G are a performance analysis tool based on the graphical. Generalized Stochastic Petri Nets: A Definition at the Net Level and Its Implications

Transcription

1 leee TRANSACTIONS ON SOFTWARE ENGINEERING, VOL. 19, NO. 2, FEBRUARY Generalized Stochastic Petri Nets: A Definition at the Net Level and Its Implications Giovanni Chiola, Marco Ajmone Marsan, Senior Member, ZEEE, Gianfranco Balbo, and Gianni Conte, Member, ZEEE Abstmct- The original proposals of several stochastic Petri net modeling techniques and of generalized stochastic Petri nets (GSPN) in particular were based mainly on the characteristics of their underlying stochastic processes. This led to the use of GSPN only as a shortened notation for the description of stochastic models. Although already quite useful in practice, this approach did not fully exploit the benefits of a Petri net description; in particular, it did not use any of the results of classical net theory. The integration of qualitative net theory results, together with the probabilistic analysis approach, requires a deep structural foundation of the GSPN definition. In this paper, the class of Petri nets obtained by eliminating timing from GSPN models while preserving the qualitative behavior is identified. Structural results for those nets are also derived, thus obtaining the first structural analysis of Petri nets with priority and inhibitor arcs. A revision of the GSPN definition based on the structural properties of the models is then presented. The main advantage is that for a (wide) class of nets, the definition of firing probabilities of conflicting immediate transitions does not require the information on reachable markings (which was, instead, necessary with the original definition). Identification of the class of models for which the net-level specification is possible is also based on the structural analysis results. The new procedure for the model specification is illustrated by means of an example, which shows the usefulness of the new approach. A net level specification of the model associated with efficient structural analysis techniques can have a substantial impact on model analysis as well. Index Terms-Conflicts and concurrency, Markovian models, performance modeling, probabilistic specification, stochastic Petri nets, structural Petri net analysis, timed and immediate transitions, transition priorities. I. INTRODUCTION ENERALIZED stochastic Petri nets (GSPN) [l], [2] G are a performance analysis tool based on the graphical system representation typical of Petri nets (PN) [3]-[6], in which some transitions are timed, while others are immediate. Random, exponentially distributed firing delays are associated with timed transitions, whereas the firing of immediate transitions takes place in zero time, with priority over timed transitions. The selection among possibly conflicting enabled Manuscript received March 16, 1992; revised June 15, This work has been partially supported by the CNR under Contract CT12 and by MURST. Recommended by Tadao Murata. G. Chiola and G. Balbo are with the Dipartimento di Informatica, Universitl di Torino, Torino, Italy. M. A. Marsan is with the Dipartimento di Elettronica, Politecnico di Torino, Torino, Italy. G. Conte is with the Dipartimento di Ingegneria dell Informazione, Universith di Parma, Parma, Italy. IEEE Log Number immediate transitions is made through firing probabilities forming the so-called random switches. GSPN s were successfully applied to the performance analysis of a variety of systems whose main characteristics include concurrency and synchronization. Several successful areas of application of GSPN s are worth mentioning: distributed computing systems (both in their hardware and software components) [7]-[ 111, local area network communication protocols [ 121-[ 141, and flexible manufacturing systems [E], [16]. Nevertheless, acceptance of GSPN s as a modeling tool has not been as widespread as the descriptive and analysis power of the tool deserves. This was due to two reasons: difficulty in the construction of the models and computational complexity in the model solution. Difficulty in the construction of the model derives essentially from the fact that, according to the original definition of GSPN s [l], specification of random switches requires the information about the set of reachable markings. Complexity in the computation of the model solution stems from the very large state space typical of PN models of distributed systems and is encountered both with the simulative and the Markovian (numerical) analysis approach. In this paper, we focus on the model construction issue. However, the structural results that we present, and the new GSPN definition that depends only on the structure of the net, constitute the first necessary step to address the complexity problem as well. Indeed, the new definition will hopefully allow us to develop analysis techniques capable of exploiting the information inherent in the structure of the Petri net. This was simply not possible using the original definition of GSPN given at the state-space level because of the lack of correspondence between the semantics of the underlying net and the behavior of the timed model. Some partial successes in this direction have already been obtained, and the most significant examples are these: reduction rules that allow the elimination of immediate transitions from GSPN s, producing equivalent (from the point of view of the underlying stochastic process) SPN models [17] and thus eliminating all vanishing markings (this technique cannot be applied unless firing probabilities are defined completely at the net level), computation of bounds on model performance for some special net classes [18], [19] (the computation is based In the case of simulation, complexity is due to the requirements in terms of CPU time, whereas in the case of Markovian analysis the complexity issue arises both in time and in space /93$ IEEE

2 90 IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, VOL. 19, NO. 2, FEBRUARY 1993 on the analysis of the net structure rather than its state space), improvement of time and space efficiency of the computer programs implementing the numerical algorithms for the solution or simulation of GSPN models [20]-[24] (obtained by implementing concurrent firing of immediate transitions or by recognizing symmetries at the net level), and simplified procedure for solution of DSPN models [25] in which the analysis is performed by taking separate subnets into consideration individually (thus needing a definition at the net level since the solution is driven by the structure of the net). A modeling technique that is not supported by analysis algorithms is of little use, no matter how powerful the formalism is in terms of descriptive power. In the particular case of GSPN s, the relevance of efficient software tools cannot be emphasized enough since the GSPN approach would be impossible in real applications if it is not adequately automated. Introduction of some of the foregoing features into GrearSPN [23] (the tool for the development and analysis of GSPN models) has already produced a remarkable improvement in the efficiency of the software, expanding its applicability to larger models.2 Much research work was performed in the past on the analysis of the structural properties of PN s, but neither priority nor timing were considered in those studies. When priority is absent and timing is associated with all the transitions in the net by means of continuous random variables with infinite support distributions, the presence of timing does not alter the logical behavior of the net. Stochastic Petri nets (SPN) [26], [27], in which an exponentially distributed delay is associated with each transition, are an example of timed nets with no priority that may preserve the reachability graph of the untimed model even in the timed environment. Unfortunately, there are many other cases in which the presence of priority and/or timing alters the structural characteristics of the model. Hence, the need for extending the known results arises. Models in which PN transitions are associated with generally distributed firing delays, such as ESPN s [28], do indeed exhibit qualitative behavior, which in general differs from that of the untimed PN. In the particular case of GSPN s, the priority of immediate transitions over timed transitions and the mixing of exponentially distributed and null firing delays induces a qualitative behavior that is drastically different from that of the untimed PN if priorities are not taken into account at the PN level. The difference in qualitative behavior was not recognized as a problem in the definition of models such as GSPN s and ESPN s since the need for structural analysis was initially overlooked. GSPN s, for instance, were defined at the behavioral (state-space) level not at the level of the net structure. *The actual improvement depends on the model and may vary for different applications and different styles of modeling. On average, newest versions of the state space and Markovian analysis algorithms that take structural properties into account allow the solution of models 10 times larger than previous versions that did not, using the same amount of computational resources (memory and CPU time). Definition of GSPN s at the structural level, i.e., on the net itself rather than its state space, requires the development of the structural analysis of (untimed) PN s with priorities. In this paper we expand on the work presented in [2] and introduce definitions and results concerning the structure of PN s with priority and inhibitor arcs and then exploit these results for a definition of GSPN s based on their structural properties. The main modeling advantage of the new definition is in a much simpler procedure for the model construction than was previously possible. In particular, the definition of random switches [l] is simplified and requires no information on reachable markings. The paper is divided into eight sections. Sections 11, 111, and IV present definitions and properties concerning the type and structure of PN s with priorities and inhibitor arcs: these are the nets derived from GSPN s by removing timing while preserving qualitative behavior. An effort is made to integrate formal definitions with examples and informal descriptions, trying to ease the reader s task (with some sacrifice in conciseness). Note that results that we present on the structural analysis of PN s with priority and inhibitor arcs are novel. Later attempts to formally introduce priorities into PN s (with different semantics) and to develop the structural analysis are reported in [29]-[31]. The structural results obtained for PN s with priority and inhibitor arcs carry over to GSPN s, and allow the identification of a class of models for which the specification of the firing probabilities of conflicting immediate transitions is possible at the net level. Section V discusses the introduction of temporal specifications into SPN and GSPN models, emphasizing the shortcomings inherent to the GSPN definition at the state-space level. Again, examples are used to support the statements. Section VI contains the definition of GSPN at the net level for the class of models identified in the previous sections by using the structural analysis. For such models, the definition of random switches does not require any information about reachable markings, SO that the model specification can be performed independently of its state space analysis. Section VI1 details the construction of the GSPN model of a flexible manufacturing system cell, trying to emphasize the advantages of the approach. (A nonstandard example in an important application field in which other performance evaluation tools prove not to be satisfactory was selected on purpose.) Finally, Section VI11 contains the concluding remarks and comments on future research topics. 11. BASIC PN NOTATION AND PROPERTIES In this section, we introduce and study some properties of the class of nets that are obtained form GSPN s by removing temporal specifications. The formalism is illustrated on a running example, with the hope of reducing the reader s effort in mastering notation and concepts. A Petri net with priorities and inhibitor arcs can be defined as a seven-tuple: PN = (P, T, lx.1, W-(.), W+(.), WH(.), MO). (1)

3 CHIOLA et al.: GENERALIZED STOCHASTIC NETS: A DEFINITION AT THE NET LEVEL 91 It comprises a set of places P, a set of transitions T (with P n T = 0), four functions defined on transitions, and an initial marking MO. This definition is a direct extension of the class of PIT nets formalized in [6]. Although the notions of priorities and inhibitor arcs are quite old in the Petri net literature (see, e.g., [4]) they were seldom studied from a structural point of view [32]. It is only very recently, due to the demand posed by GSPN s, that a comprehensive study of their semantics and structural properties has been attempted [30], [31]. K= 5 P1 n U T1 Fig. 1. P4 t5 P7n Example of a Petri net. A. The Net Structure The structure of a PN can be graphically represented with a directed bipartite graph in which the two types of nodes (places and transitions) are drawn as circles and either bars or boxes, respectively. The priorityfunction II(.) maps transitions into nonnegative natural numbers, representing their priority level. We use the shortened notation ~ rinstead j of ri(tj) to indicate the priority level of any transition tj E T. In the graphical representation of PN, transitions have a label indicating their associated priority level; by default, priority 0 transitions are drawn as boxes, and transitions at priority 2 1 as bars. The default priority value for a transition represented by a bar is 1. We denote by TMAX the maximum priority level of the net, defined as TMAX = maxtjetirj. Without loss of generality, we assume that VO I 1 5 TMAX, 3tk E T: Irk = 1. The input, output, and inhibition functions (W-(.), W+(.), and WH(.)) map transitions on bags (or multisets, i.e., sets with multiplicity) of places. Finite bags can always be represented by vectors of nonnegative integers of appropriate dimension, and we employ the usual vector notation for bag operations whenever convenient. In particular, we denote by Wi(tk), Wf(tk), and Wr(tk) the multiplicity of input, output and inhibitor arcs connecting place pj to transition tk. We denote by t, to, and Ot, respectively, the set of input, output, and inhibition places of transition t, i.e., Vt E T, t = {pj E PI wi(t) > 0}, etc. The input and output functions are represented by directed arcs from places to transitions and vice versa, respectively. The inhibition function is represented by circle-headed arcs connecting every place pj E tk to the transition tk itself. When multiplicity is greater than one, it is written as a number next to the arc. For example, in Fig. 1 the graphical representation of a PN is shown. It consists of seven places (P = {PI, PZ, p3, p4, p5, P6, ~ 7 ) ) and Seven transitions (T = {tl, t2, t3, t4, t5, t6, t7)). Transitions tl, t6, and t7 have priority 0 (default for boxes), transitions tz and t3 have priority 2 (indicated by the r = 2 label), and transitions t4 and t5 have priority 1 (default for bars). Transition tl is connected to pl through an input arc, and to pz through an output arc. Place p5 is both input and output for transition t4. Only one inhibitor arcs exists in the net, connecting p6 to t5. B. The Marking Places may contain tokens, drawn as black dots. The state of a PN is defined by the number of tokens contained in each place. The PN state is usually called the PN marking and is a bag of places M represented by the p-component vector (ml,..., mp) whose jth component is a natural number representing the multiplicity of place pj into marking M. MO is called the initial marking of a PN and determines its initial state. In specifying the initial marking of a net, when the number of tokens to be allocated into a place is large or may vary within a range without changing the semantics of the model, positive integer parameters may be defined. In these cases the token representation in places is substituted by the name of the parameter. In the initial marking of the net in Fig. 1, pl contains K tokens (where the parameter K assumes the value 5 in this case), p5 contains one token, and all other places are empty. C. Firing Rules The dynamic behavior of a PN is defined in terms of the so called token game. A transition t is said to have concession in marking M iff M 2 W-(t) nvpj E Ot, mj < wr(t). Let r(m) denote the set of all transitions that have concession in marking M. A transition tj is defined to be enabled in marking M (denoted [M, tj)) iff tj E r(m) and vtk E r(m), rj 2 Tk. Consequently in this definition, only transitions of the same priority level can be enabled in a marking. Any transition t that is enabled in a marking M can fire, producing a new marking: M = M + W+(t) - W-(t). (2) The firing operation is denoted as M[t)M, meaning that [MI t), and that M satisfies (2). We define a transition sequence starting from marking M, as UM = (tl,..., tk) to be any sequence of transitions tj (the jth transition) such that: 3M1,..., Mk such that M[tl)M1, and Vj: 1 < j 5 k, Mj-l[tj)Mj. Given any transition sequence OM, we can define its firing count as the bag of transitions W(UM) = x,k=l[tk].3 A marking M is said to be reachable from a marking M (denoted by M[oM)M ) iff there exists a sequence UM such that Mk = hi!. In our example in Fig. 1, only transition tl is enabled in the initial marking. Its firing yields Mo[tl)Ml. Marking MI has K - 1 tokens in place pl, one token in places p2 and p5, and no tokens in the other four places of the net. In marking MI, transition tl is not enabled any more due to the priority 3The sum on bags is defined by Vn, m E IN, Vt,, tb E T, [nt,] + [mtb] = [nt~, mtb] [nta] + [mt~] = [(n + m)ta].

4 ~ 92 IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, VOL. 19, NO. 2, FEBRUARY 1993 structure of the net; only the two transitions t2 and t3 are enabled. D. Effective Conflict Informally, when the firing of a transition tl disables another previously enabled transition t,, we say that t, is in conflict with tl. The usual conflict relation for ordinary Petri nets [6] does not account for priorities and is defined to be commutative. The notion of effective conflict can be introduced in nets with priorities as a binary relation between transitions. This relation is, in general, noncommutative, unreflexive, and intransitive. Transition t, is said to be in effective conflict with tl in marking M (and this will be indicated as tlec(m)t,) if and only if t, has concession in M, tl is enabled in M, and marking M obtained after the firing of tl (M[tl)M ) is such that t, has not concession in MI STATIC PROPERTIES OF PETRI NETS WITH PRIORITIES AND INHIBITOR ARCS In this section, we develop for the class of PN s under consideration concepts and definitions of properties that can be computed statically from the net structure and initial marking, independently of information that can be obtained by playing the token game. A. Linear Invariants If we define the incidence function C(.) = W+ (.)- W- (.), we can rewrite (2) in a form in which the composition between the incidence function and the transition looks like a scalar product in linear algebra: M = M+C.t. Due to the linearity of the firing operator, it is trivial to obtain the equation: Mk = M + C. w(o~). Priorities and inhibitor arcs are simply neglected, so that we can use standard Petri net concepts and techniques to compute place and transition invariants [5]. Any column vector x of nonnegative integers (having the cardinality of T as dimension) that is a nontrivial solution of the matrix equation C. x = 0 (and that is called transition invariant ) can be the representation of the firing count of a transition sequence o~ that brings the PN back to the starting marking M. On the other hand, any row vector y of nonnegative integers (having the cardinality of P as dimension) that is a nontrivial solution of the matrix equation y.c = 0 (and that is called place invariant ) has the property that do^, Vj 5 IC, y. M = y. Mj. All place invariants of a PN can be obtained as positive linear combinations of a finite set PI of generators y, called minimal-support placeinvariants (P invariants). Similarly, all transition invariants can be obtained as positive linear combinations of a finite set TI of generators x, called minimal-support transition invariants (T invariants). Efficient algorithms exist for the computation of P and T invariants [33]. Transition invariants identify possible repetitive components of transition sequences (i.e., subsequences of transitions that, if firable, make the net perform a tour from a marking back to itself,). The actual possibility of firing a T invariant as a (repetitive) transition sequence depends on the initial marking. In case of ordinary Petri nets without priorities or inhibitor arcs, a minimal initial marking always exists such that all T invariants are firable. In case of extended nets with priorities and inhibitor arcs, a T invariant may be firable as a transition sequence for no initial marking. In any case, the actual fireability should be checked for a given MO. Place invariants identify marking-conservative place bags (i.e., positive integer weights associated with places that yield a constant weighted token count, independently of any transition firing). The invariance relation is totally independent of the initial marking and of the presence of priorities and inhibitor arcs. The scalar product between a P invariant y and any marking M reachable from MO yields a constant T~(Mo) (whose value depends only on MO), the (weighted) token count of the invariant. The linear equation resulting from this scalar product is called a marking invariant (M invariant). Other interesting invariant relations could be stated on the reachable markings of a net besides M invariants once the initial marking MO is defined. In particular, the computation of M invariants does not account for the presence of inhibitor arcs and priorities in the net, so that, in general, the list of M invariants is certainly not an exhaustive list of the invariant relations that hold independently of the firing of transition sequences. It is, however, an exhaustive representation of the invariant relations that can be expressed in linear form in nonnegative arithmetics, as argued in [32]. Experience, however, shows that in several cases, if inhibitor arcs are not abused: the information gained by observing M invariants can be quite useful. In [ll], a complete example of formal correctness proof of a complex (colored) GSPN model based on structural properties (mostly P invariants) is shown, despite the presence of two priority levels and of several inhibitor arcs. In our example depicted in Fig. 1, two minimal-support place invariants can be identified, composed of places pl, p2, p3, p4, p6, p7, and places p5r p7, respectively, all with multiplicity 1. Thus, PI = {yl, y2}, with y, = [pl, pz, P3, p4, p6, ~71, and Y2 = [p5, ~71. The first-place invariant has a token count of K, while the second one has a token count of 1, i.e., ~y,(mo) = K and 7y2(M0) = 1. Since each place of the net is contained in at least one P invariant with a token count less than or equal to K (=5), it is not possible to accumulate more than K tokens in a place, hence the net in Fig. 1 is (structurally) K (in this case, 5) bounded. Similarly, two minimal-support transition invariants can be computed. They consist of transitions tl, t2, t4, t6, and transitions tl, t3, t5, t7, respectively. Both T invariants can be implemented as firing sequences starting from the initial marking of the net. 4Normally, one can express most of the characteristics of a Petri net model using input and output arcs and conveniently use inhibitor arcs only in particular situations where they yield substantially more compact model representations. Hence, usually most of the behavioral characteristics can be derived from the net structure even if inhibitor arcs are neglected.

5 ~ CHIOLA et al.: GENERALIZED STOCHASTIC NETS: A DEFINITION AT THE NET LEVEL 93 B. Mutual Exclusion Two transitions tl and t, are effectively mutually exclusive (denoted by ti EME tm) if and only if they cannot be simultaneously enabled in any reachable marking. This relation, which is peculiar for Petri nets with priorities and inhibitor arcs, is unreflexive and commutative. Unfortunately, the foregoing definition requires the complete knowledge of the possible firing sequences. It is not very difficult, however, to find a (by no means exhaustive) set of sufficient conditions for EME that can be checked a priori (i.e., without playing the token game) and that are based either on structural properties or on M invariants. Trivially, two transitions belonging to different priority levels are mutually exclusive due to priority. Another more subtle case of ME due to priority (denoted UME) is: tlume t, iff 3tk: Tk > Ti A Tk > Tm A vpj E P, wj(tk) 5 max(w;(ti), wy(tm)) A (wjh(tk) = o vwy(tk) 2 min(wjh(tl), wjh(t,)) > 0). (4) Informally, two transitions (at the same priority level) are ITME if, in order to make both have concession at the same time, a third higher priority transition is always made to have concession. A condition for structural mutual exclusion due to the presence of inhibitor arcs is called HME and is defined by tl HME t, iff 3Pk E P: o < wc(ti> 5 wi(tm) v o < Wf(tm) < - wi,(tl). (5) Informally, two transitions are HME if there are places that are part of the input of one transition and, at the same time, of the inhibition of the other one, with arc multiplicities such that if one has concession the other one has not and vice versa. A possibility of accounting for the additional constraints posed by the initial marking is to exploit M invariants. Two transitions ti and t, are defined to be marking mutually exclusive (MME) when they satisfy the relation ti MME t, iff 3y E PI: Informally, the MME condition requires that the token count of the M invariant prevent the two transitions from having simultaneously concession in any reachable marking. Any one of the foregoing four conditions can be checked without computing the actual transition sequences, and is sufficient for the EME relation. The notation ti SME t, (structural mutual exclusion) is used as a synonym of ti HME t, V tl HME tm V tl MME t,. The notion of structural mutual exclusion is computed independently of the actual possibility of EME in particular transition sequences (it depends only on the initial marking through the MME relation). The drawback inherent in the use of SME instead of EME is that we may be unable to recognize all cases of mutual exclusions in a net, so that we may sometimes be unable to prove the correctness of a correct net (where the correctness criteria are based on ME) by structural analysis (see Section III-H). On the other hand, when a net can be proven to be correct by structural analysis only, the result is more effective: if correctness is guaranteed by the model structure there is no need for behavioral analysis, and the actual verification of EME can be extremely costly even for bounded models due to the need for the generation of all states. On our example in Fig. 1, transitions tl, t2, and t3 are not in SME relation with any other transition. Transition t4 is in MME relation with t7, due to the M-invariant p5 + p7 = 1. Transition t6 is in HME relation with t5, due to the connection of input and inhibitor arcs to place p6. C. Structural Conflict A second (see Section II-D) conflict relation between transitions may beintroduced, this time independently of the marking. This relation is called structural conflict and is extended with respect to the ordinary Petri net structural conflict [6] in order to account for inhibitor arcs and to render it noncommutative. Again, this binary relation is unreflexive and intransitive. For notational convenience, let us first introduce the forward and backward transition firing functions. The forward transition firing function C+ (t) is defined as follows: Vt E T, Vpj E P, c:(t) = max(wt(t) - wi(t), 0) The backward transition firing function C- (t) is defined by c;(t) = max(w;(t) - wt(t), 0). A transition t, is said to be in structured conflict (SC) with ti (denoted by ti SC t,) iff w-(t,). c-(tl) + WH(t,). c+(tl) > 0 (7) i.e., a structural conflict exists when the firing of transition tl either decrements the marking of some input place or increments the marking of some inhibition place of transition t,. Structural conflict is a necessary, but not sufficient, condition for effective conflict; for example, two transitions that share some input place, but that are also mutually exclusive, are in structural, but not in effective, conflict. Moreover, there can be markings such that both tl and t, can fire without disabling each other. In our example in Fig. 1 transitions t2 and t3 are both in structural and in effective conflict with each other. Analogously, t4 is both in structural and in effective conflict with t5 due to the interaction on the input place p5, and, vice versa, t5 is both in structural and in effective conflict with t4 due to the interaction on the outputfinhibition place p6. D. Causal Connection A dual concept of structural conflict is one of causal connection, which states that the firing of a transition ti can determine the enabling of another transition t, that was not previously enabled. Also, this relation is significant for nets with inhibitor arcs. Formally, we say that transition t, is causally connected (CC) to tl (denoted by tl CCt,) iff W-(tm) C+(tl) + WH(tm) C-(t,) > o (8) i.e., causal connection exists when the firing of the first transition either increments the marking of some input place

6 94 IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, VOL. 19, NO. 2, FEBRUARY 1993 Fig. 2. An example of indirect conflict. Fig. 3. Structural reduction of indirect conflict. connection between two transitions tl and tk while a third transition t, is enabled. We call this situation conditional causal connection (CCC). The relation between tl and tk is derived from the CC relation, but, since the effect of transition tl on tk is interesting only in the case that a third transition t, is already enabled, the input and inhibition places common to t, and tk need a special attention. The effect of tl must be combined with the condition that if common places exist between t, and tk, the fact that t, was already enabled prior to the firing of tl means that these common places already contained at least as many tokens as the multiplicity of the input arcs that connect them to t,. Similar considerations may be used for what concerns the inhibition places of t, and tk. Formally, these conditions are represented in the following definition: or decrements the marking of some inhibition place of the second one. The structural relation of causal connection is a necessary, but not sufficient, condition for the firing of a transition to enable another transition. In our example in Fig. 1, among others, the following CC relations hold: tl CC t2, t2 CC t4, t4 CC t6, t7 CC t4, and t6 CCt5. Only in the first case is the structural relation sufficient to determine the enabling of t2 after firing tl; in the other cases, the second transition involved in the relation may remain disabled after the firing of the first one, either because of lack of concession (e.g., no token in place p5), or due to the priority structure (e.g., the firing of t7 when one token is present in p4 and no tokens are present in pl). E. Causally Connected Set and Indirect Conflict In the case of nets with many different priority levels, more complex situations of conflict may arise. A third concept of conflict can thus be introduced for PN, that of indirect conflict. The problem is best illustrated by an example. The net depicted in Fig. 2 represents one such situation. In this PN, transitions tl and t2 are at the same priority level, while transition t3 has a priority level higher than the others. Transitions t2 and t3 are in structural conflict with each other, but since t3 has higher priority, it certainly fires immediately after tl. Therefore, if t2 does not fire before tl, it has no chance to fire before t3, and the actual choice on whether to disable t2 is implemented already by the selection between tl and t2. In situations like this, we say that t2 is indirectly conflicting with tl. This problem can also be viewed at the structural level by transforming the net of Fig. 2 into that of Fig. 3, which is behaviorally equivalent for what concerns the lower priority levels. Indeed, firing transition ti is equivalent to the firing of tl when tz fires first, whereas the firing of transition ty represents the firing of tl first, immediately followed by the firing of t3 (which has priority over tz). From this structurally reduced net, it is apparent that ty and t2 are in conflict (both structural and effective in MO) with each other. In order to check for structural situations of the type depicted in Fig. 2, we need a more sophisticated relation of causal As mentioned previously, the use of SME instead of EME leads to less powerful, although correct, results but is necessary in order to avoid the computation of the reachability graph and to maintain the complexity of the analysis polynomial in the size of the net. The situation of indirect conflict represented in Fig. 2 shows a case of conditional causal connection between tl and t3 given t2 (tl CCCo,t, t3), and can be generalized to more complex structures assuming that place p3 is expanded into an arbitrarily long chain of places connected through transitions with priority level greater than II(t2) to make sure that the firing of tl actually interferes with that of tz. To test for the existence of similar structures, we can take the transitive and reflexive closure of the conditional causal connection with respect to priority levels higher than R, defining the causally connected set at priority R as ccsr, t, (tk) = {tl 1 R1 = R A tlcccr, t, ccc:+,, t, tk) (10) where the star operator * represents the transitive and reflexive closure of a binary relation. The CCS associated with transition tk comprises all the transitions that are causally connected with tk without altering the enabling condition of transition t,. Using the notation just introduced, it is now possible to formalize the concept of indirect structural conflict: ti ISC t, iff (9)

7 CHlOLA et al.: GENERALIZED STOCHASTlC NETS: A DEFTNITION AT THE NET LEVEL 95 which represents a necessary condition for the firing of a transition tl to indirectly determine the disabling of a transition t, through sequences of higher priority transitions. P3 F. Extended Conflict Set When possibly conflicting transitions are enabled in the same marking, a choice needs to be made in deciding which one among the effectively conflicting transitions is to be fired next. Partitioning the transitions belonging to the same priority level is thus needed to identify the sets of potentially conflicting sets, called extended conflict sets. A first proposal of structural identification of extended conflict sets was proposed in [2]. Here we improve that original proposal by using a more precise version of mutual exclusion relation. In order to define this partition, we need an equivalence relation derived from the structural conflict relations SC and ISC. First, we can symmetrize the conflict and account for mutual exclusion, defining a relation of symmetric structural conflict (SSC) : The transitive and reflexive closure of the symmetric structural conflict SSC* is obviously an equivalence relation that can be used to group transitions into possibly conflicting classes. The extended conflict set for a transition tl is thus defined as follows: ECS (ti) = {tm I ti SSC* tm}. (13) Note that the definition of ECS takes explicitly indirect conflict into account, so that transitions that may affect each other enabling either directly or through an arbitrarily long sequence of higher priority transitions belong to the same ECS. In the case of the PN in Fig. 1, two nontrivial extended conflict sets can be computed: ECS (t2) = { tz, t3} ECS (t3) = (t2, t3) ECS(t4) = (t4, ts} e ECS(t5) = (t4, t5) while the other three transitions cannot be enabled in conflict with any other transition. G. Confusion In general Petri nets, the nondeterminism associated with the firing of simultaneously enabled transitions might, at first glance, suggest that the order of firing of simultaneously enabled transitions is immaterial for the evolution of the net: when simultaneously enabled transitions are not in conflict, one could even think that their concurrent firing could be attained without altering the general behavior of the net. In fact, the actual resolution of a conflict may depend on the firing of sequences of transitions that are not in conflict with each other. The problem, known in the literature under the name confusion [34], is illustrated by the net in Fig. 4. This Fig. 4. Example of Confusion. PN is identical to the one in Fig. 2, except for the fact that all three transitions have the same priority. The two enabled transitions tl and t2 are not in conflict with each other; nevertheless, if tl fires, then transition t3 becomes enabled in conflict with t2, thus yielding a conflict resolution with an associated decision to be made. On the contrary, the firing of t2 first does not raise any conflict, thus resulting in a single final marking. Hence, transitions tl and t2 cannot fire concurrently even if they are not in conflict, and a decision on which one to fire first determines the subsequent behavior of the model. Models comprising confusion are usually considered to be semantically wrong; the absence of confusion can then be considered a correctness criterion for a PN model. The net in Fig. 4 illustrates the case in which confusion arises because of the enabling of a conflicting transition. This case is known in the literature as asymmetric confusion [34]. The problem of confusion is substantially affected by the availability of several priority levels. If we start with a PN in which transitions are partitioned into extended conflict sets satisfying the definition stated in (13), only asymmetric confusion may arise. Structural sufficient conditions for absence of confusion in priority nets are developed in the following for the first time. H. Structurally Confusion-Free Nets Since the structural pattern to be checked for is the same as in the case of indirect conflict, we can exploit the concept of the causally connected set defined in (10) also to check for structural confusion freeness. In particular, we are interested in deriving conditions that guarantee the absence of confusion only in subnets comprising transitions with priority higher than a given threshold. A sufficient condition for a PN to be confusionfree at priority levels greater than or equal to T is that CF,(PN) if Vtl E T: ~1 2 r, Vti E ECS(t1): IC # 1, Vtm E CCSxl,tl(tk), tt SMEtm. (14) The condition is not necessary since, as already discussed, we use the notion of SME instead of the stronger (but more difficult to compute) notion of EME. Also, in this case, obtaining a necessary and sufficient condition appears not to be possible without the observation of all sequences of markings and transition firings. The largest structural class of nets that is known to be confusion free is the one of free-choice nets [35], which is, however, too restrictive for the modeling of many real systems. Moreover, they cannot be extended to priority nets

8 96 IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, VOL. 19, NO. 2, FEBRUARY 1993 since, due to the possibility of indirect conflicts, the absence of confusion is guaranteed only if the whole net (independently of priority levels) is free choice; nets in which subnets comprising transitions of equal priority levels are individually free choice are not guaranteed to be confusion free. The test represented by (14) obviously recognizes free-choice nets to be confusion free, but employing additional information on the structure of the PN and on the invariant properties of its reachable markings recognizes the absence of confusion also in nets with a more complex structure. By applying the check of (14) to the example in Fig. 1, it is possible to determine that the model is confusion free at priority level 1, despite the presence of the triples of transitions t2, t4, t5, and t3, t4, t5 that apparently exhibit a structural pattern of the type outlined in Fig. 4. However, no confusion may occur because of the higher priority level (T = 2) of transitions t 2 and t3. Iv. DYNAMICS OF PETRI NETS In Section 11-C, we introduced the dynamic behavior of a PN by describing its token game. We also introduced the concept of marking as the current state of the model and the change of state from a marking verifying some enabling preconditions to another by the firing of one enabled transition. The dynamics specified by the token game can be interpreted as the definition of a state machine whose states are the markings reachable from MO and whose state changes correspond to transition firings. This apparently trivial mapping of the PN dynamics into its state space behavior should, however, be modified in order to account for the intrinsic concurrency of PN s. Indeed, enabling-and-firing rules allow concurrent transition firings when several nonconflicting transitions are enabled in the same marking (the standard term in the literature on P/T nets, is transition steps [6]). The extension to nets with priority [29] and inhibitor arcs is not trivial [30]. To take this possibility of concurrency into account, we introduce a new concept of state space based on the firing of transition batches. A. Concurrent Transition Firing A transition batch x is defined as a bag of transitions. A transition batch x is said to be positive iff at least one transition tj E T is contained in x. We define the class of unitary batches t j as transition bags containing only transition t j with multiplicity one. Functions mapping transitions onto transition bags are trivially extended to transition bag domains by taking the sum of the functions applied to the individual components of the argument. A positive transition batch x is said to have concession in marking M iff vtj: xj > 0 M 2 xj. w-(tj) + c-(x - xj. tj) r\vpk E Otj, mk + Wk+(X - tj) < Wf(tj) (15) i.e., if any individual transition comprised in the batch x can proceed concurrently with the rest of the batch itself. We denote by r(m) the set of all transition batches that have concession in marking M. Given two positive transition batches x and y, it is very easy to prove that if x E r(m) and if y 5 x, then y E r(m). A necessary condition for a transition batch x to have concession, is thus that all its component transitions have concession. Focusing the attention on the concession of unitary transition batches, we return to the case of transition concession. Any positive transition batch x is defined to be enabled in marking M iff x E r(m) and Vtj such that xj > 0 and Vtk E r(m), ~j 2 Tk. As a consequence of this definition, only batches composed of transitions of the same priority level can be enabled in a marking. We extend the notation [M, x) to indicate that the positive transition batch x is enabled in marking M. We define the enabling degree function Ei(M) associated with transition ti, as the maximum multiplicity of transition ti in any transition batch x that is enabled in marking M, i.e., Vti E T, &(M) = max x;. z:[m, z) Any transition batch x that is enabled in a marking M can fire, producing a new marking: M[z)M = M + W+(x) - W-(x). We can then define a transition batch sequence starting from a marking M, as u~ = (xl,...,xk) to be any sequence of transition batches xj (the jth batch) such that 3Ml1...,Mk such that M[xl)M1, and vj: 1 < j 5 IC, Mj-l[xJ)Mj. Given any transition batch sequence OM, k we can define its firing count w (u~) = Cj=l xk. A marking M is said to be reachable from a marking M (denoted by M[~M)M ) iff there exists a sequence OM such that kfk = M. All the static properties and results derived in the previous section still hold when transition batches, together with their concession and enabling conditions, are substituted in the appropriate definitions. In the initial marking of the net depicted in Fig. 1 only transition tlis enabled (as already noted), but as many transition batches are enabled as the number of tokens in place pl, corresponding to a different number of instances of firing of transition tl. Since xmax = Ktl has concession in MO, the enabling degree of transition tl is in this case &(MO) = K. This example shows how transition batches can take the concurrency intrinsic in each transition (multiple enabling or reentrance of a transition) into account, but this is only a very simple type of concurrency. A different type of concurrency captured by the concept of transition batch is illustrated in Fig. 5. Here, transitions t2 and t3 become enabled concurrently after the firing of tl so that transition batches t2, t3, and x = tz + t3 are all enabled and any one of them can fire. This example shows that the composition of transition batches is determined by the concurrency inherent to the structure of the PN. Thus positive nonunitary transition batches represent the projection on the global state of the model of the result of concurrent transition firings. In the case of confusion-free PN s, the choice of transition batches to be fired cannot alter the behavior of the model, since conflicts arise and are solved in the same way for any choice of transition batches. The model can thus be studied, for example, by firing maximal transition batches only, if this is convenient from an implementation point of view.

9 j CHIOLA et al.: GENERALlZED STOCHASTIC NETS A DEFINITION AT THE NET LEVEL 91 B. State Space Fig. 5. Another example of Concurrency. The initial marking, together with the net structure and the firing rule, define the state space of a PN model. The reachability set of a PN, denoted by RS( MO), is defined as the set comprising MO together with all markings that can be reached from MO itself by firing any legal transition batch sequence. The reachability set of a net may contain either a finite or an infinite number of markings. In the case of finite RS, positive integer constants can be determined that bound the maximum number of tokens in places. When the number of tokens in a place never exceeds the integer constant k, the place is said to be k bounded. A PN is said to be k bounded (or just bounded ) if all of its places are k bounded (for some finite number k). The reachability graph of a PN is defined as a labeled directed graph, whose set of nodes is the net RS, and whose set of arcs A represents all possible transition batch firing relations between pairs of marking. where A C (RS(M0) x RS(M0) x Bags(T)) such that (Mi, Mj, xk) E A Mi[zk)Mj. That is, an arc connecting Mi E RS(M0) to Mj E RS(M0) and labeled with the transition batch xk represents then the firing relation ~i[x~)~j. Transition batch sequences can be interpreted as paths through the reachability graph of a PN. Transition tl E T is said to be live iff VMi E RS(M0) a path can be found in the reachability graph starting from Mi such that a marking Mj is reached in which [Mj, tl). Conversely, transition tl is said to be dead iff it is not enabled in any reachable marking. Usually, a PN model of a dynamic system comprising dead transitions is considered to be semantically incorrect (even though dead transitions may be used to define invariant assertions). A PN is said to be live iff all its transitions are live. A sufficient condition for a PN to be simultaneously live and bounded is that its reachability graph is strongly connected, provided that the net does not contain dead transitions (the condition is not necessary, as shown in an example in [36]). The reachability graph of a PN is strongly connected iff a path exists from each marking of the RS to reach the initial marking MO (the initial marking is a home-state). The net in Fig. 1 defines a reachability set comprising 161 markings, 31 of which enable priority 0 transitions, 85 enable priority 1 transitions, and 45 enable priority 2 transitions if concurrent (nonunitary batch) firing is allowed. If the firing is restricted to unitary transition batches, the reachability set contains only 80 markings: 31 that enable priority 0 transitions, 28 that enable priority 1 transitions, and 21 that enable priority 2 transitions. All the places are bounded by the constant K (which is 5 in this case), so that the net is said to be K (5) bounded. The reachability graph of the PN is strongly connected and no transition is dead, so that the net is live. C. Reduced State Space The priority structure defined on transitions can be used to partition the reachability set of a PN according to the priority level of the transitions enabled in the markings. In particular, for the analysis of GSPN s, it is convenient to consider the projection of the state space on the subset of states enabling only lower priority transitions. In general, we define a reduced reachability set at a given priority level T as RRS,(Mo) = {M E RS(M0)lv~i: [M, ~ i ), ~i 5 T}. (18) As a shorthand, we use the symbol TRS to denote the set of (tangible) markings that enable only priority zero transitions (i.e., RRSo ( MO)). Similarly, we define the projection of the reachability graph on the subset of transitions of priority lower than a given threshold as where A C (RRS,(Mo) x RRS,(Mo) x Bags(T) xbags(tx 2T)) such that (Mi, Mj, x, y) E A iff VZ: xl > 0, ~l 5 T and M~[Z)M(~) and 3n E N, v1 5 k < n, E T, S(k) E 2T, M(k) That is, an arc connecting Mi E RRS,(Mo) to MJ E RRS,(Mo) and labeled with bags x and y, represents the firing of the transition batch x of priority < T, possibly followed by the firing of a sequence of higher priority transitions. The information on the transitions enabled in the same conflict set of the higher priority transitions that fire is also maintained in order to capture the stochastic behavior of the net as defined as follows. In case of nonconfused PN s (see definition in Section 111-H), the local information on the enabling of transitions in the same conflict set is shown to be sufficient. We adopt the special notation TRG to indicate RRGo(Mo), the tangible reachability graph of a PN, i.e., the projection of the PN reachability graph on priority zero transitions. V. PN WITH TIMED AND IMMEDIATE TRANSITIONS The most natural way of introducing time into a PN is based on its interpretation as a system model in which, given a situation (marking), time must elapse before an event occurs. Since events are modeled by transitions, time is thus naturally -

10 98 IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, VOL. 19, NO. 2, FEBRUARY 1993 associated with transitions. However, in many cases, not all transitions in a model actually represent activities for which the system spends time. Transitions may be introduced to represent changes of states that take place in zero time, once certain conditions are verified. In these cases it is useful to allow the possibility of associating time only with a subset of the transitions in the model (these transitions are called timed). The other transitions are called immediate and fire in zero time. Immediate transitions may be considered as high-priority transitions that fire always before timed transitions when transitions of the two types have concession simultaneously. By convention, timed transitions are drawn as boxes, and immediate transitions are drawn as bars. Different policies can be defined with respect to the firing mechanism of timed transitions [26]-[28], [37]-[40]. The transition firing policy considered here is usually indicated as a single-phase (or atomic) mechanism. The atomic firing mechanism is compatible with the usual firing rule of untimed PN s. A timed transition that is enabled to fire, sets a timer for the end of the associated activity, and waits until the timer goes off. When the delay timer expires, tokens are withdrawn from the input places and deposited in the output places with one atomic action. During the countdown of a timer, other events can take place in the net. Some of these may have an effect on the behavior of the timed transitions whose timers are still counting. In particular, they may disable some timed transition. When this happens, the countdown is interrupted, and different policies can be used to restart the timer when the same transition will become enabled again in the future [41]. The alternatives need not be distinguished when firing delays are exponentially distributed random variables. A. Stochastic Petri Nets Stochastic Petri Nets (SPN s) were originally defined assuming that all transitions were timed and that firing delays were exponentially distributed random variables [26], [27]. Firing rates of SPN models may be marking dependent to represent activities carried on by servers of variable speed, for instance. Because of the memoryless property of the exponential distribution, it can be assumed that the activity associated with each transition is restarted in any new marking, as already noted. SPN s are thus isomorphic to continuoustime Markov chains (MC). An SPN is said to be ergodic iff it generates an ergodic MC. A sufficient condition for an SPN to be ergodic is that RG(M0) be finite and strongly connected. The equilibrium and transient solutions of this MC provide the probability distributions on the markings of the SPN either at steady state or at a given time t. From these distributions it is possible to obtain performance indices related to the behavior of the SPN. If the firing rates of certain transitions are increased toward infinity, it is possible to obtain a stochastic behavior for an SPN that approaches that of a GSPN. However, this limiting net lacks the concept of priority of immediate transitions over timed ones that is typical of GSPN s. GSPN s explicitly associate immediate transitions with higher priority levels. The process spends a nonnull amount of time in markings enabling timed transitions only, while it transits in zero time through markings enabling immediate transitions. States (or markings) of the former type are called tangible; states (or markings) of the latter type are called vanishing. GSPN models can be recognized to be equivalent to continuous-time Markov chains defined over a set of states isomorphic to the set of tangible markings of the net. GSPN can be usefully applied in performance evaluation studies when, as in the case of SPN, their reachability set is finite, firing rates do not depend on time parameters, and no infinite loops exist over sets of vanishing markings. A sufficient condition for the latter property in a live and bounded GSPN is that no T invariant exists comprising immediate transitions only. B. Firing One Transition at a Time in GSPN SPN and GSPN are such that timed enabled transitions fire one at a time, according to an order that is determined by the probabilistic structure of the model. This is a direct consequence of the fact that the probability of simultaneous events in a continuous-time Markovian model is null. Hence the possible concurrent firing of timed transitions to form nonunitary transition batches is prevented by the stochastic hypothesis (with probability 1). In the case of the GSPN vanishing markings, instead, whenever more than one (immediate) transition is enabled, the selection of the next transition to fire must be based on specifications other than the temporal ones. Firing delay is deterministically equal to zero for all immediate transitions so that it cannot be used to discriminate the one that will actually fire. According to the definition in [l], a random switch is defined by the analyst for each marking enabling several immediate transitions. The random switch comprises the set of enabled immediate transitions as well as the switching distribution (i.e., the probability mass function defined over the enabled immediate transitions). Note that the definition of random switches is strongly dependent on the GSPN marking. Thus, in general, the identification of a random switch cannot be made on the basis of the GSPN structure alone but requires the construction of the net reachability set first. Indeed, a correct application of the definition provided in [l] would require first generating the reachability set of the net and then specifying a switching distribution for each marking that enables several immediate transitions. Although conceptually powerful, this approach may become extremely cumbersome, and it may require the definition of probabilities also for the selection among transitions whose firing order is absolutely irrelevant. In other words, the user is forced to specify not only the choices that are intrinsic in the nature of the system being described but also the choices that are artificially introduced by the model, due to the assumption of firing one transition at a time. An example will better explain the situation. Consider the GSPN model in Fig. 6. It comprises five immediate transitions. Transitions tl and t2 share one input place and are hence in structural conflict. Transitions t5 and t6 are obviously in

11 CHIOLA et al.: GENERALIZED STOCHASTIC NETS: A DEFINITION AT THE NET LEVEL 99 Fig. 6. Example of a GSPN. structural and effective conflict since they are extended free choice. Finally, transition t7 is not in conflict with any other immediate transition. The correct specification of this model requires the generation of the reachability graph and the definition of switching probabilities for all vanishing markings enabling more than one immediate transition. The generation of the reachability graph reveals that 75 vanishing markings exist, and that the following sets comprising more than one immediate transition can be simultaneously enabled: Assuming that no marking dependency is involved in the model, the definition of random switches can be factorized with respect to all the sets of simultaneously enabled immediate transitions that can be found in the RS. The number of factorized random switches in this GSPN is thus 6 (in the case of marking dependency the number of random switches can be as large as 75, one per vanishing marking, since no factorization is possible without knowledge of the form of the dependency on the marking). Note that some of these distributions refer to transitions that are not in conflict, and hence the specification of the model requires the definition of probabilistic choices that are not necessary. For example, for the set {tl, t5, t6}, a probability must be specified for the choice between tl on one side and t5 and t6 on the other. Any probability distribution over {tl} and {t5, t6) would lead to the same results. Assuming that the user needs to specify equal probabilities for the choice between tl and t2, and probabilities 213 and 113 for the choice between t5 and t6, respectively, the probability mass functions could be the following, where the arbitrary selections are always made with equal probabilities. (P(tl1 = 1/2, P(t21 = 1/21 (P(tl1 = 1/2, P(t71 = 1/21 (P(t21 = 1/2, P(t71 = 1/21 (P(t5) = 2/3, P{t6) = l/3} (P(t1) = 1/2, P(t5) = 1/6, P{t6} = 1/6} (P(t2) = 1/2, P(t5) = 1/3, P(t6) = 1/6} C. Firing Batches of Immediate Transitions The shortcomings of the original GSPN definition [l] that we mentioned previously, can be removed by allowing a concurrent firing of nonconflicting immediate transitions (firing of immediate transition batches) and the association with immediate transitions of weights that can be used for the computation of firing probabilities in vanishing markings enabling more than one immediate transition within individual conflict sets. Structural characteristics of the untimed PN models underlying GSPN s, described in Sections 11, 111, and IV, allow the firing of immediate transition batches comprising at least one immediate transition per ECS. This entails the generation of a smaller number of vanishing markings, and thus a reduced complexity in the model solution (this is yet another example of simplifications in the model yielded by the structural results.) In the case of the GSPN in Fig. 6, the analyst first describes the model topology, as well as the transition types. Then, knowing that three ECS exist in this GSPN, namely {tl, t2}, (t5, t6}, and {t7}, in order to obtain the same result as with the previous distributions, he or she only needs to assign equal weights to tl and t2, to t5 a weight double than that assigned to t6, and a default arbitrary weight to t7. D. Marking Dependency As we mentioned, SPN s allow the marking dependency of transition firing rates. The main advantage of marking

12 100 IEEE TRANSACTIONS ON SOFIWARE ENGINEERING, VOL. 19, NO. 2, FEBRUARY 1993 dependency is the possibility of constructing very compact models in which a single transition represents a whole complex subsystem whose aggregated delay is dependent in an arbitrarily complex way on the population inside the subsystem. On the other hand, the introduction of marking dependency brings about also several drawbacks: first, it permits the behavior of the model with respect to the untimed net to change; hence the net is used only as a shortened description of the state space, and the actual semantics of the model is completely defined only by the reachability graph plus the marking-dependent rates. This also means that results cannot be computed without the complete state-space construction. Furthermore, the meaning of marking dependency becomes unclear for general firing time distributions. The first issue is by far the most critical, since it refers to the coherence between the stochastic model and the underlying PN model. Two levels of coherence may be acceptable: 1) Minimal Coherence: the possibility of general marking dependency, provided that no firing rate or probability is null. This is sufficient to guarantee that all state changes possible in the RG of the PN may occur with nonnull probability in the stochastic model. Hence the graphic representation of the associated Markov chain in terms of state transitions is isomorphic to the RG. 2) Complete Coherence: the parallelism of the net (concurrent enabling of transitions and reentrance) is completely reflected in the timing semantics through the use of an infiniteserver semantics. The possibility of specification of single- and multiple-server transitions can be used as a shortened notation for more complex PN s in which the enabling degree of the transition is limited to a given value k by structural and initial marking constraints. No other form of marking dependency is allowed for timed transitions. This restriction is sufficient to identify activities with transition enabling, associating one independent server with each instance of transition enabling. The adoption of the minimal level of coherence allows the use of validation techniques based on the interleaving semantics of the untimed PN model to be used for the analysis of the structural properties of the stochastic model. The complete coherence is obtained by the elimination of general marking dependency and by the use of the infinite-server firing semantics for timed transitions; it allows a complete qualitative analysis of the stochastic model to be performed on the untimed PN specification. In particular, PN validation techniques based on both interleaving and concurrency semantics can be used. In the case of immediate transitions, a general marking dependency for the transition firing weights inside ECS s may lead to stochastic confusion, i.e., to improperly defined stochastic models. Restricted forms of marking dependency must be introduced in order to avoid this problem, as shown later. The model in Fig. 1 can be recognized as a representation of the single-writer/multiple-readers access to a shared resource. Place pl represents thinking customers that sometimes issue their request for the access to a shared resource through the firing of transition tl. Since customers think independently of each other, transition t1 should be of type infinite server. At this point, they can choose (in zero time) to be either readers by firing transition t2, or writers by firing transition t3. Readers can start accessing the shared resource by firing transition t4 provided that no writer is accessing the resource (place p5 contains one token). Writers can access the resource by firing transition t5 only when no other customer is accessing it. Transitions t6 and t7 represent the end of an access for readers and writers, respectively. Since readers access independently to the shared resource, transition t6 should also fire with an infinite-server semantics. Transition t7 may be either single or infinite server, since its enabling degree is limited to 1 (to represent sequential writes) by the structure of the PN. In this example, we have thus a complete coherence between the PN and the GSPN model, and no marking dependency is needed. VI. GSPN WITH PARAMETERS DEFINED AT THE NET LEVEL As already mentioned, the goal of the definition of GSPN is to allow a simple specification of random switches, independently of the knowledge of reachable markings. In order to attain this goal, it is necessary to introduce some restrictions on the class of allowable models, in which the priority of immediate transitions over timed ones is enforced. The extension of the previous definition [l] to allow different priority levels for immediate transitions has thus been naturally included in the revised definition [2]. A. Definition of GSPN A GSPN is an eight-tuple GSPN = (P, T, II(.), I+-(.), W+(.), WH(.), A(.), MO) (20) where PN = (P, T, ri(.), W-(.), W+(.), WH(.), MO) is a confusion-free PN at priority levels greater than zero (CFl(PN), i.e., satisfying condition stated in (14) with 7r = 1) that is referred to as the PN underlying the GSPN, and A(.) is a function defined on the set of transitions. The PN underlying the GSPN constitutes the structural component of a GSPN model. Timed transitions are assumed to have the lowest priority level, whereas transitions at other priority levels are said to be n immediate, where n is the priority level. If only two priority levels exist, transitions are simply referred to as timed and immediate. Markings that enable timed transitions only are said to be tangible, whereas markings that enable n-immediate transitions of any level are said to be vanishing. Function A(.) allows the definition of the stochastic component of a GSPN model. In particular, adopting the preferred convention of marking independency, it maps transitions into real positive numbers. The possibility of introducing marking dependency in the definition is discussed later. We use the simpler notation xk to indicate h (tk), for any transition tk E T. The quantity & is called the rate of transition tk if tk is timed, and the weight of transition tk if tk is n immediate. The association of firing rates with timed transitions implies that an exponentially distributed firing time with rate xk is

13 CHIOLA et al.: GENERALIZED STOCHASTIC NETS: A DEFINITION AT THE NET LEVEL 101 associated with tk. When a tangible marking enables several (timed) transitions, the model semantics is as specified by the race policy: all transitions are assumed to compete with each other, and the one that actually fires is that for which the firing delay is minimum. It is thus possible to compute the probability P{tk I M } that (timed) transition tk is the one that actually fires in (tangible) marking M as P{tk I = xk cl: [M,tl) 1 (21) The association of weights with n-immediate transitions is necessary to determine which of the enabled transitions will actually fire in a marking M that enables more than one conflicting n-immediate transition. In principle, the same formula (21) could be used in order to produce a strictly sequential firing of immediate transitions one at a time. This is, however, in contradiction with the assumption that all immediate transitions fire in zero time on enabling. The problem is overcome by showing that in confusionfree GSPN s the selection can be made locally within ECS s. Hence, absence of confusion is a sufficient condition for both local specification of weights at the level of ECS s and for independent firing of transitions belonging to different ECS s. On the other hand, if the net is confused the choices made in different ECS s may affect each other, thus preventing a definition of weights at the net level associated with structural conflicts as well as concurrent firing of transitions. B. Independence among ECS s Transition weights are associated with n-immediate transitions by considering one ECS at a time. When several transitions belonging to the same ECS are enabled in a given marking, one of them, say transition ti, is selected as a candidate to fire with probability: where a;(m) is the weight of ECS(t;) in marking M and is defined as follows: It may happen, however, that several ECS s comprising transitions of the same priority level are simultaneously enabled in a vanishing marking. According to the usual firing mechanism of stochastically timed transitions, it would appear natural to allow only one immediate transition to be fired at a time, so that a selection among the candidates chosen inside each ECS should be specified. The characteristic of GSPN s of being confusion-free guarantees that the way in which this choice is performed is irrelevant with respect to the resulting Markovian model (see the example in Section 3.1.1) in [2); a sketch of a proof is given in the following outline), or, in other words, that no choice is needed and the transitions can fire concurrently. It is thus possible to say that either transitions fire simultaneously, or a fixed ordering among ECS s exists, or the ECS s consisting of enabled transitions are selected with equal probability, or an ECS is chosen with a probability proportional to the weights of the enabled transitions that it comprises. With the latter, the probability of firing the enabled immediate transition tk in marking M is the one specified by (21). C. Outline of Proof of Irrelevance of ECS Election 1) By definition of ECS, it is not possible that the firing of transition t, can disable another transition tb at the same priority level if they are not contained in the same ECS. Hence the only effect that the firing of a transitions tj E ECSl may have on another ECS2 at the same priority level can only be the enabling of some transitions tj E ECS2. 2) By definition of confusion, if the net is confusion-free at priority level 7r, then the firing of any transition tj E ECSl such that rj = r can enable a transition tk E ECSz such that 7rk = 7r only if no other transition tl E ECSz (with tl # tk) was already enabled. 3) From 1) and 2), it follows that VECS1, ECS2, Vt, E ECSl and V reachable marking M such that M[tj)M, if ACSz(M) = {tk E ECSzI[M, tk)} # 0 then Vtl E ECS2, [M, tl) iff tl E ACSz(M). That is, in a confusion-free GSPN, the firing of any transition in ECSl cannot change the subset of transitions in ECS2 that were already enabled concurrently with ECSl. 4) From 3), it follows that if only a restricted marking dependency is allowed for n-immediate transitions so that the weight of a transition may depend only on the subset of transitions enabled in the same ECS and on the markings of places that are not connected to other transitions of priority 2 n, then the firing probability computed by (22), once the ECS is enabled is not affected by the firing of transitions belonging to other ECS s enabled concurrently. 5) Equation (22) gives a conditional firing probability for transition ti E ECS(t,). Total firing probability for t; is computed as the product of conditional probability (22) times the probability that a transition belonging to ECS(ti) fires. Since, from l), transitions belonging to ECS(t;) may not be disabled by other transitions, the probability of eventually firing ECS(t;) is 1, independently of the ordering imposed among different ECS s. We emphasize that the association of marking-independent weights with n-immediate transitions requires only the information about ECS and not about reachable markings. For each ECS the analyst thus defines a local association of weights. From these weights, actual probabilities are derived by normalization with respect to the subset EC(M) & ECS in each marking M enabling some transitions of the considered ECS. The relative values of transition weights belonging to different ECS s are irrelevant for the derivation of the Markovian model that is constructed to obtain the probability distribution of tokens over places, so that it is possible to avoid this kind of (artificial) combinatorial sequentialization at the level of construction of the tangible reachability graph [ 161.

14 102 IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, VOL. 19, NO. 2, FEBRUARY 1993 D. Marking Dependency The new definition of GSPN conceives the function A(.) to map transitions into real numbers. From the point of view of the underlying stochastic process, it is, however, possible to allow a mapping of transitions into functions defined on markings, thus introducing a dependency of the stochastic component of the GSPN model on the marking. In the original definition of GSPN [l], no restrictions were introduced on the definition of these functions. However, the vtk principle that GSPN models should be developed without the need of anticipating the behavior of the net requires some restrictions to be considered in the specification of marking dependency functions. In particular, different restrictions should be considered for timed and immediate transitions. For what concerns timed transitions, marking dependency functions that are completely defined at the structural level are easy to envision, based on the concept of degree of enabling in order to completely preserve the concurrency semantics of the underlying Petri nets. Requirements for the net level definition of marking dependency for immediate transitions are, instead, less constraining: the only property that should be preserved is the absence of confusion that allows the definition at the level of individual ECS s. 1) Marking Depend Rates for Timed Transitions: Timed transitions may be characterized by the following types of firing speed: finite server, infinite server, and enabling dependent. Indicating with Ei (.) the enabling degree function associated with transition ti as defined in (16), the firing rates of timed transitions can be expressed in the following form: min (Ei (M), Ki)& if type multiple-server (with multiplicity K;) if type infinite server if type enabling dependent Obviously, in the case of marking dependency, transition firing rates are (re)evaluated whenever a new marking is entered. 2) Marking Dependent Weights for Immediate Transitions: The concept of firing speed does not apply to immediate transitions. Thus, marking dependency functions for immediate transitions cannot be related to their enabling degree. On the other hand, general dependency of the weights from the marking may yield dependencies among different choices in different ECS s, thus contradicting the independence property logically guaranteed by the absence of confusion. By default, immediate transitions are then assumed to be marking independent. If a marking dependency is really required for immediate transitions, the dependency can be kept under control by introducing restrictions on the domain of the functions so that the marking dependency does not give rise to confusion. Two sufficient conditions can be identified: first by limiting dependency to places whose marking cannot be modified by transitions of priority greater than or equal to the one of the considered transition; second, by allowing dependency from the set of transitions that are actually enabled within the considered ECS. If this condition is not satisfied, a sort of stochastic confusion may appear in GSPN behavior. This fact would render GSPN behavior dependent on the sequences of transition firings, hence confused. Sufficient Condition 1: Denoting with Dk the domain of the marking dependency function associated with transition tk, DI, cannot contain places whose marking may be modified by the firing of transitions of priority level greater than or equal to 7rk that belong to a different ECS. Formally: Dkn( ti: k#la+r, ME U ti Ati +ZECS(tk) ) {P,IC,(tl) # 0) = 0 Sufficient Condition 2: The weight of an immediate transition may depend on the subset of transitions ACSk(M) C EcS(tk) of all transitions of ECS that are actually enabled in marking M (e.g., to specify an equal probability for all enabled transitions in an ECS.) Since in confusion-free PN s these sets cannot change until one transition of the ECS fires, this kind of indirect dependency on the marking is guaranteed not to introduce stochastic confusion. 3) Modeling Restrictions on Marking Dependency: Even in the cases in which the marking dependency does not give rise to stochastic confusion, from a modeling point of view it is advisable to restrict the domain of the weight functions in order to construct models that are robust with respect to slight modifications of the net structure. In particular, the domains of the weight functions associated with the immediate transitions of a given ECS should not extend outside the set of places connected to the transitions of the same ECS by some input, output or inhibitor arc. Indeed, control of the side effects between separate subnets obtained through an unrestricted use of marking dependency can be difficult in large models and can be practically impossible when some small changes are introduced in the model. VII. AN EXAMPLE In this section, we describe as an example the GSPN Of a simp1e manufacturing system (FMS) This demonstrates the for the construction, describes the semantics and the practical use Of the properties Of GSPN On Of systems and the effectiveness Of the technique A. Problem Identification An FMS cell is composed of machines, buffers, transport system, and control system. Machines are usually able to process different types of parts. Buffers are needed because different machines have different processing times. The transport system can move parts from one point to another within the FMS cell, following the commands issued by the control system. The control system decides the part routing with the objective of attaining the highest possible throughput and system utilization with the lowest possible inventory. Usually, a part to be processed needs a support (pallet) on which it is loaded at the beginning of processing, and from which it is unloaded after the completion of processing.

15 ~ CHlOLA et al.: GENERALIZED STOCHASTIC NETS: A DEFINITION AT THE NET LEVEL 103 x2 Fig. 7. Example of an FMS cell. The structure of any FMS model is, then, a cc..xtion o cooperating resources (machines) that can work in parallel and can be accessed and used by customers (pallets with parts) competing against each other. This type of problem, by far more general than the specific example, is naturally described by means of GSPN models. Consider as an example the FMS cell whose functional structure is depicted in Fig. 7. It is composed of four different machines Y1, Y2, Y3, and Y4. %NO types of parts (X1 and X2) can be processed by the four machines. Parts of type X1 need to be processed by Y1 and Y4 in sequence, parts of type X2 have three possible alternatives; they can be processed by machines Y 1 and Y4 in sequence, by machine Y 3 or by machines Y2 and Y4 in sequence. B. Model Construction Following a top-down approach, from the description of the FMS depicted in Fig. 7, four types of subunits can be identified: 1) machines that can process only one type of parts (Y2 and Y3), 2) machines that can process two types of parts (Y1 and Y4), 3) loading site where pallets are loaded with parts, and 4) unloading site where parts are unloaded from pallets. Fig. 8(a) shows the model of the subunit Ya of type 1). Place Xraw contains tokens representing pallets loaded with parts X that require work from machine Ya. If Ya is free (a token is present in Yafree), the transition XinYa is enabled and can fire. A token is then moved to YawX thus enabling the timed transition XoutYa whose firing denotes the end of the work of Ya on X. In a very similar way, the GSPN in Fig. 8@) models a subunit of type b). If loading time is assumed to be negligible compared with other delays in the system, the model of the loading operation is simply described by the GSPN subnet in Fig. 8(c). WO immediate transitions loadxa and loadxb represent the loading of parts of type Xa and Xb, respectively. The unloading site is simply modeled by place pallets-unloading, which collects the loaded pallets, and by a timed transition that models the time necessary to move back the pallets to the loading site. From the flow model in Fig. 7, using the GSPN models of the subunits, it is straightforward to obtain the GSPN model of the FMS under analysis. C. Model Verification and Specification Verification of the adherence of net behavior to the actual system operations is obtained in two steps: verification of the structural properties of the net (boundedness, deadlock (4 Fig. 8. GSPN models of FMS cell subunits. freeness, etc.) and verification of the semantic properties of the net (e.g., relationship between the net activity and actual behavior of the system). Both steps exploit the structural properties (place and transition invariants) of the net. For the net in Fig. 9, the following P invariants are found: j1 = [freepallets, Xlraw, YlwX1, XIwaitY4, Y4wX1, X2raw,YlwX2, Y2wX2, Y3wX2, X2waitY 4, Y 4wX2, pallets-unloading] y2 = [Ylfree, YlwX1, YlwX21 y3 = [YZfree, Y2wX21 y4 = [Y3free, Y3wX21 y, = [Y4free, Y4wX1, Y4wX21. All places are covered by P invariants, and therefore the net is structurally bounded. Interpretation of P invariants is very simple: y, identifies the possible states of the pallets, y2, y3, y4, and y5 refer, respectively, to Y1, Y2, Y3, and Y4 and identify all possible machine states. Possible states of both pallets and machines can be, in this case, easily recognized to be consistent with the behavior of the system. T invariants are the following: z1 = [loadx2, X2inY2, X2outY2, X2inY4, X2outY4, palletsmove] z2 = [loadx2, X2inY1, X2outY1, X2inY4, X2outY 4, palletsmove] 23 = [loadxz, X2inY3, X2outY3, palletsmove] 24 = [loadxl, XlinY1, XloutY1, XlinY4, XloutY4, palletsmove]

16 104 IEEE TRANSACTIONS ON SOFIWARE ENGINEERING, VOL. 19, NO. 2, FEBRUARY 1993 Xlraw XlinYl XloutYl XlinY4 XloutY4 Y4free t\ loadx2 X2waitY4 I Y4wX2 X2inY4 X20utY4 \ I \ X2inY3 X2outY3 / I Fig. 9. GSPN model of the FMS cell. It can be easily recognized that all transitions are covered by some T invariant so that the net is cyclic. Interpretation of T invariants is again immediate. Invariants can be associated with the different paths that parts can follow in the FMS. For instance, z1 is associated with the path of parts X2 through Y3 and Y4. From these checks, we gain confidence on the correctness of the net, but the GSPN model is not yet completely specified. Firing rates and weights must be assigned to timed and immediate transitions, respectively. The assignment of the firing rates is usually a simple task. A more complex task is the weight and priority assignment to immediate transitions. Extended conflict sets must be known for this association to be performed. The net comprises two isolated subnets TI and T2 of immediate transitions. T1 = {loadxl, loadx2, XlinYl, X2inY1, X2inY2, X2inY3) T2 = (XlinY4, X2inY4) The ECS identification can be done automatically. No problem derives from subnet T2, since the two transitions are grouped into a single extended conflict set. Subnet T1 has problems of confusion. Implementation of the structural analysis techniques presented in Section I11 allows transitions XlinY1, X2inY1, X2inY2, and X2inY3 to be identified5 as members of a single confused ECS, and the firing of loadx1 or loadx2 can be identified as the responsibles of the change of the enabling condition of the 51n the case of software package GreatSPN described in [23], transitions are highlighted in the graphical interface. ECS, and thus of confusion. Consider, for instance, transitions loadx2, XlinY1, X2inY1, and assume that loadx2, and XlinY1 are enabled. In fact, load X2 and XlinYl are not in conflict with each other, but, if loadx2 fires, then X2inY 1 becomes enabled in conflict with XlinY1, thus yielding a conflict resolution with an associated probability. On the contrary, if XlinY12 fires first, no conflict is generated, thus resulting in a unique marking with probability 1. This is a typical case of confusion, and a specification of the relative interaction of the two transitions that are not in conflict is required, to define the behavior of the system. Confusion can be removed from the net giving priority to transitions loadx1 and loadx2 over the other transitions of subnet T1. The final model that presents no confusion problem is thus the same as in Fig. 9, with the addition of a priority 2 specification (label T = 2 ) for transitions loadx1 and 10adX2.~ The ECS s can be easily identified to assign weights to immediate transitions. The extended conflict sets of the net are: ECSl = {loadx1(1), loadx2(1)} ECSz = {XlinYl(I), X2inY1(1), XZinY2(2), X2inY3 (2)} ECS3 = {XlinY4(1), XZinY4(1)}. The parenthetical numbers are the weights assigned to each immediate transition. In this case the following policy is implemented: 6The same result can be obtained in this particular case by adding inhibitor arcs from place freegallets to XlinY1, X2inYl. X2inY2, and X2inY3; thus forcing first the pallet loading, if tokens are present in freegallets.

17 CHIOLA et al.: GENERALIZED STOCHASTIC NETS: A DEFINITION AT THE NET LEVEL 105 The same probability is given to loading of X1 and X2 by the weight assignment to transitions in ECS. The weight assignment to transitions in ECS2 gives to the pallets loaded with X2 parts the same probabilities for the use of the three machines (Yl, Y2, and Y3) and to X1 and X2 the same probability of access to machine Y1. The weight assignment to transitions in ECS3 gives to X1 and X2 the same probability of access to machine Y4. Of course, different policies can be implemented using different weights. To show some examples of the kind of performance figures that can be obtained using a GSPN model, let us consider that from the model in Fig. 9 the average utilization of each machine and the number of parts that are processed per unit of time are required. These parameters can be derived quite simply from the steady-state probability distribution on markings. All places Ynfree are 1 bounded, and when on token is present in Ynfree, the machine is active. Therefore the average utilization of machine Yn (percentage of time the machine is used) is given by 1 - AYnfree, where AYnfree is the average number of tokens in place Ynfree. The mean number of parts X1 processed per time unit is given by the inverse of the frequency of firing of transitions XloutYl or XloutY4. The frequency of firing of XloutYl is fxlouty1 = PrM~~ slouty1 M: [M, XlOUtYl) where wxlouty1 is the firing rate of transition XloutYl (which is not marking dependent), and is the steady-state probability of marking M. VIII. CONCLUSIONS The structural analysis of PN s with priority and inhibitor arcs, i.e., of the nets obtained by removing timing specifications from GSPN s while preserving their qualitative behavior, led to a revision of the GSPN definition. The possibility of using structural results (that can be obtained with very limited computational effort) for the model validation allows modeling mistakes to be detected in the early stages of the model development, and thus at a lower cost. Under the condition that all subnets of immediate transitions be confusion free, and that a minimal level of coherence is maintained between the untimed net structure and the stochastic specification, the new definition permits a complete and precise definition of a GSPN model independently of the knowledge of the set of reachable markings, as well as the possibility of a model validation that does not require reachability analysis. This entails a remarkable improvement with respect to the previous situation in which the definition of the parameters of a GSPN model (in particular, of marking dependent firing rates and random switches) often required the user to have the information of the reachability set of the model. Furthermore, the results of the structural analysis provide sufficient conditions to determine if a GSPN model belongs to the class for which the simpler parameter definition is possible (confusion-free nets with restricted or no marking dependency). GSPN s in their present form are an attempt to reach a tradeoff between modeling power in terms of what a modeler can easily express using the basic formalism and analysis power in terms of the possibility of implementing efficient modeling support and analysis algorithms. Indeed, the use of GSPN s is currently supported by the GreatSPN software tool [23]. It provides an efficient implementation of the basic analysis algorithms for validation, Markovian analysis, and simulation of models. Having eased the task of the model construction, two main issues still remain to be solved in the GSPN field and both are related to the model complexity. The first is the graphical complexity of real system models. Possible approaches for dealing with this problem are the definition of high-level GSPN s and the definition of rules for the hierarchical construction of models, i.e., for the composition of submodels into the model of the whole system. The former approach has already received some attention for symmetric models [42], [43], and more work is being performed on the subject [44], [22]. The second approach was considered in the definition of timed Petri nets used as a means for the development of simulative models [45] but has not yet been formalized in the GSPN field. Preliminary work has started in this direction at the level of the qualitative behavior of (untimed) Petri nets underlying the GSPN definition [46]. The second issue to be tackled is the complexity of the algorithms for the computation of the solution of GSPN models. The availability of a deep structural foundation of GSPN models has already led to some partial successes in the reduction of the analysis complexity. The results presented in [17]-[22], [24] are more than simple indications that the margins for improvement are great. However, a great deal of work is still needed before the complexity of the analysis of GSPN models can be brought to a level such that the study of detailed models of complex real systems is feasible with reasonable cost. It seems clear that only by bringing together the power of structural analysis and of stochastic analysis can further success in these directions be obtained. ACKNOWLEDGMENT The authors are grateful to G. Franceschinis and S. Donatelli of the Dipartimento di Informatica of the Universiti di Torino for their active participation in the research activity that led to some of the results described in this paper. They also acknowledge the valuable comments and suggestions of two anonymous referees. REFERENCES [l] M. Ajmone Marsan, G. Balbo, and G. Conte, A class of generalized stochastic Petri nets for the performance analysis of multiprocessor systems, ACM Trans. Computer Syst., vol. 2, no. 1, May [2] M. Ajmone Marsan, G. Balbo, G. Chiola, and G. Conte, Generalized stochastic Petri nets revisited: Random switches and priorities, in Proc. Int. Workshop Petri Nets and Performance Models, Madison, WI, Aug. 1987, pp [3] W. Reisig, Petri Nets: An Introduction. New York: Springer-Verlag, [4] J. L. Peterson, Petri Net Theory and The Modeling of Systems. Englewood Cliffs, NJ: Prentice-Hall, 1981.