the output gateway of the object subnet ${\mathrm{OPSN}}_1$. Moreover, ${\mathrm{f}}_1$, ${\mathrm{f}}_2$, ${\mathrm{f}}_3$, and ${\mathrm{f}}_4$ are transition functions of transitions ${\mathrm{t}}_1$, ${\mathrm{t}}_2$, ${\mathrm{t}}_3$, and ${\mathrm{t}}_4$, respectively. Their corresponding transition delays are $\left[{\mathrm{a}}_1,{\mathrm{b}}_1\right]$, $\left[{\mathrm{a}}_2,{\mathrm{b}}_2\right]$, $\left[{\mathrm{a}}_3,{\mathrm{b}}_3\right]$, and $\left[{\mathrm{a}}_4,{\mathrm{b}}_4\right]$, respectively. In addition, ${\mathrm{f}}_{\mathrm{g}1}$ and ${\mathrm{f}}_{\mathrm{g}2}$ are the gateway functions of gateways ${\mathrm{g}}_1$ and ${\mathrm{g}}_2$, and their corresponding gateway delays are $\left[{\mathrm{a}}_{\mathrm{g}1},{\mathrm{b}}_{\mathrm{g}1}\right]$ and $\left[{\mathrm{a}}_{\mathrm{g}2},{\mathrm{b}}_{\mathrm{g}2}\right]$.

Definition 4. 

An OOPIRES+ net system is a four-tuple $OPN=\left(OPSN,G,F,M\right)$, where $OPSN=\left(OPS{N}_1,OPS{N}_2,\dots ,OPS{N}_s\right)$ is the object subnet set of OOPIRES+; $G=\left\{g_1,g_2,\dots ,g_t\right\}$ is the set of all gateways; $F$ includes $F_I$ and $F_O$, where $F_I\subseteq \left(Q\times G\right)$, $F_O\subseteq \left(G\times Q\right)$; $M$ is the marking; and the initial marking is $M_0$.

Definition 5. 

Suppose that $OPN=\left(OPSN,G,F,M\right)$ is an OOPIRES+ net system, $M\in R\left(M_0\right)$, and $t^{*}$ is the inhibitor place set of transition, $t$.

(i)

If $t^{*}\ne \varnothing$ and$·t\cap Q\ne \varnothing$, then $t$ is called enabled under $M$ if $\forall p\in ·t-t^{*}:M\left(p\right)\ge W\left(p,t\right)$, $\forall p\in t^{*}:M\left(p\right)=\varnothing$, and $\forall q\in Q:M\left(q\right)\ge W\left(q,t\right)$;

(ii)

If  $t^{*}=\varnothing$ and $·t\cap Q\ne \varnothing$, then $t$ is called enabled under $M$ if $\forall p\in ·t:M\left(p\right)\ge W\left(p,t\right)$ and $\forall q\in Q:M\left(q\right)\ge W\left(q,t\right)$;

(iii)

If $t^{*}\ne \varnothing$  and $·t\cap Q=\varnothing$ and, then $t$ is called enabled under $M$ if $\forall p\in ·t-t^{*}:M\left(p\right)\ge W\left(p,t\right)$, $\forall p\in t^{*}:M\left(p\right)=\varnothing$;

(iv)

If  $t^{*}=\varnothing$ and $·t\cap Q=\varnothing$, then $t$ is called enabled under $M$ if  $\forall p\in ·t:M\left(p\right)\ge W\left(p,t\right)$;

(v)

The system marking changes after the firing of transition $t$:$M\to M^{\prime }$, where

$$\begin{gathered} M^{\prime }\left(p\right)=\left\{\begin{array}{cc}M\left(p\right)-W\left(p,t\right)& p\in ·t-t·-t^{*}\\ M\left(p\right)+W\left(t,p\right)& p\in t·-·t or p\in t·\cap t^{*}\\ \begin{array}{c}M\left(p\right)-W\left(p,t\right)+W\left(t,p\right)\\ M\left(p\right)\end{array}& \begin{array}{c}p\in ·t\cap t·-t^{*}\\ others\end{array}\end{array}\right. \\ {M}^{\prime }\left(q\right)=\left\{\begin{array}{cc}M\left(q\right)-W\left(q,t\right)& p\in ·t\\ M\left(q\right)+W\left(t,q\right)& p\in t·\\ M\left(q\right)& others\end{array}\right. \end{gathered}$$

Definition 6. 

Suppose an OOPIRES+ net system is $OPN=\left(OPSN,G,F,M_0\right)$, where $M_0$ is the initial marking, $t\in OPSN\left(T\right)$, and $g\in G$. Then, we have the following:

(i)

If $\forall M\in R\left(M_0\right)$, $\exists M^{\prime }\in R\left(M\right)$, $M^{\prime }[t>$, then $t$ is said to be live. If $\forall M\in R\left(M_0\right)$, $\exists M^{\prime }\in R\left(M\right)$, $M^{\prime }[g>$, then $g$ is said to be live.

(ii)

If $\forall t\in OPSN\left(T\right)$,$\forall g\in G$, $t$, and $g$ are live, then the OOPIRES+ net system OPN is said to be live.

Definition 7. 

Suppose an OOPIRES+ net system is  $OPN=\left(OPSN,G,F,M_0\right)$, where $M_0$ is the initial marking, $p\in OPSN\left(P\right)$, and $q\in OPSN\left(Q\right)$. Then, we have the following:

(i)

Place $p$ is said to be bounded if $\exists k>0$, $\forall M\in R\left(M_0\right):M\left(p\right)\le k$. Message place $q$ is said to be bounded if $\exists l>0$, $\forall M\in R\left(M_0\right):M\left(q\right)\le l$.

(ii)

If $\forall p\in OPSN\left(P\right)$,$\forall q\in OPSN\left(Q\right)$,$p$, and $q$ are bounded, then the OOPIRES+ net system $OPN$ is said to be bounded.

Definition 8. 

Assuming that $OPS{N}_1$ and $OPS{N}_2$ are two OOPIRES+ object subnets, then $OPS{N}_1$ and $OPS{N}_2$ are said to have the same reachability if and only if the following takes place:

(i)

The pre-set place’s number of input gateway and the post-set place’s number of output gateway of $OPS{N}_1$ are the same as those of $OPS{N}_2$.

(ii)

If the number of tokens in pre-set places of the input gateway of $OPS{N}_1$ is equal to that of $OPS{N}_2$, then the number of tokens in post-set place of the output gateway of $OPS{N}_1$ is equal to that of $OPS{N}_2$.

Definition 9. 

Assuming that $OPS{N}_1$ and $OPS{N}_2$ are two OOPIRES+ object subnets, then $OPS{N}_1$ and $OPS{N}_2$ are said to have the same functionality if and only if the following takes place:

(i)

$OPS{N}_1$ and $OPS{N}_2$ have the same reachability.

(ii)

If the token type of tokens in pre-set places of the input gateway of $OPS{N}_1$ is equal to that of $OPS{N}_2$, then the token type of tokens in the post-set place of output gateway of $OPS{N}_1$ is equal to that of $OPS{N}_2$.

Definition 10. 

Assuming that $OPS{N}_1$ and $OPS{N}_2$ are two OOPIRES+ object subnets, $OPS{N}_1$ and $OPS{N}_2$ are said to have the same timing if and only if the following takes place:

(i)

$OPS{N}_1$ and $OPS{N}_2$ have the same reachability.

(ii)

If the token time of tokens in pre-set places of the input gateway of $OPS{N}_1$ is equal to that of $OPS{N}_2$, then the token time of tokens in the post-set place of output gateway of $OPS{N}_1$ is equal to that of $OPS{N}_2$.

3. OOPIRES+ Gateway Refinement Operation and Property Analysis

In this section, the gateway refinement operation of OOPIRES+ is proposed, and the preservation of liveness, boundedness, reachability, functionality, and timing of the original net system by this refinement operation is investigated.

Figure 3 is a schematic diagram of the gateway refinement operation of the OOPIRES+ net system.

Definition 11. 

Gateway refinement operation of the OOPIRES+ net system $Re f\left(g_A,OPS{N}_A+\overline{G_A}\right)$: The gateway, $g_A$, of the OOPIRES+ net system $OPN=\left(OPSN,G,F,M\right)$ is refined into a subnet and a gateway set, $\overline{G_A}=\left\{\overline{g_{A1}},\overline{g_{A2}}\right\}$; that is, $g_A$ is replaced by the subnet, $OPS{N}_A$, and the gateway set $\overline{G_A}=\left\{\overline{g_{A1}},\overline{g_{A2}}\right\}$. Then, a new OOPIRES + net system, $OP{N}_B=\left(OPS{N}_B,G_B,F_B,M_B\right)$, is obtained, where we have the following:

(i)

$OPS{N}_B=OPSN\cup OPS{N}_A$;

(ii)

$G_B=G\cup \overline{G_A}-g_A$;

(iii)

$f_{gB}=f_{\overline{g_{A2}}} \circ f_s \circ f_{\overline{g_{A1}}} = f_{gA}$ (here, $\circ$ is the function composition operator), where $f_{\overline{g_{A1}}}$, $f_{\overline{g_{A2}}}$, and $f_{g_A}$ are the gateway functions of $\overline{g_{A1}}$, $\overline{g_{A2}}$, and $g_A$, respectively; $f_s:\tau \left(p_1\right)\times \tau \left(p_2\right)\times \dots \times \tau \left(p_n\right)\to \tau \left(q\right)$, $p_1,p_2,\dots ,p_n\in OPS{N}_A\left(Q_{AI}\right)$, and $q\in OPS{N}_A\left(Q_{AO}\right)$.

(iv)

$d_{g_B}^{-}=d_{\overline{g_{A1}}}^{-}+d_s^{-}+d_{\overline{g_{A2}}}^{-}=d_{g_A}^{-}$, and $d_{g_B}^{+}=d_{\overline{g_{A1}}}^{+}+d_s^{+}+d_{\overline{g_{A2}}}^{+}=d_{g_A}^{+}$, where $d_{\overline{g_{A1}}}^{-}$, $d_{\overline{g_{A2}}}^{-}$, and $d_{g_A}^{-}$ are the minimum gateway delays of $\overline{g_{A1}}$, $\overline{g_{A2}}$, and $g_A$, respectively; $d_{\overline{g_{A1}}}^{+}$, $d_{\overline{g_{A2}}}^{+}$, and $d_{g_A}^{+}$ are the maximum gateway delays of $\overline{g_{A1}}$, $\overline{g_{A2}}$, $g_A$, respectively; and $d_s^{-}$ and $d_s^{+}$ are the minimum and the maximum transition delays of $OPS{N}_A\left(T\right)$.

(v)

$F_B$ includes $F_{BI}$ and $F_{BO}$, where $F_{BI}=F_I\cup F_{AI}\cup \left\{\left(q,\overline{g_{A1}}\right)|q\in ·g_A\right\}\cup \left\{\left(q,\overline{g_{A2}}\right)|q\in ·\overline{g_{A2}}\right\}-\left\{\left(q,g_A\right)\right|q\in ·g_A\}$, and $F_{BO}=F_O\cup F_{AO}\cup \left\{\left(\overline{g_{A2}},q\right)|q\in g_A·\right\}\cup \left\{\left(\overline{g_{A1}},q\right)|q\in \overline{g_{A1}·}\right\}-\left\{\left(g_A,q\right)\right|q\in g_A·\}$;

(vi)

$M_B\left(p\right)=\left\{\begin{array}{c}\begin{array}{cc}{M}_0\left(p\right)& p\in OPSN\left(P\right)\end{array}\\ \begin{array}{cc}{M}_{A0}\left(p\right)& p\in OPS{N}_A\left(P\right)\end{array}\end{array}\right.$.

Definition 12. 

The closed net system of the OOPIRES+ subnet $OPSN=\left(P,T;F,I,Q,W\right)$ is defined as a three-tuple $OP{N}^{\prime }=\left(OPSN,G^{\prime },p^{\prime }\right)$; that is, the gateway set, $G^{\prime }=\left\{g_1^{\prime },g_2^{\prime }\right\}$, and message place, $p^{\prime }$, are added to $OPSN$, where $g_1^{\prime }$ is the input gateway of $OPSN$, $g_2^{\prime }$ is the output gateway of $OPSN$, and $p^{\prime }=\left\{g_2^{\prime }\right\}\wedge p^{\prime }·=\left\{ g_1^{\prime }\right\}$.

Definition 13. 

The extended subnet of the gateway, $g$, is a three-tuple $g^{″}=\left(g,Q,F\right)$ ; that is, a message place set, $Q$, and a flow relationship, $F$, are added to the gateway, $g$, where $Q$ includes $Q_I$ and $Q_O$, and $F=\{\left(q_1,g\right),\left(g,q_2\right)|q_1\in Q_I,q_2\in Q_O\}$.

In the following, we investigate the preservation of liveness, boundedness, reachability, functionality, and timing of the gateway refinement operation of the OOPIRES+ net system.

It is assumed that the OOPIRES+ net system ${\mathrm{OPN}}_{\mathrm{B}}=\left({\mathrm{OPSN}}_{\mathrm{B}},{\mathrm{G}}_{\mathrm{B}},{\mathrm{F}}_{\mathrm{B}},{\mathrm{M}}_{\mathrm{B}}\right)$ is obtained from the OOPIRES+ net system $\mathrm{OPN}=\left(\mathrm{OPSN},\mathrm{G},\mathrm{F},\mathrm{M}\right)$ by using the gateway refinement operation $\mathrm{Re} \mathrm{f}\left({\mathrm{g}}_{\mathrm{A}},{\mathrm{OPSN}}_{\mathrm{A}}+\overline{{\mathrm{G}}_{\mathrm{A}}}\right)$.

Theorem 1. 

$OP{N}_B$ is live if and only if $OPN$ and the closed net system $OP{N}_A{}^{\prime }=\left(OPS{N}_A,G_A^{\prime },p_A^{\prime }\right)$ of $OPS{N}_A$ are live.

Proof. 

($\Leftarrow$) For the net system $\mathrm{OPN}$, since $\mathrm{OPN}$ is live, according to Definition 6, $\forall \mathrm{t}\in \mathrm{OPSN}\left(\mathrm{T}\right)$ and $\forall \mathrm{g}\in \mathrm{G}$, for $\forall \mathrm{M}\in \mathrm{R}\left({\mathrm{M}}_0\right)$, there exists $\mathrm{M}{}^{\prime }\in \mathrm{R}\left(\mathrm{M}\right)$, such that $\mathrm{M}{}^{\prime }[\mathrm{t}>$ and $\mathrm{M}{}^{\prime }[\mathrm{g}>$, and then $\mathrm{t}$ and $\mathrm{g}$ are live. For the closed net system ${\mathrm{OPN}}_{\mathrm{A}}{}^{\prime }$, since ${\mathrm{OPN}}_{\mathrm{A}}{}^{\prime }$ is live, according to Definition 6, $\forall \mathrm{t}\in {\mathrm{OPSN}}_{\mathrm{A}}\left(\mathrm{T}\right)$ and $\forall \mathrm{g}\in {\mathrm{G}}_{\mathrm{A}}^{{}^{\prime }}$, and for $\forall \mathrm{M}\in \mathrm{R}\left({\mathrm{M}}_0\right)$, there exists $\mathrm{M}{}^{\prime }\in \mathrm{R}\left(\mathrm{M}\right)$, such that $\mathrm{M}{}^{\prime }[\mathrm{t}>$ and $\mathrm{M}{}^{\prime }[\mathrm{g}>$; then, $\mathrm{t}$ and $\mathrm{g}$ are live. Since ${\mathrm{OPN}}_{\mathrm{B}}$ is obtained from $\mathrm{OPN}$ by using ${\mathrm{OPSN}}_{\mathrm{A}}$ and $\overline{{\mathrm{G}}_{\mathrm{A}}}$ to replace ${\mathrm{g}}_{\mathrm{A}}$, ${\mathrm{OPSN}}_{\mathrm{B}}\left(\mathrm{T}\right)=\left\{\mathrm{OPSN}\left(\mathrm{T}\right),{\mathrm{OPSN}}_{\mathrm{A}}\left(\mathrm{T}\right)\right\}$, ${\mathrm{OPN}}_{\mathrm{B}}\left(\mathrm{G}\right)=\left\{\mathrm{OPN}\left(\mathrm{G}\right),{\mathrm{OPN}}_{\mathrm{A}}\left({\mathrm{G}}_{\mathrm{A}}^{\prime }\right)\right\}$. According to Definition 12, for $\forall \mathrm{t}\in {\mathrm{OPSN}}_{\mathrm{B}}\left(\mathrm{T}\right)$, $\forall \mathrm{g}\in {\mathrm{G}}_{\mathrm{B}}$, $\forall \mathrm{M}\in \mathrm{R}\left({\mathrm{M}}_{\mathrm{B}0}\right)$, $\exists \mathrm{M}{}^{\prime }\in \mathrm{R}\left(\mathrm{M}\right)$, such that $\mathrm{M}{}^{\prime }[\mathrm{t}>$, $\mathrm{M}{}^{\prime }[\mathrm{g}>$, $\mathrm{t}$, and $\mathrm{g}$ are live. Therefore, the net system ${\mathrm{OPN}}_{\mathrm{B}}$ is live.

($\Rightarrow$) Suppose that ${\mathrm{OPN}}_{\mathrm{B}}$ is live. Without loss of generality, assume that $\mathrm{OPN}$ is not live, and then $\exists \mathrm{t}\in \mathrm{OPSN}\left(\mathrm{T}\right)$ or $\exists \mathrm{g}\in \mathrm{G}$, $\exists \mathrm{M}\in \mathrm{R}\left({\mathrm{M}}_0\right)$, $\forall \mathrm{M}{}^{\prime }\in \mathrm{R}\left(\mathrm{M}\right)$, such that $\neg \mathrm{M}{}^{\prime }[\mathrm{t}>$ or $\neg \mathrm{M}{}^{\prime }[\mathrm{g}>$. Since $\mathrm{OPSN}\left(\mathrm{T}\right)\subseteq {\mathrm{OPSN}}_{\mathrm{B}}\left(\mathrm{T}\right)$ and $\mathrm{G}\subseteq {\mathrm{G}}_{\mathrm{B}}$, then $\exists \mathrm{t}\in {\mathrm{OPSN}}_{\mathrm{B}}\left(\mathrm{T}\right)$ or $\exists \mathrm{g}\in {\mathrm{G}}_{\mathrm{B}}$, $\exists \mathrm{M}\in \mathrm{R}\left({\mathrm{M}}_{\mathrm{B}0}\right)$, $\forall \mathrm{M}{}^{\prime }\in \mathrm{R}\left(\mathrm{M}\right)$, $\neg \mathrm{M}{}^{\prime }[\mathrm{t}>$ or $\neg \mathrm{M}{}^{\prime }[\mathrm{g}>$, so ${\mathrm{OPN}}_{\mathrm{B}}$ is not live. This contradicts the hypothesis. Therefore, $\mathrm{OPN}$ and ${\mathrm{OPN}}_{\mathrm{A}}{}^{\prime }$ are live. □

Theorem 2. 

$OP{N}_B$ is bounded if and only if $OPN$ and the closed net system $OP{N}_A{}^{\prime }=\left(OPS{N}_A,G_A^{\prime },p_A^{\prime }\right)$ of $OPS{N}_A$ are bounded.

Proof. 

($\Leftarrow$) Since the net system $\mathrm{OPN}$ is bounded, according to Definition 7, $\forall \mathrm{p}\in \mathrm{OPSN}\left(\mathrm{P}\right)\wedge \forall \mathrm{q}\in \mathrm{OPSN}\left(\mathrm{Q}\right)$, $\exists \mathrm{k}>0$, $\forall \mathrm{M}\in \mathrm{R}\left({\mathrm{M}}_0\right)$, such that $\mathrm{M}\left(\mathrm{p}\right)\le \mathrm{k}\wedge \mathrm{M}\left(\mathrm{q}\right)\le \mathrm{k}$. Since the closed net system ${\mathrm{OPN}}_{\mathrm{A}}{}^{\prime }$ is bounded, according to Definition 7, $\forall \mathrm{p}\in {\mathrm{OPSN}}_{\mathrm{A}}\left(\mathrm{P}\right)\cup \left\{{\mathrm{p}}_{\mathrm{A}}^{\prime }\right\}\wedge \forall \mathrm{q}\in {\mathrm{OPSN}}_{\mathrm{A}}\left(\mathrm{Q}\right)$, $\forall \mathrm{M}\in \mathrm{R}\left({\mathrm{M}}_{\mathrm{A}0}\right)$, $\exists {\mathrm{k}}_{\mathrm{A}}>0$, such that $\mathrm{M}\left(\mathrm{p}\right)\le {\mathrm{k}}_{\mathrm{A}}\wedge \mathrm{M}\left(\mathrm{q}\right)\le {\mathrm{k}}_{\mathrm{A}}$. Let ${\mathrm{k}}_{\mathrm{B}}=\max \left\{\mathrm{k},{\mathrm{k}}_{\mathrm{A}}\right\}$ and then $\forall \mathrm{p}\in {\mathrm{OPSN}}_{\mathrm{B}}\left(\mathrm{P}\right)\wedge \forall \mathrm{q}\in {\mathrm{OPSN}}_{\mathrm{B}}\left(\mathrm{Q}\right)$,$\forall \mathrm{M}\in \mathrm{R}\left({\mathrm{M}}_{\mathrm{B}0}\right)$, such that $\mathrm{M}\left(\mathrm{p}\right)\le {\mathrm{k}}_{\mathrm{B}}\wedge \mathrm{M}\left(\mathrm{q}\right)\le {\mathrm{k}}_{\mathrm{B}}$. Thus, ${\mathrm{OPN}}_{\mathrm{B}}$ is bounded.

($\Rightarrow$) Suppose that ${\mathrm{OPN}}_{\mathrm{B}}$ is bounded. Without loss of generality, assume that $\mathrm{OPN}$ is not bounded, and then, for $\forall \mathrm{M}\in \mathrm{R}\left({\mathrm{M}}_0\right)$, $\exists \mathrm{p}\in \mathrm{OPSN}\left(\mathrm{P}\right)$ or $\exists \mathrm{q}\in \mathrm{OPSN}\left(\mathrm{Q}\right)$, for $\forall \mathrm{k}>0$, $\mathrm{M}\left(\mathrm{p}\right)>\mathrm{k}$ or $\mathrm{M}\left(\mathrm{q}\right)>\mathrm{k}$. Since $\mathrm{OPSN}\left(\mathrm{P}\right)\subseteq {\mathrm{OPSN}}_{\mathrm{B}}\left(\mathrm{P}\right)$ and $\mathrm{OPSN}\left(\mathrm{Q}\right)\subseteq {\mathrm{OPSN}}_{\mathrm{B}}\left(\mathrm{Q}\right)$, for $\forall \mathrm{M}\in \mathrm{R}\left({\mathrm{M}}_{\mathrm{B}0}\right)$, $\exists \mathrm{p}\in {\mathrm{OPSN}}_{\mathrm{B}}\left(\mathrm{P}\right)$ or $\exists \mathrm{q}\in {\mathrm{OPSN}}_{\mathrm{B}}\left(\mathrm{Q}\right)$, $\forall {\mathrm{k}}_{\mathrm{B}}>0$, $\mathrm{M}\left(\mathrm{p}\right)>\mathrm{k}$ or $\mathrm{M}\left(\mathrm{q}\right)>\mathrm{k}$, so ${\mathrm{OPN}}_{\mathrm{B}}$ is not bounded. This contradicts the hypothesis. Therefore, $\mathrm{OPN}$ and ${\mathrm{OPN}}_{\mathrm{A}}{}^{\prime }$ are both bounded. □

Theorem 3. 

$OP{N}_B$ and $OPN$ have the same reachability.

Proof. 

According to gateway refinement operation, $\mathrm{Re} \mathrm{f}\left({\mathrm{g}}_{\mathrm{A}},{\mathrm{OPSN}}_{\mathrm{A}}+\overline{{\mathrm{G}}_{\mathrm{A}}}\right)$, of the OOPIRES + system, in ${\mathrm{OPSN}}_{\mathrm{A}}+\overline{{\mathrm{G}}_{\mathrm{A}}}$ and ${\mathrm{g}}_{\mathrm{A}}^{″}$, the number of pre-set places and post-set places of $\overline{{\mathrm{G}}_{\mathrm{A}}}$ and ${\mathrm{g}}_{\mathrm{A}}$ is the same, and the number of tokens in the pre-set places of $\overline{{\mathrm{G}}_{\mathrm{A}}}$ is equal to that of ${\mathrm{g}}_{\mathrm{A}}$. According to Definition 11, the tokens’ number in the post -set places of $\overline{{\mathrm{G}}_{\mathrm{A}}}$ is equal to that of ${\mathrm{g}}_{\mathrm{A}}$. According to Definition 8, the reachability of ${\mathrm{g}}_{\mathrm{A}}^{″}$ and ${\mathrm{OPSN}}_{\mathrm{A}}+\overline{{\mathrm{G}}_{\mathrm{A}}}$ is the same. Since $\mathrm{OPN}-\left\{{\mathrm{g}}_{\mathrm{A}}\right\}={\mathrm{OPN}}_{\mathrm{B}}-\left\{{\mathrm{OPSN}}_{\mathrm{A}}+\overline{{\mathrm{G}}_{\mathrm{A}}}\right\}$, the reachability of ${\mathrm{OPN}}_{\mathrm{B}}$ and $\mathrm{OPN}$ is the same. □

Theorem 4. 

$OP{N}_B$ and $OPN$ have the same functionality.

Proof. 

According to Theorem 3, net system ${\mathrm{OPN}}_{\mathrm{B}}$ and $\mathrm{OPN}$ have the same reachability. In ${\mathrm{OPSN}}_{\mathrm{A}}+\overline{{\mathrm{G}}_{\mathrm{A}}}$ and ${\mathrm{g}}_{\mathrm{A}}^{″}$, the token type of tokens in the pre-set places of $\overline{{\mathrm{G}}_{\mathrm{A}}}$ is the same as that of ${\mathrm{g}}_{\mathrm{A}}$. According to Definition 11, ${\mathrm{f}}_{{\mathrm{g}}_{\mathrm{B}}}={\mathrm{f}}_{\overline{{\mathrm{g}}_{\mathrm{A}2}}}\circ {\mathrm{f}}_{\mathrm{s}}\circ {\mathrm{f}}_{\overline{{\mathrm{g}}_{\mathrm{A}1}}}={\mathrm{f}}_{{\mathrm{g}}_{\mathrm{A}}}$; therefore, the token type of tokens in post-set places of $\overline{{\mathrm{G}}_{\mathrm{A}}}$ is the same as that of ${\mathrm{g}}_{\mathrm{A}}$. By Definition 9, ${\mathrm{OPSN}}_{\mathrm{A}}+\overline{{\mathrm{G}}_{\mathrm{A}}}$ and ${\mathrm{g}}_{\mathrm{A}}^{″}$ have the same functionality. Since ${\mathrm{OPN}}_{\mathrm{B}}-\left\{{\mathrm{OPSN}}_{\mathrm{A}}+\overline{{\mathrm{G}}_{\mathrm{A}}}\right\}=\mathrm{OPN}-\left\{{\mathrm{g}}_{\mathrm{A}}\right\}$, ${\mathrm{OPN}}_{\mathrm{B}}$ and $\mathrm{OPN}$ have the same functionality. □

Theorem 5. 

$OP{N}_B$ and $OPN$ have the same timing.

Proof. 

According to Theorem 3, net systems ${\mathrm{OPN}}_{\mathrm{B}}$ and $\mathrm{OPN}$ have the same reachability. In ${\mathrm{OPSN}}_{\mathrm{A}}+\overline{{\mathrm{G}}_{\mathrm{A}}}$ and ${\mathrm{g}}_{\mathrm{A}}^{″}$, the token time of tokens in the pre-set places of $\overline{{\mathrm{G}}_{\mathrm{A}}}$ is the same as that of ${\mathrm{g}}_{\mathrm{A}}$. According to Definition 11, ${\mathrm{d}}_{\overline{{\mathrm{g}}_{\mathrm{A}1}}}^{-}+{\mathrm{d}}_{\mathrm{s}}^{-}+{\mathrm{d}}_{\overline{{\mathrm{g}}_{\mathrm{A}2}}}^{-}={\mathrm{d}}_{{\mathrm{g}}_{\mathrm{A}}}^{-}$, ${\mathrm{d}}_{\overline{{\mathrm{g}}_{\mathrm{A}1}}}^{+}+{\mathrm{d}}_{\mathrm{s}}^{+}+{\mathrm{d}}_{\overline{{\mathrm{g}}_{\mathrm{A}2}}}^{+}={\mathrm{d}}_{{\mathrm{g}}_{\mathrm{A}}}^{+}$; therefore, the token time of tokens in post-set places of $\overline{{\mathrm{G}}_{\mathrm{A}}}$ is the same as that of ${\mathrm{g}}_{\mathrm{A}}$. By Definition 10, ${\mathrm{OPSN}}_{\mathrm{A}}+\overline{{\mathrm{G}}_{\mathrm{A}}}$ and ${\mathrm{g}}_{\mathrm{A}}^{″}$ have the same timing. Since ${\mathrm{OPN}}_{\mathrm{B}}-\left\{{\mathrm{OPSN}}_{\mathrm{A}}+\overline{{\mathrm{G}}_{\mathrm{A}}}\right\}=\mathrm{OPN}-\left\{{\mathrm{g}}_{\mathrm{A}}\right\}$, then ${\mathrm{OPN}}_{\mathrm{B}}$ and $\mathrm{OPN}$ have the same timing. □

4. Applications

This section applies the gateway refinement method of the object-oriented PIRES+ (OOPIRES+) to the modeling and analysis of smart home remote control systems.

The smart home remote control system is mainly composed of five functional modules: mobile control module, PC control module, instruction data transmission module, function echo feedback module, and system function control module. When users want to manage their smart homes, they can give instructions to the smart home devices connected to the network, one by one, through the mobile phones or PC terminals. Instructions are summarized by the mobile control module or PC control module and uploaded to the cloud for storage. The instructions are transmitted to the system function control module through the instruction data transmission module, achieving management and control of the smart home, and ultimately completing the feedback of the instructions.

4.1. Construct OOPIRES+ Model for Smart Home Remote Control System

In this subsection, the smart home remote control system’s OOPIRES+ model is constructed. We first provide the OOPIRES+ abstract model and then apply the above refinement operation method to obtain its refined OOPIRES+ model.

As shown in Figure 4, the abstract OOPIRES+ net system model $\mathrm{OPN}=\left(\mathrm{OPSN},\mathrm{G},\mathrm{F},\mathrm{M}\right)$ of the smart home remote control system is proposed, which includes instructions transmission module ${\mathrm{OPSN}}_1$, function feedback module ${\mathrm{OPSN}}_2$, and gateways ${\mathrm{g}}_{\mathrm{A}}$ and ${\mathrm{g}}_{\mathrm{AA}}$. The meaning of the internal transition of ${\mathrm{OPSN}}_1$ and ${\mathrm{OPSN}}_2$ is as follows: ${\mathrm{t}}_1$, receive current instructions; ${\mathrm{t}}_2$, remote transmission of instructions; ${\mathrm{t}}_3$, instruction transmission completed; ${\mathrm{t}}_4$, receive functional feedback; ${\mathrm{t}}_5$, functional feedback transmission; and ${\mathrm{t}}_6$, screen status display.

Figure 5 shows the object subnet model ${\mathrm{OPSN}}_{\mathrm{A}}$, which includes system function control module ${\mathrm{OPSN}}_3$ and gateways $\overline{{\mathrm{g}}_{\mathrm{A}1}}$ and $\overline{{\mathrm{g}}_{\mathrm{A}2}}$. According to the received instructions, ${\mathrm{OPSN}}_{\mathrm{A}}$ completes the control of subsystems. The meaning of the internal transition ${\mathrm{OPSN}}_3$ is as follows: ${\mathrm{t}}_{\mathrm{A}1}$, apply for control permission; ${\mathrm{t}}_{\mathrm{A}2}$, confirm system status; ${\mathrm{t}}_{\mathrm{A}3}$, confirm control permission; and ${\mathrm{t}}_{\mathrm{A}4}$, complete instruction execution. Moreover, ${\mathrm{t}}_{\mathrm{A}1\prime }$~${\mathrm{t}}_{\mathrm{Am}\prime }$ corresponds to control systems, which include the lighting control system, monitoring control system, and electrical control system, and realizes corresponding instruction functions.

Figure 6 shows the object subnet ${\mathrm{OPSN}}_{\mathrm{AA}}$, including mobile terminal control module ${\mathrm{OPSN}}_4$, PC control module ${\mathrm{OPSN}}_5$, and the gateways $\overline{{\mathrm{g}}_{\mathrm{AA}1}}$ and $\overline{{\mathrm{g}}_{\mathrm{AA}2}}$. According to the operator’s intention, this module sends instructions to the functional control terminal through different devices. The meaning of the internal transitions of ${\mathrm{OPSN}}_4$ and ${\mathrm{OPSN}}_5$ is as follows: ${\mathrm{t}}_{\mathrm{AA}1}$, apply to activate mobile devices; ${\mathrm{t}}_{\mathrm{AA}2}$, summarize current instructions; ${\mathrm{t}}_{\mathrm{AA}3}$, check network connectivity; ${\mathrm{t}}_{\mathrm{AA}4}$, upload instructions to the cloud; ${\mathrm{t}}_{\mathrm{AA}5}$, complete cloud upload; ${\mathrm{t}}_{\mathrm{AA}6}$, apply to enable PC devices; ${\mathrm{t}}_{\mathrm{AA}7}$, check synchronization on PC devices; ${\mathrm{t}}_{\mathrm{AA}8}$, confirm synchronization on PC devices; ${\mathrm{t}}_{\mathrm{AA}9}$, summarize current instructions; and ${\mathrm{t}}_{\mathrm{AA}10}$, instruction cloud synchronization. Moreover, ${\mathrm{t}}_{\mathrm{AA}1\prime }$~${\mathrm{t}}_{\mathrm{AAm}\prime }$ and ${\mathrm{t}}_{\mathrm{AA}1″}$~${\mathrm{t}}_{\mathrm{AAm}″}$ are used to realize the collection of system instructions on a mobile phone and PC terminal.

Next, the object subnets ${\mathrm{OPSN}}_{\mathrm{A}}$ and ${\mathrm{OPSN}}_{\mathrm{AA}}$ are used to carry out refinement operations on ${\mathrm{g}}_{\mathrm{A}}$ and ${\mathrm{g}}_{\mathrm{AA}}$ in the net system abstract model $\mathrm{OPN}$, and the smart home remote control system ${\mathrm{OPN}}_{\mathrm{B}}$ is obtained (as shown in Figure 7). The system begins to issue control instructions to smart home devices from ${\mathrm{OPSN}}_4$ or ${\mathrm{OPSN}}_5$. ${\mathrm{OPSN}}_1$ receives the instructions and transmits them remotely to ${\mathrm{OPSN}}_3$. ${\mathrm{OPSN}}_3$ receives the instructions and executes them. ${\mathrm{OPSN}}_2$ is used to control the screen display and remind the users of their smart home status.

4.2. Property Preservation Analysis of the OOPIRES+ Model

In this subsection, the property preservations of the smart home remote control system’s OOPIRES+ model are analyzed.

4.2.1. Liveness and Boundedness Preservation

As can be seen from Figure 5, the net system $\mathrm{OPN}$ is live and bounded, and the corresponding closed net systems can be obtained by adding message places on the basis of the models of ${\mathrm{OPSN}}_{\mathrm{A}}$ and ${\mathrm{OPSN}}_{\mathrm{AA}}$ in Figure 5 and Figure 6. It is easy to see that the closed net systems are also live and bounded. The net system ${\mathrm{OPN}}_{\mathrm{B}}$ is obtained from the net system $\mathrm{OPN}$ by using ${\mathrm{OPSN}}_{\mathrm{A}}$ and ${\mathrm{OPSN}}_{\mathrm{AA}}$ to replace ${\mathrm{g}}_{\mathrm{A}}$ and ${\mathrm{g}}_{\mathrm{AA}}$, respectively. Therefore, according to Theorems 1 and 2, the net system ${\mathrm{OPN}}_{\mathrm{B}}$ is also live and bounded. As can be seen from Figure 4 and Figure 7, $\mathrm{OPN}$ and ${\mathrm{OPN}}_{\mathrm{B}}$ are both live and bounded. In addition, the liveness and boundedness of $\mathrm{OPN}$ (Figure 4) and ${\mathrm{OPN}}_{\mathrm{B}}$ (Figure 7) can also be verified by the modeling tool Tina 3.7.0, and the verification results are shown in Figure 8 and Figure 9.

4.2.2. Reachability, Functionality, and Timing Preservation

In Figure 4 and Figure 7, the pre-set places of ${\mathrm{g}}_{\mathrm{A}}$ and $\overline{{\mathrm{g}}_{\mathrm{A}1}}$ are ${\mathrm{q}}_2$, and the post-set places of ${\mathrm{g}}_{\mathrm{A}}$ and $\overline{{\mathrm{g}}_{\mathrm{A}2}}$ are ${\mathrm{q}}_3$. Since ${\mathrm{g}}_{\mathrm{A}}$ and $\overline{{\mathrm{g}}_{\mathrm{A}1}}$ have the same number of pre-set places and the same number of tokens, and after the refinement operation, ${\mathrm{g}}_{\mathrm{A}}$ and $\overline{{\mathrm{g}}_{\mathrm{A}2}}$ have the same number of post-set places and the same number of tokens, ${\mathrm{g}}_{\mathrm{A}}$’s extended subnet has the same reachability as subnet ${\mathrm{OPSN}}_{\mathrm{A}}$. Since the token type of tokens in the pre-set places of ${\mathrm{g}}_{\mathrm{A}}$ and $\overline{{\mathrm{g}}_{\mathrm{A}1}}$ is the same; the gateway function of ${\mathrm{g}}_{\mathrm{A}}$ is equal to the function of ${\mathrm{OPSN}}_{\mathrm{A}}$; and, after the refinement operation, the token type of tokens in the post-set places of ${\mathrm{g}}_{\mathrm{A}}$ and $\overline{{\mathrm{g}}_{\mathrm{A}2}}$ is the same, ${\mathrm{g}}_{\mathrm{A}}$’s extended subnet has the same functionality as subnet ${\mathrm{OPSN}}_{\mathrm{A}}$. Since the token time of tokens in the pre-set places of ${\mathrm{g}}_{\mathrm{A}}$ and $\overline{{\mathrm{g}}_{\mathrm{A}1}}$ is the same; the gateway delay of ${\mathrm{g}}_{\mathrm{A}}$ is equal to the delay of ${\mathrm{OPSN}}_{\mathrm{A}}$; and, after the refinement operation, the token time of tokens in the post-set places of ${\mathrm{g}}_{\mathrm{A}}$ and $\overline{{\mathrm{g}}_{\mathrm{A}2}}$ is the same, ${\mathrm{g}}_{\mathrm{A}}$’s extended subnet has the same timing as subnet ${\mathrm{OPSN}}_{\mathrm{A}}$. Similarly, the extended subnet of ${\mathrm{g}}_{\mathrm{AA}}$ and the subnet ${\mathrm{OPSN}}_{\mathrm{AA}}$ have the same reachability, functionality, and timing. Thus, by Theorems 3, 4, and 5, ${\mathrm{OPN}}_{\mathrm{B}}$ and $\mathrm{OPN}$ have the same reachability, functionality, and timing. According to Figure 4 and Figure 7, it is easy to see that ${\mathrm{OPN}}_{\mathrm{B}}$ and $\mathrm{OPN}$ have the same reachability, functionality, and timing.

Note that the gateway refinement method can be used for the modeling and validation of various embedded-system instances, such as intelligent transportation, smart cities, smart homes, etc. The modeling and verification of the smart home remote control system is only one of many system examples. The application of the refinement method to model and validate different system instances may vary, and a specific analysis should be conducted on specific issues. However, the basic modeling and validation process is similar.

5. Conclusions

For embedded system modeling, common formal modeling methods, such as the extended finite-state machine method, data flow diagram method, communication process method, etc., can describe the characteristics of embedded systems from different perspectives but do not form a unified standard. Classical Petri nets lack a hierarchical structure and the concept of time, making it impossible to fully describe embedded systems. PRES+ improved the accuracy of embedded system modeling, but there are still issues with the inability to describe event priorities and fully express complex program control and data flow. PIRES+ can consider the system and behavior uniformly, but it is not easy to reflect the division of functional modules.

In response to the problem of formal modeling and analysis of large-scale complex embedded systems, object-oriented technology is combined with PIRES+, and an object-oriented PIRES+ (OOPIRES+) and a gateway refinement operation method are proposed. This paper investigates the preservation of the liveness, boundedness, reachability, functionality, and timing of the original net system by the gateway refinement operation and presents the preservation conditions for the above important properties of the refinement operation, which can effectively alleviate the “state space explosion” problem of OOPIRES+. The application in the refined modeling and analysis of smart home remote control systems also demonstrates the effectiveness and practicality of the proposed refinement method. The research results of this paper will also provide a new method for modeling and analysis of large complex embedded systems.

The limitation of the gateway refinement approach is that the operation must meet the constraints of gateway replacement, gateway function, gateway delay, and so on. The next research work may consider proposing a wider range of conditions for the study of OOPIRES+ gateway refinement operations or other refinement operations (such as a subnet refinement operation).