Modeling and formal analysis of meta-ecosystems with dynamic structure using graph transformation


 The dynamics of ecosystems is of crucial importance. Various model-based approaches exist to understand and analyze their internal effects. In this paper, we model the space structure dynamics and ecological dynamics of meta-ecosystems using the formal technique of Graph Transformation (short GT). We build GT models to describe how a meta-ecosystem (modeled as a graph) can evolve over time (modeled by GT rules) and to analyze these GT models with respect to qualitative properties such as the existence of structural stabilities. As a case study, we build three GT models describing the space structure dynamics and ecological dynamics of three different savanna meta-ecosystems. The first GT model considers a savanna meta-ecosystem that is limited in space to two ecosystem patches, whereas the other two GT models consider two savanna meta-ecosystems that are unlimited in the number of ecosystem patches and only differ in one GT rule describing how the space structure of the meta-ecosystem grows. In the first two GT models, the space structure dynamics and ecological dynamics of the meta-ecosystem shows two main structural stabilities: the first one based on grassland-savanna-woodland transitions and the second one based on grassland-desert transitions. The transition between these two structural stabilities is driven by high-intensity fires affecting the tree components. In the third GT model, the GT rule for savanna regeneration induces desertification and therefore a collapse of the meta-ecosystem. We believe that GT models provide a complementary avenue to that of existing approaches to rigorously study ecological phenomena.


Introduction
Over the long term, ecosystems are growing and shrinking in space according to intrinsic and extrinsic processes as well as to neighboring opportunities. To understand and predict such changing structures, ecologists usually model them as assumed empty spaces (i.e., fixed ecosystem patches) gradually filled by ecosystems (Verburg et al. (2002)). It could be more efficient to model new ecosystem patches according to present ecological processes and without assumptions about the influencing spatial structure (Gaucherel et al. (2013); Giavitto and Michel (2003)). Several theories have been proposed to handle space in ecology. To the best of our knowledge, this paper illustrates for the first time in ecology the use of discrete-state discrete-event models to capture an unlimited (i.e., unbounded) growth of meta-ecosystems.
The landscape ecology theory (Griffiths (1998)) focuses on spatially fixed mosaics composed of various adjacent ecosystem patches (e.g. forest stands, crop fields) and considers biotic and abiotic processes they involve (Forman and Godron (1981); Turner et al. (2001); Forman (2014)). The meta-population theory provides a new understanding on how distant populations of a given species with connections (fluxes of individuals) to other ones influence the fate of the meta-population (Hanski (1997); Tilman and Kareiva (2018)). The meta-community theory (Leibold et al. (2004)) is a functional extension of the meta-population theory considering various communities of the same kind that are spatially connected (Holt (1993)). Finally, the meta-ecosystem theory takes into account biotic and abiotic fluxes between different and potentially distant spatial units displaying common arbitrary characteristics. In this paper, we consider a meta-ecosystem as "[...] a set of ecosystems connected by spatial flows of energy, materials, and organisms across ecosystem boundaries" (Loreau et al. (2003)). So far, none of these four theories has been able to convincingly model a growing (or shrinking) meta-ecosystem in space over time, i.e., a meta-ecosystem with new ecosystem patches added (or removed) to (from) the meta-ecosystem during the simulation (Massol et al. (2011)).
The previously mentioned theories focus on the impacts of space in ecological (i.e., spatial) dynamics but they usually bypass modeling the space structure dynamics. In addition, most models used in ecology are based on a quantitative approach and, more specifically, on ordinary differential equations (Loreau et al. (2003); Staver et al. (2011); Touboul et al. (2018)). The calibration and resolution of such equation systems usually show an exponential increase in complexity with the number of involved variables and the number of ecosystem patches. Due to this increase in complexity and to be able to handle more variables and ecosystem patches, it could be helpful to simplify the used models (Touboul et al. (2018)). In contrast, qualitative models may be a viable alternative grasping this ecological complexity with a flexible and still rigorous control (Dambacher et al. (2003); Machado et al. (2009) ;Rykiel Jr. (1989)) where the presence/absence of components but not their number is captured as in quantitative models.
Qualitative discrete-state discrete-event models based on Petri nets and their firing relation to model complex ecosystems integrating multiple components have been already used in ecology (e.g. Gaucherel and Pommereau (2019)). However, using Petri nets often assumes a fixed (frozen) structure of the meta-ecosystem (Chaouiya et al. (2011); Machado et al. (2009);Reisig (2012)) whereas real meta-ecosystems are often growing and/or shrinking dynamically (Kéfi et al. (2014)). To model meta-ecosystems, we therefore need to model a dynamic system on a dynamic structure (i.e., a kind of space structure growth, also called DS2 (Giavitto et al. (2012))) possibly assuming and knowing how space structure will change.
The formal technique of Graph Transformation (short GT), which allows for rule-based transformation of discrete-state models, is a well-known general purpose technique that has been developed in theoretical computer science with a broad range of available tools for modeling and analysis (e.g. Ehrig et al. (2006); Giavitto and Michel (2003); König et al. (2018)). GT allows for adding and removing nodes/edges (i.e., ecosystem patches or ecological components) using GT rules (which describe ecological processes) as soon as the (meta-)ecosystem is represented as a graph with a changing topology (i.e., the neighboring relationships between ecosystem patches).
We illustrate our approach on savannas (sensu lato) as these ecosystems are widely represented (one fifth of the Earth land surface) and quite simple in terms of vegetation structure (i.e., tree and grass interplay) but among the ecosystems most sensitive to future global changes (Bond et al. (2003)). Savannas result from the interplay between various components (e.g. local climate, fire, vegetation, hydrology, topography, human populations, and activities (Hély et al. (2003))) and may be considered as meta-ecosystems (Sankaran et al. (2005); Gounand et al. (2018)). Savannas are also often associated (i.e., nearby) to crop fields and woodlands in landscapes (Staver and Levin (2012)). Understanding the drivers that structure savanna meta-ecosystems is thus required to improve future management efforts (Jackson et al. (2002); Sankaran et al. (2004)).
The aim of this paper is to evaluate whether the formal technique of GT is suitable for the modeling of meta-ecosystems with fixed or dynamic space structure. To achieve this, we (a) determine whether GT is suitable to model the space structure dynamics and ecological dynamics of savanna meta-ecosystems with a fixed number of ecosystem patches, (b) analyze using GT the influence of the space structure dynamics generated when the number of ecosystem patches is unlimited and varies due to the ecological processes at work (e.g. vegetation dispersal, impact of fire, vegetation regrowth), and, finally, (c) discuss the pros and cons of the usage of GT in ecology.

Material and Methods
In subsection 2.1, we introduce the formal technique of GT based on typed graphs. In our approach, we use GT for the modeling of space structure dynamics and ecological dynamics of meta-ecosystems captured by so-called GT models. Afterwards, in subsection 2.2, we define three concrete GT models for three different savanna meta-ecosystems. Subsequently, in subsection 2.3, we introduce the notion of labeled transition systems describing state spaces generated by GT models together with the central operations for merging these state spaces according to a suitable equivalence notion. Finally, in subsection 2.4, we discuss analysis techniques dedicated to GT models and use them to provide the reachability properties of three concrete meta-ecosystem models.

Typed Graphs and Graph Transformation
In this subsection, we provide a short informal introduction to the well-established formal technique of GT (Ehrig et al. (2006)) based on typed graphs (see subsection A.1 for more details on formal definitions).
As discrete data structures, graphs can be used to represent system states. In particular, graphs are efficient at visually capturing relationships between the system elements (called nodes) using connections (called edges) between these elements. In this paper, we consider directed graphs where each edge has a single source node and a single target node as well as allow for the special case of edges, called loops, where the source and the target node are the same (see Figure 1b for a directed graph with a loop). Moreover, we allow that different edges may have the same source and target nodes, leading to so-called parallel edges. In this paper, we focus on finite graphs with a finite number of nodes and edges, to ease tool-based analysis. In our ecological case study, nodes represent ecological components as well as ecosystem patches, which describe the boundaries of ecosystems, while edges represent the interaction between ecological components on these ecosystem patches.

Definition 1 (Graph)
If N is a finite set of nodes, E is a finite set of edges, s : E → N maps each edge to its source node, and t : E → N maps each edge to its target node, then G = (N, E, s, t) is a directed graph also called graph for short in the following. (b) The initial graph G0 for the metaecosystems S2, S U , and S D . Fig. 1: Type graph and initial graph for the meta-ecosystems S 2 , S U , and S D . Squares in color represent ecological components of a meta-ecosystem as well as ecosystem patches. Arrows represent interactions between ecological components and ecosystem patches.
There exist various graph formalisms that allow for distinguishing between different kinds of nodes and edges. Here, we follow the standard approach of typed graphs (instead of e.g. labeled or attributed graphs). In typed graphs, each node and each edge has a certain type that is contained in a given type graph TG. In general, a type graph TG specifies which node and edge types are allowed in graphs that are typed over TG. At the same time, a type graph restricts the set of all admissible graphs by preventing the existence of certain edges (based on their types) between certain nodes (based on their types). The type graph TG S of our ecological case study is given in Figure 1a. TG S contains as nodes the node types Eco, Grass, and Tree for modeling ecosystem patches, grass, and trees, respectively. Also, we use the node type Rain for modeling rainfall on ecosystem patches during the rainy season. TG S contains as edges the edge types g2e and t2e to model that a certain ecosystem patch contains grass and trees, respectively. Moreover, the edge type r2e is used to model that rainfall is possible on a connected ecosystem patch. Finally, the edge types on and off are used to model if there is or if there is no rainfall on the connected ecosystem patches, respectively. Note also that TG S prevents e.g. edges from nodes of type Eco to nodes of type Grass as well as between nodes of type Grass and Rain altogether.
The graph G 0 , which is an example of a graph that is typed over the type graph TG S , is given in Figure 1b. Intuitively, the graph G 0 represents a state of a meta-ecosystem consisting of two ecosystem patches (given by two Eco-nodes), each containing trees and grass (given by Tree-and Grass-nodes connected to the corresponding Eco-nodes), during the rainy season (given by the Rain-node with an on-loop connected to both Eco-nodes). Note that a graph such as G 0 does not need to contain nodes or edges of each type contained in the type graph TG S .
To transform a given graph into a new one, GT rules are used. An application of a GT rule to a graph modifies this graph using two basic operations, namely removal and addition of certain graph elements (i.e., nodes or edges). For this purpose, a GT rule contains a left-hand-side graph L, an interface graph I, and a right-hand-side graph R. The left-hand-side graph L is a subgraph of the graph to be modified (up to renaming of graph elements). The interface graph I, which is a subgraph of the graph L, describes the elements of L that should not be removed (i.e., the elements contained in I and L should not be removed while the elements contained in L but not in I (i.e., in L − I) should be removed). The right-hand-side graph R, which has I as a subgraph, describes the elements that should be added (i.e., the elements contained in R but not in I (i.e., in R − I) should be added). Moreover, a GT rule contains a finite set NAC of forbidden graphs X (also called negative application conditions in computer science), which have L as a subgraph and are used to restrict the applicability of the GT rule (see subsection A.1 for more details on formal definitions). In the ecological context, GT rules represent the transitions between meta-ecosystem states and hence are directly linked to ecological processes.

Definition 2 (GT Rule)
If L is a left-hand-side graph, R is a right-hand-side graph, I is an interface graph that is contained in L and R, and NAC is a finite set of forbidden graphs X containing L, then ρ = (NAC , L, I, R) is a GT rule also called rule for short in the following.
For examples of GT rules see e.g. the rule GrowGrass in Table 1. Intuitively, this rule describes the ecological process that grass may grow on an ecosystem patch during the rainy season if there is no grass on that ecosystem patch yet. In our visualization, we depict the left-hand-side graph L of the rule in the square left to the double arrow, the right-hand-side graph R of the rule in the square right to the double arrow, the name of the rule over the double arrow, and the single forbidden graph from the set NAC in the red square over the left-hand-side graph L. The red triangle between the left-hand-side graph L and the forbidden graph visualizes that the extension of L to the forbidden graph disables the rule application. Moreover, we capture the node identities in L, R, and forbidden graphs using numbers in the nodes' bottom corners. Note that we do not visualize the interface graph I in the following since it is used for technical reasons only.
GT steps then apply a rule ρ = (NAC , L, I, R) to a given graph G to modify G into a resulting graph H. For this purpose, the left-hand-side graph L is embedded into the graph G such that this embedding cannot be extended to an embedding of one of the forbidden graphs in NAC . Afterwards, the graph elements from L − I are removed on the basis of where L has been embedded into the graph G. This removal then results in an embedding of the interface graph I into the intermediate graph D, which retains information on where graph elements have been removed. Finally, the graph elements from R − I are added to the graph D resulting in the graph H. Hereby, the embedding of I into D is used to determine where graph elements should be added to D (see subsection A.1 for more details on formal definitions).

Definition 3 (GT Step)
If ρ = (NAC , L, I, R) is a rule, G is a graph, L can be embedded into G, the embedding of L in G cannot be extended to an embedding of any forbidden graph in NAC , D is a graph obtained by removing L − I from G resulting in an embedding of I in D, and H is a graph obtained by adding R − I to D, then G ρ =⇒ H is a GT step modifying graph G into resulting graph H.
A GT step for an application of the rule GrowGrass from Table 1 works as follows. Whenever a subgraph containing an Eco-node connected to a Rainnode with an on-loop is found in a graph to be modified and there is no Grass-node connected to the found Eco-node, a Grass-node is added to the found subgraph and connected to the Eco-node.
Graph Transformation Systems (GTSs) are used to describe how and when graphs have to be modified following the concept of GT steps introduced before. A GTS contains (a) a unique initial graph from which all sequences of GT steps start, (b) a finite set of GT rules that may be applied to perform GT steps of the GTS, and (c) an assignment of each contained GT rule to a priority given by a natural number. A GTS uses these priorities to only permit those GT steps modifying a graph G for which no other rule with higher priority can be applied to the same graph G. Such rules with higher priorities represent mandatory processes in meta-ecosystems. For examples of GTSs, see the following subsection. Note that in the ecological context, we also call GTSs GT models.

Definition 4 (Graph Transformation System (GTS))
If G 0 is a typed graph (called initial graph), P is a finite set of rules, and κ : P → N is a mapping assigning a priority (i.e., a natural number) to each rule in P , then S = (G 0 , P, κ) is a graph transformation system (GTS).

Examples of Meta-Ecosystems Modeled as Graph Transformation Systems
In this subsection, we model the ecological dynamics as well as the space structure dynamics of three different savanna meta-ecosystems using GTSs. In the first GTS (also called GT model in the following), we consider a savanna meta-ecosystem that is limited in space to two ecosystem patches, whereas in the other two GTSs we consider two savanna meta-ecosystems that are unlimited in the number of ecosystem patches and only differ in one rule describing how the space structure of the meta-ecosystem grows.
For all three GT models we use the same initial graph given in Figure 1b that consists of two ecosystem patches with trees and grass during the rainy season. Starting with this initial graph, we then apply the corresponding rules to model the possible ecological dynamics and space structure dynamics of meta-ecosystems.
In the first GT model S 2 , we model a savanna meta-ecosystem where grass and trees can grow during the rainy season and where grass and trees can disappear due to low or high intensity fire during the dry season. S 2 contains six rules with the same priority (see first six rules in Table 1). The rules RainOff and RainOn allow to model the change between the rainy and the dry season in the meta-ecosystem. The rules GrowGrass and GrowTree allow under certain conditions to model the growth of grass and trees on ecosystem patches during the rainy season, respectively. The rules LowFire and HighFire allow to model the impact of a low and high intensity fire on affected ecosystem patches during the dry season, respectively. Note that none of the rules allows for the addition or deletion of ecosystem patches as the meta-ecosystem S 2 is limited in space to two ecosystem patches only.
In the second GT model S U , we model a savanna meta-ecosystem as in S 2 with the additional space structure dynamics. S U contains in addition to the six rules from S 2 the rules DelEco and AddEcoU (see Table 1). The rule DelEco allows to remove an ecosystem patch without trees and grass from the metaecosystem, whereas the rule AddEcoU allows ecosystem patches with grass to appear during the rainy season. To ensure that an ecosystem patch without trees and grass is removed from the meta-ecosystem before another rule can be applied, the rule DelEco has a higher priority than the other rules.
Definition 6 (GT Model S U ) If G 0 is the initial graph from Figure 1b, P U is the set of rules {RainOff , RainOn, LowFire, HighFire, GrowGrass, GrowTree, DelEco, AddEcoU } (see Table 1), and κ U assigns the same priority 0 to each rule in P U − {DelEco} and the priority 1 to the rule DelEco, then S U = (G 0 , P U , κ U ) is a GT model.
In the third GT model S D , we model a savanna meta-ecosystem as in S 2 with a different kind of space structure dynamics as in S U . S D differs from the second GT model S U in only one rule describing how the space structure of the metaecosystem grows: The rule AddEcoD (see Table 1) is used in S D instead of the rule AddEcoU (explained before) to model that grass may spread to new ecosystem patches during the rainy season from ecosystem patches with grass and trees. Also, the rule DelEco has a higher priority than the other rules to ensure that an ecosystem patch without trees and grass is removed from the meta-ecosystem before another rule can be applied.

Definition 7 (GT Model S D )
If G 0 is the initial graph from Figure 1b, P D is the set of rules {RainOff , RainOn, LowFire, HighFire, GrowGrass, GrowTree, DelEco, AddEcoD} (see Table 1), and κ D assigns the same priority 0 to each rule in P D − {DelEco} and the priority 1 to the rule DelEco, then S D = (G 0 , P D , κ D ) is a GT model.

Rule
Ecological Interpretation Trees may spread to another ecosystem patch with grass during the rainy season if there are no trees yet on that ecosystem patch (rule used in GT models S 2 , S U , and S D ).

DelEco Rain
Eco r2e Ecosystem patches without grass and trees are removed from the meta-ecosystem (rule with higher priority used in GT models S U and S D ). Grass may spread to new ecosystem patches during the rainy season from ecosystem patches with grass and trees (rule used in GT model S D ). Table 1: Rules for the GT models S 2 , S U , and S D . For each rule, its left-hand-side graph L is depicted in the square left to the double arrow, its right-hand-side graph R is depicted in the square right to the double arrow, its name is written over the double arrow, and its possibly existing forbidden graphs are depicted in the red squares over the left-hand-side graph L. The red triangle between the left-hand-side graph L of a rule and its forbidden graph visualizes that the extension of L to the forbidden graph disables the rule application. The node identities in L, R, and forbidden graphs are captured using numbers in the nodes' bottom corners.

Labeled Transition Systems and Strongly Connected Components
As already introduced in subsection 2.1, GTSs execute GT steps between successive graphs labeled with the rules used for these steps. When all possible graphs that can be reached using successive GT step computation are determined, we obtain a labeled transition system (LTS).
An LTS, which is a certain kind of graph as well, consists of a possibly infinite set of states S, a finite set of labels L, a distinguished initial state Z, and a step relation R where each step between two states is labeled using an element of L. In the ecological context, an LTS represents all trajectories of the modeled meta-ecosystem starting in the initial state G 0 .

Definition 8 (Labeled Transition System (LTS))
If S is a set of states, L is a finite set of labels, Z ∈ S is an initial state, R ⊆ S ×L×S is a relation for discrete labeled steps on states, then L = (S, L, Z, R) is a labeled transition system (LTS).
In the context of GTSs, we call an LTS also a state space of the GTS and interpret the components of such an LTS as follows. The states are all graphs, which are reachable from the initial graph of the GTS, the labels are the rules of the GTS, the initial state Z is the initial graph of the GTS, and the step relation is obtained using GT steps.
As the next step, we want to introduce an aggregation operation that merges several LTS states when they are understood to be equivalent. Such merging of LTS states leads then to a smaller and simpler LTS. For this purpose, we first introduce the notion of paths through the states of an LTS. Note that the iterative application of the step relation R of an LTS results in a multi-step relation R * ⊆ S × L * × S. This relation thereby characterizes the paths between two states using lists of labels. That is, a tuple (s, π, s ′ ) of R * contains the start state s, a finite list of labels π (the empty list is denoted by ǫ), and the end state s ′ of that path. In the ecological context, a path corresponds to a trajectory of the modeled meta-ecosystem.
Two states s and s ′ of an LTS are understood to be equivalent when there is a path from s to s ′ and vice versa. In general, this equivalence results in a partitioning of the set of states of an LTS where each partition is as large as possible. Such partitions are called strongly connected components (SCCs). Each state within an SCC can be reached from any other state of this SCC.

Definition 10 (Strongly Connected Component (SCC) of an LTS)
If L = (S, L, Z, R) is an LTS and C ⊆ S is a maximal subset of the states of L satisfying that for each state s and s ′ in C there is some list of labels π such that (s, π, s ′ ) ∈ R * , then C is a strongly connected component (SCC) of L.
Based on the notion of SCCs, we now define the aggregation operation, which takes an LTS as an input and returns another LTS as an output. For each SCC of the input LTS, the aggregation operation merges all states of this SCC into a single state of the output LTS. The steps between these merged SCCs are then obtained by lifting the steps of the input LTS to the output LTS. This means that when s and s ′ are states contained in two (possibly the same) SCCs C and C ′ , respectively, then each step between s and s ′ results in a step between the states obtained from merging the two SCCs C and C ′ .
In the ecological context, we are interested in the SCC-based merged state spaces (which can be understood to be directed acyclic graphs) induced by GT models. These SCC-based merged state spaces identify sets of states that are structurally stable. That is, all states in an SCC of such a state space are equal with respect to the states that can be reached from them. Hence, GT steps within an SCC describe reversible steps of the meta-ecosystem dynamics. In contrast, the step relation of an SCC-based merged state space describes how one SCC can be reached from another one using an irreversible step of the meta-ecosystem dynamics.

Analysis of Graph Transformation Systems
A wide variety of analysis techniques have been developed in the past for GTSs. Some of these analysis techniques are based on the computation of tractably small finite state spaces. Some other analysis techniques are symbolic (also called static) and allow for reasoning on the generated state space only based on the rules of the GTS and without calculating the GT steps on particular graphs. In this subsection, we discuss only those analysis techniques that we apply to the three GT models (see subsection 2.2) from our ecological case study.
Firstly, an exhaustive behavioral analysis of GTSs can be performed when the entire state space can be explicitly computed (depending on time and hardware restrictions). For example, the computation tree logic (CTL) (Clarke and Emerson (1981)) can be used to check whether a specific target state can be reached using some finite path from the initial state of the state space (see subsection A.2 for a formal introduction of CTL). In the savanna ecological context, such a target state could be e.g. a state that does not have any Tree-node. Moreover, CTL allows for recursive properties, which could require that the reachable state must not have a path back to another specific state. In the savanna ecological context, the latter state could be e.g. a state that has at least one Tree-node. CTL is well-suited for specifying properties of the generated state space due to its expressiveness and yet simple syntax and semantics. For our ecological case study, we used the tool Groove (Ghamarian et al. (2012)) that supports CTL by computing the entire state space first and then by evaluating the provided CTL properties.
Secondly, when the state space of the GTS is infinite or intractably large, it may be possible to adapt the GTS in a reasonable way so that it results in a finite state space. For this purpose, rules may be adapted such that they are applicable to fewer graphs while still producing the same resulting graphs as in the infinite case. For example, rules may be modified such that an upper threshold of graph elements of a certain type is never exceeded. Such an adaptation leads to a finite state space that can be inspected for specific properties. Since this adaptation cuts off all but a finite part of an infinite state space, only certain properties can then be checked. For example, a state that is reachable in the finite state space is also reachable in the infinite state space but not vice versa.
Thirdly, symbolic analysis techniques such as the principle of k-induction can be applied to GTSs that generate finite as well as infinite state spaces (Dyck and Giese (2017); Schneider et al. (2020a)). This particular technique attempts to establish an invariant, which requires that all reachable states of a GTS satisfy a certain property such as e.g. that the number of graph elements of a certain type never exceeds a certain upper limit.
However, it is a well-known result in computer science that non-trivial properties on Turing-complete formalisms such as GTSs cannot be solved by fully-automatic procedures. This implies that implementations of symbolic techniques, such as k-induction, do not always succeed by proving or disproving a conjectured invariant. In cases where such available techniques for fullyautomatic analysis fail, manual mathematical reasoning is the usual fallback solution. Manual mathematical reasoning then allows to verify properties of a GTS by relying on the knowledge of domain experts that understand the GTS at a more fundamental level compared to the generic fully-automatic procedures, which realize a fixed heuristics for analysis.

Results
In this section, we analyze the ecological dynamics as well as the space structure dynamics of the three savanna meta-ecosystems introduced in subsection 2.2 using the SCC-based merged state spaces of the corresponding GT models.

Analysis of GT Model S 2
The following theorem captures the analysis results for the GT model S 2 .
The finite state space for the GT model S2. The states are visualized using filled rectangles. The transitions between states by rule applications are visualized using labeled arrows. The six green states represent graphs with two Tree-nodes, the eight orange states represent graphs with one Tree-node, and the six blue states represent graphs with no Tree-nodes. The initial graph G0 is marked with a vertical red arrow. The name of a state of the form n1n2n3n4b captures the information about the structure of the underlying graph Gi using the following five variables: (i) the number n1 of Eco-nodes in Gi with a connected Tree-and a connected Grass-node, (ii) the number n2 of Eco-nodes in Gi with no connected Tree-and a connected Grass-node, (iii) the number n3 of Eco-nodes in Gi with no connected Tree-and no connected Grass-node, (iv) the number n4 of Eco-nodes in Gi with a connected Tree-and no connected Grass-node, and (v) the Boolean value b = T if the Rain-node in Gi has an on-loop and the Boolean value b = F if the Rain-node in Gi has an off -loop.  The state space given in Figure 2a is computed using the general-purpose GT tool Groove (Ghamarian et al. (2012)). When inspecting each state of this state space, it turns out (by using the principle of k-induction) that all graphs reachable from the initial graph G 0 contain (1) precisely one Rain-node, (2) precisely one on-loop or precisely one off -loop, (3) a number of Eco-nodes all connected to the Rain-node, (4) a number of Grass-nodes each connected to a unique Eco-node, (5) a number of Tree-nodes each connected to a unique Eco-node, (6) no two different Grass-nodes connected to the same Eco-node, and (7) no two different Tree-nodes connected to the same Eco-node. Based on this observation, we can define for each graph G i in the state space of S 2 the abstraction (n 1 , n 2 , n 3 , n 4 , b). This abstraction captures (i) the number n 1 of Eco-nodes in G i with a connected Tree-and a connected Grass-node, (ii) the number n 2 of Eco-nodes in G i with no connected Tree-and a connected Grass-node, (iii) the number n 3 of Eco-nodes in G i with no connected Treeand no connected Grass-node, (iv) the number n 4 of Eco-nodes in G i with a connected Tree-and no connected Grass-node, and (v) the Boolean value b = T if the Rain-node in G i has an on-loop and the Boolean value b = F if the Rain-node in G i has an off -loop. In Figure 2a, we do not show the actual reachable graphs for presentation purposes but instead employ names of the form n 1 n 2 n 3 n 4 b for the states using the five variables of the introduced abstraction. For example, the initial graph G 0 from Figure 1b has the name 2000T.
Moreover, the state space in Figure 2a is visually separated using blue rectangles into two SCCs that abstractly represent the two stable states of the GT model S 2 . The left SCC describes S 2 being in a state with at least one Tree-node and the right SCC describes S 2 being in a state without any Tree-node. The fact that both visualized partitions are SCCs means that all ecological processes within each partition are reversible (represented by some finite sequence of GT steps inside that partition).
The SCC-based merged state space in Figure 2b is obtained from the state space in Figure 2a by checking mutual reachability between each two states of the computed state space. We formulated the property of mutual reachability using CTL properties and checked the satisfaction of these CTL properties using the tool Groove. Since the number of Tree-nodes is captured by the expression n 1 + n 4 according to the abstraction above, the two SCCs are named n 1 + n 4 > 0 representing graphs that have at least one Tree-node and n 1 + n 4 = 0 representing graphs that have no Tree-nodes. Figure 2b shows again that the removal of the last Tree-node (by means of the rule HighFire) is an irreversible step from the left SCC to the right SCC.

Analysis of GT Model S U
The following theorem captures the analysis results for the GT model S U .
Theorem 2 (State Space Induced by S U ) The GT model S U generates an infinite state space. The SCC-based merging of this infinite state space results in the state space given in Figure 2c containing two SCCs.
The state space of the GT model S U is infinite in contrast to that of S 2 because an unlimited number of Eco-nodes can be added using the rule AddEcoU . Since the infinite state space of S U is not manageable by fully-automatic analysis techniques, as a first step for analysis, we adapt the rule AddEcoU . This adaptation only permits the addition of Eco-nodes up to a fixed threshold N resulting in a finite state space. It turns out that for thresholds such as N = 4 the state space can be partitioned into two SCCs as for S 2 containing states with at least one Tree-node and states with no Tree-nodes.
However, the use of such thresholds may significantly change the structure of the state space in terms of resulting SCCs. Hence, as a second step for analysis, we manually analyze the infinite state space generated by S U . The result of this manual analysis is given in Theorem 2 stating that the infinite state space of S U induces the same two SCCs as suggested by the threshold-based state space generation. The proof of Theorem 2 is given in subsection A.3.

Analysis of GT Model S D
The following theorem captures the analysis results for the GT model S D .

Theorem 3 (State Space Induced by S D )
The GT model S D generates an infinite state space. The SCC-based merging of this infinite state space results in the state space given in Figure 2d containing infinitely many SCCs.
The state space of the GT model S D is infinite as for S U . However, in S D , the addition of Eco-nodes using the rule AddEcoD requires the existence of Eco-nodes with a connected Grass-and Tree-node. Hence, as soon as all Treenodes are removed by the rule HighFire, the rule AddEcoD is continuously disabled. As a consequence, the only remaining GT steps change the season between rainy and dry using the rules RainOn and RainOff , remove Grassnodes using the rule LowFire, and remove Eco-nodes using the rule DelEco. Since the rules LowFire and DelEco are not reversible, there is an infinite chain of SCCs as indicated in Figure 2d where either the number of Eco-nodes or the number of Grass-nodes decreases from SCC to SCC.
These observations have again been obtained using the threshold-based approach as for S U . To ensure that the use of thresholds did not significantly change the structure of the induced SCC-based merged state space of S D , we employed manual analysis, which results in Theorem 3 stating that the observations above are also valid for the infinite state space of S D . The proof of Theorem 3 is given in subsection A.3.

Discussion
The main goal of this paper was to evaluate whether the formal technique of GT is suitable for the modeling and analysis of meta-ecosystems.
GT as a domain agnostic formal technique has been already applied in different fields of biology including cellular and molecular biology (e.g. Giavitto et al. (2004); Rosselló and Valiente (2005); Aittokallio and Schwikowski (2006)) but, to the best of our knowledge, this paper shows its applicability in the field of ecology for the first time.
In this paper, we have considered GTSs in which the graphs representing states of meta-ecosystems are discrete (i.e., not featuring continuous variables) and the transitions between these states are untimed (i.e., the passage of time is not modeled), discrete (i.e., there are countably many descriptions of transitions between two states), atomic (i.e., steps cannot be interrupted halfway), asynchronous/nondeterministic (i.e., multiple transitions possibly using different rules may be possible from the same state), and nonprobabilistic (i.e., no relative likelihood is assigned to possible transitions from a single state). In contrast to the less expressive formalism of Petri nets that has been investigated previously (Gaucherel and Pommereau (2019)), the use of such GTSs enables the modeling of space structure dynamics in which the number of ecosystem patches in the meta-ecosystem may grow unboundedly.
To achieve our main goal, we have defined in subsection 2.2 three GT models for three different savanna meta-ecosystems, analyzed them with respect to their space structure dynamics and ecological dynamics in section 3, and we now compare the obtained results to related model-based analysis results from the literature. In particular, we have analyzed for these three GT models two different kinds of qualitative properties. Firstly, we have analyzed state reachability meaning that the modeled meta-ecosystem can reach a certain state according to the GT model at hand. This state reachability served as the basis for the validation of the GT model (i.e., it helped to determine whether the transitions in the GT model correspond to the transitions expected from the modeled meta-ecosystem) as well as for the comprehension of unpredicted dynamics governed by the rules of the GT model (i.e., the desertification effect induced by the rule for the grass dispersal (AddEcoD) in the third GT model S D , see below). Secondly, we have analyzed transition irreversibility (meaning that when a transition from a first state to a second state cannot be undone by any sequence of further transitions leading back to the first state) including an analysis of the transition sequences leading to a tipping point. The result of such an analysis of transition irreversibility is assumed to be useful for managers wishing to be notified of situations in which they want to act sparingly and efficiently on the system to timely counter certain dynamics via human intervention before unwantedly reaching the related tipping point (Cumming (1999); Walker et al. (2004)). In particular, in the considered GT models, we have analyzed the effect of two kinds of fires on the vegetation for which the effect varies among these GT models due to the considered ecological processes for the growth of grass. Moreover, considering the distinguishing feature of unbounded space structure dynamics, we subsequently discuss the results of our evaluation with respect to the three defined GT models and assess how qualitative properties of these GT models can be derived using formal analysis techniques.
The first GT model S 2 from subsection 3.1 describes a savanna metaecosystem with a constant number of two ecosystem patches (i.e., a metaecosystem with a rigid space structure dynamics) and induces a finite state space. For the GT model S 2 , we have assumed that seeds of trees can only spread over short distances by requiring that the growth of trees on an ecosystem patch is impossible without trees on neighbor ecosystem patches. Consequently, a high intensity fire destroying the last tree in a meta-ecosystem is irreversible in S 2 leading to an attractor given by a set of states representing grassland and desert states. This irreversibility (as obtained in our analysis of S 2 ) indicates that the ecological dynamics of the modeled savanna metaecosystem is highly sensitive to high intensity fires. This result is in good agreement with previous studies (e.g. Touboul et al. (2018); Staver et al. (2011)), which show the importance of the dispersal of trees for maintaining metaecosystems with high biodiversity.
To obtain these analysis results for the GT model S 2 and to obtain hints for human intervention, we have performed an exhaustive computation of all states that are reachable from the initial state resulting in a finite state space to allow for the analysis of qualitative properties (see Figure 2a). State reachability properties (e.g. the expected possibility of the destruction of all trees in the meta-ecosystem) can then be analyzed either by inspecting each state and transition by hand or by applying standard logics such as CTL (which supports the checking of further properties on the entire state space) for automation. Transition irreversibility properties (given in S 2 by a high intensity fire destroying the last tree in the entire meta-ecosystem) can be identified by constructing an additional finite SCC-based merged state space from the original state space where states that are mutually reachable (i.e., the transitions between them are reversible) are merged (see Figure 2b). The transitions between different states in the finite SCC-based merged state space then characterize the irreversible transitions of the original state space. Additionally, once such irreversible transitions are identified, transition sequences leading to these tipping points can be identified and inspected. In S 2 , such an inspection results in the observation that the distance (in terms of the number of transitions) to the tipping point grows with (a) the number of ecosystem patches with trees, (b) the number of ecosystem patches with trees but without grass, and (c) the meta-ecosystem being in the rainy season. This observation indicates that (a) tree planting (to compensate for tree destruction via high intensity fires), (b) removal of grass from ecosystem patches with trees (to prevent high intensity fires where grass serves as a combustive agent), and (c) artificial watering (to prevent high intensity fires during the dry season) are viable human interventions according to the GT model. However, some of these interventions may not be feasible due to resource limitations such as economic costs or the availability of water. Note that artificial tree plant-ing in S 2 is even then successful when all trees have been destroyed because the destruction of all trees did not result in a further irreversible collapse of other ecological components. The identified tipping point and the transition sequences leading to it are in agreement with other studies (e.g. Scheffer et al. (2015); Staver (2018)). However, in our approach, such transition sequences leading to the tipping point can be explicitly obtained from the state space of the GT model. In the GT model S 2 , the restriction of the space structure dynamics to a constant number of two ecosystem patches allows for a finite state space. Subsequently, we discuss the two GT models S U and S D with space structure dynamics where an unbounded number of ecosystem patches may be observed. This space structure dynamics is significant since it results in an infinite state space in both cases, which requires an adaptation of the successful analysis procedure carried out for S 2 . Also note that such space structure dynamics can be modeled using GT since it does not require a fixed space structure on the reachable graphs in contrast to e.g. DS 2 (Giavitto et al. (2004)) and the formalism of Petri nets (Reisig (2012); Pommereau (2010)).
The second GT model S U from subsection 3.2 describes a savanna metaecosystem with an unbounded number of ecosystem patches (i.e., a metaecosystem where additional ecosystem patches can appear due to ecological processes) and induces therefore an infinite state space. The grass related ecological processes considered in S U differ from that in S 2 as follows. Firstly, in S U , we have allowed that ecosystem patches without grass and without trees can disappear from the meta-ecosystem since such empty ecosystem patches are of no further interest. Secondly, as for S 2 , we have assumed for S U that seeds of grass can successfully spread over close ranges during the rainy season to nearby ecosystem patches, which may result in S U in such nearby ecosystem patches appearing in the meta-ecosystem. Moreover, the spreading of trees between ecosystem patches in S U follows the same ecological processes as in S 2 . Consequently, as for S 2 , a high intensity fire destroying the last tree in a meta-ecosystem is irreversible in S U . Such an irreversible transition in S U leads to a more complex attractor compared to S 2 containing states with any number of grassland ecosystem patches.
According to our analysis results, the GT model S U suggests the same human interventions as S 2 as discussed in the following where we had to rely on the manual process of mathematical reasoning due to the infinite state space of S U . We have demonstrated that the underlying structures of the state spaces induced by S 2 and S U (in terms of the SCC-based merged state spaces) coincide (compare Figure 2b and Figure 2c). This means that the number of ecosystem patches involved and the space structure dynamics of both GT models differed but both GT models exhibited the same two overall stabilities (in particular, one with trees and one without trees). Consequently, we have observed in S U the same tipping point as in S 2 given by the irreversible transition enabling the destruction of the last tree by a high intensity fire during the dry season. Further analysis of the transition sequences leading to this tipping point also shows that, albeit there are states in the state space where a large number of high intensity fires is required to reach this tipping point, there is a state where a single high intensity fire is irreversible as in S 2 and S U therefore suggesting the same human interventions as for S 2 . We conclude that GT models with infinite space structure dynamics may be tractable using manual mathematical reasoning resulting in suitable finite representations such as the one given by the SCC-based merged state space of S U , which demonstrates transition irreversibility.
The space structure dynamics in the GT model S U allows for a finite SCCbased merged state space. Subsequently, we discuss the GT model S D with space structure dynamics where not only the state space but also the SCCbased merged state space are infinite. For this more complex case, we evaluate by means of the GT model S D how to adapt the successful analysis procedure carried out for S U . The third GT model S D from subsection 3.3 describes a savanna metaecosystem with an unbounded number of ecosystem patches as for S U and therefore also induces an infinite state space. In S D , we have adapted the ecological process for the spreading of grass from S U by requiring that grass may only spread to nearby ecosystem patches during the rainy season from ecosystem patches with trees. Moreover, the spreading of trees between ecosystem patches in S D follows the same ecological processes as in S 2 . Consequently, as for S 2 and S U , a high intensity fire destroying the last tree in a meta-ecosystem is irreversible in S D . Such an irreversible transition in S D leads to an infinite number of attractors each containing states with a certain number of grassland/desert ecosystem patches including the attractor containing a metaecosystem state without ecosystem patches representing a desertified savanna (see Hély et al. (2003); Hély et al. (2009);Staver and Levin (2012)).
According to our analysis results, the GT model S D suggests the same human interventions as S 2 as discussed in the following where we had to rely as for S U on the manual process of mathematical reasoning due to the infinite state space of S D . We have demonstrated that the same transitions are irreversible in S D as in S 2 and S U even though the induced SCC-based merged state space of S D is infinite and therefore fundamentally different to the finite SCC-based merged state spaces of S 2 and S U (compare Figure 2b, Figure 2c, and Figure 2d). However, note that the state in the SCC-based merged state space of S U representing meta-ecosystem states without trees can be understood to correspond to the infinite number of states of the SCC-based merged state space of S D representing meta-ecosystem states without trees. These latter states are not merged for S D because some transitions for the spreading of grass from S U are not allowed in S D where the existence of trees is an additional requirement for the spreading of grass. Consequently, even though the number of states in the SCC-based merged state spaces differs between S D on the one hand and S 2 and S U on the other hand, we have observed in S D the same tipping point as in S 2 and S U given by the irreversible transition enabling the destruction of the last tree by a high intensity fire during the dry season. Further analysis reveals that the transition sequences leading to this tipping point correspond closely to those for S 2 and S U therefore indicat-ing the same human interventions. We conclude that GT models with infinite space structure dynamics may be still tractable using manual mathematical reasoning even when they induce infinite SCC-based merged state spaces.
The strong similarities between S 2 , S U , and S D result from the fact that different intra-patch and inter-patch dynamics are defined independently using GT rules. This indicates that the formal technique of GT is well suited for the modeling of meta-ecosystems where even larger numbers of ecological processes are to be considered. In comparison, other formalisms such as Petri nets would require during the manual modeling process an error-prone composition of the various transitions that may be carried out at the same state. In the future, we want to further evaluate the applicability of GT by incorporating more complex and realistic intra-patch and inter-patch dynamics observed in the past such as that of the green sahara during holocene (Demenocal et al. (2000); Watrin et al. (2009)).
As described above, we have evaluated the validity of considered GT models by (a) inspecting the finite state space manually, (b) using automatic support for checking CTL properties (such as state reachability), or (c) mathematically characterizing the reachable states (for GT models with infinite state spaces). We have observed that the considered GT models show ecological dynamics similar to those modeled in other studies (e.g. Kéfi et al. (2014);Hély et al. (2006); Touboul et al. (2018)), which do not use GT and do not consider space structure dynamics, and observed through long term monitoring or paleoecological reconstructions. However, it also turned out that seemingly minor modifications such as adding, removing, or changing a single rule may drastically affect the dynamics of a GT model as can be observed by the drastically different behavior of the GT models S U and S D resulting from the replacement of the rule AddEcoU by the rule AddEcoD. This observation may be understood as a threat that a given GT model adequately captures the dynamics of the considered meta-ecosystem but it also demonstrates the feasibility of human interventions that can also be integrated into the GT model via additional rules. Nevertheless, a further systematic analysis of the sensitivity of GT models such as S U against reasonable adaptions is called for.
As mentioned before, in our approach we have considered standard GTSs where seasonal timing, durations of ecological processes, and relatively likelihoods of transitions are not captured. We have decided against the use of more advanced GTSs (e.g. Schneider et al. (2020b); Maximova et al. (2018); Giese (2005); Becker and Giese (2008)) supporting such parametrizations in this paper since (a) suitable values for such parametrizations are often difficult to obtain, (b) the qualitative analysis of GT models considered in this paper can be better compared to related work involving qualitative analysis using formalisms that are not based on GT, (c) the qualitative analysis is of no less importance since it is usually simpler compared to quantitative analysis where results cannot be always obtained, and (d) the ecological dynamics of the GT models considered in this paper may serve as a starting point for the integration of time and probabilities into the GT models since these would be used to rule out certain transitions of GT models or to make these transitions less likely once certain transition sequences (e.g. an infinite uninterrupted switching between dry and rainy season) are observed in the GT model. An obvious consequence of omitting a parametrization using time and probabilities is that the properties referring to time, probabilities, or quantities (e.g. the probability that all trees have disappeared within 10 years) cannot be analyzed. With all these points in mind, once suitable parametrizations can be determined via long term monitoring of meta-ecosystems or paleoecological reconstructions, we want to explore the use of such more complex GTSs and the available analysis approaches for the field of ecology.
While not being critical for the GT model S 2 with a small state space, the efficiency of the tools such as Groove (Ghamarian et al. (2012)) and Autograph (Schneider et al. (2020b)) for generating such state spaces may become critical in the future when incorporating many ecological processes. Hence, further technical advancements may be required, which seem to have not yet been in the focus of the GT community.
Moreover, the analysis of GT models describing meta-ecosystems requires dedicated domain-specific tools tailored for the needs of ecologists. (Chaouiya et al. (2011)). Such tools should e.g. support the construction of the SCC-based merged state space from a given state space but also provide at least partial automation of the mathematical reasoning carried out for S U and S D with their infinite state spaces. Also, while CTL has proven to be useful in this paper for the considered GT models without any further parametrization, we also need to evaluate the usefulness of other logics such as PTCTL (Kwiatkowska et al. (2002)) or MTGL (Giese et al. (2019)) for the specification and analysis of GT models describing meta-ecosystems that capture aspects of time or probabilities.
In conclusion, we propose to use the formal technique of GT for the modeling of (savanna) meta-ecosystems exhibiting besides ecological dynamics also space structure dynamics and their analysis with respect to qualitative properties such as transition irreversibility. In particular, the space structure dynamics cannot be adequately modeled using already existing approaches based on Petri nets (e.g. Gaucherel and Pommereau (2019)), differential equations (e.g. Loreau et al. (2003); Touboul et al. (2018); Kéfi et al. (2014)), or IBMs (e.g. Edelaar et al. (2017)). We believe that GT models provide a complementary avenue to that of existing approaches to rigorously study ecological phenomena.

Acknowledgments
We warmly thank Franck Pommereau, Colin Thomas from the IBISC, University of Evry and Maximilian Cosme from the AMAP, University of Montpellier for valuable discussions on a preliminary version of this paper. We also thank Malo Y. Bourget from the CNRS Moulis for the proof-reading of the paper and his support during this study. We also thank the Leap-Agri Eureopean call (SESASA project) for its financial support.

A.1 Additional Details on Typed Graphs and Graph Transformation
In this appendix, we give more details on the formal technique of GT based on typed graphs following the standard handbook (Ehrig et al. (2006)).
First, we introduce so-called plain graphs, which are then used to define typed graphs. A plain graph consists of nodes that are connected by edges. Plain graphs considered here are allowed to have parallel edges (i.e., two or more edges can have the same source and target node). While we do not use parallel edges in the GT models from subsection 2.2, this requirement is generally assumed to ensure that pushouts (see Definition 19 below) can always be constructed.

Definition 12 (Plain Graph)
If N is a finite set of nodes, E is a finite set of edges, s : E → N maps each edge to its source node, and t : E → N maps each edge to its target node, then G = (N, E, s, t) is a plain graph.
Plain graph morphisms between plain graphs are used to detect how a plain graph G 1 can be embedded into another plain graph G 2 . This is achieved by mapping each node and edge of G 1 to one node and edge in G 2 . If both components of the plain graph morphism are injective, then G 1 is a subgraph of G 2 . Each plain graph morphism must, however, preserve the graph structure, which means that the mapping of nodes and edges must be compatible (i.e., the source and target nodes of an edge e must be mapped to the source and target nodes of the mapping of e).

Definition 13 (Plain Graph Morphism)
If G 1 = (N 1 , E 1 , s 1 , t 1 ) and G 2 = (N 2 , E 2 , s 2 , t 2 ) are plain graphs, m N : N 1 → N 2 maps each node of G 1 to a node of G 2 , m E : E 1 → E 2 maps each edge of G 1 to an edge of G 2 , s 2 (m E (e 1 )) = m N (s 1 (e 1 )) and t 2 (m E (e 1 )) = m N (t 1 (e 1 )) for each edge e 1 ∈ E 1 (which means that if m E maps an edge e 1 to an edge e 2 , then m N must map the source/target of e 1 to the source/target of e 2 ), then m = (m N , m E ) is a plain graph morphism from G 1 to G 2 , also written m : The composition of two plain graph morphisms m : G 1 → G 2 and m ′ : G 2 → G 3 is defined componentwise using the composition operation for functions. It results in a plain graph morphism from G 1 to G 3 that specifies how G 1 is embedded into G 3 .

Definition 14 (Composition of Plain Graph Morphisms)
The notion of typed graphs relies on that of plain graphs. A typed graph consists of a plain graph G that is typed over a type graph TG. The typing of G is represented by a plain graph morphism m from G to TG. Note that this typing morphism m is in general not injective since all graph elements of the same type are mapped to the same graph element of TG.

Definition 15 (Typed Graph)
If G is a plain graph, TG is a plain graph called type graph, and m : G → TG is a plain graph morphism, then (G, m) is a typed graph.
Typed graph morphisms map nodes and edges as plain graph morphisms additionally ensuring that nodes and edges are only mapped to nodes and edges of the same type.

Definition 16 (Typed Graph Morphism)
If H 1 = (G 1 , m 1 : G 1 → TG), H 2 = (G 2 , m 2 : G 2 → TG) are typed graphs using the same type graph TG, m : G 1 → G 2 is a plain graph morphism, m 2 • m = m 1 (which means that m maps a node/an edge of a certain type only to a node/an edge of the same type), then m is a typed graph morphism from H 1 to H 2 , also written m : The composition of two typed graph morphisms m : H 1 → H 2 and m ′ : H 2 → H 3 is defined componentwise as for plain graph morphisms.

Definition 17 (Composition of Typed Graph Morphisms)
composition of m and m ′ .
Note that in the following, typed graphs are also called graphs and typed graph morphisms are also called morphisms for short.
The formal technique of GT relies on the notion of GT rules. A GT rule contains an injective morphism ℓ : I → L that describes the removal of graph elements (technically given by L − ℓ(I)) and an injective morphism r : I → R that describes the addition of graph elements (technically given by R − r(I)). Moreover, GT rules contain a finite set NAC of so-called negative application conditions. Each negative application condition is given by an injective morphism n : L → X describing (in comparison to L) additional graph elements that must not be in the graph to be transformed.

Definition 18 (GT Rule)
If ℓ : I → L and r : I → R are injective morphisms (i.e., both of their components are injective functions) and NAC is a finite set of injective morphisms n : L → X, then ρ = (NAC , ℓ, r) is a GT rule also called rule for short.
The rule application in a GT step is realized by the construction of two pushouts. In general, a pushout construction merges two graphs H 1 and H 2 to obtain a resulting graph G ′ . As for the union operation on sets, some graph elements may be identified (i.e., merged), which results in the case that G ′ contains fewer graph elements than the sum of the graph elements in H 1 and H 2 . To determine graph elements in H 1 and H 2 that are to be identified, two morphisms m 1 : G → H 1 and m 2 : G → H 2 are used. Two graph elements in H 1 and H 2 are identified when they are the images of a common graph element in G via m 1 and m 2 (i.e., m 1 (x) and m 2 (x) are identified for a common graph element x in G). The resulting morphisms m ′ 1 : H 1 → G ′ and m ′ 2 : H 2 → G ′ identify then the graph elements of H 1 and H 2 in the resulting graph G ′ . These morphisms are needed because e.g. the identification generally implies that m ′ 1 and m ′ 2 are not both inclusions for both of their components. For better comprehensibility of the preceding explanations see the diagram in Definition 19.

Definition 19 (Pushout)
If m 1 : G → H 1 , m 2 : G → H 2 , m ′ 1 : H 1 → G ′ , and m ′ 2 : H 2 → G ′ are morphisms, then (m ′ 1 , m ′ 2 ) is the pushout of (m 1 , m 2 ) according to the following construction. The graph G ′ is the smallest graph such that m ′ 1 and m ′ 2 map together to all graph elements of G ′ and the square (1) below commutes (i.e., m ′ A GT step uses a rule ρ = (NAC , ℓ : I → L, r : I → R) to transform a graph G into a graph H. For this purpose, a morphism m : L → G (also called match) needs to be determined first. A GT step is possible if none of the negative application conditions n : L → X from the set NAC can be embedded into the graph G to be transformed. Technically, this means that we attempt to match the elements of X into the graph G using some morphism k : X → G such that k maps graph elements in the same way as m with respect to the morphism n. To allow for the removal of graph elements according to the morphism ℓ of the rule, two morphisms d : I → D and ℓ ′ : D → G are constructed such that (m, ℓ ′ ) is the pushout of (ℓ, d). Intuitively, the graph D is constructed by preserving all graph elements of G that are not mapped to by m and by adding all graph elements that should be preserved by the rule application (i.e., the graph elements from m(ℓ(I))). Implicitly, the removal of graph elements is subject to two conditions. Firstly, the dangling condition ensures that a node cannot be removed by the rule application when it has an adjacent edge that is not also removed by this rule application. Secondly, the identification condition ensures that if two graph elements in L are mapped to the same graph element in G (using a non-injective match m), then both of these elements in L should be removed or not removed by the rule application. To allow for the addition of graph elements according to the morphism r of the rule, two morphismsm : R → H and r ′ : D → H are constructed such that (m, r ′ ) is the pushout of (r, d). Intuitively, the graph H is constructed by preserving all graph elements of D and by adding all graph elements that are not mapped to by r (i.e., the graph elements from R − r(I)). For better comprehensibility of the preceding explanations see the diagram in Definition 20.
Definition 20 (GT Step) If G and H are graphs, ρ = (NAC , ℓ : I → L, r : I → R) is a rule, m : L → G, d : I → D, m : R → H, ℓ ′ : D → G, and r ′ : D → H are morphisms, ∀n : L → X ∈ NAC . ∄k : X → G. k • n = m (which means that there is no negative application condition given by some injective morphism n : L → X contained in the set NAC of the rule ρ that can be extended using a morphism k to a morphism k • n in a compatible way with the morphism m), (m, ℓ ′ ) is the pushout of (ℓ, d), and (m, r ′ ) is the pushout of (r, d), then there is a GT step from G to H using rule ρ, written G A graph transformation system (GTS) contains a unique initial graph G 0 from which all sequences of GT steps start. Moreover, every GT step uses only one of the rules contained in the rule set P . To simplify the used rules, we assign to them priorities ensuring that a GT step modifying a graph G using a certain rule is part of the induced LTS of a GTS (i.e., of the GTS semantics) given below if there is no other rule with a strictly higher priority also applicable to G.

Definition 21 (Graph Transformation System (GTS))
If G 0 is a graph, P is a finite set of rules, and κ : P → N is a mapping that assigns a priority 28 B. Flotterer, M. Maximova, S. Schneider, J. Dyck, C. Zöllner, H. Giese, et al. (i.e., a natural number) to each rule in P , then S = (G 0 , P, κ) is a graph transformation system (GTS).
Finally, to connect the formal technique of GT presented here to the notion of LTSs used in subsection 2.3, we define the notion of induced LTS of a given GTS. Such an induced LTS is the foundation for our analysis using SCCs.

Definition 22 (Induced LTS of a GTS)
If S = (G 0 , P, κ) is a GTS, S is the set of all graphs reachable by GT steps, L is the set of rules P , Z is the initial graph G 0 , and R is the labeled step relation that contains all GT steps G ρ =⇒ H where ρ ∈ P and where no GT step G ρ ′ =⇒ H ′ with ρ ′ ∈ P satisfies κ(ρ ′ ) > κ(ρ), then L = (S, L, Z, R) is the LTS induced by the GTS S.

A.2 Additional Details on the Computation Tree Logic (CTL)
For presenting CTL, we follow the introductory book (Baier and Katoen (2008), section 6.2), which covers various linear and branching temporal logics together with algorithms for model checking. CTL is a propositional temporal logic in the sense that every state (i.e., every graph in our case) of a state space is labeled with the subset of the set of socalled atomic propositions Q, which are understood to be satisfied in these states. Based on these atomic propositions, further CTL state formulas are constructed using propositional operators such as conjunction and negation (hence, we automatically also allow for other propositional operators such as disjunction and implication as they can be derived from conjunction and negation). Moreover, the path operators next (written X) and until (written U) can be used to state that the next state in a selected path satisfies a certain condition or that all following states in a path satisfy a condition until some other condition is eventually satisfied, respectively. Here we also allow for other path operators such as e.g. eventually (written F) and globally (written G) as they can be derived from the path operators next and until. For more derived path operators see (Baier and Katoen (2008), section 6.2). Lastly, the branching operators for all (written A) and exists (written E) can be used to switch from a state property to a path property by requiring that all paths or some path exiting the current state satisfy/satisfies a certain path condition, respectively. For example, the condition (EX a) → A(b U c) states for atomic propositions Q = {a, b, c} and some current state s that if a is satisfied in some state directly reachable from s, then b is satisfied until eventually c is satisfied on every path starting in s.

Definition 23 (Syntax of CTL)
If Q is a finite set of atomic propositions then ψ is a computation tree logic (CTL) formula over Q, written ψ ∈ S CTL Q , if one of the following items applies.
For defining the semantics of CTL, we now introduce all paths (including the infinite paths) of an LTS as sequences of states where the labels of the steps are ignored.

Definition 24 (Possibly Infinite Paths of an LTS)
If L = (S, L, Z, R) is an LTS, then R ω * contains all finite and infinite paths w over the states S such that for each pair (s, s ′ ) of adjacent states in w there is some label l such that (s, l, s ′ ) ∈ R. Moreover, w i is the ith state of the path w.
Finally, we provide the CTL semantics (as described above) for the case of LTSs, which are equipped with a state-labeling operation ξ.

Definition 25 (Semantics of CTL)
If L = (S, L, Z, R) is an LTS, ξ ⊆ S × Q is a relation between states S of L and atomic propositions Q, s is a state from S, and ψ ∈ S CTL Q is a CTL formula over Q, then s satisfies ψ for L and ξ, written (L, ξ, s) |= ψ, if one of the following items applies.

A.3 Proofs for Results
We now present the proofs for Theorem 2 and Theorem 3. Theorem 1 is justified by application of the tool Groove.
Proof (of Theorem 2) Let L = (S, L, Z, R) be the state space (i.e., an LTS) induced by the GT model S U = (G 0 , P U , κ U ). We make use of the invariant that ensures that each state G of L (given by a graph) can be represented by a tuple (n 1 , n 2 , n 3 , n 4 , b) where (i) n 1 is the number of Eco-nodes in G with a connected Tree-and a connected Grass-node, (ii) n 2 is the number of Eco-nodes in G with no connected Tree-and a connected Grass-node, (iii) n 3 is the number of Eco-nodes in G with no connected Tree-and no connected Grass-node, (iv) n 4 is the number of Eco-nodes in G with a connected Tree-and no connected Grass-node, and (v) b = T if the Rain-node in G has an on-loop and b = F if the Rain-node in G has an off -loop. We prove the following items to focus on the central statements indicated in the theorem.
We now consider the four items from above.
-We need to show that there is a path from G to G 0 : We construct the list of labels π 1 needed to transform G = (n 1 , n 2 , n 3 , n 4 , b) into

RainOn·
(4) RainOff · (HighFire · DelEco) n 1 +n 4 +1−2 · (9) RainOn (10) We now discuss the individual steps one by one. Using (1): All n 3 Eco-nodes without Tree-and Grass-nodes are removed using the rule DelEco (note that n 3 can be at most one for all reachable states because the rule DelEco has a higher priority than all other rules). The resulting state is (n 1 , n 2 , 0, n 4 , b). Using (2): The rainy season changes to the dry season using the rule RainOff , if S U is currently in the rainy season. The resulting state is (n 1 , n 2 , 0, n 4 , F ). Using (3): The n 2 Eco-nodes with only a Grass-node are removed using the rules LowFire and DelEco. Note that the rule DelEco must be applied directly after the rule LowFire due to its higher priority. The resulting state is (n 1 , 0, 0, n 4 , F ). Using (4): The dry season changes to the rainy season using the rule RainOn. The resulting state is (n 1 , 0, 0, n 4 , T ). Using (5): On each of the n 4 Eco-nodes with a Tree-node but no Grass-node, a Grass-node is added using the rule GrowGrass. The resulting state is (n 1 + n 4 , 0, 0, 0, T ). Using (6): For the case that there are not at least two Eco-nodes with Tree-and Grass-nodes now, another Eco-node with a Grass-node (by construction) is added using the rule AddEcoU . The resulting state is (n 1 + n 4 , 0, 0, 1, T ). Using (7): On this new Eco-node, a Treenode is added using the rule GrowTree. The resulting state is (n 1 + n 4 + 1, 0, 0, 0, T ).
Using (8): The rainy season changes to the dry season using the rule RainOff . The resulting state is (n 1 + n 4 + 1, 0, 0, 0, F ). Using (9): All but two Eco-nodes with Tree-and Grass-nodes are removed using the rules HighFire and DelEco. Note that the rule DelEco must be applied directly after the rule HighFire due to its higher priority. The resulting state is (2, 0, 0, 0, F ). Using (10): The dry season changes to the rainy season using the rule RainOn. The resulting state is (2, 0, 0, 0, T ). The graph representing the resulting state is, as required, equal to G 0 . -We need to show that there is a path from G 0 to G ′ : This path trivially exists using π 2 = π G ′ from above.
It is sufficient to show now that G 1 is in C 2,n,0 . This has been shown in the previous item. Note that G 2 is in C 2,n−1,1 by appending the rule LowFire to the list of labels used for showing that G 1 is in C 2,n,0 . 7. We need to show that there are no other steps between the mentioned SCC candidates, which means that they are maximal and, hence, SCCs.
-Assume that there are ρ ∈ P , G 1 ∈ C 1 , and G 2 ∈ C 2,n,0 ∪ C 2,n,1 such that (G 2 , ρ, G 1 ) ∈ R. But there is no such rule ρ in the GT model S D as follows. Only the rule GrowTree can increase the number of Tree-nodes but this rule requires the existence of a Tree-node in G 2 . Hence, there is no such step (G 2 , ρ, G 1 ) ∈ R as required.
-Assume that there are ρ ∈ P , G 1 ∈ C 1 , and G 2 ∈ C 2,n,0 ∪ C 2,n,1 such that (G 1 , ρ, G 2 ) ∈ R and ρ = HighFire. But the rule HighFire is the only rule that can decrease the number of Tree-nodes as required for such a step (G 1 , ρ, G 2 ). -Assume that there are ρ ∈ P , G 1 ∈ C 2,n,0 , and G 2 ∈ C 2,m,0 such that (G 1 , ρ, G 2 ) ∈ R and n = m. There is no rule that changes the number of Eco-nodes with a connected Grass-node. Each removal of Eco-nodes requires two steps using the rules LowFire and DelEco. Each addition of Eco-nodes requires an existing Eco-node with a connected Tree-and a connected Grass-node using the rule AddEcoD. -Assume that there are ρ ∈ P , G 1 ∈ C 2,n,0 , and G 2 ∈ C 2,m,1 such that (G 1 , ρ, G 2 ) ∈ R, n = m, and ρ = LowFire. The only two rules that lead to the existence of an Eco-node with no Tree-and no Grass-node are the rules LowFire and HighFire. The rule LowFire is excluded here by assumption. The rule HighFire cannot be applied because there is no Tree-node in G 1 . -Assume that there are ρ ∈ P , G 1 ∈ C 2,n,1 , and G 2 ∈ C 2,m,1 ∪ C 2,m,0 such that (G 1 , ρ, G 2 ) ∈ R and n = m. ρ must be the rule DelEco due to the priority but the application of that rule retains the number of Eco-nodes with only a Grass-node implying n = m. Figure 1 (a) The type graph TGS for the metaecosystems S2, SU, and SD. (b) The initial graph G0 for the metaecosystems S2, SU, and SD. Type graph and initial graph for the meta-ecosystems S2, SU, and SD. Squares in color represent ecological components of a meta-ecosystem as well as ecosystem patches. Arrows represent interactions between ecological components and ecosystem patches. (a) The nite state space for the GT model S2. The states are visualized using lled rectangles. The transitions between states by rule applications are visualized using labeled arrows. The six green states represent graphs with two Tree-nodes, the eight orange states represent graphs with one Tree-node, and the six blue states represent graphs with no Tree-nodes. The initial graph G0 is marked with a vertical red arrow. The name of a state of the form n1 n2 n3 n4 b captures the information about the structure of the underlying graph Gi using the following ve variables: (i) the number n1 of Eco-nodes in Gi with a connected Tree-and a connected Grass-node, (ii) the number n2 of Eco-nodes in Gi with no connected Tree-and a connected Grass-node, (iii) the number n3 of Eco-nodes in Gi with no connected Tree-and no connected Grass-node, (iv) the number n4 of Eco-nodes in Gi with a connected Tree-and no connected Grass-node, and (v) the Boolean value b = T if the Rain-node in Gi has an on-loop and the Boolean value b = F if the Rain-node in Gi has an off-loop. (b) The nite SSC-based merged state space for the GT model S2. (c) The nite SCC-based merged state space for the GT model SU. (d) A nite part of the in nite SCCbased merged state space for the GT model SD. Analysis results for the GT models S2, SU, and SD. The obtained SCCs are visualized using un lled blue rectangles. The transitions between SCCs by rule applications are visualized using labeled arrows. The SCC containing the initial graph G0 is marked with a vertical red arrow. The names of SCCs capture the information about the contained states using conditions over the variables n1, n2, n3, n4, and b from Figure 2a.