Stochastic Automata Network For Modeling Parallel Systems - CiteSeerX

IEEE

TRANSACTIONS

ON SOFTWARE

ENGINEERING.

VOL.

17, NO.

10, OCTOBER

1991

1093

Stochastic Automata Network For Modeling Parallel Systems J

Brigitte

Plateau

Abstract-This paper is motivated by the study of the performance of parallel systems. The performance models of such systems are often complex to describe and hard to solve. The method presented here uses a modular representation of the system as a network of state-transition graphs. The state space explosion is handled by a decomposition technique. The dynamic behavior of the algorithm is analyzed under Markovian assumptions. The transition matrix of the chain is automatically derived using tensor algebra operators, under a format which involves a very limited storage cost. Index Terms-Performance evaluation, Markov chain, tensor product, parallel systems, discrete time scale. I. INTRODUCTION

T

HE complexity of the new generation of concurrent computer systems has made the availability of sophisticated modeling tools for specification and analysis a very important issue. This work is motivated by the study of the performance of parallel systems. These systems are complex to study, since they lead to models with an exponential growth of the number of states. Thus ad hoc models of parallel systems are often hard to build and study. It is convenient and often necessary to have a systematic modeling approach and to be able to master this state space explosion: this is the concern of this paper. Stochastic Petri Nets (SPN) are one approach suitable for the representation of parallel systems [14], [12], [22]. They have been successfully and systematically applied in many areas, and the specification tool “Petri Net” allows an accurate modeling of a wide range of systems. The major problem of Stochastic Petri Nets is that they do not generally lead to compact models. In addition, they do not provide results to deal with the state space explosion and are thus computationally expensive. Petri Net packages exist and differ one from another by the assumptions they use concerning the delays within the Petri Net [19], [6]. Here, we have an approach based on a modular statetransition representation of a parallel system which we call the Stochastic Automata Network (SAN). This state-transition representation is closely related to what is done in some verification methods for parallel systems [l], [3]. We think that this operational and modular approach provides natural constructs to the modelers. In [4], the authors propose a similar Manuscript received March 1, 1991; revised June 25, lY91. Recommended by E. Gelenbe. This work was supported hy the French program C3-Communication, Cooperation, and Concurrency. The authors are with IMAG-Groupe Calcul Paralltle, 46 Avenue Felix Viallet, 38031 Grenoble, France. IEEE Log Number 9102612.

and Karim

Atif

approach except that it is based on a higher level description language, which is translated into a state-transition model in a second step. For performance modeling, this state-transition model is studied under Markovian assumptions. As far as the objectives are concerned, this work is similar to the Stochastic Petri Net approach. The automata network concept has been used efficiently in many other areas: machine decomposition [9], (21, systolic computing and neural computing [20], etc. Nevertheless, the differences in behavior assumption (deterministic or stochastic) and objectives (computing models, machine description, performance modeling) imply that the mathematical tools and fundamental results are not interchangeable. More recent work has been done on formal methods to compute concurrency measures of abstract parallel computation. This work is based on language theory [8], [5] and uses different measures of concurrency (wait event frequency, number of nonblocking computations) under deterministic assumptions or uniform distribution assumptions. The mathematical background is based on counting, limits, and generating functions. Our approach is similar in the sense that it is an attempt to understand the structure of parallel computations. It is different in the sense that we do not aim at characterizing the intrinsic parallelism of a computation, but to compute performance measures as response time, throughput, effective synchronization delay, etc. Abstract Markov models provide reasonable tools for modeling sequential and relatively small systems. But unlike those systems, useful Markov models of parallel (thus large) systems do not usually fall in the class of known efficiently solvable models. Indeed, any technique whose purpose is to describe parallelism-whether it is to achieve correctness proofs or to compute performance measures-has to be efficient regarding to the rapid growth of the state space. Our method is based on a modular representation where the state explosion is hidden, and where the mathematical representation of the underlying Markov chain is compact. The translation from the model representation (the SAN) to the analytical representation (the probability transition matrix) is automatic. In [18], efficient algorithms to compute performance indexes are presented. This modeling technique and adequate algorithms are being implemented in software called PEPS (Performance Evaluation of Parallelism and Synchronization). The SAN method is dedicated to the performance evaluation of parallel systems [15]; that is to say, systems composed of interacting modules: communicating processes, concurrent processors, shared memory, etc. In the SAN approach the dynamic behavior of a module in the parallel system is

0098%5589/91$01.00 0 1991 IEEE

IEEE

1094

TRANSACTIONS

represented by one automaton. A module is modeled by a set of states, and an event or an action of the module is modeled by a transition from a state to another. A single automaton represents only the state of one module; additional information is used to express interactions among the modules: synchronization among processes, resource contention, etc. As usual in graph representations of performance models, labels on the transitions of each automaton give information concerning the timing and probability of occurrence of events. In a SAN, these labels specify also the type of interactions among automata of the same network. The denomination network refers to the interactions which exist among the automata. In this paper we go through a formal presentation of the SAN modeling technique and show how the Markovian transition matrix can be derived automatically to obtain a compact formula. Continuous time-scale assumption is traditionally used in performance modeling (see general queuing networks results in [21]), by some extensions exists for queuing networks on discrete time scale [lo]. The SAN can be used for parallel system modeling, and in this case continuous time-scale assumption seems to be adequate. But SAN can also be used for parallel program modeling where discrete timescale assumption can be convenient or necessary (see the example in Section V). In both cases, performance measures such as response time, throughput and synchronization delays are sought. The emphasis is on SAN with a discrete time scale. The continuous time-scale model has been presented in [16]. The difference between the two models comes from the probabilistic assumptions which are inherent to Markovian properties in both cases. The structure of the paper is as follows. Section II introduces the main features of the SAN modeling technique. Section III presents the abstract formalism. Section IV is about the automatic derivation of the Markovian transition matrix. Section V shows an example, and Section VI is the conclusion. Appendix A provides the basic tensor algebra definitions. II. THE GENERAL APPROACH Our goal is to model a system composed of modules which are connected in some manner. Defining what is a module is equivalent to defining the parallelism grain of the system under study: it is the responsibility of the model designer. In a SAN, a module is represented by one automaton. Each module is modeled by a set of states. The state of the parallel system is the collection of the states of each component module. The state of one automaton is called a local state, and the state of the parallel system is called a global state. An event of a component module or an external event which interacts with this module is modeled by a transition from one state to another of the corresponding automaton. These events are classified into two categories: the local events the synchronizing events. A local event affects a single component module. It is modeled by one local transition of the corresponding automaton. On the opposite, a synchronizing event modifies the state l

l

ON

SOFTWARE

ENGINEERING,

VOL.

17, NO.

10, OCTOBER

1991

of more than one module. More precisely, a synchronizing event is the simultaneous change of state of more than one constituting module. It is modeled by a set of local transitions of each module concerned by this event: this is called a synchronized transition (the type of synchronized transitions that is modeled in a SAN is the multiple rendezvous proposed in the formal language CCS for describing communicating processes). A transition of the SAN from a global state to another global state is composed of local and synchronized transitions. It is referred to as a global transition. Beside the notions of module-automaton and eventtransition, another relevant issue is time. Two types of time scale can be considered: discrete or continuous. In this paper, only the discrete time scale results are presented. The SAN behavior is studied under Markovian assumptions. This means that the global state space evolution is Markovian. Consider any global state. From this global state a set of local events and synchronized events may happen. To guarantee the Markovian property, we assume that each possible event happens with a probability which is geometrically distributed with a parameter depending on the current global state, and that these events are all independent. The discrete time-scale assumption implies that more than one event may happen in one time unit (because of the independence of the geometric distributions); for example, one local event for one automaton and one synchronized event for the rest of the SAN occur in the same time unit. These concurrent events provoke a change of state for the global system-a global transition. The Markov property is global, but a SAN is a collection of automata; in other words, a collection of local views which are easier to apprehend than the unique (and huge) global view. To represent the global Markov property from local views, we usefunctional transition probabilities. It was already mentioned that the probability of occurrence of an event varies with the current global state. It is equivalent to say that the probability of occurrence of this event is a function of the global state. Therefore take for instance a local event which occurs solely during one time unit: when it happens, the SAN global transition is the change of state of only one automaton (by definition of a local event) with a probability which is a function of the current global state. In our SAN representation this functional probability is the label of the local transition on the local view (the component automaton). Also, with one automaton and a functional transition probability, a collection of global transitions can be represented (namely, all the global transitions characterized by this local move only and having eventually different transition probabilities (see the example in Fig. 1). Similarly, synchronized transitions have functional transition probabilities. A particular case of function is the constant function. Summarizing what is discussed above, the SAN is a modular description of a parallel system as follows: it is a collection local views: the automata. The state of the system is a t-uple a global transition is the effect on the global state of local events and synchronized events the probabilities are expressed on each automaton as functions of a global state l

l

l

PLATEAU

AND

ATIF:

STOCHASTIC

AUTOMATA

NETWORK

FOR

MODELING

PARALI.EL

SYSTEMS

..1(‘) is defined by the tuple

(SW L. Q”‘)

xi’) is the state valiable of autumaton 4”’ Functions

/(r”‘)

and g( .I?‘)

are defined

as follow

:

Fig. 1. A stochastic automata network

Fig. 2.

The corresponding global automziton

interactions among the component automata are expressed in terms of functional transition probabilities and synchronized transitions. But the Markovian assumption holds only for the global SAN behavior. This modular description has a direct, easy, graphical representation in terms of state-transition graphs with labels on the edge (see the example in Figs. 1 and 2), where transitions that cannot occur (that is to say, arcs with an empty label) are not represented. l

III. THE STOCHASTIC AUTOMATA

NETWORK

The purpose of the SAN modeling technique is to provide a formal modeling framework which is modular and which allows the precise description of a global system. From a set of automata-relations, we want to represent a global system, or global automaton. First, the Stochastic Automata Network syntax is described. Then the corresponding global automaton is specified.

A. Syntax of a Stochastic Automata Network Definition 1: A Stochastic Automata Network with -V components over a set of synchronizing events E is a set of stochastic automata (A(i))iC[l,,.-~.’ Each stochastic automaton

where SC’) is a set of states; Q (‘1 is the transition function of automaton ,A(‘) and is defined from SC’) x SC’) + L; and L is a set of labels. Given the notations e (the name of a synchronizing event in E), 7 (a transition probability: a function from II;‘i,S(‘) to [0, 11) and p (an alternative probability: a function from II$lS(‘) to [0, l]), a label 1 is either the empty list represented by the symbol 0 only, a list with a function T only, a list of triplets (e. -r,.p,) with different symbols e:, or a list with a function 7 and triplets (c. 7,-. pc ) with different symbols P. 7 is called the transition probability of this list (if it exists), and (P. 7;.p,) is called the synchronizing label element for e in this list (if it exists). The state-transition definition is standard for an automaton. The labels have a special syntax, so let us comment on this: . A label is a list: each element of this list is either a transition probability 7, or a synchronizing label element (( . TilS(i). we say that event e is achievable in state 2 if and only if for any entry .r(‘) of 2 such that i E 0,. SUCC,(Z(~)) is not empty. Transition (2. ?(x(~)/;,o, ~(~1) is said to be a transition achievable with e. Fig. 3. A SAN with synchronized and local events. This definition simply says that a synchronized transition is SUCC~(Z(~)). the set of states y(‘) such that label possible if and only if all component modules i. i E 0, are Q(‘)(x(~), yci)) contains a transition probability. This set ready for this synchronized transition. In other words, there is a precondition on the global state :? to enable a synchronized may be empty. this set may also contain x(;) SUCC,(X(~)), the set of states yci) such that label transition. If the precondition is true, then the synchronized ~y’“‘) c ontains a synchronizing element for e. transition may take place from 2 to .~.(x(~)/;~o, y(‘)). ~(‘1 E This set may be empty. This set may also contain ZLY(~). succ, (~(~1). On the opposite, if the precondition is not true, the synchronized transition cannot take place. Note that a Definition 2: A SAN (Aci))i, 1. ,.v over a set of synchronized events E is locally well defined if and only if for any synchronizing event may be achievable from more than one i E [l..N] and for all x(‘) E Sci): if succ~(:c(‘)) # 0 then state :E. and that from 2. where r is achievable, more than one destination may be possible with c. c 7(x ci), y(“)) = 1: and if for a synchronizing Definition 4: Given a synchronizing event e E E. we event e, SUCC,(Z(~)) # 0. then for all ~(~1.2(i) E succ,(~(~)). say that e is well defined if and only if for any transition T&:(i), y(i)) = q,(&)>.(i)) (5. :i.(n.(‘)/,Eo,y(i)). y(j))) ac h’ievable with e, the synchronizing label elements (e. r, (~(~1. y(“) ). ~1~(x(~). Y(~))) are such and that at most one of them (e. re(:r(‘). y(‘)).~)~(z(‘). y(l))) has a probability ~(‘1 different from the constant function 1. = 1. c y(‘,ts”cr,(~(‘))pe(;U(i).Y(l)) This r(‘) is identified as the transition probability of the synchronized transition. As such, it should be uniquely deterDenote rp(~(i)) in the common transition probability mined for all 2 and all synchronized transitions for e possible T&9. yq. from 2. A synchronized event e has a specification which is If there are multiple alternative local transitions from a given distributed over the automata in 0,. This “distribution” should state, then the sum of the corresponding transition probabilities is one. This insures that we have properly represented the not induce an ambiguity on the probability of occurrence. Unicity of the transition probability is the reason for this notion probability of occurrence and nonoccurrence of the corresponding local events. If for a synchronizing event e there of well-defined synchronizing event. The value r(‘) = 1 for i # 1 in a synchronizing label eleare multiple alternative transitions from a given state, then the probability of occurrence of this event should be the same on ment to indicate that the actual synchronizing event transition probability is not represented locally, and is an arbitrary choice all alternatives. Also, the sum of the alternative probabilities for the SAN construction. Value 1 is more convenient for should be 1. These constraints insure a probabilistic coherency. further development and will be clarified in Definition 7. A B. Synchronizing Events special case is when the actual synchronizing event transition probability r(‘) is 1: this does not cause any difficulty. To The proper use of synchronizing events requires some more restrictions on the SAN syntax. Before defining the insure practically that a synchronizing event e is well defined, it is sufficient to represent the actual transition probability of synchronizing event semantic, we introduce the notations: this event only on one automaton whose index belongs to 0, A global state is denoted 2 = (x(l). t . . x(-“1) for a SAN (see the example in Fig. 3). Denote n(e) in this automaton with N automata index. The global state obtained from i; where all ~(‘1 E Convention: In the following, each synchronizing event Sci). i E 0, 0 being a subset of [l..N] have been replaced e is associated to automaton A(“(‘)). whose labels include the by yci) E S(i), is E(~(~)/i~oy(“)) For any synchronizing event e in E, denote O,, the set actual transition probabilities of this event. This does not limit of indexes i E [l..N] , such that automaton Aci) has at the generality of the model. Next we introduce an intermediate tool which makes the least one synchronizing label element for event e Denote E! the set of synchronizing events which are used further developments easier. Definition 5: We call Qc’. i = l..N. the completed transiin the SAN under study; namely, E = {e E E/O, # 0) For any synchronizing event e E E. we associate a tion function of automaton Aci). Qp’ is defined from Sci) x fake synchronizing event Z. One interpretation of E is to S(“) + L by: consider it as the event of the nonoccurrence of e. If the For all z(‘): yci) E SC”) such that x(‘) # yci), we have: Q!i)(&). y(i)) = Q(i)(& y(i)). representation of the nonoccurrence of a local event can l

l

Q’“‘(&

y(‘)Esucci(r(‘))

l

l

l

l

l

l

PLATEAU

AND

ATIF:

STOCHASTIC

AUTOMATA

NETWORK

FOR

MODELING

PARALLEL

For all z(‘) E S(“). if i E 0, and SUCC,(.C(~))is not empty, Q~)(x(‘).x(~)) is equal to Q(l)(:r(‘)..c(i)). to which is added the label element (i?. r~(.c(‘). .I:(~)). 1) of the fake synchronizing Z. ~~(11: (‘1. x(‘)) is defined as follows: if i = n(e). then ~F(J (i).n:(i)) = 1 - rE(.r(‘)) and 7l(e) = n,(e); and if i # n(e). then r7(~(‘)..r(‘)) = 1. For all :I:(‘) E SC’). if Q(‘)(x(~). ,r(‘)) has no transition probability in its list, then we add to Q!“(.r(‘). r(1)) a transition probability equal to: the constant value 1, if succl( X(I)) = 0; and the constant value 0, if srrcc, (~(‘1) # 0. Qt’ is exactly the transition function Q(‘). except that additional label elements are introduced for the transitions from a state to itself. The additional label elements represent the nonoccurrence of each synchronizing event c whenever this event can be achievable from the state. As was already mentioned, the nonoccurrence of P is represented by F. The probability of occurrence of Z is 1 minus the probability of occurrence of e. The probability rr(.,.i’). .r(‘)) is equal to 1 out of automaton 71(Z). Also, if this label Q(‘)(.~(2)..r(‘)) has no transition probability, we add one. As the SAN is locally well defined, the value of this probability can only be 1 or 0. Note that these additional transition probabilities do not introduce any change in the SAN behavior. l

l

C. The Compatible Events Keep in mind that the behavior of the SAN is Markovian, with a discrete time scale, and the events (local or synchronized) are independent. It is necessary to identify the events which can happen in the same time unit-the compatible events. This simultaneity induces some kind of complexity in the model, which is not in the continuous time-scale model [16]. From a given state, let us characterize the compatible events with the following notations: l

l

l

l

l

We extend the definition of succ~~(,r(‘)) and succ, (.I.(‘)) for e E E*. and from the transition function Q(‘) to transition function Q!“. The only differences are the addition of the sets succ,. and that succ~(.~(‘)) always contains :I(~) P(E*). the set of subsets of E* ET = {s E ‘P(E*)/ n, E,s0, = 0, or Is] = l}. E: (C stands for compatible) contains all possible subsets of synchronizing events s which are achievable simultaneously as nrtsOe = Cn.or single events. If O,, n OEL # (n. two cases may occur: either the synchronizing label elements for er and e2 are in the same label and are mutually exclusive in a given transition, or they are in different labels, thus from different starting states, and cannot be achieved in the same time unit. If s = (el. e2) E E:. then (er.&). (?I. e2) and (Z!r.Z*) are in E: {s E E~/S n E = 8). s E E: contains only fake synchronizing events Let 2 E S and s E Er. We say that s is achievable in state 5 if and only if: V e E s. e is achievable in state .?. We denote: Ez (2) = {s E Sy/s is achievable in state j;}; and E:(F) = {s E Ez /s is achievable in state :?} sy

=

’ IsI is the cardinality of the set .A.

I

l

1097

SYSTEMS

we define: I, = [l..AV] - UeEsOe. Automata ForsESr. ,4(‘). i E 1, possess local events which are compatible with the synchronizing events of s. Remark that 1, = 8 is possible; succ,(~(~)) is the set of states yci) such that label . y (d ) contains a transition probability if i E I,7. or a label element of the synchronizing event e E .s if i E UpEs 0,. Transitions (5. ~(r(i)/i~(l,,~~~y(i))). y(‘) E ~ucc,~(r(“)) are called transitions achievables with s (the local events of automata in I, and synchronizing events of s are compatible and generate achievable global transition). Denote T,. the set of those achievable transitions; and consequently, for (:i-. $) E T,. we define: Q;)(#)

T.( ,, Ir(i). ,I”‘)

T(d). p).

=

i

‘T~&ql~(.T(~).

if i E I5 p).

if i E O,.e E s.

(1) r, (,1.(l) )P~(.I.(‘). y(l)) is the ordinary product of the transition probability rP(:r(‘)) by the alternative probability p&W y’“‘). Now we have all the necessary notions to proceed to the construction of the global automaton. Before this, a last constraint is presented: Definition 6: Given a SAN (il(‘)),=l,,-l- over a set of welldefined synchronizing events E. We say that this SAN is well-defined if and only if: it is locally well-defined; and the transition function satisfies the following inequality: for all :? E S.

where E:(.?..?) = {s E ~:(.?)/(j..?) E T,}. This last constraint on the syntax of a SAN cannot be explained at this point. It is necessary to ensure that the global automata which is defined next can be given a stochastic meaning (see Theorem 1). The right-hand side of inequality (2) is exactly the sum of all the transition probabilities of the global transitions (:i.y).? # $. This sum should be less than 1. This last constraint is a global constraint in the sense that it involves the transition function of all the automata of the SAN.

D. The Global Automaton Now proceed to the definition of the global automaton, whose specification is the SAN. We have to define the state space and transition function: Definition 7: Given a well-defined stochastic automata network (A(i)),,l,,-,-. Aci) = (S(i). L. Qci)). over a set of well-defined synchronizing events E on a discrete time scale, the SAN defines the global automaton A = (5’. L. Q)? where: S = I&S(‘); L is the same as for the component automata; and Q is defined from S x S in L by: 1) for all %,2/ E S. 5 # 5. such that for all i E [l.~V],y(~) E SUCC~(Z(~)).then label Q(?. 9) contains the transition probability II$~~(z(~),

IEEE

TRANSACTIONS

ON

SOFI-WARE

ENGINEERING.

VOL.

17. NO.

10, OCTOBER

1991

global state (1,l) to (2,O) with probability i~pr. and to (0,O) with probability ~,JIO,and have the label sr in Fig. 4. IV. THE MARKOVIAN (1.0)

Fig. 4.

The global automaton of the SAN from Fig. 3.

:r(‘)); 2) for all :i E 5’. for all s E $(.Y). and for all :$ with (,?.lj) E TX./ # 5. then label Q(,(.?.fi) has the following triplet, (s. II>!rr,~(,r:(‘). y(‘)). 1); and 3) a transition with no label element defining the preceding items 1 or 2 has a label Q(:E. G) = fl. In this last definition the labels of the transitions (.?. 1s) with $ # :i are defined according to the transitions derived from all combinations of compatible local events (item 1) and compatible local and synchronized events (item 2). The transitions (5. G) with G # .Y which are not achievable with these combinations have an empty label, as they cannot occur. To avoid the complex definition of the labels Q(:i. 6) we set them to Cn. When we build the stochastic matrix the diagonal terms will be defined by normalization to 1 (see Theorem 1). For the global automaton the different notations for the label elements (local event and its transition probability or synchronizing label element) do not keep their original meaning, since all events are now local to this automaton. The notation (,s. II>irr,(,r(‘). ,r(‘)). 1) helps to remember the construction of this global transition. Remark that H~~rr5(.r:(‘). y(‘)) may involve probabilities of local and synchronized events as (Uct,s()f ) U I,? = [l..N]. The global automaton defined by a SAN is unique as we know (see examples in Figs. 2 through 4): the global state space; and the labels of the transition function. But it is clear that a global automaton can have more than one representation in terms of a SAN (a simple argument is the nonunicity of the decomposition of the product (9, rJ’)) in factors). &3b%(:r The state space S of the global automata is the cross product of the local state spaces. If the global automata is given an initial state, the set of states reachable from this initial state might be strictly included in S. However, 5’is used as a global state space for the formal definitions, and the reachable state space is used in the computation phase [18]. This ends the presentation of the SAN formalism whose objective is to represent a global system with a modular approach. The SAN syntax is described in Definition 1, and the corresponding unique global automaton syntax is given in Definition 7. Remark on the Graphical Representation: For the sake of clarity, the arcs from one state to itself are omitted, as they can be derived from the definitions. In Fig. 3 the synchronized transitions achievable with the synchronizing event el are from

DESCRIPTOR

Remember that our goal is to study a model of a parallel system under Markovian assumptions. The next step is to define the Markov model by its transition probability matrix from the global automaton of the SAN and its transition function. This step is straightforward, since the SAN formalism is built with this very objective. The Markovian property is ensured by the following assumptions: each possible event happens with a probability depending on the current global state, and these events are all independent each multiple choice transition probability is an independent Bernoulli random variable, with a parameter depending on the current global state. The transition probabilities are derived readily from the transition labels (Definition 8). Then we give in Theorem 1 a definition of the probability transition matrix, which is done by enumeration and is not practically usable. In Section IVC it is shown that this probability transition matrix can be given by a compact formula, called the descriptor of the SAN. The operands of this formula are defined in Section IV-B. This descriptor can be derived automatically from the SAN description. It is shown that storing the probability transition matrix as a descriptor other than extensively provides a substantial gain. For the remainder of this section, we assume that a welldefined SAN is given: (,4(‘)),E[1,,.Yl. with A(‘) = (SC’). L. Q(l)) over a set of well-defined synchronizing events E. This SAN defines the global automata .4 = (5’. L. Q). We assume that each local state space S(‘) is ordered, and on S = Il>?,Sc’) the lexicographic ordering is used. Using these orderings for the states (local or global), the transition functions Q(j) and Q can be viewed as transition matrices. Denote tl”). the size of Q(‘). Let d be the size of Q.d = II>l,rl(‘). Denote I&C,, . the identity matrix of size c&i). Let -A(.?) be the evaluation of matrix =1 in .?. l

l

A. The Global Transition Matrix First, we define the probability associated with a labeled transition in a stochastic automaton (local or global). In the next definition, R can be either an A(‘) or A, and o is, respectively, an element of Sci) or of S. Denote 7(o). the evaluation of ‘T (a function from S to [0, 11) in o. Note that if a E Sci). r(a) is a partial evaluation, and if (Y E 5’. then ~(0) is a positive real value in [0, 11, a result of a complete evaluation. Definition 8: Given a stochastic automaton R = (P, L. 0) and the label 1 of a transition (o. /j) of R, the corresponding transition probability 7’is: l

l

l

if 1 is the list equal to I?. then I’ = 0 if I is the list reduced to a function 7, then t = 7(o) if 1 is a list of M triplets (errl. rm. p,). then T = c;lf=, T”, (@)Pm (fi)

PLATEAU

l

AND

ATIF:

STOCHASTIC

AUTOMATA

NETWORK

FOR

MODELING

PARALLEL

if 1 is a function 7 and a list of M triplets (e,, r, , p,). then

This definition has an obvious interpretation when 9 = S (the global state), and the functions can be completely evaluated. If a transition cannot occur (empty label), the corresponding probability is zero. If a transition can be caused by multiple events, then the transition probability is the sum of the events’ transition probabilities (this comes from the events’ independence assumption). When a multiple-choice routing probability occurs, the probability is the product of the transition probability of the event and of the alternative probability. So the labels have a straightforward meaning within the Markov framework in terms of their associated transition probability. Therein comes the natural definition, Theorem I: Given the global stochastic automata A = (S, L. Q) defined by the SAN (A(i))iE[l..n-~. the matrix P defined by: for any (?.c).(.i # 6). P(fz.5) is the probability computed from label Q(:i;. 5); and for all 2. P(2.2) is computed so that the sum of the entries of a row in P is one, is a stochastic matrix and is by definition the Markov transition matrix of the global stochastic automata

partial local transition matrices P/“’ and P,‘“‘: 1) Pis initializedwith nullentries 2 ) For all 5, $ E S. 5 # G? such that

3) For all for all

P/“)(z(i), yy’qq

x

Proof: Definitions 7 and 8 Theorem 1 give the arguments for the proof: The algorithm to add an element into a label list in Definition 7 is the algorithm used to add up transition probability to obtain P in lemma 1 Definition 8 states that the transition probability corresponding to a label list is a sum of probabilities By definition, matrices Pji) contain the transition probabilities r(‘) of local events. The transition probability of (5. G)> with yci) E succl(~(~)) and i # 6, is (see item 1 of Definition 7) II,clr, ,.Y~r(z(i). ~(~1) and by definition, l

l

l

l

0

B. The Partial Transition Matrices In this section we define the building blocks used in the SAN descriptor. Given an automaton Aci) = (S(‘), L. Qci)) of the SAN, denote E(‘) c E*. the subset of synchronizing events appearing in Qp’. Define a collection of partial local transition matrices whose entries are defined by decomposition of the label lists: a partial transition matrix Qli’ which contains the transition probability of all the label of Qt’, and v) elsewhere; and for all e E ~(~1, a partial transition matrix Q?’ which contains all the synchronizing label elements of Qt’ for event e, and 0 elsewhere. Each transition matrix has a corresponding probability transition matrix, namely: to Qi”’ we associate the corresponding partial transition probability matrix P/‘). Note that P/i) can be a matrix with only null entries, if Qci) has only empty labels and synchronized label elements; and to each QF’ for all e E ~(~1, we associate the corresponding probability matrix PJ’“‘. The next lemma shows how to compute P from the partial probability transition matrix. We use the notations of Section III-D. Given a matrix P/i)P{i)(s(i), ~(~1) is an entry located in the row CC(~)and in the column y ci) of this matrix that is a function. Pji)(di), yci))(5) is the evaluation of that function in 3. Lemma 1: The global transition probability matrix P is given by the following algorithmic procedure in terms of the

for

5 E S. for all s E E,*(Z) and ?j with (2, G) E T,,$ # 5. then

P(%. 5) + P(& g+n,,,*

A = (S.L.Q). Proof: The proof is given in Appendix B, which shows that P is a stochastic matrix. It is guaranteed by the welldefined property.

SYSTEMS

By definition, matrices P,‘“’ contain the products r,p,. For all s E or. the transition probability of (%,jj):1~(~) E SUCC,(X(~)) and 5 # 5. is (see item 2 of Definition 7) II$rrs(,(‘). ~(~1). Using the definition of ,(x(~), ~(~1). the precedent expression is equal to:

y(i))p,(,w y”‘)]n ,(di). j-Jn [G (Z).

y(‘))

eES iE0,

iEI,

which is exactly,

n eEs

n

P;;)(,(;), y”‘)(Z)

ito,

x n

P/i)(z(i).yq(q.

iEI,

0 The next subsection proceeds further and provides a close form formula for the global Markov transition matrix.

C. The Tensor Constructs Theorem 2: (Sci), L, Qci)) events E, the SAN is given

Given a well-defined SAN (A(i))iE[l..,v]. Aci) = over the set of well-defined synchronizing Markov transition probability matrix P of the by:

with, for all s E E:: for all e E s for all i E O,, we have P,‘“’ = PLi’ for all i E I,, we have P,‘“’ = P/” l

l

IEEE

l

TRANSACTIONS

Matrix PL:L is a diagonal matrix dimension dci) whose elements are defined as follows:

Proof: The elements of tensor algebra needed for this proof are in Appendix A. Denote 7, the right-hand side of

ON

SOFTWARE

ENGINEERING,

VOL.

17, NO.

10, OCTOBER

1991

From (8)-(10) we can derive an algorithmic way to compute the nondiagonal entries of 7. More precisely, 1) ‘7 is initialized with null entries 2) from (8) and (9) take the algorithmic step (7 +- 7 + 3). This means that (V 2 E S), and for all 5 # Ic such that yCi) E succ&7Tq,

7(5.7j)

t

7(2.5)

+ fJ P~“$7?,

p)(q

i=l

(3): 3) From (8) (lo), and (V s E ET), the algorithm step (7 c 7 + Is) implies (V 2 E S). and for all 5 # 5 such that (g,$) E T,: We want to compute 7. entries. Denote,

Thus, (8) SEE;

SEE;

The identification of 7 and P is done in two steps: first, the nondiagonal terms are shown to be equal; then we prove that 7 is, like P, normalized (the sum of the entries on a row being 1). Consider the nondiagonal terms. Using the result of the appendix to compute the tensor products, we have:

This proves that the nondiagonal terms of 7 and P (see Lemma 1) are equal. Let us prove not that 7 is normalized. This is done also in two steps: first, we show that ?; is normalized, and in the second step we prove that the matrix ?;, - 7s,n is such that the sum of elements in every row is equal to zero. Denote Si(A(2)). the sum of the entries in the ith row of matrix A evaluated in 2: from (5) and Proposition 1 in the appendix, we have:

(V .i: E S)&(Z)

.v = n s,(,,(Pp(q). i=l

from (5): .v %(2> fj) = n P/y&

p)(2)

(9)

1=1

By construction, P/“’ is normalized (see Definition 2). So S,,,,(P,‘i’(tE)) = 1. This implies S;;(x) = 1. So 5 is normalized. From (6) and Proposition 1 in the appendix, we have:

from (6) for all s E E::

(V 5 E S)(V s E E:)Si(ls) Z(?, 7j) = fi

p,‘“‘(&yq(it).

From (7) and Proposition 1 in the appendix, we obtain:

Using the properties of the matrices P,‘“’ (see Theorem 2), the last equation leads to: = n n Pp(z(i),y(i))(~) [ PESiE0, .

n Pji)(z(i).y(~))(2) i iEI,

S,~k,(P,(“)(~)).

k=l

i=l

Z(5,Y)

= fi

1 1

(V 5 E S)(V s E E;)S&..n)

= fi

s,ck,(Pg(5)).

k=l

By definition, Ps,s 1s a diagonal matrix chosen so that (equation (4)): (10)

For all s E E:, I,,, is a diagonal matrix (the result of tensor product of diagonal matrices). I,,, is not considered in the first step.

S,(k,(P@)(2)) s.n

= S,Ck,(P(“~(i?)). s

This leads to (V 5 E S), S5(ls) - ,!?,(I,,,) = 0. Thus 7, - I,,, is a matrix such the sum of elements in every row is null.

PLATEAU

AND

ATIF:

STOCHASTIC

AUTOMATA

NETWORK

FOR MODELING

In conclusion, 7 is the sum of a normalized matrix and matrices such that the sum of elements in every row is null, so therefore is normalized. P is normalized by construction (see Lemma 1). Equality of the nondiagonal entries and normalization proves the equality of P and 7. q Now we can comment on the complexity of the descriptor formula. Managing functional transition probabilities of local events is easy, because they require a single tensor product construct for all of them in the descriptor. So we can handle problems as complex as we want, provided that only functional dependencies occur among the automata. On the other hand, each set of compatible events requires two tensor product constructs. This limits the number of synchronizing events that can be handled. It is not reasonable to write the descriptor of a problem with as many synchronized events as there are states in the global state space. This would be a case where there is no parallelism in the model and where the SAN representation is inappropriate (this limitation would have been also noticeable at the graphical level). If the number of synchronized transitions is small and manageable, this method gives a compact and elegant description of the global transition matrix. We have looked at problems, for distributed algorithms modeling [15], where the global state space was of the order of ten thousands and where the number of tensor constructs was less than ten. It is clear also from the definitions we gave that the descriptor can be derived automatically from the SAN description in the following way: from a syntactic analysis of the labels of a SAN, derive E, then &*,Q+, the partial transition functions and their associated transition probabilities check that the SAN is locally well-defined and that the synchronizing events are well-defined build E: and the descriptor check that the SAN is well-defined with the descriptor. This automatic derivation is implemented in a package called PEPS [18]. The descriptor is also (and before all) an efficient way to store a transition probability matrix of size (lI$1d(‘))2, using at most (41~1 + 1)(cfLi(d(i))2) entries according to the formula descriptor. 1~1denotes the cardinality of the set E which is half of the cardinality of E*. Usually, l

l

l

l

gq2

>> (4(E( + 1)(&d))‘)

i=l

i=l

The next section gives an example of a mutual exclusion algorithm of Lamport expressed as a SAN. V.

THEMUTUALEXCLUSION

ALGORITHMOFLAMPORT

Lamport has recently developed a new, efficient, mutual exclusion algorithm for shared-memory multiprocessor computers which lack atomic test-and-set instructions [ll]. The shared memory is assumed to support atomic read and write operations. Lamport’s algorithm is based on the observation that if contention for a critical section occurs rarely, then

PARALLEL

1101

SYSTEMS

start: < b[+true >; < z:=i >; zJthen < b[+Jaise >; await < y = 0 >, goto start fi; ; if< z# i> then < b[i]:=Jalse >; for j:=l to N do await if < y # i > then await; goto start

< not blji

> od;

fi f;;

Cntical Section; < y:= a>; < b[i] := false >;

Fig. 5. Lamport’salgorithmcode, executedby processi. i = l...T.

there is no need for a process to inspect the state of the other processes. The algorithm (see Fig. 5) requires only five writes and two reads to the shared memory in the absence of contention, independently of the number of processes in the system. When the contention is detected, the algorithm requires the inspection of the state of all N processes. Performance modeling objective is to evaluate the efficiency of this optimistic method. Precisely, one might want to compute: the time necessary to obtain the critical section; the rate of critical section utilization; and the rate at which processes exit the critical section. Those may be evaluated by the modeling of the algorithm by a stochastic automata network which is described below. From the SAN modeling, the steady-state probability vector can be computed, and from that, performance measures evaluated.

A. Modeling Lamport’s Algorithm by a SAN Fig. 5 depicts the code that process i executes under Lamport’s algorithm; angle brackets delimit atomic operations, and the await statement represents a busy wait. Lamport’s algorithm uses N + 2 shared variables: Z, y, and b[l ..N]. We remark that the identity of the process in the critical section is contained in variables x and y. We model Lamport’s algorithm by a network of N + 2 stochastic automata: A(“), A(Y), Aci) ! i = 1.. N, where: automaton A(“) (see Fig. 6) describes the dynamic behavior of variable 2. The states of this automaton are all possible values of variable x: from value 1 until value N. Thus S(“) = [l..N] automaton A(Y) (see Fig. 6) describes the state of transitions of variable y. The states of this automaton are all possible values of variable y: from value 0 to value N. Thus S(Y) = [O..N] automaton Aci), i = l..N shows the dynamic evolution of the algorithm executed by process i (see Fig. 7) with 13 + N states. The automaton states are all atomic instructions of the code described in Fig. 5 variable b[i] does not need to be represented by an automaton, because the possible values of variable b[i] (false or true) can be deduced from the state of automaton A(“): l

l

l

l

b[i] = false H (SA (4 = “absence”)

IEEE

Automaton

Automaton

A”’

TRANSACTIONS

A(Y)

(e s,r.*> 1,1) l

ON

SOFIWARE

ENGINEERING,

Fig. 6.

l

(ei.y.l,1,1) (er,Y.lr 1,1)

10, OCTOBER

1991

E T, w E V and i E [l..N]}

U {er,b[i],j/ilj

k

17, NO.

cess: executing the instruction (await not b[j]), process i can proceed if and only if it has the exclusive access on variable b[j] and b[j] = false. These two conditions are modeled by one synchronizing event e,,b[j],2. Event eT,+],% is achievable when b[j] = false (see Equivalence 11 and Fig. 7) and the synchronizing events e,,b[j],i for all i = l..N are not compatible because they appear on the same automaton Aci). thus denote E, the set of synchronizing events of this model, as follows: E ={et,v.i/t

2

VOL.

= l..N

function pl(y # 0) is a function which is defined as follows:

and i # j} transition probability

Lamport’s algorithm: stochastic automata .-I(s) and ,1(y) for the case,

= false j#l

G.

Jfi

(e’,q,~,~,1, 1) denotes the following list:

(ev,b[i],l-

1,1)

(er,b(&2+

1,1)

(er.b[+lr

1,1)

(er,b[t],2+lr

1, 1)

(er,q+v,

1,1)

Fig. 7. Lamport’s algorithm: stochasticautomata.=I(?’for the case. .\- = 2.

associated Markov process, called the descriptor. This is the point where our approach differs from SPN or the formallanguage approach, in the sense that we propose a practical tool associated with the SAN and descriptor. This descriptor can be derived automatically and be used efficiently for performance computing. This descriptor formulation involves a substantial gain in storage cost, compared to an extensive description. In [18], it is shown that it is possible to derive an efficient algorithm (negligible storage cost for the descriptor, linear or over-linear cost for the computation) for computing the steady-state behavior of the Markov process. This method is implemented in an experimental software called PEPS, which from a graphical description of a SAN derives the descriptor and the steady-state behavior for some numerical values of the parameters using an iterative procedure. Specific performance indexes can be computed also, when specified. The use of PEPS could be coupled with the use of a verification software based on the same state-transition approach. This methodology is quite general and systematic (although it may not be the best for analytically solvable models in queuing theory). Also, a higher level language could be used for the description of the model, then automatically translated into a SAN as proposed in [4]. For numerical

I

efficiency, progress can be made by using the local knowledge on each automaton to compute the steady-state probability vector. Lastly, since our main objective in this direction of research is to handle the state space explosion, we are currently working on a method to reduce the computation complexity and storage cost in models where some kind of symmetry exists. By symmetry, we mean SAN models where some of the automata are identical. Each identical automata has an identical view of the SAN. The idea is to collapse these views. Also, approximate resolution methods are under study. APPENDIX A ELEMENTS OF TENSOR ALGEBRA AND THEIR EXTENSIONS This appendix states the definitions and gives a few results for using the tensor algebra constructs.

A. Basic Definitions Let M(d) be the set of square matrices with a? entries in 72. The entry matrix C on row i and column j is denoted by ci,J. A matrix C in M(d(‘)d(*)) can be decomposed into d(l)’ blocks each in M(d(*)). An entry of such a matrix C can be located by the coordinates of its block, and its coordinates

IEEE

TRANSACTIONS

within this block. So we can write:

SOFTWARE

bz,l a2.1

($2)) =

{; 1;= (i(l),p91 5 p) 5 /j(l),1 5 p) &a),

. bz(qjcz) (i) j =

For example, if d(l) = dc2) = 2,

for

(j(l,,jW),

PLATEAU

AND

ATIF:

A

STOCHASTIC

@ B

=

AUTOMATA

NETWORK

FOR

MODELING

m(l.

l)h,l(l.

1)

al.r(l.

l)b1.2(1: 1)

al.l(l.

2)bz,l(l.

2)

m(l.

2kdlr

~2,1(2.l)bl,l(2.1)

1al(2.

2)b2.1(2T2)

matrix C = @=,A(“)

SYSTEMS

1105

al.2(Ll)h,l(l,

1)

a1,2(l.l)b1,2(1,1)

a1.2(1.2)h(L

2)

al,2(1,

W2,2(1,2>

a(% l)h,1(‘4 1) m44

l)h,*(2,1)

m.2(2.2)b2.1(2,2)

2)b2,2(2.2)

For (j(l).

q&4

. . 7j(‘V-‘))

’

fixed, it is possible to factorize:

$1)

J(J)

$3)

,(I’

$2,

j(7)

j(V-1)

I;=1

is defined by:

.v

S,i.x, (A(-‘-)(;)).

k=l

i = (i(l). . j = (j(l),

2)

a2.1(2.l)b1.2(2, 1) a2,1(2.2)b2.2(2 2)

In the tensor product the functional entries of each operand are evaluated for some value. So C is a matrix in M(d(*)d(l)). The ordinary tensor product is clearly a restriction of this generalized tensor product when we identify a constant function with its value. In the paper we use generalized operators with mixed arguments: matrices in M(d(‘)) or M(d(l). F(i)). Now we introduce the generalized tensor product with more than two operands. Definition A3: Given matrices A(“) = (a~“:,,,,,~,,,cill in

Ill(dck). F(z)).

PARALLEL

. i(-‘-)) E L(d) . . .p-)

Completing the factorization,

and

E L(d).

(13)

s S;(c) = n &(&d”)(i)).

Cl

k=l

Of the algebraic properties that were true for the ordinary tensor product, only the distributivity over addition still holds. The compatibility with the matrix product is wrong in general. The next proposition gives a relation between the sum of the entries in a row of a tensor product and the sums of the entries in a row of the factors in the tensor product. Given matrix A. S,(A) denotes the sum of the entries in its jth row. If a matrix A has functional entries, A(i) denotes the matrix obtained from A by evaluating each entry in i. Proposition Al: Given matrices (A(i))zEll...,-l in bf(d(“). F(d)). and C = @C&A(~), then: s

S;(C) = n

Si&“)(;)).

(14)

k=l

Proofi From (13), we can write:

cr.; = II k=l

; 1 ($1).

. . p))

j = (j(l) * ” .p)) Compute S;(C).

E L(i)

E L(d).

By definition of S;(C). .\

and

This proposition is used in the paper for deducing normalization properties. We already remarked upon the possible use of classical tensor algebra for multidimensional Markov chains with independent components. the point of the descriptor of a SAN is that the generalized operations have the same use when the components are not independent. APPENDIX B PROOF OF THEOREM

3

To prove that P is a stochastic matrix, we have to show: that all entries P(%. 5). fj # 5 are positive. This is obvious since they are the sum and products of positive numbers; and that &ES. ?jfZ P($> i-9 is 1ess than one. This is the main point to prove. Let us proceed to the first Lemma. Consider T a set of transition of S x S, and 01,Oa. . . . , 0, a partition of [l..N]. Assume that T can be expressed as the cross-product TO, x . . . x TO,. where TO, is a set of transitions from 7(x ci), yci)) denotes a transition KEO, sCi) to rr&ojs(i). probability associated with transition (x(~), y(“)). For a given i. denote z(OI), its entries indexed in Or. Lemma Bl: For any given Z E 5’; we have: c rqYlT(2 (il. y(i)) (.Ec,G)tT

= q=,

c (z(“J).y(oJ))ETo

. lx rE0,T(Z(i):y(i)).3 or

Proof: Since T = ToI x . . . x TO, ? we can write:

IEEE

... c

c

(.doz),y(o~))ETo,

TRANSACTIONS

ON

SOFIWARE

ENGINEERING,

VOL.

17, NO.

10, OCTOBER

1991

rival+, y(i)).

(Z(Op),y(“+TOp

(z(a),ym), (2KwyKw), For fixed, it is possible to factorize:

. . . (,(o*-dy(oP-‘d) + %(~I) [

Ls,,GTe(4 c SC1GE; c, (?)

Since (.T~,(i) + rzl (2)) = 1 (see Definition dent equation becomes: c &cs~eT,(~) = c SEE;(z) St1qe, Completing obtain:

the factorization

&s,,G(~). (2)

in a similar way, we finally

c rI,,,T,(iJ) SEC(,) s

Completing the factorization,

1

5), the prece-

0

= 1.

c II~l’(z(i),y(i)) =rIy=, c Denote that Tt(2) = {(2,$)/V i E [l..N]. yci) E (*,G)ET (z(OJ).y(“i))rTosucc~(z(‘ ))}. and T~(z(~)) = ((~(~1. r~(~))/y(‘) E succ~(z(“))}. These are the transitions achievable with local events, . rI&O,T(Z(i), y”‘).’ 0 respectively, in S and S(‘) from, respectively, 2 and x(~). It Denote re(Z), the transition probability event e from state 5:

of synchronizing

T!(2) = Tl(Z (1)) x T&P)

Te(Z) = n,,,e7e(x(i))pe(z(i)

JY (;I 1 = 7~(~(“(e)))~;,o,p,(~(~), yq

and for a given S E Z:(5), denote e:(5) = {s E cz(IC)/V e E s, then e E S or Z E S}. Note that: &E(Z) =

(2)

=

and el E s}. synchronizing synchronizing l

E;,E1

(5)

=

= s - {er}, Set E$ el (2) includes events’of c:(2) which event er s - {El}, Set E$,~ (5) includes events’of c;(Z) which event ~1.

{sel/se,

{s,,

and El E s}. synchronizing synchronizing We remark that:

/s,,

=

x T&O~P))

x . . . x T((&)).

Theorem Bl: For all 5 E S. we have: (15)

Proof: Consider a synchronizing event el E E such that El E 3. In &G(5), there are two types of elements s: those which contain er and those which contain El. Denote: E&1

= (Tel (doe1 )) x “. x T[(Z(“))

rI e&~e(~) = 1. c SEE;(*)

x . . . x T&w)

For a given set of compatible synchronized events, T,(2) is the set of achievable transitions with s from 2. T,(Z(Ot)) is given a similar definition. It comes, if s = (el, ez,. . . . e,) and I, = (ir, . f .. iy): T,(2)

u Ef(2). SEE:(2)

Lemma B2: For a given 2 E S and a given s E E,*(z?),

l

is clear from these definitions that:

with s E e;(2) all combinations of are compatible with with s E e;(2) all combinations of are compatible with

c P(2. lj) = [l - II;:,+r9. GE.%yfi

X(Z))]

1

. + ley(iql - c rI~~lTs(z(i);z(i)) [ SEE; (L?,i) This proves that CGES, Gf5 P(2,Q) 5 1, since the righthand side being less than one is the condition for the SAN to be well-defined. Proof: From Definitions 7 and 8, we can split the nonzero terms of the following sum in two parts, for all 2 E S: c P(Z,:fj) = c IIf!:,r(z(~),z(~)) x.5, G#? (~>C)ETl,G#j:

+

c SEE:(2)

1) Compute first, In using these sets, the sum of the right-hand side of (15) is split: In fact, it is easier to calculate,

yq= c c JJ~l+i), (d,G)ETi(r)

rIfIIlT(&), y(Q)

(G,?/)ETI(Z). i#Z + IIty,,T(di), .@)).

(16)

PLATEAU

AND

ATIF:

STOCHASTIC

AUTOMATA

NETWORK

FOR

MODELING

PARALLEL

We know that (?,Z) always belongs to Z’l(2). From Lemma Bl, using the decomposition x(2) = Tl(z(‘)) x Tt(x(*)) x . . . x T~(x(~)), we deduce:

SYSTEMS

Given that the SAN is well defined (see Definition

and the definition

The SAN is well defined (see Definition

c

2):

of

(21) becomes:

2), so for all i:

T(&),y(q

1107

= 1.

(z(‘),y(‘))ET~(z(‘))

From Lemma B2 we have:

Thus,

(f,O)ET (5) From (16) and (17):

From (19) and (22), we have:

rIp:lrs(z(‘ ), 1 (5) (5,i) [SEE; I[ SEE; rI~lTs(Z(i). 1

2) Now compute:

yq

=

As previously, evaluate the following

Cl-

(23)

sum3:

yq

ZZ According

to the remark introducing Lemma B2, e:(i) the right-hand side of (19) becomes:

=

US~E:(~)E:(C?),

c

(24)

(19)

c

[

SEE:(?) SEE;(?)

From Lemma Bl

T,(2) = T,,(z(O-)

1

":lr,l,:li),y(~))]

Finally, from (18) and (24) we obtain the following tion:

proposi-

(20)

(?,G)ET,(?)

and for any s using the decomposition

) x . . x T,Jx(~~P))

x T~(Lc(~~)).we

deduce: ACKNOWLEDGMENT

The authors thank J. P. Merlet for his graphic package JpDraw [13] and his helpful and quick answers to their naive questions.

=Is&, c .(x(z~),y(i)) [(“(~J).Y(i-‘))ET~(~c(‘-I))

1

np=, i

c

n&O, TeTe, (di))peJ (di).

(z(“J),y(o~)ET,~(z(o-i))

y(i))

1 .

(21) 3 l(p) is equal to 1 if p is true, 0 otherwise.

REFERENCES

[1] S. Aggarwal, R. P. Kurshan, and K. Sabnami, “A calculus for protocol specification and validation,” in Protocol Specification, Testing and kification, vol. III, H. Rudin and C. H. West, Eds. Amsterdam: Elsevier-North Holland, 1983. [2] M. Arbib, Algebraic Theory of Machines Languages and Semi-Groups. New York: Academic, 1968.

1108

IEEE

TRANSACTIONS

[31 A. Arnold, “Met: a system for constructing and analyzing transition systems,” in Proc. 3rd Workshop on Protocol Verification (Grenoble, France), June 1989. [41 S. Berson, E. Souza e Silva, and R. Muntz, “A methodology for specification and generation of Markov models,” in Proc. 1st Znt. Conf Numerical Solution of Markov Chains (Raleigh, NC), Jan. 1990. 151 B. Charron-Bost, “Mesures de la concurrence et du parallelisme des calculs repartis,” Ph.D. thesis, Paris VII Univ., France, Sept. 1989. [61 G. Chiola, “Greatspn 1.5,” in Proc. 5th Int. Conf: Modeling Techniques and Tools for Comput. Performance Evaluation (Torino, Italy), Feb. 1991, pp. 117-132. [71 M. Davio, “Kronecker products and shuffle algebra,” IEEE Trans. Comouters. vol. C-30, Feb. 1981. PI D. deniet and L. Thimonier, “Fast computing of concurrency measure and mutual exclusion,” Paris-Sud Univ.. France, Tech. Rep. RR 432, July 1988. [91 J. Hartmanis and R. E. Stearns,Algebraic Structure Theory of Sequential Machines. Englewood Cliffs, NJ: Prentice-Hall, 1966. WI H. Kobayashi, “Discrete time queuing systems,” in Probability Theory and Computer Science, G. Louchard and G. Latouche, Eds. New York: Academic, 1983, chap. 4. IllI L. Lamport, “A fast mutual exclusion algorithm,” ACM Trans. Computer Syst., vol. 5, no. 1, pp. 1- 11, Feb. 1987. [121 M.A. Marsan, G. Balbo, and G. Conte, “A class of generalized stochastic petri nets,”ACM Trans. Comput. Syst., vol. 2, pp. 93- 122, May 1984. [I31 J. P. Merlet, “Notice d’utilisation JpDraw version 2.3 sur SUN,” INRIA, Sophia Antipolis, France, 1990. 1141 M. Molloy, “Performance analysis using stochastic petri nets,” IEEE Trans. Computers, vol. C-31, Sept. 1982. [W B. Plateau, “On the stochastic structure of parallelism and synchronization models for distributed algorithms, ” in Proc. ACM Sigmetrics Con) Measurement and Modeling of Comput. Syst. (Austin, TX), Aug. 1985. WI B. Plateau and K. Atif, “A method for handling complex Markov models of parallel systems,”IMAG Instit., Grenoble, France, Tech. Rep. RR 826 I, Sept. 1990. [I71 B. Plateau and J.M. Fourneau, “A methodology for solving Markov models of parallel systems,”.I. Parallel and Distributed Comput., vol. 12, 1991. V31 B. Plateau, J. M. Fourneau, and K. H. Lee, “Peps: a package for solving complex Markov models of parallel systems,” in Modeling Techniques and Tools for Comtmter Performance Evaluation (Palma, Spain), R. Puigjaner and D. Pbtier, Eds:, Sept. 1988. [I91 M.A. Marsan, S. Donatelli. and F. Neri, “Gspn models of Markovian multiserver multiqueue systems,” Perform. E&, vol. 11, no. 4, Nov. 1990.

ON

SOFTWARE

ENGINEERING,

VOL.

17, NO.

10, OCTOBER

1991

[20] F. Fogelman Soulie, Y. Robert, and M. Tchuente, Automata Networks in Computer Science, Theory and Applications. Manchester, UK: ManChester Univ. Press, 1987. [21] K. S. Trivedi, Probability and Statistics with Queuing and Science Applications. Englewood Cliffs, NJ: Prentice-Hall, 1982. [22] M. Vernon and M. Holliday, “Performance analysis of multiprocessor cache consistency protocols using generalized timed petri nets,” in Proc. Performance ‘86 and ACM Sigmetrics 1986, May 1986, pp. 9-17.

Brigitte Plateau received the Master’s degree in applied mathematics from the University of Paris VI in 1976, and the These de Troisieme Cycle and These d’Etat in computer science from the University of Paris XI in 1980 and 1984, respectively. She was Charge de Recherche at CNRS (France) from 1981 to 1985, and Assistant Professor in the Computer Science Department of the University of Maryland from 1985 to 1987. She currently holds the position of Professor at the engineering school, ENSIMAG, in Grenoble, France, and is a member of a research group whose main interest is the study of massively parallel machines. Her research interests include queuing theory and performance evaluation of parallel and distributed computer systems.

Karim Atif received the Bachelor degree in computer science from the University USTHB of Algiers in 1987, and the Master’s degree in computer science from the University of Paris XI in 1988. He will obtain the Ph.D. degree in computer science from the INPG in Grenoble, France, in January 1992. His research interests include modeling, and the performance evaluation of parallel and distributed computer systems.