Fig 1.
State-and-transition models of the Borana vegetation pathways.
The states are embodied by illustrated boxes, and the transitions by arrows labelled by their main driving processes. (a) Before pastoralism, fire was the main driver of the rangeland dynamics. The combination of fire, wildlife herbivory and vegetation recruitment maintained the entire system in a loop between open canopy woodland and grassland. (b) The presence of cattle and the fire ban gave a competitive advantage to woody plants, inducing an irreversible bush encroachment. Concurrently, wildlife increasingly avoided the Borana zone because of the denser human and livestock populations. (Based on [21] with author’s permission).
Fig 2.
Toy model illustrating the if-then rule modelling.
Modelling of the STM of Fig 1a (left) into a if-then rule model (middle: system description) from which an STG can be computed (right). Each state of the STG is a vector of three Boolean variables defined in the “variables” section of the system description: grasses (Gr), shrubs (Sh) and trees (Tr), noted with + if present and with - if absent. The initial values of the variables are noted next to their symbol in the system description, defining the initial state from which the STG is computed (Gr+,Sh-,Tr-). The “rules” section of the system description defines the if-then rules describing the transitions. For example, the first rule R1 embodies that if grasses are present (Gr+) then (>>) they can fuel a high intensity fire burning down shrubs and trees (Sh-, Tr-), as grasses resprout first they do not disappear in the fire consequence. This rule corresponds in the STG to the transitions labelled by R1 from the middle and bottom states toward the top state. The cascading applications of every rule whose condition is fulfilled and whose consequence is not to every reachable state compute the STG. Compared to the STM, the computed STG is more explicit: there are two transitions from the middle state toward the bottom one because two distinct events may lead the system from the former to the latter.
Table 1.
Variables and controls of the Borana model.
The initial values of the variables are noted next to their symbols.
Fig 3.
The model-checking methodology.
In black the general model-checking outline. In blue italic the implementation described in this article that consists of a particular choice of techniques and tools among the available ones. (Adapted from [45]).
Fig 4.
Computation trees rooted in the STMs of Fig 1.
Each branch descending from the root represents a possible pathway in the corresponding STM. (a) The CT rooted in the open canopy woodland state of the STM of Fig 1a. As the pathways are infinite in this STM, the branches of the CT are also infinite, and thus the CT itself. (b) The CT rooted in the open canopy woodland state of the STM of Fig 1b. The grassland state is not reachable from the open canopy woodland state in this STM, and thus it does not appear in its CT. As the pathways are finite in this STM, the branches of the CT are also finite, and thus the CT itself. Formally the branches of a CT are usually assumed to be infinite, so that its pathways always carry on. In order to tackle this issue, the dead-end leaves of a CT can be interpreted as infinite pathways remaining in the same state.
Fig 5.
Syntax and semantics of Computation Tree Logic (CTL).
The syntax defines how state properties and operators (logical, existential or universal) can be combined into a formula. The semantics describes the meaning of formulas. The semantics presented here is intuitive and given through example CTs satisfying basic CTL formulas. (Adapted from [47].) See [2] for a formal semantics of CTL.
Table 2.
Catalogue mapping query patterns to their translations in CTL.
Dynamical properties relevant to ecological systems are gathered into patterns. The patterns are written in English and translated into CTL formulas. x and y are place-holders for state properties. (Adapted from [49]).
Fig 6.
Scenario subgraph computed by the Borana model.
This subgraph corresponds to the scenario with wildlife and fire at high altitude (Alt+,Fb-,Cb+,Wl+,Ps-,Ig-,BLv-), the scenario at low altitude is similar (see S1 Notebook). The states are displayed as white squares, the variables within a square represent the variables valuated “+” in this state. From the initial state (top left), the subgraph is computed by the cascading applications of the if-then rules (S1 Table). The transitions are labelled by the rules that produced them, if several rules produced the same transition then it is labelled by all of them, separated by commas. The states belonging to the same vegetation class (S2 Table) are gathered inside a blue rounded box labelled by the name of the vegetation class. Each transition from a state in a vegetation class to a state in another vegetation class, gives rise to a transition between the two classes in the same direction and labelled by the tags of the corresponding rules. For instance, transition gives rise to the transition from class “Sparse scrubland” to class “Grassland” that is labelled by “low fire” (tag of R1) and “high fire” (tag of R2). The additional tag “browsing” comes from transition
.
Table 3.
Scenario selection by model-checking.
For each of the six queries we show: (1) its pattern type and CTL formula, (2) its translation into English, (3) ☑ the scenario selection (i.e. control valuations) for which the associated model-checking output of the query is yes, (4) an English interpretation of this scenario selection.