Discrete-event simulation of fluid stochastic Petri nets

Discrete-event simulation of uid stochastic Petri nets�Gianfranco Ciardo1 David Nicol2 Kishor S. [email protected] [email protected] [email protected] Dept. of Computer Science, College of William and Mary, Williamsburg, VA 231872 Dept. of Computer Science, Dartmouth College, Hanover, NH 037553 CACC, Dept. of Electrical and Computer Eng., Duke University, Durham, NC 27708AbstractThe purpose of this paper is to describe a method forthe simulation of the recently introduced uid stochas-tic Petri nets. Since such nets result in rather complexsystem of partial di�erential equations, numerical so-lution becomes a formidable task. Because of a mixed(discrete and continuous) state space, simulative solu-tion also poses some interesting challenges, which areaddressed in the paper.Keywords: Discrete-event simulation, continuoussystem simulation, stochastic Petri nets.1 IntroductionDiscrete-event dynamic systems are commonplace,and discrete-state models are normally used to studytheir behavior. Ordinary and stochastic Petri nets, forexample, provide a convenient and concise method ofdescribing these systems [4, 8, 11, 22, 25]. However,the underlying state space of these models tends tobe extremely large in practical modeling applications,often forcing us to seek approximate solution meth-ods. An example is the uid ow approximations inperformance analysis of queueing systems [5, 15, 21],where a large number of discrete entities is modeledas a single continuous variable.On the other hand, hybrid systems, that is, systemshaving both discrete and continuous components thatevolve over time, have received increasing attention inthe last few years, due to the ubiquitous trend of em-ploying digital controllers in traditionally analog envi-ronments such as power generators, chemical plants,�This research was partially supported by the National Aero-nautics and Space Administration under NASA Contract No.NAS1-19480. Additionally, D. Nicol was supported in part bythe National Science Foundation under grants CCR-9201195and NCR-9527163, and K. Trivedi was supported in part by theNational Science Foundation under grant NSF-EEC-94-18765.

or water distribution systems.Thus, it is natural to extend Petri nets so that theycan have a hybrid state-space that enables the studyof both otherwise discrete systems through uid ap-proximations, and of truly hybrid systems. In addi-tion, the behavior of such models can be deterministicor stochastic. Various formalisms falling in this cat-egory have appeared. Timed continuous Petri nets,whose places are marked in a continuous way, and,more recently, hybrid Petri nets, which also containordinary places containing an integral number of to-kens, have been introduced by David [14, 13]. Fluidstochastic Petri nets (FSPNs) have been introduced byTrivedi and Kulkarni [24], and considerably enhancedin [18]; these included immediate and exponentiallydistributed �ring times for the transitions, as in theGeneralized Stochastic Petri Nets GSPNs [3].In FSPNs, as in hybrid Petri nets, the places of thePetri net are partitioned into two classes, one contain-ing a nonnegative (integer) number of tokens, just asin ordinary Petri nets, the other containing a nonneg-ative (real) level of uid. However, initial de�nitionsof FSPNs posed severe restrictions on the semanticbehavior of these nets, to make the models analyt-ically tractable. The numerical solution algorithmsproposed in [24, 18] are applicable only when the in-teractions between the discrete and continuous portionof the net satisfy fairly strong assumptions.We observe that, even before performing a numer-ical study of the performance or reliability of a sys-tem, answers to various \logical" questions are oftenrequired, such as \is the system bounded?", or \doesit have a home state?". Unfortunately, the decidabil-ity of one of the most natural and important analysisquestions, \can a particular state be reached start-ing from a given initial state?" depends on the typeof model. For example, reachability is decidable forordinary Petri nets [6], but not for Turing-equivalentformalisms, such as Petri nets with transition priori-

ties or inhibitor arcs [1, 17]. For hybrid models, hencefor our FSPNs, it has been shown that reachability isdecidable only in the one- and two-dimensional case[7], even under the assumptions that the number ofpossible discrete states is �nite and that the equationsdescribing the evolution of the continuous componentshave piecewise-constant derivatives.In this paper, thus, we take a radically di�er-ent approach. By not seeking a numerical solutionof the models, but, rather, accepting to employ adistribution-driven simulation, we are free from manyof the previous restrictions. We can then de�ne avery general FSPN formalism, and proceed to investi-gate e�cient simulation algorithms, according to thecharacteristics of the model under study. Admittedly,this prevents us from performing any general type ofreachability study but such shortcoming is shared byall simulation-based approaches. On the other hand,avoiding the generation of the (discrete projection of)the state space altogether is also an advantage, be-cause this is a very memory-intensive step.The extensions to the FSPN formalism we proposeinclude:� uid impulses associated with both immediateand timed transition �rings,� guards for both immediate and timed transitions,dependent on both uid levels and on the discretemarking.These extensions are quite natural and useful, giventhe type of systems we intend to address. Fluid im-pulses are the continuous analogue of ordinary tokenmovements for ordinary Petri nets, while complete de-pendency of any behavior (including the guards of im-mediate transitions) on the entire state of the system(including the current uid levels) is certainly a desir-able orthogonality goal. Indeed, one could argue thatthese are not really \extensions", but rather that theinitial de�nitions of FSPNs were \restrictions" moti-vated by the desire of allowing a numerical solution.Using simulation as a solution method frees us fromthese restrictions. It should be noted that our ex-tended FSPN formalism is not any more di�cult tosimulate than the restricted type initially proposed in[18, 24]. However, we do not mean to suggest thatits simulation is straightforward. In fact, several in-novations are needed, because the simulation of theresulting hybrid models is greatly complicated by thecomplex dependencies that the behavior of the net canhave on the discrete, and even more on the continuous,evolution of the state.

In this regard, the contributions of this paper in-clude:� Generation of random deviates based on a non-homogeneous Poisson process, using the \thin-ning" technique [20].� Interleaving of ODE solution for uid places withsimulation of discrete events in the FSPN.� De�nition of restrictions under which one canmore e�ciently integrate the change of uid levelsusing built-in closed-form results, such as decou-pled behavior and special classes of functions forthe uid rates.It should also be noted that simulation of hy-brid models su�ers from the same problems a�ectingdiscrete-event simulation. If we are interested in a rareevent, long run times will be required to obtain usefulcon�dence intervals, regardless of whether the event isde�ned as a condition on the discrete marking or onthe continuous uid levels. If we are interested in long-term behavior, deciding when the transient e�ect ofthe particular initial state chosen becomes statisticallynegligible is a di�cult problem. Hybrid models furthercomplicate these issues. A logical condition a�ectingthe behavior of the model might be formally de�nedas \places a and b have the same uid level", but, ina practical implementation using oating point repre-sentation, such a test is seldom appropriate; a betterapproach is to de�ne some relative range within whichwe can consider two levels to be equal. A related issueis that of regenerative simulation for hybrid models.While a discrete model can have speci�c regenerationpoints (discrete markings), requiring the same of ahybrid model might be excessive, since the continuouslevels of various places might never return to exactlythe same point at the same time; of course, the oat-ing point roundo� errors only make things worse. Inthis paper, we only discuss how to perform a transientsimulation, that is, up to a given �nite time � ; as inthe simulation of discrete-state models, one can hopeto approximate stationary behavior by using a large �(in comparison to the timing of the net's transitions),but we do not claim that this is indeed the case ingeneral.Before concluding this introduction, we stress thatmethods proposing a mixed discrete-continuous ap-proach to simulation are widely used in industrialapplications. Indeed, many of the major simulationtools (including SIMAN, ProModel, and Arena) sup-port the development of general mixed models. Thereis also a literature on optimizations for managing the

execution of such models (e.g., [19]). Work in thisarea either attempts to optimize general, models, atthe price of ignoring optimizations that are formalismspeci�c, or develop optimizations for a certain formal-ism. Our work is of the latter type, by wedding of theSPN paradigm|which is essentially stochastic and es-sentially discrete|with continuous components. Ourcontribution lies in exploring the interaction of thisspecialized SPN paradigm with continuous simulation.Not only is this combination of characteristics unusualin the more general mixed simulation context, it isparticularly important to develop these notions in thecontext of the SPN/GSPN community. Ours is a steptowards identifying a modeling framework in whichanalytic, simulated, discrete, and continuous solutionsof submodels might be seamlessly joined.After introducing the FSPN model in the next sec-tion, we describe the method of simulation for themost general case in Section 3. Section 4 considersvarious subclasses of FSPNs that can be studied usingfaster simulation algorithms. Examples are providedin Section 5. Section 6 concludes the presentation.2 Fluid stochastic Petri netsIn the following, we denote sets by upper case calli-graphic letters. In particular, N , R, and R0 indicatethe natural, real, and nonnegative numbers, respec-tively.For simplicity, we only address exponentially dis-tributed �ring times, but we discuss the profound im-plications of allowing the distributional parameters(the �ring rates) to depend on the uid levels. Gener-ally distributed �ring times are clearly useful, and, inconnection with discrete-event simulation, do not addmuch complexity to the solution if their distributionalparameters are independent of the uid levels. Indeed,our prototype SPNP implementation [12] includes sev-eral other distributions: constant, uniform, geometric,Weibull, truncated normal, and lognormal. However,the de�nition of the interruption policies (what hap-pens to the remaining �ring times of transitions whenone of them �res) requires complex descriptions in fullgenerality [10, 23]; this is not the case with the expo-nential distribution, due to its memoryless property.A uid stochastic Petri net (FSPN) is a tuple�PD;PC ; T T ; T I ; a; f; g; �; w; b;m0;x0�, where:� PD = fp1; : : : ; pjPDjg and PC = fq1; : : : ; qjPC jgare two disjoint and �nite sets of places. LetP = PD [ PC . A (discrete) place p 2 PD isdrawn with a single circle and can contain a num-ber of tokens mp 2 N . A (continuous) place

q 2 PC is drawn with two concentric circles andcan contain a level of uid xq 2 R0. The mark-ing, or state, of the FSPN is given by a pairof vectors describing the contents of each place,(m;x) 2 S = N jPD j � R0jPC j. We call S the\potential state space", as opposed to the \actualstate space" S � S , the set of markings actuallyreachable during the evolution of the FSPN. Themarking (m;x) evolves in time, which we indi-cate by � , so, formally, we can think of it as astochastic process f(m(�);x(�)) ; � � 0g.� T T = ft1; : : : ; tjT T jg and T I = fu1; : : : ; ujT I jgare two disjoint and �nite sets of transitions. LetT = T T [ T I . A (timed) transition t 2 T T isdrawn as a rectangle and has an exponentiallydistributed �ring time. An (immediate) transi-tion u 2 T I is drawn as a thin bar and has aconstant zero �ring time.� a : �(PD � T ) [ (T � PD)� � S ! N anda : �(PC � T ) [ (T � PC)� � S ! R0 de-scribe the marking-dependent cardinality (for dis-crete places) or the uid impulse (for continuousplaces) of the input and output arcs connectingtransitions and places. We use the same symbolfor both, and we draw them as thin arcs withan arrowhead on their destination, since the typeof place eliminates any possibility of confusion.Graphically, the arcs is drawn only if the func-tion is not identically equal zero; the function de-scribing a is written on the arc, with a missinginscription indicating the constant value 1.� f : �(PC � T T ) [ (T T � PC)� � S ! R0 de-scribes the marking-dependent uid rate of the in-put and output arcs connecting timed transitionsand continuous places. These uid arcs are drawnwith a thick line, and an arrowhead on their des-tination. Also in this case the arc is omitted iffunction is identically equal zero and the functionis written on the arc, with a default value 1.� g : T � S ! f0; 1g describes the marking-dependent guard of each transition.� � : T T � S ! R0 and w : T I � S ! R0describe the marking-dependent �ring rates (fortimed transitions) and weights (for immediatetransitions).� b : PC � N jPDj ! R0 [ f1g describe the uidbounds on each continuous place. This boundhas no e�ect when it is set to in�nity. Note that

b depends only on the discrete part of the statespace, N jPDj, not on S, to avoid the possibilityof circular de�nitions.� (m0;x0) 2 S is the initial marking. We re-quire that, for any continuous place q 2 PC ,xq � bq(m0). Graphically, the initial markingis represented by writing the value of m0p, or x0q ,inside the corresponding place. A missing valueindicates zero. For discrete places, it is also com-mon to draw m0p tokens inside the place, if thisnumber is small.The meaning of these quantities is given by the en-abling and �ring rules. We say that a transition t 2 Thas concession in marking (m;x) i�8p 2 PD; ap;t(m;x) �mp and gt(m;x) = 1:If any immediate transition has concession in (m;x),it is said to be enabled and the marking is said tobe vanishing. Otherwise, the marking is said to betangible and any timed transition with concession isenabled in it. In other words, a timed transition is notenabled in a vanishing marking even if it has conces-sion.Some de�nitions of SPNs allow one to disable atransition t with concession in a marking by speci-fying a zero rate or weight for it, or by introducinginhibitor arcs, drawn with a circle instead of an ar-rowhead. Since we can represent these behaviors byan appropriate de�nition of the input arc cardinalitiesor the guards, we assume, without loss of generality,that rates and weights are positive for an enabled tran-sition. Inhibitor arcs can then be considered merelyas a shorthand1.Let E(m;x) denote the set of enabled transitions inmarking (m;x). Enabled transitions may change themarking in two ways. First, a transition t 2 T enabledin marking (m;x) yields a (possibly) new marking(m0;x0), when it �res. We then write (m;x) t+(m0;x0),where8p 2 PD; m0p =mp + at;p(m;x)� ap;t(m;x)8q 2 PC ; x0q = minfbq(m0);maxf0;xq+ at;q(m;x)� aq;t(m;x)gg(the min and max operator are used to ensure that thenew uid level x0q is between zero and the bound for1If, in (m;x), an inhibitor arc from p 2 PD (q 2 PC) tot 2 T has cardinality c 2 N (c 2 R0), t is disabled if c � mp(c � xq). The same behavior can be modeled by ensuring thatthe guard gt evaluates to 0 in (m;x).

place q evaluated in the new discrete marking). Sec-ond, if marking (m;x) is tangible, uid ows continu-ously through the arcs f of enabled timed transitionsconnected to continuous places. The potential rate ofchange of uid level for the continuous place q 2 PCin tangible marking (m;x) is�potq (m;x) = Xt2E(m;x)ft;q(m;x)� fq;t(m;x):However, the uid level can never become negative orexceed the bound bq(m), so the (actual) rate of changeover time, � , while in marking (m;x), is�q(m;x) = dxqd� =8<: 0 if (xq = 0 and �potq (m;x) � 0) or(xq = bq(m) and �potq (m;x) � 0)�potq (m;x) otherwise :(1)The stochastic evolution of the FSPN in a tangiblemarking is governed by a race [2]: the timed transi-tion t with the shortest �ring time is the one chosento �re next, unless some uid levels reach particularvalues and cause t to become disabled prior to its �r-ing. In a vanishing marking, instead, the weights areused to decide which transition should �re: an imme-diate transition u enabled in marking (m;x) �res withprobability wu(m;x)Xu02E(m;x)wu0 (m;x) : (2)3 General caseThe FSPN de�nition we just gave is very powerful, butit allows one to describe models whose solution can bequite di�cult, even with discrete-event simulation.3.1 Unstable behaviorIt is unfortunately possible to de�ne FSPNs that havean \unstable" behavior, that is, the simulation wouldhave to process an in�nite number of discrete eventsin a �nite amount of time. It should be noted thatthese unstable behaviors were already possible in theoriginal de�nitions of FSPNs, and that they presentedthe same di�culties and had to be treated as errors inthe same way.

(xq = 0)q

u1 u2

(xq > 0)q

t1 t2

(xq = 0) (xq > 0)

F1 F2q

t1 t2

Figure 1: FSPNs exhibiting unstable behaviors.3.1.1 In�nite number of discrete eventsConsider the FSPNs in Fig. 1 on the left. Immediatetransitions u1 and u2 alternatively put and remove aunit impulse instantaneously. Thus, without advanc-ing time, an in�nite number of events can occur.This is analogous to the so-called \vanishing-loop"in GSPNs [9] and, in particular, to the \absorbing"type, which, once encountered, will keep reoccurringwith probability one. With few exceptions [16], such abehavior has been considered a modeling error in theliterature on discrete-state models, hence we do thesame for FSPNs.Another well-known type of instability involves ac-tual time advances between change of markings, butincreasingly faster, so that an in�nite number of eventscan occurs in a �nite (although nonzero) time. Onecan just think of the classical example of nonregularcontinuous-time Markov chain, where the rate of go-ing from state i to state i + 1 is 2i. This is alwaysconsidered an error.3.1.2 In�nite number of in�nitesimal eventsThe instability of the model in the middle of Fig. 1 isinstead exclusive to models with a state having a con-tinuous component, such as our FSPNs. When x0q = 0,timed transition t1 is enabled and timed transition t2is disabled. However, as soon as the uid arc startsadding uid to q, the situation is reversed, t1 becomesdisabled, while t2 becomes enabled and starts empty-ing q. It could be argued that, in such a situation, qwill always be empty, but any model where an in�nitenumber of events occurs in a �nite time (e.g., transi-tions t1 and t2 become enabled and disabled an in�nitenumber of times) cannot be managed by conventionaldiscrete-event simulation techniques. Hence, we willconsider such behavior illegal.The model on the right, with constant uid rates F1and F2, could also be considered unstable if F2 > F1.Both t1 and t2 are always enabled, hence there is acontinuous ow into q at rate F1 due to t1. However,the outgoing ow due to t2 cannot be F2. Our def-

inition simply states that �q is identically equal 0 inthis case, implying that the outgoing ow is e�ectivelyreduced to be F1, instead of F2. In other words, thearc from q to t2 can be thought to have e�ect only afraction F1=F2 of the time. Since this type of behav-ior can be easily managed by examining all the owsincident to a continuous place, we do not regard it asan error.We stress that detection of instability might be ac-complished \on-the- y" while running the simulation,provided we keep a stack of markings visited withoutadvancing the simulation clock. However, this is pos-sible only when the instability causes the FSPN toreturn to the same marking with probability one. If,on the other hand, the markings visited in zero timeare nonrepeating, the stack will simply grow withoutlimit until the simulation program runs out of mem-ory. Again, this is not a new problem: one can simplythink of a GSPN with an immediate transition t that,once enabled, keeps adding a token at a time to a placep that does not a�ect the enabling of t.Unfortunately, these situations cannot be detectedin general even for GSPNs, since this formalism isTuring-equivalent, so we have no hope to devise andalgorithm to detect them in general for FSPNs either.Hence, in practice, we can implement checks to dis-cover only the simple cases of instability, but we mustassume that no other instability exist in the model.3.2 Stable behaviorWe now describe how a model with no unstable behav-iors can be studied. Assume that we have just enteredtangible marking (m;x). If there is any enabled tran-sition, each continuous component xq might vary in avery general way over time. In a marking (m;x(0)),we can apply Eq. 1 to each q 2 PC and obtain thesystem of ordinary di�erential equations8q 2 PC ; dxq(�)d� = Xt2E(m;x(0))ft;q(m;x(�))�fq;t(m;x(�))with given initial condition x(0); (3)

Λ*(m)

λ*t1

(m)

λ*t2

(m)

λ*t3

(m)

λ*t4

(m)

τ1

τ2

Time

0 τ3

= τ f

a

λt4(m,x(τ

1))

λt3(m,x(τ

1))

λt2(m,x(τ

1))

λt1(m,x(τ

1))

do not accept

b

c

λt4(m,x(τ

3))

λt3(m,x(τ

3))

λt2(m,x(τ

3))

λt1(m,x(τ

3))

do not accept

f

λt4(m,x(τ

2))

λt3(m,x(τ

2))

λt2(m,x(τ

2))

λt1(m,x(τ

2))

do not accept d

e

Figure 2: Sampling the NHPP process underlying a FSPN.which is valid in any interval [0; �) during which theset of enabled transitions does not change, that is,E(m;x(�)) = E(m;x(0)). We can then consider twocases, based on whether the set E(m;x(�)) is indepen-dent or not on the continuous component x.3.2.1 Enabling independent of the uid levelsIn the simpler case, the cardinality of the arcs con-nected to discrete places and the guards do not de-pend on x. Even so, the �ring times behave as anonhomogeneous Poisson process (NHPP) whose ratedepends on the continuous marking, and so some careis required in sampling the �ring instants. We as-sume that the �ring rate of each timed transition t canbe bounded from above by ��t (m), given our knowl-edge of its dependence on the uid marking. That is,when the discrete marking is m, the rate of t satis�es�t(m;x) � ��t (m), for any value of x that might bereached in conjunction withm. We can therefore sam-ple from the NHPP using the technique of \thinning"[20], where we sample \potential �ring instants" in ac-cordance with a homogeneous Poisson arrival processwith rate ��(m) = Xt2E(m;x)��t (m):From this process, we can de�ne a sequence of increas-ing time instants (�1; �2; : : :). Starting from i = 1, we\accept" �i, that is, we declare that a �ring occurred

at time �i, with probability �(m;x(�i))=��(m), where�(m;x(�i)) = Xt2E(m;x)�t(m;x(�i)):In other words, we use the actual �ring rates at time�i as a weight, to determine whether the event corre-sponds to a true �ring or not. This requires us to solvefor the value of x(�1), by integrating the system of or-dinary di�erential equations (3). If �1 is accepted, westop. Otherwise, we integrate until �2, compute x(�2),and decide whether to accept �2 or not, and so on.Eventually, this process stops at some step i, givingus a sampling �f = �i of the actual �ring time.For example, Fig. 2 illustrates the case wherefour transitions are enabled in (m;x): t1, t2, t3,and t4. The sequence of labeled arrows shows therandom deviates that must be generated, in order.First, we generate �1 (a) according to the distribu-tion Expo(��(m)). Then we generate a random de-viate (b) �Unif(0;��(m)). In the �gure, this hap-pens to fall in the interval corresponding to the \donot accept" case. Thus, we need to generate anotherpotential �ring time (c) by sampling the distributionExpo(��(m)) again and summing the sampled valueto �1, obtaining �2. We also need another random de-viate (d) �Unif(0;��(m)), which also, in the �gure,happens to cause a rejection. Finally, we generate athird potential �ring time and we add it to �2, result-ing in �3 (e). When we sample (f) �Unif(0;��(m))again, we �nally obtain a value falling in the interval

corresponding to t2, hence we schedule the �ring of t2at time �3.It is then apparent that the expected number orrandom deviates that need to be generated to decidewhich transition to �re is larger when the bounds�t(m;x) for the enabled transitions are less tight,since this increase the likelihood of rejections whenperforming the thinning. On the other hand, if therates of the enabled transitions in marking m are afunction of x, but their total, Pt2E(m;x) �t(m;x) is aknown constant independent of x, ��(m) can be set tothis value, and no rejection will occur. Then, only twodeviates are needed: the �rst one to decide the valueof �1 and the second one to decide which transition to�re among the enabled ones.3.2.2 Enabling dependent on the uid levelsIf, instead, the set of enabled transitions can change asx evolves, we also need to consider an \enabling event"at the time �e when the �rst change in E(m;x) occurs.The method to compute �e depends on the nature ofthe dependencies.In principle, we should know the value of x(�) overthe entire horizon � 2 [0; �f ]. We can still use integra-tion but, in full generality, we have to check whetherthe set E(m;x) has changed, at each integration step.These additional checks can be quite expensive, sincethey potentially imply reevaluating many marking-dependent functions.If we �nd no value �e 2 [0; �f ] for which the set ofenabled transitions changes, the next event to scheduleis the �ring at time �f . Otherwise, we must schedulean \enabling event" at time �e, the time of the �rstchange in E(m;x). Of course, in this case, we can stopthe integration at time �e, without having to reachtime �f .We stress that, regardless of whether the enabledset can change or not, the generation of next �ringtimes is considerably simpli�ed if the �ring rates of theenabled timed transitions are not dependent on uidlevels, since the machinery of NHPP-based generationof random deviates can be avoided.3.2.3 Processing immediate �ringsThe processing of the scheduled event causes a changeof marking, from (m;x) to (m0;x0), where m0 =m ifthe event was of the enabling type. Then, in mark-ing (m0;x0), a �nite sequence of immediate �ringsmight take place, just as in ordinary, non- uid, SPNs,until the next tangible marking (m00;x00) is reached.

Thanks to the memoryless property of the exponen-tial distribution, the evolution of the FSPN from thispoint on is analogous to the evolution from the ini-tial marking, that is, we do not need to be concernedabout the \remaining �ring times" of transitions thatwere already enabled prior to reaching this marking.4 FSPNs with e�cient solutionThe general behavior just described requires us tosolve the system of ordinary di�erential equations (3)at each step of the simulation. This computation canbe quite costly. We now examine various subclassesof FSPNs which, due to their restricted marking-dependent behavior, have simpler solution algorithms.4.1 Uncoupled behaviorA restriction on the type of dependency allows us touncouple the system, resulting in a set of ordinary dif-ferential equations that can be solved independently.This requires that the uid rates incident on q, hence�q(m;x), depend only on (m;xq), not on the uid lev-els in the other continuous places:8(m;x); (m;x0) 2 S ; xq = x0q ) �q(m;x) = �q(m;x0):As in the general case, we can still distinguishwhether the set of enabled transitions can be a�ectedby x or not, and the NHPP random variate generationneeds to be used only if their �ring rates depend on x.4.2 Prede�ned classes of behaviorsFor particular cases of uncoupled dependencies, we caneven have a built-in closed form solution, which willavoid the need for numerical integration altogether.4.2.1 Linear uid change rateOne such case is when, in a given marking (m;x),dxq(�)d� = A(m) � xq(�) +B(m); A(m) 6= 0that is, the uid change rate for a continuous place isa linear function of the uid level in the place itself.In this case, the solution isxq(�) = �B(m)A(m) +�xq(0) + B(m)A(m)� eA(m)� ;assuming that xq remains between 0 and bq(m) during[0; � ]. This answers the question of how much the uid

level in a place will change during the �ring time � ofa timed transition. Inversely, the time �q when placeq reaches a certain uid level threshold Lq is given by�q = ln0BB@ Lq + B(m)A(m)xq(0) + B(m)A(m) 1CCAA(m) ; (4)if this quantity is positive (if it is negative, we cansimply de�ne �q =1, that is, the threshold Lq cannotbe reached in this marking).If the set of enabled transitions can only changewhen some place q reaches a threshold level Lq, thenwe can simply de�ne the time �e of the next enablingevent as �e = minq2PCf�qg:4.2.2 Constant uid change rateWhen A(m) = 0, that is, when the uid change rateis a constant, the solution is much simpler,dxq(�)d� = B(m) ) xq(�) = xq(0)+B(m)�;again assuming that xq remains between 0 and bq(m)during [0; � ]. The time �q when place q reaches thethreshold Lq is then�q = Lq � xq(0)B(m) ; (5)if this quantity is positive, in�nity otherwise.4.3 Discretized dependency on xComplete dependency on the marking (m;x) is desir-able in principle, but the solution complexity it entailscan be large, and its full power in a model. A simplertype of dependency is obtained by enforcing a dis-cretization on the behavior of the FSPN with respectto the continuous component x. This can be accom-plished using a �nite set L = fl1; : : : ; ljLjg of booleanthreshold-type functions of the marking, wherelk(m;x) def= (l�k(m;x) � �(m)); with �(m) 2 Rand l�k(m;x) is a real function of the marking whoseform depends on the nature of the functions �q for theplaces involved in its de�nition. We consider two casesleading to e�ciency improvements for the simulation:

� For any uid place q 2 PC with a linear uidchange rate (Sec. 4.2.1), we can de�ne functionsof the form l�k(m;x) = �k;q(m)xq;where the coe�cient �k;q is a real function of thediscrete portion of the marking,�k;q : N jPDj ! R:� For any set Q � PC of uid places with constant uid change rates (Sec. 4.2.2), we can de�ne func-tions of the forml�k(m;x) =Xq2Q�k;q(m)xq;where the coe�cients �k;q are, as above, real func-tions of m alone.Given a marking (m;x), we can de�ne the \dis-cretized" marking (m; l) obtained from (m;x) throughL. If we force a (for discrete places only), g, and � tobe de�ned on the discretized marking (m; l), ratherthan on the original mixed marking (m;x), then thelogical and timing behavior of the FSPN can changeonly when the value of one or more of the functions lkchanges its truth value, that is, when the correspond-ing function l�k crosses the threshold value �k(m), orwhen a �ring occurs.Given the way each function l�k is de�ned, however,it is easy to compute the time �k at which this canhappen. For a function lk of the �rst type, we candetermine �k by using the right-hand-side of equation(4), with Lq set to �k=�k;q. For a function lk of thesecond type, we can determine �k as follows:1. compute the overall change rate in the value ofl�k(m;x), �k(m) = Pq2Q ak;q�q(m;x), a quan-tity that does not depend on x given our assump-tion of constant uid change rate;2. if �k(m) is zero, l�k(m;x) is constant and will nothit the threshold, set �k =1;3. otherwise, compute the distance dk from �k tol�k(m;x), dk = �k �Xq2Q ak;qxq ;4. if �k(m) and dk have the same sign, set�k = dk=�k(m);otherwise set �k =1.

Then, the time of the next event to be managedby the simulator is simply the minimum between the�rst hitting of a threshold, minf�k : 1 � k � jLjg, andthe minimum �ring time. However, the �ring timesare now guaranteed to be constant within a given dis-cretized marking (m; l). Hence, the entire simulationcan proceed as in a traditional discrete-event simula-tion, with the exception that the types of events thatneed to be scheduled in the event queue are eithertransition �rings or the hitting of a threshold.Fortunately, there is no need to place the same re-striction on the uid impulses (a for continuous places)or the weights w, since the simulation always evaluatesthe value of impulses and weights only at a speci�cand known instant in time, and the identity of thearcs and transitions for which they need to be eval-uated is known as well. Applying the restriction tothese quantities as well would prevent us from mod-eling useful behaviors, such as emptying a continuousplace, or choosing between two immediate transitionswith probability proportional to the level in two con-tinuous places, but would not simplify the simulationalgorithms.We stress that this restricted type of discretiza-tion still allows to model many interesting behaviors,such as disabling a transition t when a uid level xqreaches a given level �, provided place q has either lin-ear or constant uid change rate. With places havingconstant uid change rates, even more general testscan be performed, such as testing for the conditionxq1 + xq2 � xq3 , which corresponds to the booleanthreshold function lk(m;x) = (xq1 + xq2 � xq3 � 0).Nonlinear conditions such as xq1xq2 � xq3 , however,cannot be captured by the proposed discretization.We conclude this section on discretized behavior byobserving that an alternative could be to de�ne inte-ger, instead of boolean, threshold functions, for exam-ple as lk(m;x) def= bl�k(m;x)c :This would be more general, since the component l ofthe discretized marking can now in principle describein�nite sets, instead of just 2jLj tuples. However, asimulator using this convention would have to sched-ule events each time a function lk crosses an integerboundary, even if many of these events might not re-ally a�ect the net's behavior.5 ExamplesWe illustrate the power of the proposed FSPN formal-ism with a few examples.

5.1 A queue with impatient customersand breakdownsConsider a queue with a server subject to break-downs and repairs. The customers arrive with a con-stant rate, and queue in an unbounded waiting room.They are served in �rst-come-�rst-serve order, but,once their service starts, they can become impatientand leave before completion (see Fig. 3). Unlike othersystem with impatient customers, the amount of timea customer has been in the queue before his servicebegins does not a�ect his decision to leave. The arcsfrom Serving to Busy and from Waiting to Idle areused to count time into the two places, hence theyhave uid rate one. The arcs from Busy and Idle toServing (or Leave) have impulse xBusy and xIdle de-�ned on them, respectively. Hence, they are \ ushing"arcs, they have the e�ect of emptying the two placesimmediately after the �ring of Serving (or Leave).The guard of immediate transition Leave speci�eswhen the customer at the head of the queue decidesto leave. Various policies can be easily modeled.1. The total amount of time from the moment ser-vice began exceeds a certain threshold MAX.Then, we could de�ne the guard gLeave to be theboolean expression (xBusy + xIdle = MAX).This policy is representative of situations where,once the server begins operating on a customer,the operation must complete within a certaintime, for example to avoid spoilage.2. The total amount of time a customer has not re-ceived any service from the moment service be-gan exceeds a certain threshold MAX. Then,gLeave = (xIdle = MAX).This could represent a similar situation, wherespoilage occurs only when the customer is not be-ing served.3. A customer has waited for an uninterrupted pe-riod of time MAX without receiving any service.Then, gLeave = (xIdle = MAX), after adding animpulse arc aIdle;Repair(m;x) = xIdle, so thatplace Idle becomes empty after each repair.This could represent a situation, where, in ad-dition to occurring only when the customer isnot being served, any spoilage immediately dis-appears as soon as service resumes.4. A customer has spent more time waiting for theserver to be operational than receiving service,from the moment service began. Then, gLeave =(xIdle > xBusy).

Arrive

Leave

Customers Up

Down

Fail

Repair

Busy

Idle

Waiting

ServingxBusy

xIdle

gLeave= ...

xIdle

xBusy

Figure 3: The FSPN of a queue with impatient customers and breakdowns.

0.0020.0040.0080.0160.0320.0640.128

2 4 6 8 10

DeparturesperminuteMAX=�

Policy 1: Upper 333 3 3 3

Policy 1: Lower +++ + + +

Policy 2: Upper 22 2 2 2 2

Policy 2: Lower �� � � � �Figure 4: Lower and upper limits of the 95% con�dence interval for the expected frequency of impatient departures.A measure of interest is the fraction of jobs thatdecides to leave,number of �rings of Leave up to time �number of �rings of Arrive up to time � :Fig. 4 compares the throughput of transition Leaveaccording to the �rst two policies, averaged over theinterval [0: : :10,000], as a function of MAX normal-ized by the average service time 1=�. Note that alogarithmic scale is used on the y-axis. The followingparameters are assumed:� Arrival rate = 1.0/min.� Service rate � = 5.0/min.

� Failure rate = 1/64min, Repair rate = 1/8min.� MAX = 2=�; 4=�; : : : ; 10=� (i.e., the customerbecomes impatient after 2, 4, . . . , 10 times theaverage service time).� Initial state as shown in Fig. 3.The results where obtained from our prototype FSPNsimulator implemented in SPNP2 [12].For each choice ofMAX , twenty independent repli-cations were performed. The total runtime to compute2At the moment, only a subset of the classes of FSPNs satis-fying the restrictions of Sect. 4.2 and 4.3 have been implementedin SPNP.

γinγout

γ21 TankOne Processing

Station

TankTwo

Figure 5: A dual-tank processing facility.Repair

One

Two

Up

Down

Fail

On

Off

Start Stop

mUpγin

(xTwo=bTwo)and

(mDown=1)

Fill Useγout

γ21

γ21

XfermDownγin

(mUp=1)

(xOne<bOne)and

(xTwo> 0)

Figure 6: The FSPN of the dual-tank processing facility.all the data shown in Fig. 4 was approximately sevenminutes using an ordinary Unix workstation.5.2 A dual-tank processing facilityConsider a processing plant where, during normal op-eration, liquid enters a main tank, One, from an exter-nal source with rate in, and is used by a processingstation, with a (potential) rate out > in (see Fig. 5).However, the processing station is subject to break-downs, during which it cannot process the liquid. In-terrupting the ow from the external source of liquidinto the main tank is an expensive operation, hence,a second additional tank, Two, is present. When theprocessing station is down, the liquid is automaticallyrouted to tank Two, which has a maximum capac-ity bTwo. Only when the second tank is full, the owfrom the external source is shut down. After a repair,the processing can resume and the liquid is routedagain from the external source, which is restarted if ithad been shut down, into tank One. In addition, anyliquid in tank Two is pumped into tank One, withrate 21. If in + 21 > out, the level in tank Onewill increase while the processing station is working

to catch up after a repair. Since tank One has a max-imum capacity, bOne, the ow from tank Two to tankOne, rather than the ow from the external source,is slowed down when this limit is reached. The guardgXfer = (xOne < bOne) in the FSPN of Fig. 6 enforcesthis behavior.The main reason for having two tanks, instead of asingle large one, is e�ciency. As the liquid needs to bemaintained at a given temperature, tank One is con-stantly heated, while tank Two is heated only when itcontains liquid, because of a breakdown. Indeed, thetwo measures we could be interested in computing are:number of �ring of Stop up to time �� ;the frequency at which the external source needs to gothrough a start-stop cycle, andprobability that tank Two is not empty at time � :Fig. 7 reports one of these measures, the ex-pected frequency of stops, computed over the inter-val [0: : :100,000], as a function of in. The followingparameters are assumed:

00.0010.0020.0030.0040.0050.0060.0070.0080.0090.010.5 0.55 0.6 0.65 0.7 0.75 0.8 0.85 0.9 0.95 1

Stopsperhour in

Upper 33 3 3 3 3 3 3 3 333

3Lower ++ + + + + + + + +++

+

Figure 7: Lower and upper limits of the 95% con�dence interval for the expected frequency of stops.� bOne = 1, bTwo = 2.� in = 0:5; : : : ; 1:0, 21 = 0:1, out = 1:0.� Failure rate = 1/100hr, Repair rate = 1/hr.� Initial state: mOn = 1, mUp = 1, xOne = 1:0.For each choice of in, ten independent replicationswere performed. The total runtime to compute all thedata shown in Fig. 7 was approximately two minutesusing an ordinary Unix workstation.6 ConclusionIn this paper we extended the modeling power of re-cently introduced uid stochastic Petri nets. Sinceequations characterizing the evolution of such FSPNsconstitute a coupled system of partial di�erentialequations, their generation and solution can be-come intractable but for small or very well-structuredFSPNs. Hence, discrete-event simulation becomesan important alternative avenue for the solution ofFSPNs. However, due to the mixed nature of the statespace, with discrete and continuous components andarbitrary interactions between them, simulation alsoposes several challenges that we address. When wecan characterize the type of interactions as belongingto one of the several restricted classes of models we de-�ne, a better suited, and faster, simulation algorithmcan be employed for the solution.

References[1] T. Agerwala. A complete model for representingthe coordination of asynchronous processes. Hop-kins Computer Research Report 32, Johns Hop-kins University, Baltimore, Maryland, July 1974.[2] M. Ajmone Marsan, G. Balbo, A. Bobbio, G. Chi-ola, G. Conte, and A. Cumani. The e�ect of ex-ecution policies on the semantics and analyis ofStochastic Petri Nets. IEEE Trans. Softw. Eng.,15(7):832{846, July 1989.[3] M. Ajmone Marsan, G. Balbo, and G. Conte.A class of Generalized Stochastic Petri Nets forthe performance evaluation of multiprocessor sys-tems. ACM Trans. Comp. Syst., 2(2):93{122,May 1984.[4] M. Ajmone Marsan, G. Balbo, and G. Conte.Performance models of multiprocessor systems.The MIT Press, Cambridge, MA, 1986.[5] D. Anick, D. Mitra, and M. Sondhi. Stochas-tic theory of data-handling systems. Bell Syst.Techn. J., 61(8):1871{1894, Oct. 1982.[6] T. Araki and T. Kasami. Some decision problemsrelated to the reachability problem for Petri nets.Theoretical Computer Science, 3:85{104, 1977.[7] E. Asarin, O. Maler, and A. Pnueli. Reachabilityanalysis of dynamical systems having piecewise-constant derivatives. Theoretical Computer Sci-ence, 138:35{65, 1995.

[8] C. G. Cassandras. Discrete Event Systems: Mod-eling and Performance Analysis. Aksen Asso-ciates, 1993.[9] G. Ciardo. Analysis of large stochastic Petri netmodels. PhD thesis, Duke University, Durham,NC, 1989.[10] G. Ciardo. Discrete-time Markovian stochas-tic Petri nets. In W. J. Stewart, editor, Com-putations with Markov Chains, pages 339{358.Kluwer, Boston, MA, 1995.[11] G. Ciardo, J. K. Muppala, and K. S. Trivedi.Analyzing concurrent and fault-tolerant softwareusing stochastic Petri nets. J. Par. and Distr.Comp., 15(3):255{269, July 1992.[12] G. Ciardo, K. S. Trivedi, and J. K. Muppala.SPNP: Stochastic Petri net package. In Proc.3rd Int. Workshop on Petri Nets and Perfor-mance Models (PNPM'89), pages 142{151, Ky-oto, Japan, Dec. 1989. IEEE Comp. Soc. Press.[13] R. David. Modeling of hybrid systems using con-tinuous and hybrid Petri nets. In Proc. 7th Int.Workshop on Petri Nets and Performance Mod-els (PNPM'97), pages 47{58, St. Malo, France,June 1997. IEEE Comp. Soc. Press.[14] R. David and H. Alla. Continuous Petri nets. InProc. 8th European Workshop on Application andTheory of Petri Nets, pages 275{294, Zaragoza,Spain, 1987.[15] A. I. Elwalid and D. Mitra. Statistical multi-plexing with loss priorities in rate-based conges-tion control of high-speed networks. IEEE Trans.Comm., 42(11):2989{3002, Nov. 1994.[16] W. K. Grassmann and Y. Wang. Immediateevents in Markov chains. In W. J. Stewart, editor,Computations with Markov Chains, pages 163{176. Kluwer, Boston, MA, 1995.[17] M. Hack. Decidability questions for Petri nets.Technical Report 161, Laboratory for ComputerScience, Massachusetts Institute of Technology,Cambridge, MA, June 1976.[18] G. Horton, V. Kulkarni, D. Nicol, and K. Trivedi.Fluid stochastic Petri nets: Theory, application,and solution. Europ. J. of Oper. Res., 105:184{201, 1998.

[19] J. F. Klingener. Programming combined discrete-continuous models for performance. In Proc. 1996Winter Simulation Conf., pages 833{839, 1996.[20] P. A. W. Lewis and G. S. Shedler. Simulation ofnonhomogeneous Poisson processes by thinning.Naval Research Logistics Quarterly, 26:403{414,1979.[21] D. Mitra. Stochastic theory of uid models ofmultiple failure-susceptible producers and con-sumers coupled by a bu�er. Adv. Appl. Prob.,20:646{676, 1988.[22] T. Robertazzi. Computer Networks and Systems:Queueing Theory and Performance Evaluation.Springer-Verlag, 1990.[23] M. Telek, A. Bobbio, and A. Pulia�to. Steadystate solution of MRSPN with mixed preemp-tion policies. In Proc. IEEE International Com-puter Performance and Dependability Symposium(IPDS'96), pages 106{115, Urbana-Champaign,IL, USA, Sept. 1996. IEEE Comp. Soc. Press.[24] K. S. Trivedi and V. G. Kulkarni. FSPNs: uidstochastic Petri nets. In Proc. 14th Int. Conf.on Applications and Theory of Petri Nets, pages24{31, Chicago, IL, June 1993.[25] N. Viswanadham and Y. Narahari. PerformanceModeling of Automated Manufacturing Systems.Prentice-Hall, Englewood Cli�s, NJ, 1992.