Applications of non-Markovian stochastic Petri nets

PERFORMANCE EVALUATION REVIEW, VOL. XX, NO. Y, MONTH 1998 1Applications of Non-MarkovianStochastic Petri NetsRicardo M. Fricks, Antonio Pulia�to, Mikl�os Telek, Kishor S. TrivediAbstract| Petri nets represent a powerful paradigm formodeling parallel and distributed systems. Parallelism andresource contention can easily be captured and time can beincluded for the analysis of system dynamic behavior. Mostpopular stochastic Petri nets assume that all �ring timesare exponentially distributed. This is found to be a severelimitation in many circumstances that require determinis-tic and generally distributed �ring times. This has led toa considerable interest in studying non-Markovian models.In this paper we speci�cally focus on non-Markovian Petrinets. The analytical approach through the solution of theunderlying Markov regenerative process is dealt with andnumerical analysis techniques are discussed. Several exam-ples are presented and solved to highlight the potentialityof the proposed approaches.Keywords| Stochastic Petri Nets, Markov regenerativeprocesses, preemption policies, numerical analysis.I. IntroductionOver the past decade, stochastic and timed Petri nets ofseveral kinds have been proposed to overcome limitationson the modeling capabilities of Petri nets (PNs). Althoughvery powerful in capturing synchronization of events andcontention for system resources, the original paradigm wasnot complete enough to capture other elements indispens-able for dependability and performance modeling of sys-tems. Thus, new extensions allowing for time and random-ness abstractions became necessary. Despite the consensuson which elements to add, a certain uncertainty existed onwhere to aggregate the proposed extensions. From amongseveral alternatives, a dominant one was soon establishedwhere the Petri nets could have transitions that once en-abled would �re according to exponential distributions withdi�erent rates (EXP transitions). This led to well knownnet types: Generalized Stochastic Petri Nets (GSPNs) [1]and Stochastic Reward Nets (SRNs) [2].The resulting modeling framework allowed the de�nitionand solution of stochastic problems enjoying the Markovproperty [3]: the probability of any particular future behav-ior of the process, when its current state is known exactly,is not altered by additional knowledge concerning its pastbehavior. These Markovian stochastic Petri nets (MSPNs)were very well accepted by the modeling community sincea wide range of real dependability and performance mod-els fall in the class of Markov models. Besides the abilityto capture various types of system dependencies intrinsicR.M. Fricks is with the SIMEPAR Laboratory and Ponti�cia Uni-versidade Cat�olica do Paran�a, Curitiba/PR, Brazil. A. Pulia�to iswith the Istituto di Informatica, Universit�a di Catania, Catania, Italy.M. Telek is with the Department of Telecommunications, TechnicalUniversity of Budapest, Budapest, Hungary. K.S. Trivedi is with theDepartment of Electrical and Computer Engineering, Duke Univer-sity, Durham/NC, USA. E-mails: [email protected], [email protected],[email protected], and [email protected].

to the underlying Markov models, other advantages of thePetri net framework also contributed to the popularity ofthe MSPNs. Among these reasons, we point out the powerof concisely specifying very large Markov models, and theequal ease with which steady-state, transient, cumulativetransient and sensitivity measures could be computed. Oneof the key restrictions, however, is that only exponentiallydistributed �ring times are captured. This led to the de-velopment of non-Markovian stochastic Petri nets.Non-Markovian stochastic Petri nets (NMSPNs) werethen proposed to allow for the high level description ofnon-Markovian models. Likewise in the original evolutivechain, several alternative approaches to extend the Marko-vian Petri nets were proposed. Their distinctive featurewas the underlying analytical technique used to solve thenon-Markovian models. Candidate solution methods con-sidered included the deployment of supplementary vari-ables [4], the use of phase-type expansions approximations[5], [6], and the application of Markov renewal theory [7],[8]. Representative non-Markovian Petri nets proposed,listed according to the underlying solution techniques, arethe Extended Stochastic Petri Nets (ESPNs) [9], the De-terministic and Stochastic Petri Nets (DSPNs) [10], theStochastic Petri Nets with Phase-Type Distributed Transi-tions (ESPs) [11], and the Markov Regenerative StochasticPetri Nets (MRSPNs) [12]. As a consequence of these evo-lutive steps, we observe that the restriction imposed on thedistribution functions regulating the �ring of timed tran-sitions was progressively relaxed from exponential distri-butions to a combination of exponential and deterministicdistributions, then to any distribution represented by phasetype approximations, and �nally to any general distribu-tion function (GEN transitions).However, this exibility also brought a new requirementwith it. If an enabled GEN transition is disabled be-fore �ring, a scheduling policy is needed to complete themodel de�nition. Consider the generic client/server NM-SPN model in Fig. 1 for instance. Requests from clientsarrive according to a Poisson process (EXP transition t1).Tokens in place P1 represent clients already in the system.In a single server con�guration only one of the queued re-quests will be served at a given time. The service require-ment g of each request is sampled from a general distribu-tion function Gg(t) that coordinates the �ring of the GENtransition t2. An age variables ag associated with a requestkeeps track of the amount of service actually received bythe request. Service will be completed (i.e., transition t2will �re) as soon as the age variable ag of the active request(the one receiving server's attention) reaches the value ofits service requirement g . After that, the request leaves

PERFORMANCE EVALUATION REVIEW, VOL. XX, NO. Y, MONTH 1998 2the system and its associated age variable is destroyed.�������� ����rP2��/SSw ��7SSoP3P1t2 t3 t4t1 ??c������Fig. 1. Fault-tolerant client/server model.Now, suppose that the server is failure-prone with con-stant failure and repair rates. A token in place P2 repre-sents the active state of the server while a token in placeP3 indicates server being down (undergoing repair). Conse-quently, �ring of the EXP transitions t3 and t4 correspondto the failure and end-of-repair events associated with theserver. Whenever down, the server cannot serve new clientsor complete the service requirement of the current request,as shown by the inhibitor arc from place P3 to transitiont2. Clearly a scheduling policy is then necessary to pre-cisely de�ne how the server must proceed when broughtup again. In MSPNs with EXP transitions this was not aproblem because of the memoryless property of the expo-nential distributions1 [3]. The remaining processing timeof an interrupted request is also represented by the EXPtransition t2.In the favorable case, the server is able to completely ser-vice the current request before a failure occurs (as shownin Fig. 2a). Otherwise the system behavior depends onthe amount of remaining service at the time of the inter-ruption, and whether the service already received by therequest will be discarded. The service requirement g mayincrease or decrease as an indirect consequence of systemevents responsible by the server interruption. For instance,the failure of the server in Fig. 1 may render certain activ-ities of the client unnecessary, which would then reduceits service requirement to a lower g0 value. Likewise, theage variable ag related to the active request may also be af-fected by the server interruption since the amount of servicealready provided to the request may be preserved or lost.We distinguish both situations calling the �rst a work con-serving scheme, and the second non-work-conserving. Withthese four conditions we constructed the table in Fig. 2b.Note that, although the service requirement is shown to beincreasing after the interruption in the illustration in thebottom row of the table, the situation where g 0 < g isalso possible2.Fig. 2b can be interpreted from two distinct perspectives.>From the clients' perspective, all curves correspond to thesame client whose service is momentarily interrupted be-tween times �2 and �3. From the server's perpective, clients1Note that with one of the later discussed scheduling policy (pri)even the EXP transition has to be dealt with like a GEN transition.2Naturally, g 0 � ag at the time of the interruption needs to bealways imposed.

b)

a)

t

ag

γg

τ2 τ3

t

ag

γg

work conserving

γg’

τ1 τ2 τ3

serv

ice

pres

erve

dse

rvic

e m

odif

ied

t

ag

γg

τ1 τ2 τ3

t

ag

γg

γg’

τ1 τ2 τ3

τ1

t

ag

γg

taskservice started

service completed

τ1 τ4

τ4

τ4

τ4

τ4

prd

priprs

non-working-conserving

Fig. 2. Di�erent scheduling policies.requests live only from interruption-to-interruption. Thereis a single age variable associated with the server, and whathappens after interruptions is de�ned by the schedulingpolicy which may be preemptive or non-preemptive, de-pending on if the server swaps clients before �nishing ser-vice or not. Preemptive policies are usually based on ahierarchical organization of requests (e.g., priority schedul-ing) or on an allocation of service based on time quota (e.g.,round-robin scheduling). In this case, system behavior isstrongly a�ected by the preemptive policy and the overallperformance will depend on the strategy adopted to dealwith the preempted requests, as described in the following:� The work done on the request prior to interruption is dis-carded so that the amount of work ag is lost. The serverstarts processing a new request which has a work require-ment g0; i.e., a new sample is drawn from the service timedistribution of the client. The server then starts servingthis new request from the beginning (i.e., ag = 0), as shownin the bottom-right sketch in Fig. 2b.� The server returns back to the preempted request withthe original service requirement g . No work is lost so thatthe age variable retains its value ag prior to the interrup-tion. The request is resumed from the point of interruptionas shown in the top-left sketch in Fig. 2b.� The server also returns to the same request with the orig-inal service requirement g . But the work done prior to theinterruption is lost and the age variable ag is set to zero.The request processing starts from the beginning as shownin the top-right sketch in Fig. 2b.As in [13], the above policies are referred to as preemptiverepeat di�erent (prd), preemptive resume (prs) and preemp-tive repeat identical (pri), respectively3. The case shown inthe bottom-left sketch in Fig. 2b is not considered in the3The prd, prs and pri names were borrowed from queueing theory[14].

PERFORMANCE EVALUATION REVIEW, VOL. XX, NO. Y, MONTH 1998 3literature as it is unrealistic. Note that in [15], the au-thors indicated the prd and prs type policies as enablingand age type. The pri policy of Petri net transitions wasintroduced for the �rst time in [16]. The prd and prs (withphase-type distributed �ring times) policies are the onlyones considered in the available tools modeling NMSPNs[17], [11], [18].Note that when the scheduling is preemptive: (i) theprs and prd policies produce the same results with EXPtransitions, but pri is di�erent; (ii) the prd and pri policieshave the same e�ect for transitions �ring according to adeterministic random variable, but prs is di�erent; and (iii)otherwise, all three policies will produce distinct results forotherwise same NMSPNs [14].In this paper, we deal with the general class of non-Markovian Petri nets using examples of MRSPNs, whichcan be analyzed by means of Markov regenerative pro-cesses. The remaining sections of the paper are organizedas follows. The next section introduces Markov Regener-ative Petri nets and describes how to deal with the un-derlying Markov Regenerative Process. Section 3 showshow to model a failure/repair process in a parallel machinethrough MRSPN. Section 4 further extends this modelby adopting a di�erent repair facility scheduling scheme.Preemption in a multi-tasking environment is analyzed inSection 5 through the WebSPN tool; the resulting modelcontains several concurrently enabled general transitionsand di�erent memory policies. Conclusions are �nally pre-sented in Section 6.II. Markov Regenerative Petri NetsMRSPNs allow transitions with zero �ring times (im-mediate transitions), exponentially distributed or generallydistributed �ring times. The dynamic behavior of an MR-SPN is modeled by the execution of the underlying net,which is controlled by the position and movement of to-kens. At any given time, the marking of an MRSPN isde�ned by the number of tokens in each of its places, andis represented by a vector called its marking. The set ofmarkings reachable from a given initial marking (i.e., theinitial state of the system) by means of a sequence of tran-sition �rings de�nes the reachability set of the Petri net.This set together with arcs joining its markings and in-dicating the transition that cause the state transitions iscalled reachability graph.Two types of markings can be distinguished in the reach-ability graph. In a vanishing marking at least one im-mediate transition is enabled to �re, while in a tangiblemarking no immediate transitions are enabled. Vanish-ing markings are eliminated before analysis of the MRSPNusing elementary probability theory [12]. The resultant re-duced reachability graph is a right-continuous, piecewiseconstant, continuous-time stochastic process fZt; t � 0g,where Zt represents the tangible marking of the MRSPNat time t. Choi, Kulkarni, and Trivedi [12] showed thatthis marking process is a Markov Regenerative Process(MRGP) (if the GEN transitions are of prd type and atmost one GEN transition is enabled at a time), a member

of a powerful paradigm generally grouped under the nameMarkov renewal theory [7], [8]. Mathematical de�nitionand solution techniques for MRGP are summarized next.A. Markov Renewal SequenceAssume a given system we are modeling is described bya stochastic process Z d= fZt; t � 0g taking values in acountable set �. Suppose we are interested in a singleevent related with the system (e.g., when all system com-ponents fail). Additionally, assume the times between suc-cessive occurrences of this type of event are independentand identically distributed (i:i:d:) random variables. LetS0 < S1 < S2 < ::: be the time instants of successiveevents to occur. The sequence of non-negative i:i:d: ran-dom variables, S d= fSn � Sn�1;n 2 IN = f0; 1; 2; :::gg isa renewal process [19], [20]. Otherwise, if we do not startobserving the system at the exact moment an event hasoccurred (i.e., S0 6= 0) the stochastic process S is a delayedrenewal process.However, suppose instead of a single event, we observethat certain transitions between identi�able system statesXn of a subset of �, � �, also resemble the behav-ior just described, when considered in isolation. Succes-sive times Sn at which a �xed state Xn is entered forma (possibly delayed) renewal process4. Additionally, whenstudying the system evolution we observe that at these par-ticular times the stochastic process Z exhibits the Markovproperty, i.e., at any given moment Sn, n 2 IN, we can for-get the past history of the process. The future evolution ofthe process depends only on the current state at these em-bedded time points. In this scenario we are dealing with acountable collection of renewal processes progressing simul-taneously such that successive states visited form an em-bedded discrete-time Markov chain (EMC) with state space. The superposition of all the identi�ed renewal processesgives the points fSn;n 2 INg, known as Markov regener-ation epochs (also called Markov renewal moments5), andtogether with the states of the EMC de�ne a Markov re-newal sequence.In mathematical terms, the bivariate stochastic process(X;S) d= fXn; Sn;n 2 INg is a Markov renewal sequence(MRS) provided thatPrfXn+1 = j; Sn+1 � Sn � t j X0; :::; Xn;S0; :::; Sng= PrfXn+1 = j; Sn+1 � Sn � t j Xng;for all n 2 IN, j 2 , and t � 0. We will always assumetime-homogeneous MRS's; that is, the conditional transi-tion probabilities Kij(t), whereKij(t) d= PrfXn+1 = j; Sn+1 � Sn � t j Xn = igare independent of n for any i; j 2 , t � 0. Therefore, wecan always writeKij(t) = PrfX1 = j; S1 � t j X0 = ig; 8i; j 2 ; t � 0:4We are assuming Xn is the system state at time Sn.5Note that these instants Sn are not renewal moments as describedin renewal theory, since the distributions of the time interval betweenconsecutive moments are not necessarily i.i.d..

PERFORMANCE EVALUATION REVIEW, VOL. XX, NO. Y, MONTH 1998 4The matrix of transition probabilities K(t) d= [Kij(t)] iscalled the kernel of the MRS.B. Markov Regenerative ProcessesA stochastic process fZt; t � 0g is a Markov regenerativeprocess if and only if it exhibits an embedded MRS (X, S)with the additional property that all conditional �nite dis-tributions of fZSn+t; t � 0g given fZu; 0 � u � Sn; Xn =i; i 2 g are the same as those of fZt; t � 0g given X0 = i.As a special case, this de�nition implies that [8]PrfZSn+t = j j Zu; 0 � u � Sn; Xn = ig =PrfZt = j j X0 = ig; 8i 2 ;8j 2 �:This means that the MRGP fZt; t � 0g does not havethe Markov property in general, but there is a sequenceof embedded time points (S0; S1; :::; Sn; :::) such that thestates (X0; X1; :::; Xn; :::) respectively of the process atthese points satisfy the Markov property. It also impliesthat the future of the process Z from t = Sn onwards de-pends on the past fZu; 0 � u � Sng only through Xn.The stochastic process between consecutive Markov re-generation epochs, usually refered to as subordinated pro-cess, can be any continuous-time, discrete-state stochas-tic process over the same probability space. Recentlypublished examples considered subordinated homogeneousCTMCs [12], [21], non-homogeneous CTMCs [22], semi-Markov processes (SMPs) [23], and MRGPs [24].C. Solution of ProblemsLet Z = fZt; t � 0g be a stochastic process with discretestate space � and embedded MRS (X;S) = fXn; Sn;n 2INg with kernel matrix K(t). For such a process we cande�ne a matrix of conditional transition probabilities as:Vij(t) d= PrfZt = j j Z0 = ig; 8i 2 ;8j 2 �; t � 0:In many problems involving Markov renewal processes, ourprimary concern is �nding ways to e�ectively computeVij(t) since several measures of interest (e.g., reliabilityand availability) are related to the conditional transitionprobabilities of the stochastic process.At any instant t, the conditional transition probabilitiesVij(t) of Z can be written as [7], [8]:Vij(t) = PrfZt = j; S1 > t j Z0 = ig+ PrfZt = j; S1 � t j Z0 = ig= PrfZt = j; S1 > t j Z0 = ig+ Xk2 Z t0 dKik(u)Vkj(t� u);for all i 2 , j 2 �, and t � 0. If we construct a matrixE(t) = [Eij(t)] withEij(t) d= PrfZt = j; S1 > t j Z0 = ig;then the set of integral equations Vij(t) de�nes a Markovrenewal equation, and can be expressed in matrix form asV(t) = E(t) + Z t0 dK(u)V(t � u); (1)

where the Lebesgue-Stieltjes integral6 is taken term byterm.To better distinguish the roles of the matrices E(t) andK(t) in the description of the MRGP we call the matrixE(t) the local kernel of the MRGP, since it describes thestate probabilities of the subordinated process during theinterval between successive Markov regeneration epochs.Since matrix K(t) describes the evolution of the processfrom the Markov regeneration epoch perspective, withoutdescribing what happens in between these moments we callit the global kernel of the MRGP.In the special case when the stochastic process Z doesnot experience state transitions between successive Markovregeneration epochs; i.e.,Zt = ZS+n where S+n = maxfSn j Sn � t; n 2 INg;Z is called a semi-Markov process and E(t) is a diagonalmatrix with elementsEii(t) = 1�Ki(t);where Ki(t) d= PrfS1 � t j Y0 = ig; 8i 2 = Xj2Kij(t)is the sojourn time distribution in state i. Hence, the globalkernel matrix alone (which in this case is usually denotedas Q(t)) completely describes the stochastic behavior ofthe SMP.The Markov renewal equation represents a set of cou-pled Volterra integral equations of the second kind [25] andcan be solved in the time or in the Laplace-Stieltjes do-main. One possible time domain solution is based on adiscretization approach to numerically evaluate the inte-grals presented in the Markov renewal equation. The inte-grals in Eqn. 1 are solved using some approximation rulesuch as trapezoidal rule, Simpson's rule or other higher or-der quadrature methods. Another time domain alternativeis to construct a system of partial di�erential equations(PDEs), using the method of supplementary variables [4].This method has been considered for steady-state analysisof DSPNs in [21] and subsequently extended to the tran-sient case in [26].An alternative to the direct solution of the Markov re-newal equation in time-domain is the use of transformmethods. In particular, if we de�ne E�(s) = R10 e�stdE(t)and V�(s) = R10 e�stdV(t), the Markov renewal equationbecomes V�(s) = E�(s) +K�(s)V�(s)= [I�K�(s)]�1E�(s)After solving the linear system for V�(s), transform in-version is required7. In very simple cases, a closed-form6R t0 dK(u)V (t � u) = R t0 k(u)V (t � u)du when K(t) possesses adensity function k(t) = dK(t)dt .7This being the approach addopted in the solution of all examplespresented in this paper.

PERFORMANCE EVALUATION REVIEW, VOL. XX, NO. Y, MONTH 1998 5inversion might be possible but in most cases of interest,numerical inversion will be necessary. The transform inver-sion however can encounter numerical di�culties especiallyif V�(s) has poles in the positive half of the complex plane.For a thorough discussion of Markov renewal equationsolution techniques see [27], [28], and for generic Volterraintegral equations numerical methods see [29], [30]. Refer-ences for the application of Markov renewal theory in thesolution of performance and reliability/availability modelssee [16], [31], [22], [27], [32], [33], [34], [35], [36].III. Modeling Failure/Repair Activities in aParallel Machine ConfigurationThe use and analysis of MRSPNs is initially demon-strated using a computer system performability model.Two machines (a and b) are working in a parallel con�g-uration sharing a single repair facility with a First-ComeFirst-Served (FCFS) scheduling discipline. Due to the non-preemptive nature of this discipline, we do not need agevariables in this case (once enabled all GEN transitions inthe model will never be disabled until �ring). We assumethat both machines have exponential lifetime distributionswith constant parameters �a and �b respectively. When-ever one of the machines fails it immediately requests re-pair. When the single repair facility is busy and a secondfailure occurs, the second machine to fail waits in a re-pair queue until the �rst machine is put back into service.The repair-time of the machines is de�ned by the generaldistribution functions Ga(t) and Gb(t).P1 P2

ar rb

f bf a

f a f b

rbar

f a f b

f a

f b

1

c)

Pai i b

P

P

1:

1

r

1

rbar

a bi i

a

ff

br

b a

2: 3:

4: 5:

1,1,0,0,1,0,0

0,1,1,0,1,0,0

0,1,0,0,0,1,0

0,0,0,1,0,1,0 0,0,1,0,0,0,1

1,0,0,0,0,0,1

1,0,0,1,1,0,0

P

3

6

P5

7

4

6: 7:

7 6

a)

b)

5r

r4

b

a

2 3

Fig. 3. Parallel system model: a) MRSPN; b) reachability graph;and c) state transition diagram.The overall behavior of the system can be understoodfrom the MRSPN illustrated in Fig. 3a. Machine a is work-ing whenever there is a token in place P1. The EXP tran-sition fa with rate �a represents the failure of machine a.When machine a fails, a token is deposited in place P6 andits repair is requested. If the repair facility is available (i.e.,there is a token in place P5), it is appropriated with the�ring of immediate transition ia. The GEN transition ra,

�ring according to the distribution function Ga(t), repre-sents the random duration of repair. A token in place P3means that machine a is queued waiting for the availabilityof the single repair facility while machine b is undergoingrepair (there is a token in place P7). A symmetrical set ofplaces and transitions describes the behavior of machine b.The system is down whenever there are no tokens in boththe places P1 and P2.The reachability graph corresponding to the Petri net isshown in Fig. 3b. Each marking in the graph is a 7-tuplekeeping track of the number of tokens in places P1 throughP7. In the graph, solid arcs represent state changes dueto the �ring of immediate transitions or EXP transitions,while dotted arcs denote the �ring of GEN transitions. Thevanishing markings (enclosed by dashed ellipses in the dia-gram) are eliminated when the reduced reachability graphis constructed (not shown), and based on the reduced ver-sion we constructed the state transition diagram of Fig. 3c.De�ne the stochastic process Z = fZt; t � 0g to repre-sent the system state at any instant, whereZt =8>>>>>>>>>>>><>>>>>>>>>>>>:

1 if both machines are working at t,2 if machine a is under repair whilemachine b is working at t,3 if machine b is under repair whilemachine a is working at t,4 if machine a is under repair whilemachine b is waiting for repair at t,5 if machine b is under repair whilemachine a is waiting for repair at t.Note that possible values of Zt are the labels corre-sponding to tangible markings in Fig. 3b. We are in-terested in computing performability measures associatedwith the system. To do so, we need to determine the con-ditional probabilities PrfZt = j j Z0 = 1g; 8j 2 � =f1; 2; :::; 5g. Analysis of the resulting (reduced) reachabil-ity graph shows that Z is an MRGP with an EMC de�nedby the states 1, 2, and 3; i.e., = f1; 2; 3g. We can ob-serve that transitions to states 4 and 5 do not correspondto Markov renewal epochs because they occur while GENtransitions are enabled. An additional step adopted beforestarting the synthesis of the kernel matrices was the con-struction of a simpli�ed state transition diagram. Fig. 3cshows a simpli�ed version of the reduced reachability graphwhere the markings were replaced by the correspondingstate indices. We preserved the convention for the arcsand extended the notation by representing states of theEMC by circles, and other states by squares.The construction of kernel matrices proceeds with theanalysis of possible state transitions. The only non-zeroelements in the global kernel matrix K(t) correspond tothe possible single-step transitions between states of theEMC. Consequently, we have the following structure of thematrix (identi�ed directly from Fig. 3c):K(t) = 24 0 K1;2(t) K1;3(t)K2;1(t) 0 K2;3(t)K3;1(t) K3;2(t) 0 35

PERFORMANCE EVALUATION REVIEW, VOL. XX, NO. Y, MONTH 1998 6Let the random variables La and Lb be the respec-tive time-to-failure of the two machines, we can determineK1;2(t) in the following way:K1;2(t) = PrfX1 = 2; S1 � t j X0 = 1g= Prfmachine a fails by time t andis the first one to failg= PrfLa � t ^ Lb > Lag= Z t0 �1� �1� e��b��� d�1� e��a�= Z t0 e��b��ae��a�d�= �a�a + �b h1� e�(�a+�b)ti :Similarly,K1;3(t) = PrfX1 = 3; S1 � t j X0 = 1g= Prfmachine b fails by time t andis the first one to failg= �b�a + �b h1� e�(�a+�b)ti :Determination of the elements K2;1(t) and K2;3(t) isquite alike, so we only show how K2;1(t) is determined.The third row is completelly symmetrical to the second, soit can be easily understood once K2;1(t) is understood. Weneed some auxiliary variables to help in the explanationof the constructive process of K2;1(t). Hence, we de�nethe random variables Ra and Rb to respectively representtimes necessary to repair machines a and b. The distri-bution function of Ra (Rb) is Ga (Gb). Using these newvariables we can compute K2;1(t):K2;1(t) = PrfX1 = 1; S1 � t j X0 = 2g= Prfrepair of a is finished by time tand b has not failed during therepair of ag= PrfRa � t ^ Lb > Rag= Z t0 PrfLb > �gdGa(�)= Z t0 �1� �1� e��b��� dGa(�)= Z t0 e��b�dGa(�):To summarize, the elements of the global kernel matrix are:K1;2(t) = �a�a + �b h1� e�(�a+�b)ti ;K1;3(t) = �b�a + �b h1� e�(�a+�b)ti ;K2;1(t) = Z t0 e��b�dGa(�);K2;3(t) = Z t0 �1� e��b�� dGa(�);

K3;1(t) = Z t0 e��a�dGb(�); andK3;2(t) = Z t0 �1� e��a�� dGb(�):Note that the global kernel will always be a square ma-trix. In this case with dimensions 3 � 3, since we have 3states in the embedded Markov chain. However, the lo-cal kernel matrix is not necessarily a square matrix, sincethe cardinality of the state space of Z can be larger thanthe cardinality of the state space of the embedded Markovchain. This can be seen, for instance, in this system sincethe embedded Markov chain has only 3 states while theMRGP has 5 possible states.We construct the local kernel matrix E(t) following asimilar inductive procedure. In this case we are looking forthe probability that the MRGP will move to a given statebefore the next Markov renewal moment.Since in a single step the system can only go from state1 to the other two states of the EMC then E1;1, the onlynon-zero element of this row, should be the complementarysojourn time distribution function in state 1, that is,E1;1 = 1� (K1;2(t) +K1;3(t))= e�(�a+�b)t:The di�culty comes with the analysis of E2;2(t) and E2;4(t)(complement of E2;2(t)). Once we solve for these, we havethe solution for the remaining components of the matrixdue to the symmetry of the problem. Therefore, we explainthe procedure that leads to E2;2(t):E2;2(t) = PrfZt = 2; S1 > t j X0 = 2g= Prfrepair of a is not finished up to tand b has not failed until tg= Prfrepair of a is not finished up to t� Prfb has not failed until tg= [1�Ga(t)]e��bt:We can now express the remaining non-zero elements ofthe local kernel matrix asE2;4(t) = �1� e��bt�Gca(t)E3;3(t) = e��atGcb(t)E3;5(t) = �1� e��at�Gcb(t)with Gca(t) = 1�Ga(t); andGcb(t) = 1�Gb(t):We can always verify our answers by summing the elementsin each row of both kernel matrices. Corresponding row-sums of the two matrices must add to unity.

PERFORMANCE EVALUATION REVIEW, VOL. XX, NO. Y, MONTH 1998 70 100 200 300

time (hours)

0.997

0.998

0.999av

aila

bilit

y

instantaneousinterval

0 100 200 300time (hours)

1.90

1.92

1.94

1.96

1.98

inte

rval

pow

er

0 100 200 300time (hours)

0.997

0.998

0.999

1.000

avai

labi

lity

instantaneousinterval

0 100 200 300time (hours)

1.90

1.92

1.94

1.96

1.98

2.00in

terv

al p

ower

LST results:

Fig. 4. Numerical results for the parallel system with non-preemptiverepair.The kernel matrices determined can then be substitutedin Equation (1) and the resulting system of coupled integralequations solved using one of the approaches described in[27], [28]. The resultant plots, labelled LST in Fig. 4, reportsystem availability and performability computed when timeto repair is deterministic; i.e.,Ga(t) = 1(t� �a); �a > 0Gb(t) = 1(t� �b); �b > 0where 1(t) is the unit step function. The failure rates (pa-rameters �a and �b) are identical and equal to 0.01 hour�1;and the repair-time (parameters �a and �b) takes 5 hours.The interval availability is the expected proportion of timethe system is operational during the period [0; t]:�A(t) = 1t Z t0 E[X(�)]d�;when the discrete random variable X represents the oper-ational status of the system; i.e., X(t) = 1, if the system isoperatinal at time t, and 0, if it is not. The performability(dependability) measure plotted in the �gure correspondsto the interval processing capacity of the system, with theconvention that a unit of computing capacity correspondsto that of one active machine.Following the approach used in [33], we also plotted cor-responding Markovian system results, where each DETtransition was replaced by an equivalent 25-stage Erlangsubnet. The Markovian models were solved using theStochastic Petri Net Package (SPNP) introduced in [37].The numerical results show that the sharp change of the

instantaneous availability is not captured by the phase typeapproximation.IV. Preemptive LCFS repairIn the case the repair time distribution has a heavytail it might be worth applying a preemptive Last-ComeFirst-Serviced (LCFS) scheduling instead of the FCFS one,hence we re-consider the previous example with the LCFSscheduling in this section.��������?? ����66 ����66 ��������66 ����66 ����

����??r rr ??� �� � 666 6� � 66� �� �?/ � �� �?R� �CCCCW� �������CCCCC� �6����� �6

P1faP3 iaP6ra P5 rbP7ib P2fbP4r0aP8i0a r0bP9i0bFig. 5. Preemptive LCFS repair with non-identical machinesFig. 5 shows the PN which describes the behavior of thesystem containing the same machines a and b of the previ-ous example and applies the preemptive LCFS schedulingscheme. The repair of machine a (b), represented by a to-ken at P6 (P7) is preempted as soon as machine b (a) fails,i.e., transition fb (fa) �res. In this case the repair facility isassigned to the machine which failed later (i0a or i0b �res anda token is placed to P8 or P9). After the repair of the lastfailed machine (�ring of r0a or r0b) the repair facility returnsto the completion of preempted repair action. Di�erentmemory policies can be considered depending on whetherthe repairman is able to \remember" the work already per-formed on the machine before preemption or not. In thecase that prior work is lost due to the interruption andthe repair must be repeated from scratch with an identicalrepair time requirement (pri policy) or with a repair timeresampled from the original cumulative distribution func-tion (prd policy). In case the prior work is not lost and thetime to complete the preempted repair equals the residualrepair time given the portion of work already completedbefore preemption (prs policy). The PN of Fig. 5 capturesthe di�erent memory policies for repair by assigning tran-sitions ra and rb the appropriate preemption policies. (Thepreemption policies of transitions r0a and r0b are not relevantsince r0a and r0b cannot be preempted.)Assuming that the two machines are identical, i.e., theirfailure and repair time distributions are the same, the PNwhich describes the behavior of the system of two iden-tical machines with LCFS scheduling and with prs policybecames simpler (Fig. 6a). Tokens in place P1 representoperational machines, tokens in P2 count failed machines(including the one under repair), and a token in place P4the availability of the single repair facility. In the initial

PERFORMANCE EVALUATION REVIEW, VOL. XX, NO. Y, MONTH 1998 8� ��� ��� �� � ��qq q���� AAAU����AAAU AAAU����AAAU ���� AAAU ���� 6

� ��� ��??M1M2M3

t1 t2t4t3t1 t3t2 t4200111100201a) b)

P1P3 P2 P4� �� �� �� �

�

�� � �

- �??6 66Fig. 6. Preemptive LCFS repair with identical machinesmarkingM1 = (2; 0; 0; 1) (Fig. 6b), t1 is the only enabledtransition. Firing of t1 represents the failure of the �rstmachine and leads to state M2 = (1; 1; 1; 0). In M2,transitions t2 and t3 are competing. The GEN transitiont2 represents the repair of the failed machine and its �ringreturns the system to the initial stateM1. The EXP transi-tion t3 represents the failure of the second machine and its�ring disables t2 by removing one token from P3 (the �rstrepair becomes dormant). In M3 = (0; 2; 0; 1) one ma-chine is under repair and the other repair is dormant, andthe only enabled transition is the repair of the last failedmachine. Firing of the GEN transition t4 leads the systemagain toM2, where the dormant repair is resumed. Assumethat the failure times of both machines are exponentiallydistributed with parameter � so that the EXP transitionst1 and t3 have �ring rates 2� and �, respectively.The preemptive policy of transition t2 has to be assignedbased on the system behavior to be evaluated. (The pre-emptive policy of transition t4 is irrelevant since t4 can notbe preempted.) Assigning a prd policy to t2 means thateach time t2 is disabled by the failure of the second ma-chine (t3 �res before t2), the corresponding age variable a2is reset. As soon as t2 becomes enabled again (the secondrepair completes and t4 �res) no memory is kept of theprior repair period, and the execution of the repair restartsfrom scratch. The prd service policies, like this one, arecovered by the model de�nition in [38], [39].The case when a pri policy is assigned to t2 is very sim-ilar to the previous one except that as soon as t2 becomesreenabled (the second repair completes and t4 �res), thesame repair (same �ring time sample) has to be completedfrom the beginning. This type of pri memory policy is cov-ered by the model de�nition in [16], and can be analyzedby the transform domain method discussed there.Hereafter we assume that a prs policy is assigned to t2.When a prs policy is assigned to t2, each time t2 is disabledwithout �ring (t3 �res before t2) the age variable a2 is notreset. Hence, as the second repair completes (t4 �res), thesystem returns to M2 keeping the value of a2, so that thetime to complete the interrupted repair can be evaluated asthe original repair requirement minus the current value ofa2. The age variable a2 counts the total time during whicht2 is enabled before �ring, and is equal to the cumulative

sojourn time in M2. The Markov renewal moments in themarking process correspond to the epochs of entrance tomarkings in which the age variables associated with all thetransitions are equal to zero. By inspecting Fig. 6b, theMarkov renewal moments are the epochs of entering M1and of entering M2 from M1.The subordinated process starting from markingM1 hasno internal state transition (since t1 is the only enabledEXP transition) and includes the only immediately reach-able state M2 (Markovian regeneration period).The subordinated process starting from marking M2 in-cludes all the states reachable from M2 before �ring of t2;i.e., M2 and M3. Since M2 is the only state in which t2 isenabled, the age variable a2 increases only in marking M2and maintains its value in M3. The �ring of t2 can onlyoccur from M2 leading to marking M1.Notice that the subordinated process starting from M2is semi-Markov since the �ring time of t4 is generally dis-tributed. The age variable a2 grows whenever the MR-SPN is in marking M2, and the �ring of t2 occurs whena2 reaches the actual value of the �ring time (which isgenerally distributed with cumulative distribution functionG(t)). With the condition that the �ring time of t2 is w, wacts an absorbing barrier for the accumulation functionalrepresented by the age variable a2, the �ring time of t2is determined by the �rst passage time of a2 across theabsorbing barrier w.The closed-form Laplace-Stieltjes transform expressionsof the kernel matrices of the LCFS repair prs case arederived here in detail, applying the technique based onMarkov renewal theory. We build the K�(s) and E�(s)matrices row by row by considering separately all thestates that can be regeneration states and can originatea subordinated process. M3 can never be a regenerationstate since t2 is always active when entering to M3, hence, = fM1;M2g. The fact that M3 is not a regenerationmarking, means that the process can stay in M3 only be-tween two successive Markov renewal moments.The starting regeneration state is M1 - No general transi-tion is enabled and the next regeneration state can onlybe state M2. The non-zero elements of the �rst row of thekernel matrices areK�12(s) = 2�s + 2� ; and E�11(s) = ss + 2� :The starting regeneration state isM2 - Transition t2 is GENso that the next regeneration time point is the epoch of�ring of t2. The subordinated process starting from M2comprises states M2 and M3 and is an SMP (since t4 isGEN) whose kernel is:Q�(s) = 24 0 �s + �G�(s) 0 35 ;where G�(s) is the LST of the distribution function of the�ring time of t4.The transition t2 �res when the age variable a2 reachesthe actual sample of the �ring time 2. In general, when a

PERFORMANCE EVALUATION REVIEW, VOL. XX, NO. Y, MONTH 1998 9GEN transition is active the occurence of a Markov renewalepoch in the marking process of an NMSPN is due to oneof the following two reasons:� the GEN transition �res,� the GEN transition of prd type becomes disabled.For the analysis of subordinated processes of this kind threematrix functions Fi(t; w), Di(t; w) and Pi(t; w) (where tdenotes the time, w a �xed �ring time sample, and thesuperscript i refers to the initial (regeneration) state ofthe subordinated process) were introduced in [23]. Fi(t; w)refers to the case when the next regeneration moment is be-cause of the �ring of the GEN transition with the (�xed)�ring time sample w. For the analysis of this case an addi-tional matrix �i, referred to as branching probability ma-trix, is introduced as well, to describe the state transitionsubsequent to the �ring of the GEN transition. Di(t; w)captures the case when the next regeneration moment iscaused by the disabling of the prd type GEN transition.Finally, Pi(t; w) describes the state transition probabilitiesinside the regeneration period.Since transition t2 is of prs type the matrix functionDi(t; w) does not play a role in the analysis of the sub-ordinated process starting from marking M2. The remain-ing functions can be evaluated based on the kernel of thesubordinated SMP (Qi(t) = fQik`(t)g) [23]:F i��k` (s; v) = �k` rk �1�Qi�k (s+ vrk)�s+ vrk +Xu2RiQi�ku(s+ vrk)F i��u` (s; v)P i��k` (s; v) = �k` s �1�Qi�k (s+ vrk)�v(s+ vrk) +Xu2RiQi�ku(s+ vrk)P i��u` (s; v)where Qik(t) = P`Qik`(t); s is the time variable and vis the barrier level variable in transform domain; rk is theindicator that the active GEN transition is enabled in statek; Ri is the part of the state space reachable during thesubordinated process; and the superscript � (�) refers toLaplace-Stieltjes (Laplace) transform.Given that Gg(t) is the distribution function of the �ringtime of the GEN transition, the elements of the i-th rowof matrices K(t) and E(t) can be expressed as follows, asa function of the matrices Pi(t; w), Fi(t; w) and Di(t; w):Kij(t) = Z 10 "Xk2Ri F iik(t; w)�ik;j +Diij(t; w)# dGg(w)Eij(t) = Z 10 P iij(t; w)dGg(w)To evaluate the second row of the kernel matrices we areapplying these results for the subordinated process start-ing from regeneration state M2. Doing so we obtain thefollowing expressions for the non-zero matrix entries:F��22 (s; v) = 1s+ v + �� �G�(s)

P��22 (s; v) = s=vs+ v + �� �G�(s)P��23 (s; v) = �(1�G�(s))=vs+ v + �� �G�(s)

20 40 60 80 100 120 140time0.992

0.994

0.996

0.998

1availability

Inst. av., LCFSInst. av., FCFS

20 40 60 80 100 120 140time

1.9

1.92

1.94

1.96

1.98

performability Inst. perf., LCFSInst. perf., FCFS

20 40 60 80 100 120 140time0.995

0.996

0.997

0.998

0.999

1availability

Inst. av., LCFSInt. av., LCFSInst. av., FCFSInt. av., FCFS

20 40 60 80 100 120 140time

1.9

1.92

1.94

1.96

1.98

performability Inst. perf., LCFSInt. perf., LCFSInst. perf., FCFSInt. perf., FCFS

a)

b)

c)

d)

Fig. 7. Availability and processing powerUnconditioning with respect to the �ring time distributionof t2, and after inverting the Laplace transform (LT) withrespect to v, the non-zero entries of the 2nd row of the LSTmatrix functions K�(s) and E�(s) become:K�21(s) = Z 1w=0 e�w(s+ ���G�(s)) dG(w)= G�(s + �� �G�(s))E�22(s) = s[1�G�(s + �� �G�(s))]s+ �� �G�(s)E�23(s) = �(1�G�(s)) [1�G�(s + �� �G�(s))]s+ �� �G�(s)

PERFORMANCE EVALUATION REVIEW, VOL. XX, NO. Y, MONTH 1998 10The LST of the state probabilities are obtained by solv-ing the Markov renewal equation in transform domain. Thetime domain probabilities are calculated by numerically in-verting the result by resorting to the Jagerman method[40].To evaluate the performance of the di�erent schedul-ing schemes, we compared the availability and processingpower of the FCFS and the LCFS repair schemes with twodi�erent repair time distributions. The FCFS scheme wasevaluated by the time domain method introduced in theprevious section and the LCFS scheme was evaluated bythe above transform domain method. It is assumed thatthe system is available when at least one machine is work-ing (markingM1 andM2) and that the system performancedoubles when both machines are working. The failure timesof both machines are exponentially distributed with rates� = �a = �b = 0:01. The repair times of both machinesare assumed to be:� deterministic � = 5, henceG(t) = G1(t) = G2(t) = 1(t� �)G�(s) = e��s;� hyperexponentially distributed with p = 0:625; �1 = 0:5;�2 = 0:1, henceG(t) = G1(t) = G2(t) = 1� pe��1t � (1� p)e��2tG�(s) = p�1�1 + s + (1� p)�2�2 + s :The mean repair time is 5 in both cases. Fig. 7a and7b show the same instantaneous and interval measures ofavailability and processing power with deterministic repairtime, respectively. The dotted line shows the instanta-neous and the short dashed line shows the interval avail-ability/power with LCFS repair, while the long dashed lineshows the instantaneous and the solid line shows the inter-val availability/power with FCFS repair. It can be ob-served that the FCFS scheduling performs better in thiscase. The availability and processing power results forthe hyperexponential repair time distribution are plottedin Fig. 7c and 7d, respectively. In these �gures the dottedline shows the instantaneous availability/power with LCFSrepair, while the dashed line shows the instantaneous avail-ability/performability with FCFS repair. As can be seenfrom these �gures, in contrast with the deterministic repairtime the LCFS scheduling performs better with the hyper-exponential repair time distribution. The reason of thisbehaviour is that at the failure of the later failed machinethe expected remaining repair time of the earlier failed ma-chine is less (greater) than the complete repaire time of thelater failed machine when the failure time is deterministic(hyperexponentially distributed).V. Modeling preemption in a multi-taskingenvironmentNMSPN require complex solution techniques mainlybased on the theory of Markov regenerative processes. As

seen in the previous sections, the �rst aspect is the gen-eration of the kernel matrices, E(t) and K(t). A manualapproach is usually adopted which implies a deep analysisof the systems in order to evaluate the regeneration pointsand all the elements of the kernel matrices. The size of theproblem is thus strongly limited. The next aspect is thecomplexity of the solution of the Markov renewal equa-tion which either requires the computation in the trans-form domain and the necessary inverse transform or thedevelopment and solution of coupled system of partial dif-ferential equations. Hand-written Mathematica programscan be used in this phase, which are usually tailored to thespeci�c model to be solved. Thus, the MRGP approach,although very elegant and formally perfect, can be hardlyadopted to solve real problems. Nevertheless, the concep-tual approach has been used as the basis for the implemen-tation of automatic solution tool which can be adopted toe�ectively approach the solution of non-Markovian models,hiding solution and implementation details. A big boost inthis direction came from tool DSPNexpress [18]. Recently,a new software package for non-Markovian Petri nets hasbeen developed in a joint e�ort between the Universitiesof Catania and Budapest. This tool, named WebSPN [41],provides a discrete time approximation of the stochasticbehaviour of the marking process which results in the pos-sibility to analyze a wider class of PN models with prd, prsand pri concurrently enabled generally distributed transi-tions. The approximation of the continuous time model atequispaced discrete time points involves the analysis of thesystem behavior over a time interval based on the systemstate at the beginning of the interval and the past historyof the system. The main steps of the implemented solutionmethod are the following:� generation of the reachability graph (with tangible andvanishing markings), and reduction of the reachabilitygraph to tangible markings, only;� generation and analysis of the expanded DTMC;� evaluation of the �nal measures at the net level, basedon the solution of the expanded DTMC.The expansion process represents the critical part of thesolution process. State space explosion could occur if thediscretization step is not properly chosen. We are currentlyworking on an automatic evaluation of the discretizationstep and on the possibility to reduce the size of the under-lying process. A Web-centered view has been adopted in itsdevelopment in order to make it easily accessible from anynode connected with the Internet as long as it possesses aJava-enabled Web browser. Sophisticated security mecha-nisms have also been implemented to regulate the access tothe tool which are based on the use of public and privateelectronic keys. WebSPN is available at the following site:http://sun195.iit.unict.it/�webspn/webspn2/WebSPN will be used for the solution of the Petri netmodel described in the next section which contains severalconcurrently enabled GEN transitions and di�erent mem-ory policies.

PERFORMANCE EVALUATION REVIEW, VOL. XX, NO. Y, MONTH 1998 11A. Model descriptionThis model does not represent any system in particu-lar, and is mainly used for showing the potentialities ofthe tool WebSPN [41]. However, as we pointed out below,this model can be used as a basis for analyzing di�erenttypes of systems such as transactional databases, manufac-turing systems and client/server communication systems.The system moves between an operative phase, where use-ful work is produced, and a phase of maintenance wherethe processing is temporarily interrupted.

Fig. 8. Petri net model of the systemThe Petri net shown in Fig. 8 represents the model ofthe system that consists of three functional blocks gener-ically referred to as Block1, Block2 and Block3. Block1models the alternation of the system between the opera-tive phase and the maintenance phase. Block2 models thetwo sequential phases of processing of jobs. Finally, Block3models the alternation of the system during the operativephase between the phase of pre-processing and the one ofprocessing of jobs.Within Block1, the two states of operation where thesystem can be are represented by places user and systemand by transitions U time and S time. A token in placeuser denotes the operative state, while a token in placesystem denotes the maintenance one. The duration of theoperative phase is denoted by transition U tim e, whilethe maintenance one is denoted by transition S time. Theinhibitor arcs outgoing from place system and leading tothe timed and immediate transitions contained in Block2and Block3 producer, cons1, busy prod, idle prod, busy2,idle2 are used for interrupting the activity of the systemduring the phase of maintenance.Block2 models the processing of jobs. In particular, thenumber of jobs to be processed is denoted by the numberof tokens contained in place work, while the time of pre-processing of each job is represented by transition producer.Pre-processed jobs are queued in a bu�er (place bu�1) wait-ing for the second phase of processing (transition cons1).In Block3, the alternation between the phases of pre-processing and processing of jobs is represented through

places slot1 and slot2 and transitions busy brod, busy2,idle prod, idle2. A token in place slot1 denotes that thesystem is executing the pre-processing of a job, while atoken in place slot2 denotes the execution of a phase ofprocessing. An inhibitor arc between slot1 and cons1 deac-tivates the phase of processing when the pre-processing oneis active. In the same way, the inhibitor arc between slot2and producer deactivates the phase of pre-processing whenthe processing one is active. The time that the system al-ternately spends for these two activities is represented bytransitions busy prod and busy2. The immediate transitionidle prod (idle2) prevents the system to remain in phase 1(2), even if no job is to be processed. The function of theinhibitor arcs from place work to transition idle prod andfrom place bu� to transition idle2 is to enable such transi-tions when no job is to be processed in the correspondingphase of processing.Immediate transition end and place Stop are used formodeling the processing of all the jobs assigned to the sys-tem at the beginning. In fact, transition end is inhibiteduntil at least one token is present in places work and bu�.When all the jobs have been processed, transition end �res,and immediately moves a token to place Stop. All the ac-tivities of the system are thus interrupted through the in-hibitor arcs outgoing from place Stop.The measure that we evaluate from this model is thedistribution of the time required for completing the set ofjobs assigned to the system at the beginning. It can beobtained as the distribution of having a token in place Stop.With regard to the distributions of the �ring times tobe assigned to timed transitions, we assume that the �ringtimes of transitions U time, S time, busy brod, busy2 aredeterministic. We assume that the �ring times of transi-tions producer and cons1 are respectively distributed uni-formly and exponentially. The measures considered cantherefore be evaluated by changing the memory policy as-sociated with transitions producer and cons1.In the case of prd policy, the temporary interruption ofthe processing of a job (either because the whole systementers the phase of maintenance, or because, even if thesystem is in the production phase, it interrupts the pre-processing phase for changing to the processing one or viceversa) causes the interrupted job to be discarded. A newjob is executed when the system is available again. Thecorrespondence with a real system is perhaps hard to �nd;however, we note that prd policy is the most commonlyused one in the literature.Conversely, by adopting prs policy, we keep a memoryof the work that we were executing. In this case, whentransition producer is disabled, we keep a memory of thework that has already been executed on the job consid-ered. When the system enters the operative state again,the pre-processing of the job continues from the point wehad reached. In this case, the model can represent a systemof manufacturing, where a machine used for production al-ternates cycles of production and cycles of maintenance,and production takes place in two sequential phases. Wenote that prd and prs policies are equivalent for transition

PERFORMANCE EVALUATION REVIEW, VOL. XX, NO. Y, MONTH 1998 12cons1, since this one is and EXP transition.With pri policy, when transition producer is disabled,the work that had already been produced is lost, but wekeep a memory of the job that we were processing. Whenthe transition is enabled again we start from zero, but theamount of work to be produced on the job remains thesame, because the job has not been changed. Such a be-havior can be easily noted when accessing transactionaldatabases, where each transaction is atomic (i.e., has to beprocessed with no interruption). If an interruption occurs,the transaction is entirely processed again. If we assumea memory policy like prs for transition cons1, the modelcould represent a client/server system where the accessesto database (transition producer) take place atomically, andthe phase of processing of the query (transition cons1) re-quires a variable time, distributed exponentially.B. Numerical ResultsFor the solution of the model we assume that the �ringtime of transition producer is distributed uniformly between0.5 and 1.5; the �ring time of transitions U time and S timeare deterministic, with a �ring time of 1; the �ring t imeof transitions busy prod and busy2 are deterministic, witha �ring time of 0.1; the �ring time of transition cons1 isdistributed exponentially, with a �ring rate of 0.1; transi-tion end is immediate and has a priority of 2; transitionsidle prod and idle2 are immediate and have a priority of 1;the total number of jobs to be processed is 3.

0.0 50.0 100.0 150.0 200.0 250.0 300.0 350.0 400.0 450.0 500.0time

0.0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1.0

1.1

Com

plet

ion

Tim

e

prdprspri

Fig. 9. Distribution of completion timeIn Fig. 9 we show the distribution of completion time fordi�erent memory policies assigned to transitions producerand cons1. The behavior of the system changes signi�-cantly depending upon the memory policy adopted. Theprs policy accrues the highest probability of completionwithin a given time. Both the prd and the prs policies ac-complish the completion of jobs. In fact, curves eventuallyreach the value 1. Conversely, a di�erent behavior can beobserved if we assume a policy like pri. In fact, in thatcase, the resulting distribution is defective, since the unitvalue is never reached for t!1. This is closely connectedwith the choice of the parameters associated with transi-tions producer and U time. As we note in Fig. 10, when the

1.50.5 1.0 2.0

U_time1 U_time2

producer1.0

Fig. 10. Firing Time Distributions of transitions producer and U time

0.0 50.0 100.0 150.0 200.0 250.0 300.0 350.0 400.0 450.0 500.0time

0.0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1.0

1.1

Com

plet

ion

Tim

e

U_time = 1U_time = 2

Fig. 11. Distribution of completion time�ring time of transition U time is lower than 1.5, transitionproducer has a positive probability (50%)of not completingits work. Since in the case of pri policy the job is processedwith the same work requirement, this causes a situation ofimpasse, which prevents the work assigned to the systemto be completed.Fig. 11 shows how the overall system behavior changesif transition U time is assigned a �ring time higher than1.5 (for example 2.0). In such case, transition producerhas a �nite probability of �ring before the system entersthe phase of maintenance, and therefore the distribution ofcompletion time with pri policy reaches the value 1.VI. ConclusionWe discussed the need for more advanced techniques tocapture generally distributed events which occur in every-day life. Among the di�erent approaches proposed in theliterature, non-Markovian Petri nets represent a valid an-alytical alternative to numerical simulation. An approachbased on the analysis of the underlying Markov Regener-ative Process has been presented. Advanced preemptionpolicies were introduced and several examples solved in de-tail. References[1] M. Ajmone Marsan, G. Conte, and G. Balbo, \A class of gen-eralized stochastic Petri net for the performance evaluation ofmultiprocessor systems," ACM Transaction on Computer Sys-tems, vol. 2, no. 2, pp. 93{122, May 1984.[2] G. Ciardo, A. Blakemore, P.F. Chimento, J.K. Muppala, andK.S. Trivedi, \Automatic generation and analysis of markov re-ward models using stochastic reward nets," in Linear Algebra,Markov Chains, and Queueing Models, IMA Volumes in Mathe-matics and its Applications, C. Meyer and R.J. Plemmons, Eds.,Heidelberg, Germany, 1992, vol. 48, Springer-Verlag.

PERFORMANCE EVALUATION REVIEW, VOL. XX, NO. Y, MONTH 1998 13[3] Kishor S. Trivedi, Probability & Statistics with Reliability,Queueing, and Computer Science Applications, Prentice-Hall,NJ, USA, 1982.[4] D.R. Cox, \The analysis of non-Markovian stochastic processesby the inclusion of supplementary variables," Proceedings of theCambridge Philosophical Society, vol. 51, no. 3, pp. 433{441,1955.[5] R.F. Botta, C.M. Harris, and W.G. Marchal, \Characterizationsof generalized hyperexponential distribution functions," Com-munications in Statistics - Stochastic Models, vol. 3, no. 1, pp.115{148, 1987.[6] M.F. Neuts, \Renewal process of phase type," Naval ResearchLogistics Quartely, vol. 25, no. 3, pp. 445{454, 1978.[7] E. C� inlar, Introduction to Stochastic Processes, Prentice-Hall,Englewood Cli�s, NJ, USA, 1975.[8] V.G. Kulkarni, Modeling and Analysis of Stochastic Systems,Chapman & Hall, London, UK, 1995.[9] J. B. Dugan, K. S. Trivedi, R. M. Geist, and V.F. Nicola, \Ex-tended stochastic Petri nets: Applications and analysis," Per-formance, pp. 507{519, 1984.[10] M. Ajmone Marsan and G. Chiola, \On Petri nets with de-terministic and exponentially distributed �ring times," LectureNotes on Computer Science, vol. 266, pp. 132{145, 1987.[11] Aldo Cumani, \ESP - a package for the evaluation of stochas-tic Petri nets with phase-type distributed transition times," inProceedings of International Workshop on Timed Petri Nets,Torino, Italy, July 1{3, 1985, pp. 144{151.[12] H. Choi, V.G. Kulkarni, and K.S. Trivedi, \Markov regenerativestochastic Petri nets," Performance Evaluation, vol. 20, pp.337{357, 1994.[13] M. Telek, A. Bobbio, and A. Pulia�to, \Steady state solution ofMRSPN with mixed preemption policies," in 2nd Int. Perfor-mance and Dependability Symposium, Urbana-Champaign, IL,1996, pp. 106{115, IEEE CS Press.[14] R. Marie and K. S. Trivedi, \A note on the e�ect of preemp-tive policies on the stability of a priority queue," InformationProcessing Letters, vol. 24, pp. 397{401, 1987.[15] M. Ajmone Marsan, G. Balbo, A. Bobbio, G. Chiola, G. Conte,and A. Cumani, \The e�ect of execution policies on the seman-tics and analysis of stochastic Petri nets," IEEE Transactionson Software Engineering, vol. SE-15, pp. 832{846, 1989.[16] A. Bobbio, V.G. Kulkarni, A. Pulia�to, M. Telek, and K. Trivedi,\Preemptive repeat identical transitions in Markov regenerativestochastic petri nets," in Proceedings of the 6th InternationalWorkshop on Petri Nets and Performance Models - PNPM'95,Durham, NC, USA, October 3-6 1995, pp. 113{122.[17] J.A. Couvillon, R. Freire, R. Johnson, W.D. Obal, M.A. Qureshi,M. Rai, W. Sanders, and J.E. Tvedt, \Performability modelingwith UltrasSAN," IEEE Software, vol. 8, pp. 69{80, September1991.[18] C. Lindemann, \DSPNexpress: a software package for the e�-cient solution of deterministic and stochastic Petri nets," Per-formance Evaluation, vol. 22, pp. 3{21, 1995.[19] D.R. Cox, Renewal Theory, Methuen & Co. Ltd, London, Eng-land, 1967.[20] William Feller, An Introduction to Probability Theory and ItsApplications, 2nd ed., John Wiley & Sons, New York, NY, USA,1966.[21] R. German and C. Lindemann, \Analysis of stochastic Petrinets by the method of supplementary variables," PerformanceEvaluation, vol. 20, no. 1{3, pp. 317{335, May 1994.[22] S. Garg, A. Pulia�to, M. Telek, and K. Trivedi, \Analysis ofpreventive maintenance in transactions based software systems,"IEEE Transactions on Computers, vol. 47, pp. 96{107, January1998.[23] A. Bobbio and M. Telek, \Markov regenerative SPN with non-overlapping activity cycles," in Proceedings of the 1st AnnualIEEE International Computer Performance & DependabilitySymposium - IPDS'95, Erlangen, Germany, April 24-26 1995,pp. 124{133.[24] M. Telek, Some Advanced Reliability Modeling Techniques,C.Sc/Ph.D. thesis, Hungarian Academy of Science, Budapest,Hungary, 1994.[25] Harold Davis Thayer, The Theory of The Volterra IntegralEquation of the Second Kind, Bloomington, Indiana, USA, 1930.[26] Reinhard German, \Transient analysis of deterministic andstochastic Petri nets by the method of supplementary variables,"in Proceedings of the 3rd International Workshop on Modeling,

Analysis, and Simulation of Computer and TelecommunicationsSystems Conference - MASCOTS'95, Durham, NC, USA, Jan-uary 18{20, 1995, pp. 394{398.[27] R. German, D. Logothetis, and K.S. Trivedi, \Transient analysysof Markov regenerative stochastic Petri nets: A comparison ofapproaches," in Proceedings of the 6th International Workshopon Petri Nets and Performance Models, Durham, NC, USA,October 3-6 1995, pp. 103{111.[28] M. Telek, A. Bobbio, L. Jereb, A. Pulia�to, and K.S. Trivedi,\Steady state analysis of Markov regenerative SPN with agememory policy," in Lecture Notes in Computer Science, H. Beil-ner and F. Bause, Eds., 1995, vol. 977, pp. 165{179.[29] H. Brunner and P.J. van der Houwen, The Numerical Solutionof Volterra Equations, North-Holland, New York, NY, USA,1986.[30] Peter Linz, Analytical and Numerical Methods for VolterraEquations, vol. 7, SIAM Studies in Applied Mathematics,Philadelphia, PA, USA, 1985.[31] R. Fricks, M. Telek, A. Pulia�to, and K. Trivedi, \Markov re-newal theory applied to performability evaluation," in State-of-the Art in Performance Modeling and Simulation. Modelingand Simulation of Advanced Computer Systems: Applicationsand Systems, Kallol Bagchi and George Zobrist, Eds., Newark,NJ, EUA, 1997, pp. 193{236, Gordon and Breach Publishers.[32] D. Logothetis and K. Trivedi, \Dependability evaluation of thedouble counter-rotating ring with concentrator attachments,"ACM/IEEE Transactions on Networks, vol. 2, no. 5, pp. 520{532, October 1994.[33] D. Logothetis and K. Trivedi, \Time{dependent behavior ofredundant systems with deterministic repair," in Computationswith Markov Chains, W. J. Stewart, Ed., Norwell, MA, USA,1995, pp. 135{150, Kluwer Academic Publishers.[34] D. Logothetis and K. Trivedi, \The e�ect of detection andrestoration times for error recovery in communication networks,"Journal of Network and Systems Management, vol. 5, no. 2, pp.173{195, June 1997.[35] V. Mainkar and K. Trivedi, \Approximate analysis of priorityscheduling systems using stochastic reward nets," in Proceedingsof the 13th International Conference on Distributed ComputingSystems - ICDCS'93, Pittsburgh, PA, USA, May 1993, pp. 466{473.[36] M. Telek and A. Pfening, \Performance analysis of Markov re-generative reward models," Performance Evaluation, vol. 27 &28, pp. 1{18, 1996.[37] G. Ciardo, J. Muppala, and K. Trivedi, \Spnp: Stochastic petrinet package," in Proc. Int. Workshop on Petri Nets and Perfor-mance Models, Los Alamitos, CA, USA, December 1989, IEEEComputer Society Press, pp. 142{150.[38] H. Choi, V.G. Kulkarni, and K. Trivedi, \Transient analysis ofdeterministic and stochastic Petri nets," in Proceedings of the14-th International Conference on Application and Theory ofPetri Nets, Chicago, June 1993.[39] G. Ciardo and C. Lindemann, \Analysis of deterministic andstochastic Petri nets," in Proceedings International Workshopon Petri Nets and Performance Models - PNPM93. IEEE Com-puter Society, 1993, pp. 160{169.[40] D.L. Jagerman, \An inversion technique for the Laplace trans-form," The Bell System Technical Journal, vol. 61, pp. 1995{2002, October 1982.[41] A. Bobbio, A. Pulia�to, M. Scarpa, and M. Telek, \Webspn: Aweb-accessible petri net tool," in Proceedings of the Int. Conf.on WEB based Modeling and Simulation, San Diego, CA, USA,January 11-14 1998.[42] C. Fr�oberg, Introduction to Numerical Analysis, 2nd. ed.,Addison-Wesley Publishing Company, Reading, MA, USA, 1969.