Petri Nets*

JAMES L. PETERSON Department of Computer Sciences, The Unwers~ty of Texas, Austin, Texas 78712

Over the last decade, the Petri net has gamed increased usage and acceptance as a basic model of systems of asynchronous concurrent computation. This paper surveys the basic concepts and uses of Petm nets. The structure of Petri nets, their markings and execution, several examples of Petm net models of computer hardware and software, and research into the analysis of Petm nets are presented, as are the use of the reachability tree and the decidability and complexity of some Petri net problems. Petri net languages, models of computation related to Petm nets, and some extensions and subclasses of the Petri net model are also bmefly discussed Keywords and Phrases: Petn nets, system models, asynchronous concurrent events. CR Categories. 1.3, 5.29, 8.1

INTRODUCTION tems of parallel or concurrent activities. Section 3 presents a more formal definition A Petri net is an abstract, formal model of and discussion of the fundamental con- information flow. The properties, con- cepts and notations of Petri nets. Section 4 cepts, and techniques of Petri nets are considers the extensive body of research being developed in a search for natural, dealing with the analysis of Petri nets, simple, and powerful methods for describ- their advantages, and their limitations. ing and analyzing the flow of information Petri net languages are presented in Sec- and control in systems, particularly sys- tion 5. Finally, in Section 6, we consider tems that may exhibit asynchronous and some of the many variations of Petri nets concurrent activities. The major use of Pe- that have been defined, both as generali- tri nets has been the modeling of systems zations of Petri nets and as subclasses of of events in which it is possible for some the general model; the more general events to occur concurrently but there are models have certain advantages for model- constraints on the concurrence, prece- ing, while the more restricted models have dence, or frequency of these occurrences. certain advantages for analysis. Since many readers may be unfamiliar with Petri nets, we first present a very 1. OVERVIEW brief and informal introduction to their Figure 1 shows a simple Petri net. The fundamentals and history. Then we con- pictorial representation of a Petri net as a sider several aspects of Petri nets in more graph used in this illustration is common detail. We begin, in Section 2, by consider- practice in Petri net research. The Petri ing the use of Petri nets for modeling sys- net graph models the static properties of a system, much as a flowchart represents * This work was supported, m part, by the National Science Foundation, under Grant Number MCS75- the static properties of a computer pro- 16425. gram.

Copyright © 1977, Association for Computing Machinery, Inc. General permismon to republish, but not for profit, all or part of this material is granted provided that ACM's copyright notice is given and that reference is made to the publication, to its date of msue, and to the fact that reprinting privileges were granted by permission of the Associat]on for Computing Machinery.

Computing Surveys, Vol 9, No. 3, September 1977 224 * J. L. Peterson

CONTENTS the Petri net. Tokens, indicated by black dots, reside in the circles representing the places of the net. A Petri net with tokens is INTRODUCTION a marked Petri net. 1 OVERVIEW The use of the tokens rather resembles a Hmtory 2. MODELING WITH PETRI NETS board game. These are the rules: Tokens Properties of Petn Nets Useful m Modeling are moved by the firing of the transitions Modeling of Hardware of the net. A transition must be enabled in Modehng of Software 3 STRUCTURE OF PETRI NETS order to fire. (A transition is enabled when The Petn Net Graph all of its input places have a token in Markings them.) The transition fires by removing Executmn Rules for Marked Petrl Nets The State Space of a Petn Net the enabling tokens from their input The Reachabfllty Set of a Petrl Net places and generating new tokens which 4 ANALYSIS OF PETRI NETS Analysis Questmns are deposited in the output places of the Solutmn Techmques transition. In the marked Petri net of Fig. Analysis Using the Reachabfllty Tree 2, for example, the transition t2 is enabled The Reachablhty Problem Unsolvable Problems since it has a token in its input place (Pl)" Complexity Transition ts, on the other hand, is not 5 PETRI NET LANGUAGES enabled since one of its inputs (P3) does not 6 EXTENSIONS AND SUBCLASSES Extended Petrt Nets have a token. If t2 fires, the marked Petri Subclasses of Petrl Nets net of Fig. 3 results. The firing of transi- Related Models tion t2 removes the enabling token from CONCLUSIONS ACKNOWLEDGMENTS place Pl and puts tokens in p2 and P3, the BIBLIOGRAPHY two outputs of t2. The distribution of tokens in a marked Petri net defines the state of the net and is

v called its marking. The marking may change as a result of the firing of transi- tions. In different markings, different The graph contains two types of nodes: transitions may be enabled. For example, circles (called places) and bars (called in the marked net of Fig. 3 three transi- transitions). These nodes, places and tran- tions are enabled: tl, t3, and t5, none of sitions, are connected by directed arcs which were enabled in the marking of Fig. from places to transitions and from transi- tions to places. If an arc is directed from node i to node j (either from a place to a transition or a transition to a place), then i is an input to j, andj is an output of i. In Fig. 1, for example, placepl is an input to transition t2, while places P2 and p3 are outputs of transition t2. In addition to the static properties repre- sented by the graph, a Petri net has dy- namic properties that result from its exe- cution. Assume that the execution of a computer program represented by a flow- chart is exhibited by placing a marker on the flowchart to mark the instruction being executed, and that as the execution progresses, the marker moves around the flowchart. Similarly, the execution of a Petri net is controlled by the position and FIGURE 1. A simple graph representation ofa Petrl movement of markers (called tokens) in net.

Computing Surveys, Vol. 9, No 3, September 1977 Petri Nets • 225

Pl sition t5 has been disabled since there is no longer a token in place P3. In the marking of Fig. 4c, transition t3 has become disa- bled. Firing either of transitions t3 or t5 disables the other; they are said to be in conflict. This simple, vague, and incomplete ex- ample of a Petri net is meant to give a brief introduction to the basic concepts of Petri nets. It also raises some questions for fur- 5~ p5p ther consideration. For example, the markings of Figs. 3, 4a, 4b, and4c were generated from the marking of Fig. 2 by 7 firing transitions. Can we characterize the class of markings that may be reached from a given marked Petri net? Can we characterize the class of sequences of tran- FIGURE 2. A marked Petr~ net. sition firings that are possible from a marked Petri net? What interesting prop- erties can Petri nets have and how can these properties be tested for? Some of these questions are of interest for Petri nets as abstract formal entities. t Other questions relate to Petri nets in their function as models of other systems, existing or proposed. For example, the net of Fig. 2 can represent a producer-con- sumer problem [25] with one producer (places p~ and P2) and two consumers (places P4, P5 and pe, P7). The items pro- duced by the producer are passed to the consumers. This is modeled by placep3 and P7 the tokens '~roduced" by transition t 2 and t~ "consumed" by transitions t3 and ts. For this interpretation of the net, we may be interested in how far the producer can get FIGURE 3 The marking resulting from firing tran- ahead of the consumers (the maximum sition t2 in Fig. 2 Note that the token in Pl was number of tokens in P3), whether the con- removed and tokens were added to p2 and p3- sumers could get ahead of the producer or consume the same item twice, and so on. 2. In this situation, we have a choice as to The use of Petri nets in modeling is dis- which transition will fire next. Figure 4 cussed in Section 2. shows the three possible resultant mark- Although Petri nets are basically very ings; from each of these, other markings simple, they may be approached and uti- may then be reached since transition fir- lized in a large number of ways. Petri nets ings may continue as long as there is an can be considered as formal automata and enabled transition. investigated either as automata or as gen- Note that in the marking of Fig. 4a, erators of formal languages [37, 79]. Ques- transitions t3 and t5 remain enabled, and tions dealing with the theory of computa- transition t2 is also enabled; if transition t2 tional complexity have been raised [64, fires, the resulting marking will have two 49]. Petri nets have associations with the tokens in place p3. In the marking of Fig. study of linear algebra [69], Presburger 4b, transition t~ remains enabled but tran- arithmetic [52], and graph theory. They

Computing Surveys, Vol. 9, No. 3, September 1977 226 • J. L. Peterson

are a major model of concurrent systems lel Computation at Woods Hole in 1970, [6], particularly computer systems. They [23] and the Conference on Petri Nets and are of interest in some areas of hardware Related Methods at MIT in 1975. design, description and construction, soft- From the work at Applied Data Re- ware systems, and the interactions be- search and MIT, the use of Petri nets has tween design and implementation. spread widely. A large amount of research Because of the breadth of application has been done on both the nature and the and depth of research into Petri nets, we application of Petri nets, and their use can only touch here on many of the results. seems to be expanding. The simplicity and We refer the interested reader to the origi- power of Petri nets make them excellent nal works cited in the Bibliography for the tools for working with asynchronous con- proofs and details of much of the research. current systems. Unfortunately much of the work on Petri nets is in the form of History theses, dissertations, reports, and memos The theory of Petri nets has developed that are not readily available nor in wide from the work of Carl Adam Petri, A. W. circulation. This paper is an attempt to Holt, Jack Dennis, and many others. Petri remedy this situation; it is intended as nets originated in the early work of Petri, both a survey and a tutorial on Petri nets. in Germany, who in his thesis [80], devel- It should be noted that Petri nets can be oped a new model of information flow in viewed in many different ways; we cannot systems. This model was based on the con- present here all such views. In part due to cepts of asynchronous and concurrent op- the difficulty of obtaining literature on Pe- eration by the parts of a system and the tri nets and the newness of the theory, the realization that relationships between the terminology, notation, and emphasis have parts could be represented by a graph, or varied widely in research on this subject. net. This problem is also caused by the power of The ideas of Petri came to the attention Petri nets and the resultant diversity of of a group of researchers at Applied Data applications. Research, Inc., working on the Informa- Petri has expanded upon his original tion Systems Theory Project [43]. This theory, continuing work on the basic con- group, led by Anatol Holt, developed the cepts of information flow and the structure theory of "systemics" [44] which was con- of concurrent systems. This has resulted in cerned with the representation and analy- a form of general systems theory called net sis of systems and their behavior. It was theory [81, 82] which is related to topology. this work which provided the early theory, This research, involving the fundamental notation, and representation of Petri nets, nature of information and its control, has and showed how Petri nets could be ap- stimulated a wealth of further research in plied to the modeling and analysis of sys- Europe, particularly at the Institut f(lr In- tems of concurrent processes. formationssystemforschung of the Gesell- Applied Data Research's associations schaft fiir Mathematik und Datenverar- with Project MAC at MIT, and particu- beitung in Bonn. While starting with the larly the Computation Structures Group same fundamental concepts as the work in under the direction of Jack Dennis, intro- the United States, this work developed in duced the concepts of Petri nets to this a different direction, evolving into a more latter group. The Computation Structures general and abstract theory. Group has been a most productive source Holt also has continued to develop new of research and literature in this field, concepts from the original work on Petri publishing several PhD theses and numer- nets, concentrating on the development of ous reports and memos on Petri nets [73, tools for the representation and analysis of 32, 34, 84, 38, 28]. Two pertinent confer- systems. His work has centered mainly on ences have been held by the Computation research into the fundamental aspects of Structures Group: the Project MAC Con- concurrency and conflict in systems with ference on Concurrent Systems and Paral- multiple parts.

Computing Surveys, Vol 9, No 3, September 1977 Petri Nets • 227

Pl P4 t 3

tJ t~ P7

(a) (b)

I) t5 •

(c)

FIGURE 4. Markings resulting from the firing of different transitions in the net of Fig. 3 (a) Result of firing tranmtion tl; (b) Result of firing transition t3; (c) Result of firing transition t~.

In contrast to the work of Petri, Holt, analyzing Petri nets in order to answer and many European researchers, which questions similar to those raised earlier emphasizes the fundamental concepts of (e.g., what markings are reachable in a systems, the work at MIT and many other given Petri net? What sequences of transi- American research centers concentrates tion firings are possible? etc.). This mecha- on those mathematical aspects of Petri nistic approach is quite different in ori- nets that are more closely related to auto- entation from the more philosophical ap- mata theory. (This paper is written from proaches of Holt and Petri. the latter point of view.) This approach is motivated by a desire to analyze systems 2. MODELING WITH PETRI NETS by modeling them as Petri nets, and then manipulating the Petri nets to derive In many sciences, a phenomenon is stud- properties of the modeled systems. This ied by examining not the actual phenome- requires the development of techniques for non itself but rather a model of the phe-

Computing Surveys, Vol. 9, No. 3, September 1977 228 • J. L. Peterson nomenon. A model is a representation, of- A CARD READER IS NEEDED ten in mathematical terms, of what are NO CARD READER AVAILABLE felt to be the important features of the IS object under study. By the manipulation of the representation, it is hoped that new © knowledge about the modeled phenome- non, and the model itself, will be obtained Eli without the cost, inconvenience, or danger A CARD READER of manipulating the real phenomenon it- IS AVAILABLE self. For example, much work on atomic FIGURE 5. A rumple model of three conditions and an event. energy has been done by modeling because of the expense and danger of handling ra- dioactive materials. ~A card reader is available' might cause Most modeling uses mathematics. The the event ~Allocate the card reader' to oc- important features of many physical phe- cur. The occurrence of this event results in nomena can be described numerically and the ceasing of the conditions 'A card reader the relations between these features de- is needed' and 'A card reader is available', scribed by equations or inequalities. Par- while causing the condition 'No card ticularly in physics and chemistry, proper- reader is available' to become true. These ties such as mass, momentum, accelera- events and conditions, and their relation- tion, position, and forces, are describable ships, may be modeled as in Fig. 5, where by mathematical equations. To success- we are using places to represent conditions fully utilize the modeling approach, how- and transitions to represent events. Note ever, requires a knowledge of both the that other conditions, such as 'The card modeled phenomena and the modeling reader is allocated', may also hold in the techniques. Thus, mathematics has devel- system even though they are not modeled. oped as a science in part because of its More complicated systems may also be usefulness in modeling phenomena in modeled in this manner. Consider for ex- other sciences. For example, the differen- ample the following description of a com- tial calculus was developed in direct re- puter system: sponse to the need for a means to model • Jobs appear and are put on an input continuously changing properties such as list. When the processor is free, and position, velocity, and acceleration in there is a job on the input list, the physics. processor starts to process the job. Petri nets are also a modeling tool. They • When the job is complete, it is were devised for use in the modeling of a placed on an output list, and if specific class of problems, the class of dis- there are more jobs on the input crete-event systems with concurrent or list, the processor continues with parallel events. Petri nets model systems, another job; otherwise it waits for and particularly two aspects of systems, another job. events and conditions, and the relation- This is a very simple system composed of ships among them [44]. In this view, in a several elements: the processor, the input system, at any given time, certain condi- list, the output list, and the jobs. We can tions will hold. The fact that these condi- identify several conditions of interest: tions hold may cause the occurrence of • The processor is idle; certain events. The occurrence of these • A job is on the input list; events may change the state of the system, • A job is being processed; causing some of the previous conditions to • A job is on the output list; cease holding, and causing other condi- and several events: tions to begin to hold. • A new job enters the system; A simple example might be that the si- • Job processing is started; multaneous holding of both the condition • Job processing is completed; 'A card reader is needed' and the condition • A job leaves the system.

Computing Surveys, Vol. 9, No 3, September 1977 Petri Nets • 229

A NEW JOB ENTERS in a Petri net. This reflects a philosophy of THE SYSTEM time which states that the only important A JOB IS ~ T" P O--SS- property of time, from a logical point of ONT~Is f ~ ~i~ R ~E OR view, is in defining a partial ordering of the occurrence of events. Events take vari- able amounts of time in real life; the Petri net model reflects this variability by not depending upon a notion of time to control the sequence of events. Therefore, the Pe- tri net structure itself must contain all necessary information to define the possi- ble sequences of events of a modeled sys- tem. ii Thus, in the net of Fig. 6 the event ~Job processing is completed' must follow the corresponding event 'Job processing is

THE OUTPUT LIST started' because of the structure of the net although no information at all is given or I considered concerning the amount of time A JOB LEAVES THE SYSTEM required to process a job. On the other FIGURe. 6 Modeling of a simple computer system. hand, events which need not be con- strained in terms of their relative order of occurrence are not constrained; thus while The Petri net of Fig. 6 illustrates the a job is being processed the event ~A new modeling of this system. The '~job enters" job enters the system' may occur, before, transition in this illustration is a source; after, or simultaneously with the occur- the '~job leaves" transition is a sink. rence of the event 'Job processing is com- pleted'. Properties of Petri Nets Useful in Modeling A Petri net, like the system which it models, is viewed as a sequence of discrete The example above illustrates several events whose order of occurrence is one of points about Petri nets and the systems possibly many allowed by the basic struc- they can model. One is inherent concur- ture. This leads to a nondeterminism in rency or parallelism. There are two main Petri net execution. If at any time more kinds of independent entities in the sys- than one transition is enabled, then any of tem: the job and the processor. In the Petri the several enabled transitions may fire. net model, the events which relate solely The choice as to which transition fires is to one or the other can occur independ- made in a nondeterministic manner, i.e., ently; there is no need to synchronize the randomly or by forces that are not actions of the jobs and the processor. Thus modeled. This feature of Petri nets reflects jobs may enter or leave the system at any the fact that in real-life situations where time independent of the action of the proc- several things are happening concur- essor. However, when synchronization is rently, the order of occurrence of events is necessary, for instance when both a job not unique, so that any of a set of se- and an idle processor must be available for quences may occur. While nondetermi- processing to start, the situation is also nism is advantageous from a modeling easily modeled. Thus a Petri net would point of view, it introduces considerable seem to be ideal for modeling systems of complexity into the analysis of Petri nets. distributed control with multiple processes To reduce this complexity, one limita- occurring concurrently. tion is generally accepted in the modeling Another major feature of Petri nets is of systems by Petri nets. The firing of a their asynchronous nature. There is no in- transition (occurrence of an event) is con- herent measure of time or the flow of time sidered to be instantaneous, i.e., to take

Computing Surveys, Vol. 9, No. 3, September 1977 230 • J. L. Peterson zero time. Since time is a continuous vari- t able, then, the probability of any two or more events happening simultaneously is zero, and two transitions cannot fire si- multaneously. The events being modeled are considered primitive events, Note that this need cause no problems in the model- ing of events. For example, in Fig. 6 the event 'Process a job' was modeled. But since this event is not a primitive one (it FIGURE 8. Modeling of %lmultaneous" events takes nonzero time and other events, such which may occur m either order. as the entering and leaving of the system by other jobs, may occur at the same time), it is decomposed into a beginning and an tj ending, which are instantaneous events, plus the noninstantaneous occurrence. This is shown in Fig. 7. Since this tech- nique can be used for any nonprimitive P~ event, the modeling power of Petri nets is not reduced. The nondeterministic and nonsimulta- neous firing of transitions in the modeling of concurrent systems takes two forms. One of these is shown in Fig. 8, which FIGURE 9. Illustration of conflicting transitions depicts "simultaneous" events that may Transitions t~ and tk conflict since the firing of one occur in either order. In this situation the will disable the other. two enabled events do not affect each other in any way and the possible sequences of The two concepts illustrated by Figs. 8 events include some in which one event and 9, concurrency and conflict, are basic occurs first and some in which the other to an understanding of Petri nets. At the occurs first. same time, the usefulness of Petri nets as The other type of situation, where si- models of information flow derives from multaneity causes difficulties in modeling, the natural way in which they can be used is handled by defining events to occur non- to express and analyze concurrency and simultaneously. This is illustrated in Fig. conflict. 9. Here the two enabled transitions tj and An important aspect of Petri nets is that tk are in confhct. Only one transition can they are uninterpreted models. The net of fire, since in so doing it removes the token Fig. 6 has been labeled with statements from p, and disables the other transition. that indicate to the human observer the To accurately model a system using Petri intent of the model, but these labels dD nets requires careful attention to assure not, in any way, affect the execution of the that in cases such as the above the Petri net. The net of Fig. 10 is identical to that of net reflects all, and only those, event se- Fig. 6 in that it has an identical structure. quences which are possible in real life. However, no meaning is attached to the places and transitions in this uninter- NON-PRIMITIVE NON-PRIMITIVE preted net; we deal only with the abstract EVENT~~BEGINS EVENT~ properties inherent in the structure of the net. Since we are interested in the proper- ties of Petri nets per se, in this paper we concern ourselves only with uninterpreted NON-PRIMITIVE Petri nets. EVENTOCCURRING Another valuable feature of Petri nets is FIGURE 7. Modeling of a nonpnnutive event. their ability to model a system hierarchi-

Computing Surveys, "Col. 9, No. 3, September 1977 Petri Nets • 231 lelism into a sequential program in such a way as to maintain correct results is called t 1 determinate. The conditions for maintain- ing determinancy have been considered by Bernstein [10]. They are the following: For two operations a and b such that a pre- t cedes b in the linear precedence of the program, b can be started before a is done if and only ifb does not need the result of a as an input and the results of b do not FIGURE 10. An uninterpreted Petri net. change either the inputs or outputs of a [15]. cally. An entire net may be replaced by a One method of applying these con- single place or transition for modeling at a straints to the construction of the com- more abstract level (abstraction) or places puter control unit that is to issue instruc- and transitions may be replaced by sub- tions is to use a reservation table. An in- nets to provide more detailed modeling struction for functional unit u using regis- (refinement). Figure 11 illustrates this hi- ters ~, j, and k can be issued only if all four erarchical modeling capability. of these components are not reserved; if Most of the work on Petri nets has been the instruction is issued, all four of them in the investigation of the properties of a become reserved. If the instruction cannot given net or class of nets. Little explicit be issued at this time, the control unit attention has been paid to developing waits until the instruction can be issued modeling techniques specifically for Petri before continuing to the next instruction. nets. However, there are certain areas in This sort of scheme can be modeled as a which Petri nets would seem to be the Petri net. To each functional unit and each perfect tool for modeling: those areas in register we associate a place. If the unit or which events occur asynchronously and in- register is free, a token will be in the place; dependently. There are many examples, if it is not, no token will be in the place. some of which we present here. Figure 12 shows a portion of a Petri net which could be used to model the execution Modeling of Hardware of an instruction using unit u and regis- Large, powerful computer systems often use asynchronous parallel activities in an effort to achieve maximum parallelism and hence increase effective processing speed. In computers such as the CDC 6600 [91] and the IBM 360/91 [4], for example, multiple functional units are provided to perform computations on multiple regis- ters. The control unit of the machine at- tempts to keep several of these units in operation simultaneously. However, the introduction of parallel- ism in this manner must be controlled so that the results of executing the program with and without parallelism are the same. Certain operations in the program will require that the results of previous operations have been successfully com- FIGURE 11. Hierarchical modeling in Petrl nets by puted before the following instructions can replacing places or transitions by subnets (or vice proceed. A system which introduces paral- versa).

Computing Surveys, Vol. 9, No. 3, September 1977 232 • J. L. Peterson INSTRUCTION USES DlglT u READY TO DECODE AND REGISTERS i, j AND k NEXT INSTRUCTION ands, it can turn out results at the rate of one every t time units. ISSUE As an example, consider the addition of two floating-point numbers. The gross steps involved are: UNIT u ~~ a) Extract the exponents of the two numbers; IS FREEI~ ~UNiT b) Compare the exponents, and inter- REGISTER u OPERATING change if necessary to properly or- der the larger and smaller of the exponents; REGISTER (• j is FREE\V ]7 I' c) Shift the smaller fraction to equal- ~/ ~INSTRUCTION ize exponents; kREGISTERIsFREE ~ COMPLETED d) Add fractions; e) Post-normalize; FIGURE 12. A portion of a Petri net modeling a f) Consider exponent overflow or un- control unit for a computer with multiple registers derflow, and pack the exponent and multiple functional units. and fraction of the result. Each of these steps can be performed by a ters i,j, and k. Modeling the entire control separate computational unit, with a par- unit would of course require a much larger ticular operand being passed from unit to Petri net. unit for the complete addition operation. The scheme described above is a very The coordination of the different units simple method of introducing parallelism can be handled in several ways. Typically, and does not consider, for example, the the pipeline control is synchronous with fact that multiple functional units can use the time allowed for each step of the pipe, the same register as an input simultane- being some fixed constant time t; every t ously. Thus, this scheme may not produce time units, the result of each unit is schedules with maximum parallelism [55]. shifted down the pipe to become the input However, there are other schemes which for the next unit. However, this can un- can do so. These (more complicated) necessarily hold up processing, as the time schemes can also be modeled by (more needed may vary from stage to stage and complicated) Petri nets. For example, the may also vary for different inputs. For CPU of a CDC 6600 has been modeled by a example, the post-normalization step in Petri net [90]. This model was used to de- the floating-point addition above may take termine how object code should be gener- different amounts of time depending on ated to minimize execution time by maxi- how long the normalization shift should be mizing parallelism between the various and whether it should be to the left or to functional units. the right. Thus processing might be Another approach to the construction of speeded up by an asyrmhronous pipeline in a high-performance computer is the use of which results from stage k are sent on to pipelines [13]. This technique is useful, stage (k + 1) as soon as stage k is done and particularly for vector and array process- stage (k + 1) is free. This scheme can be ing, and is similar to the operation of an easily modeled by a Petri net. assembly line. The pipeline is composed of Consider an arbitrary stage in the pipe- a number of stages, which may be in exe- line. Operations at this stage require cer- cution simultaneously. When stage k fin- tain inputs and produce certain outputs. ishes, it passes on its results to stage (k + Obviously, there has to be a place to put 1) and looks to (k - 1) for new work. If each the inputs and outputs. Typically, this in- stage takes t time units and there are n volves registers: the unit uses the values stages, then the complete operation for one in its input register to produce values in its operand takes nt time units. However, if output register. It must then wait until 1) the pipe is kept supplied with new oper- a new input is available in its input regis-

Computing Surveys, Vol. 9, No. 3, September 1977

~ i ;~'~<~7:1 ~i.~# ~ Petri Nets • 233 ter and 2) its output register has been emp- gating the fault-tolerant properties of de- tied by being copied into the input register signs [48]. of the next stage. Thus the control for the pipeline needs to know when the following Modeling of Software conditions hold: • input register full; On a more abstract level, Petri nets can • input register empty; also model software concepts [24, 77, 61]. • output register full; Resource allocation, deadlock, and process • output register empty; coordination in an operating system can be • unit busy; modeled. A process can be modeled by a • unit idle; Petri net in the same way that it can be • copying taking place. modeled by a flowchart, and then the in- Figure 13 shows the Petri net which teractions between processes can be models the operation of an asynchronous modeled as additional places, arcs and pipeline of this kind. Other forms of pipe- transitions. line control units can also be defined in For example, consider the mutual exclu- terms of Petri nets. sion problem [25]. This is a problem of The above examples show some of the enforcing coordination of processes in such uses to which Petri nets can be put in the a way that particular sections of code modeling of hardware. Petri nets have also called critical sections, one in each proc- been associated with the description of ess, are mutually excluded in time. That general modular asynchronous systems is, if Process 1 is executing its critical sec- [22, 75] and macromodules [14]. At Honey- tion, then Process 2 may not begin its criti- well, Petri nets have been used for investi- cal section until Process 1 has left its own critical section. At its highest level of ab- straction, the situation is illustrated as \ / follows: /\ / Process I Process 2

f ours ~T ~!i!~tion ~~mt.~laC~ii~tion'Halt

GISTER

The problem is to define appropriate entry code and exit code to assure mutual exclu- sion. The mutual exclusion problem can be F OUTPUT easily solved by using P and V operations as defined in [25] for process synchroniza- tion and coordination. The P and V opera- tions operate on semaphores, and only P

! and V instructions may be executed on a

i semaphore. (A semaphore S is a variable \ / with integer values.) These operations can be defined as follows: FIGURE 13. Representation of an asynchronous pipelined control unit. The block diagram on the P(S): As soon asS > 0, setS:= S-l; left is modeledby the Petri net on the right. V(S): S:= S+I.

ComputingSurveys, Vol. 9, No. 3, September1977 234 • J. L. Peterson These are indivisible operations. A process executing a P operation must wait until the semaphore is positive before it can de- crement it and continue. A V operation simply adds one to the semaphore (per- haps allowing some other process to exe- cute a P operation). Two processes cannot execute P or V operations on the same semaphore concurrently. For example, Process I Process 2 P(mutex); P(mutex); "Crihcal Sechon"; "Critical Sechon"; V(mutex); V(mutex); is a solution of the mutual exclusion prob- FIGURE 15. A Petrl net model of a P/V solution to lem diagrammed above using P and V op- the mutual exclusion problem erations, which are primitive, and the semaphore "mutex" which is global to the two processes and has an initial value of ing up this technique of using Petri nets to one. prove properties of semaphore systems is P and V operations have been used reported in [57], [3], and [56]. widely. Systems of processes that use these These simple examples can only provide operations can be modeled by Petri nets a slight indication of the modeling power (see [74]). A semaphore is modeled by a of Petri nets and the many diverse systems place; the number of tokens in the place that can be modeled by them. Many other models the value of the semaphore. A V areas of study have been mentioned as operation on the semaphore places a token possible subjects of Petri net modeling, in- in the semaphore; a P operation removes a cluding resource allocation, operating sys- token (it waits until there is one to re- tems [71], queueing networks, traffic con- move, if necessary). This is illustrated in trol, distributed computer systems, legal Fig. 14. The mutual exclusion problem can systems [65], proofs in mathematics [30], then be modeled as shown in Fig. 15, in and brain modeling. While much work in which the place S models the semaphore. developing modeling techniques remains Note that places P2 and P4 are mutually to be done, Petri nets are a very powerful excluded. modeling tool that can be applied to a The modeling of P and V operations by large variety of systems. Petri nets has resulted in the discovery and proof of some limitations of these nets. 3. STRUCTUREOF PETRINETS Patil showed that certain process synchro- The use of Petri nets for the modeling of nization problems (such as the Cigarette concurrent systems requires a careful un- Smokers Problem) cannot be solved by P derstanding of the properties of such nets. and V operations [74]. Other work follow- The development of an appropriate theory has motivated most of the research on Pe- tri nets. This basic theory is presented in the following sections. Since this paper is tutorial in nature, we have tried to limit the formality of the presentation; however, all of the concepts presented here have been rigorously defined and formalized in ~(a) the literature. The reader who is inter- FIGURE 14. Examples of modehng with sema- ested in a more formal treatment should phores. (a) Modeling of a P operation; (b) Model- consult the references. ing of a V operation. Petri nets are composed of two basic

Computmg Surveys, Vol. 9, No 3, September 1977 Petri Nets • 235 components: a set of places, P, and a set of transitions, T. To complete the definition, it is necessary to define the relationship c4 between the places and the transitions. This can be done by specifying two func- tions connecting transitions to places: I, the input function, and O, the output func- t I tion. The input function I defines, for each transition t~, the set of input places for the transition I(t~). The output function O de- FIGURE 16. A Petri net graph. fines, for each transition tj, the set of out- put places for the transition O(tj). Similarly, an arc is directed from a transi- These four items define the structure of a Petri net. Places and transitions are the tion tj to a place pt if the place is an output fundamental undefined concepts of Petri of the transition. net theory; other concepts are defined in A Petri net graph is a directed graph terms of these concepts. Formally, a Petri since the arcs are directed. In addition, since its nodes can be partitioned into two net C is defined as the four-tuple C = (P, T,I,O). sets (places and transitions) such that each Consider the following example Petri arc is directed from an element of one set net structure, defined as a four-tuple. (place or transition) to an element of the other set (transition or place), it is a Each component of the structure is given: bi- partite directed graph. C = (P,T,I,O) The correspondence between Petri net P = {pl, I~, p~, t)4, ps} graphs and Petri net structures is so natu- T = {t,, t~, t3, tJ ral that in most work they are considered I(tO = {p~} O(t~) = {P2, P3, Ps} not merely as different representations for l(t~) = {/)2, P3, Ps} O(t2) = {Ps} the same concept, but rather as the same I(t3) = {P3} O(t3) = {P4} I(t4) = {P4} O(t4) = {I~, t~} concept. Thus we refer to either Petri net graphs or Petri net structures as Petri ThePetri Net Graph nets. In this paper we give our examples as Petri net graphs, but our discussion and Although the definition given above is techniques are defined in terms of Petri useful and appropriate for formal work net structures. with Petri nets, it is ill-suited for the illus- tration of many of the concepts of Petri Markings nets in an informal and intuitive, yet con- cise, manner. For this purpose a different A marking ~t of a Petri net is an assign- representation of a Petri net is more use- ment of tokens to the places in that net. ful: the Petri net graph. Figure 16 shows CToken" is a primitive concept for Petri the Petri net graph corresponding to the nets.) Tokens reside in the places of the structure described above. net. The number and position of tokens in A Petri net structure consists of places, a net may change during its execution. transitions, and the input and output func- The vector fe = (f¢~, ft2, "", ~) gives, for tions. In a Petri net graph there are two each place in the Petri net, the number of types of nodes corresponding to the places tokens in that place. The number of tokens and transitions of the Petri net structure: a in place pt is p~, i = 1, ..., n. We may also circle represents a place, and a bar repre- define a marking function/~: P --* N from sents a transition. The input and output the set of places to the natural numbers, functions are represented by directed arcs N = {0, 1, 2, ...}. This allows us to use the from the places to the transitions and from notation ~(pi) to specify the number of the transitions to the places. An arc is tokens in place p~. For a marking directed from a place p, to a transition tj if ~, ~(pt) = ~. the place is an input of the transition. On a Petri net graph, tokens are repre-

Computing Surveys, Vol. 9, No. 3, September 1977 236 • J. L. Peterson

of P2, P3, and P5 and then puts one token P2 in P5. t4 Firing a transition will in general change the marking of the Petri net,/~, to a new marking p'. Note that since only enabled transitions may fire, the number of tokens in each place always remains nonnegative when a transition is fired. -~P3 "3 Firing a transition can never remove to- kens that are not there: if any one of the FIGURE 17 A marked Petri net. input places of a transition contains no tokens, then the transition cannot fire. sented by small solid dots inside the circles Figure 18 summarizes the possible results representing the places of the net. Figure of firing a transition. If a place is an input 17 is an example of a Petri net graph with to the transition, one token is removed; if a marking. It represents the structure de- it is an output, one token is added. No net scribed in the previous section with the change occurs if the place is neither an marking p = (1, 0, 1, 0, 2). A Petri net C = input nor an output, or is both an input (P, T, I, O) with a marking ft becomes the and an output. In the latter case, it is marked Petri net, M = (P, T, I, O, Iz). necessary for a token to be in the input Since the number of tokens in a place is place even though no change in marking unbounded over the set of all markings, occurs for this place. there is an infinite number of markings for a Petri net. It is, of course, a denumerable infinity. The State Space of a Petri Net The state of a Petri net is defined by its Execution Rules for Marked Petri Nets marking. Thus the firing of a transition represents a change in the state of the net. Having presented the definitions and rep- The state space of a Petri net with n places resentations of Petri nets and their mark- is the set of all markings, i.e., N". The ings, we now present the execution rules for marked Petri nets. A Petri net executes by firing transi- tions. A transition may fire if it is enabled. tj tj A transition is enabled if each of its input places has at least one token in it. In Fig- Pl I not ure 17, for example, since the inputs to in transition t2 are placesp2, p3, andps, tran- I(tj) sition t2 is enabled if p2 has at least one © token, p3 has at least one token, andp5 has at least one token. ~'(pi) = ~(pi ) ~'(pi ) = u(pi ) + 1 A transition fires by removing one token t. t. from each of its input places and then de- 3 3 positing one token into each of its output Pi places. Transition t3 in Fig. 17, with I(t3) = in I(tj) {P3} and O (t3) ---- {P4}, is enabled whenever there is at least one token in place P3. Transition t3 fires by removing one token fromp3 (its input) and placing one token in ~'(Pi ) " ~(pi ) - 1 ~*(Pi ) = U(pi ) + 1 - 1 P4 (its output). Extra tokens in P3 are not = ~(pi ) affected by firing t3 although they may enable additional firings of t3 later. Transi- Pi not in O(t 3) Pi in O(tj) tion t2 with I(t2) = {P2, P3, P5} and O(t2) = FIGURE 18. The changes in the marking of a place {P5} fires by removing one token from each p, which result from firing a tranmhon tj.

Computing Surveys, Vol. 9, No. 3, September 1977 Petri Nets • 237 change in state caused by firing a transi- The Reachability Set of a Petri Net tion is defined by a partial function 8, called the next-state function. Application From a marking ft, a set of transition fir- of this function to a marking ft and a tran- ings is possible. The result of firing a tran- sition tj yields the value of the marking sition in a marking ft is a new marking ft'. that results from the firing of transition tj We say that ft' is immediately reachable in marking ft. Since t~ can fire only if it is from ft if we can fire some enabled transi- enabled, 8(ft, tj) is undefined if t~ is not tion in the marking ft resulting in the enabled in marking ft. Iftj is enabled, then marking ft'. A marking ft' is reachable 8(ft, tj) = ft', where ft' isthe marking that from ft if it is immediately reachable from results from removing tokens from the in- ft or is reachable from any marking which puts of tj and adding tokens to the outputs is immediately reachable from ft. We then oftj. define the reachability set R(M) for a Given a Petri net and an initial marking marked Petri net M = (P, T, I, O, ft) as the fto, we can execute the Petri net by succes- set of all markings which can be reached sive transition firings. Firing a transition from ft. This is the reflexive transitive tj in the initial marking produces a new closure of the "immediately reachable" re- marking ftl = 8(fto, tj). In this new mark- lationship. ing, we can fire any new enabled transi- The reachability set of a marked Petri tion, say tk, resulting in a new marking net is the set of all states into which the ft2 = 8(ftl, tk). This can continue as long as Petri net can enter by any possible execu- there is at least one enabled transition in tion. Hence many analysis questions deal each marking. If we reach a marking in with properties of the reachability set of a which no transition is enabled, then no Petri net. (This is discussed in more detail transition can fire and the execution of the in Section 4.) Petri net must stop. Considering a Petri net in terms of As an example of Petri net execution, states and state changes may obscure consider the execution of the marked Petri some of the more important concepts relat- net of Fig. 17. In the marking/.to = (1, 0, 1, ing to concurrent systems that can be 0, 2), two transitions, tl and t3, are ena- modeled by Petri nets. One of these is the bled. Choosing one arbitrarily, we can fire concept of local changes in state, as t3 producing the marking 8(ft°, t3) = (1, 0, modeled by transitions. In a complex sys- 0, 1, 2) = ft~. In this marking, transitions tl tem composed of independent asynchro- and t4 are enabled. Firing t4 changes the nously operating subparts, each part can marking to 8(ft ~, t4) = (1, 1, 1, 0, 2) = ft2. In be modeled by a Petri net. The enabling ft2, t~, t2, and t3 are enabled. Firing tl re- and firing of transitions are then affected sults in ft3 = 8(ft2, t~) = (0, 2, 2, 0, 3). This by, and in turn affect only, local changes process can continue as long as at least one in the marking of the Petri net. Separate transition is enabled. parts of the total system may operate inde- Two sequences result from the execution pendently and concurrently. The view of of the Petri net: a sequence of markings Petri nets presented here, with a global (fto, ft], ft2, ...), and a sequence of transi- state and a global sequence of transitions, tions (t~o), tj(1), tj~2), "") such that 8(ft k, t~k)) can hide the inherent modularity and con- = ftk+~ for k = 0, 1, 2, .... In the example currency in the Petri net model. However, above the transition sequence was t3, t4, t], despite some important objections to this •"; therefore Jo = 3, jl = 4, J2 = 1, "". automata-theory-related conception [44], Given the transition sequence and ft°, we most research in the United States has can easily derive the marking sequence for been based on this approach. the execution of the Petri net and, except 4. ANALYSIS OF PETRI NETS for a few degenerate nets, given the mark- ing sequence we can derive the transition Why should systems be modeled as Petri sequence. Both of these sequences thus nets? Originally, the purpose was mainly provide a record of the execution of the net. descriptive. Petri nets with their uniform

Computmg Surveys, Vol. 9, No. 3, September 1977 238 • J. L. Peterson

and simple execution rules, can be used to that the analysis procedures are to an- describe a system in terms of simple con- swer, and the properties to be studied. Ob- cepts which provide a natural way to de- viously, the analysis techniques should be pict systems of asynchronous concurrent oriented towards the solution of those processes [24]. After a short time, how- problems that most need to be solved ever, it became obvious that another use of rather than towards areas that are only of Petri nets was to take the description of academic interest. We discuss now some of the system, as a Petri net, and analyze it the properties that have been investigated for the presence of desirable or undesirable for Petri nets. properties. A body of work is being devel- One property of Petri nets derives from oped which is aimed at deriving, from a their original definition in terms of events Petri net, properties of the net, and from and conditions. A condition is represented these, the properties of the system which by a place. The fact that the condition the net models. Some of the analytic ques- holds is indicated by a token in the place. tions that one would like to ask about a Consider, however, that either a condition Petri net are quite difficult; hence, re- holds or it does not hold. Hence, a token stricted subclasses of Petri nets have been should either be present or it should be defined to make analysis easier in specific absent. Also, no more than one token situations. (This will be discussed in Sec- should ever be present in one place at one tion 6.) time, as it seems pointless to have multi- Following this train of thought, another ple tokens when one is sufficient. Petri use of Petri nets would seem to be in the nets which are constructed such that no design of concurrent systems. One method more than one token can ever be in any of design would consist in first creating a place of the net at the same time are safe design in a traditional representation, for nets [44]. example, a logic circuit or a program. Another definition of a safe net is the Then the design would be converted into a statement that there is a bound on the Petri net and the Petri net analyzed. If no number of tokens in any place of the net, design errors were discovered, the design and that bound is 1. A natural generaliza- could then be implemented in the tradi- tion of this is to allow multiple tokens in a tional manner. If there were errors, how- place but only to the extent that there are ever, it would be necessary to determine no more than k tokens in any given place how the error which was found in the Pe- at the same time• Nets in which the num- tri net representation manifests itself in ber of tokens in any place is bounded by k the original design, modify the design, and are called k-bounded nets. (Thus a safe net repeat the entire process of conversion to a is a 1-bounded net.) If a net is k-bounded Petri net and analysis. This process could for some k but we do not know the value of be simplified if the design process could be k, it is simply called bounded. carried out directly in Petri nets and the Boundedness is a very important practi- resultant Petri net implemented directly. cal property of Petri nets. If we wish to This approach requires that both the nec- implement a design modeled by a Petri essary design techniques and the methods net, then since the capacity of any given for implementing Petri net designs, in hardware is bounded, the Petri net must hardware or software, be developed. be bounded if construction is to be possible. Although some work on design with Pe- In other words, if, for example, places are tri nets [67] and implementation of Petri to be implemented as counters, then since nets [73, 27, 75] has been done, it has been every physically realizable counter can limited in scope, presumably because its only hold a bounded number, the net must success hinges on the existence of effective also be bounded. analysis techniques. Another property that might be impor- tant is conservation of tokens. If tokens Analysis Questions are used to represent resources, then it The first task in developing analysis tech- follows that since resources are neither niques is to define the types of questions created nor destroyed, tokens should also

Computing Surveys, Vol. 9, No. 3, September 1977 Petri Nets • 239

be neither created nor destroyed. A Petri net is conservative if the number of tokens in the net is conserved. This implies that each transition in a conservative net is conservative, in the sense that the number of inputs of each firable transition is equal to the number of outputs of that transition. More generally, weights can be defined for 2 each place allowing the number of tokens to change as long as the weighted sum is constant [62]. Notice that the above statement was P3 t 3 qualified to restrict it to firable transi- Fmvmz 19 A Petri net with a nonfirable transi- tions. Consider the Petri net of Fig. 19, tmn. Tranmtmn t3 is dead in this marking. which depicts a nonfirable transition. Transitions tl and t2 are conservative. A number of different definitions of live- Transition t3 is not conservative, in the ness have been considered. Commoner [16] sense that if it ever fired it would decrease defines four subtly different forms of live- the number of tokens by two. However, for hess for a transition tj and a marking ~: any initial marking in which the number LI: If there exists a p' in R (M) such of tokens inp3 is zero, this transition is not that 8(/~', tj) is defined (i.e., tj is po- firable and hence the number of tokens in tentially firable); the net is conserved. This means, then, L2: If for every positive integer n there that the transition t3 and place P3 can be exists a transition sequence ~ such deleted from the net, simplifying it, with that 8(~, ~) is defined and t~ appears no change in its behavior. This would al- at least n times in ~; low a simpler and cheaper implementa- L3: If there exists an infinite sequence tion. of transition firings such that 8(/~, The notion of transitions that cannot ~) is defined and t~ appears infi- fire seems strange, and we want to be able nitely often in ~; to identify such transitions. Note that a L4: If t~ is live (i.e., potentially firable transition which cannot fire is not simply a in all reachable markings). transition which is not enabled, but rather Note that the implications of the four defi- a transition which cannot become enabled. nitions of liveness are quite different (see A transition is dead in a marking if there [53]). Thus, whenever the property of live- is no sequence of transition firings that ness in a Petri net is discussed, it is impor- can enable it. A transition is potentially tant to state carefully the definition being firable if there exists some sequence that used, since we do not yet have a single enables it [35]. A transition of a Petri net commonly accepted definition. is live if it is potentially firable in all As mentioned earlier, the concept of reachable markings. liveness was developed to deal with dead- The importance of the concepts of live- lock problems in operating systems. Other hess and deadness of transitions comes problems in operating systems can also be from considerations in the modeling of op- posed in terms of Petri nets. The actual erating systems. Liveness is tied to the statement of these questions depends upon concept of deadlocks and deadlock-freeness the manner in which the system is [45]. Thus it may be important not only modeled. For example, access to a resource that a transition be firable in a given may be modeled by a transition or a place. marking, but that it stay potentially fira- The mutual exclusion problem is to assure ble in all markings reachable from that that at most one of perhaps several proc- marking. If this is not true, then it is esses tries to access the resource at the possible to reach a state in which the tran- same time. Depending on the modeling sition is dead, perhaps signifying a possi- used, this will be expressed as a question ble deadlock. concerning whether or not two transitions

Computing Surveys, Vol, 9, No. 3, September 1977 240 • J. L. Peterson can be enabled simultaneously or whether Notice, however, that the reachability or not two places may have tokens simul- set of a marked Petri net is often infinite. taneously. Thus, to form a finite representation of an Notice, however, that both of these infinite set we must map many markings questions can be stated in terms of the into the same node of the tree. This many- reachability of any of a set of undesirable to-one mapping is accomplished by collaps- states. In fact, many questions can often ing a set of states into a node by ignoring be reduced to the reachabdity problem. the number of tokens in a place of the net The reachability problem is simply the fol- when this number becomes "too large." lowing: Given a marked Petri net (with This is represented by using a special sym- marking ~) and a marking ~', is ~' reach- bol, ¢o, for the number of tokens in this able from ~? This problem is very impor- place. tant to the analysis of Petri nets. It can be The symbol co represents a value which considered a special case of the set reacha- can be arbitrarily large. Because of this we bility problem, which is to determine if a must interpret the operations of addition, set of markings, S = {~1, g2 .... gk}, is a subtraction, and comparison as subset of the reachability set R(M) of a marked Petri net. co + a =¢0 There are many other interesting ques- tions that might be studied with Petri a<¢o nets. Furthermore, since the questions de- for any natural number a. Thus, co might signers want to ask about their designs be thought of as a symbol for infinity. depend on the projected use of the designs, Each node in the reachability tree is there will always be new questions. Thus labeled with a marking; arcs are labeled it is important to develop general tech- with transitions. The initial node (root of niques that allow new types of questions to the reachability tree) is labeled with the be answered. The basis for the importance initial marking. Given a node x in the of the reachability problem is that many tree, additional nodes are added to the tree questions about the correctness of systems for all markings that are directly reach- modeled as Petri nets can be translated able from the marking of the node x. For into instances of this problem. For in- each transition t~ which is enabled in the stance, Hack has shown that the liveness marking for node x, a new node with problem (are all transitions live?) is redu- mark~g 8(x, tj) is created, and an arc la- cible to the reachability problem and that beled t~ is directed from the node x to this in fact the two problems are equivalent, new node. This process is repeated for all since reachability is also reducible to live- new nodes. ness [35]. Continuing this process will obviously create the entire state-space. A path from Solution Techniques the initial marking (root) to a node in the While several approaches to the analysis tree corresponds to an execution sequence. of Petri nets have been considered, almost Since the state-space may be infinite, two all work in this area eventually uses one special steps are taken to define a finite basic technique. This technique involves reachability tree. First, if a new marking finding a finite representation for the is generated which is equal to an existing reachability set of a Petri net, in recogni- marking on the path from the root node to tion of the fact that many of the properties the new marking, the new (duplicate) of a Petri net are based on properties of its marking becomes a terminal node. Since reachability set. The representation used the new marking is equal to the previous is known as the reachability tree. It con- marking, all markings reachable from it sists of a tree whose nodes represent mark- have already been added to the reachabil- ings of the Petri net and whose arcs repre- ity tree by the earlier identical marking. sent the possible changes in state resulting Second, if any new marking x is gener- from the firing of transitions [51, 53]. ated which is greater than a marking y on

Computmg Surveys, Vol 9, No. 3, September 1977 Petri Nets • 241 the path from the root node to the marking x, then those components of marking x which are strictly greater than the corre- t 2 sponding components of marking y are re- placed by the symbol oJ. Since marking x is p2p greater than marking y, any sequence of transition firings which is possible from Pl 4 marking y is also possible from marking x. In particular, the sequence that trans- formed marking y into marking x can be ~3 repeated indefinitely, each time increas- FIGURE 20. A Petn net with marking (1,0,1,0) and ing the number of tokens in those places infinite reachable state-space. which have a ¢o. Thus the number of to- kens in these places can be made arbitrar- (1,0,1,0) ily large. As an example of this construction, con- sider the marked Petri net of Fig. 20. We (1,0,0,1) begin with (1, 0, 1, 0) as the root of the tree. In this marking, we have only one enabled transition. Thus we have a new node corresponding to firing t3, (1, 0, 0, 1) (1,~,1,0) and an arc from (1, 0, 1, 0) to (1, 0, 0, 1). From this marking we can fire t2, resulting in (1, 1, 1, 0). Now, since (1, 1, 1, 0) -> (1, 0, 1, 0), we replace the second component by (1~,0,0) (1,~,0,1) oJ. This reflects the fact that we can fire the sequence t3t2 an arbitrary number of times and make the number of tokens in place p2 as large as desired. In the mark- (1,~,1,0) ing (1, co, 1, 0), two transitions are ena- FIGURE 21. The reaehabihty tree of the Petri net of bled, tl and t3. Firing these two would give Fig. 19. us two new nodes, (1, ~0, 0, 0) and (1, w, 0, 1). The first of these has no successors In the same way, consider a conserva- since 8((1, co, 0, 0), t,) is undefined for all t~. tive Petri net. If we let k be the number of The second enables t2, which fires to give tokens in the net, then we must always (1, ~, 1, 0) which is identical to an earlier have k tokens in the net. Since there are node. Thus, the complete reachability tree only a finite number of ways to partition k is as shown in Fig. 21. tokens among n places, we must again have a finite reachability set. Analysis Using the Reachability Tree Now consider the reachability tree. If any node in the reachability tree contains How is the reachability tree used for anal- the symbol o~, then that component can ysis? Let us consider some of the questions become arbitrarily large, i.e., it is not raised in the previous section. bounded. Thus, if the symbol ~o is any- On the questions of safeness and bound- where in the reachability tree, the reacha- edness, notice that if a Petri net is k- bility set is not finite and hence neither bounded, then, by definition, no more than bounded nor conservative. On the other k tokens are ever in any place. Thus the hand, if the co symbol does not occur any- possible values for each place are drawn where in the tree, then the reachability from the set {0, 1 ..... k} and there are tree is the reachability set and both are only (k + 1)n possible reachable markings. finite. This means that the reachability set Therefore, the reachable state-space is is bounded, and the bound can be estab- finite. lished by inspection. Similarly, if the

Computing Surveys, Vol. 9, No. 3, September 1977 242 • J. L. Peterson

reachability set is finite, conservation can Unsolvable Problems be determined by inspection. In fact, for a finite reachability set, any analysis ques- Some Petri-net problems are not solvable tion can be solved by inspection. despite their apparent similarity to the Other problems can also be solved using reachability problem. The first such prob- the reachability tree. For example, the lem studied was the subset problem: given coverability problem can be solved by in- two marked Petri nets, is the reachability spection of the reachability tree [51, 35]. set of one net a subset of the reachability The coverability problem is the following: set of the other net? Rabin showed this Given a marked Petri net M and a mark- problem to be undecidable [9, 33]. Later ing /~, does there exist a marking/~' in Hack showed that the equality problem- R(M) such that ~' -> re? This problem is given two marked Petri nets, is the reach- useful in determining whether violations ability set of one net equal to the reacha- of mutual exclusion occur in a system, and bility set of the other net?-is also unde- in testing transitions for liveness (dead- cidable [36]. lock). These problems are important for appli- cations in which one might want the Petri nets to be optimized, but the set of reacha- The Reachability Problem ble markings not to be changed. Unfortu- nately, it has been shown that both of The more general questions of liveness these problems are undecidable in the and reachability are not answerable by the sense that there exists no general algo- reachability tree. Because of the funda- rithm which can decide, for two arbitrary mental nature of the reachability problem marked Petri nets, if their reachability in the analysis of Petri nets and vector sets are equal or one is the subset of the addition systems- an equivalent modeling other. This proof is quite complicated. It is system [51, 34]-it has been the object of a based on the construction of a Petri net considerable amount of research. It has which (weakly) computes the value of a been shown that the general reachability polynomial in such a way that if the equal- problem is equivalent to several special ity problem is decidable then Hilbert's cases such as the zero reachability problem tenth problem is solvable. Since Hilbert's (is the zero vector an element of the reach- tenth problem is known to be unsolvable, ability set?) [70] and the subset reachabil- the equality problem is undecidable. This ity problem (given a nonempty subset of in turn implies the undecidability of the places and a marking ft, is any reachable subset problem. marking equal to ~ for the specified subset of places, with all other places allowed to have any value?) [34]. These problems are Complexity equivalent in that if an algorithm can be While much attention has been focused on found to solve any one of them it can be the decidability of the reachability prob- modified to solve any of the others. lem and similar problems, other aspects of Such an algorithm has recently been Petri net analysis procedures have also found [88]. The algorithm is very difficult been investigated. One aspect that has re- to follow and depends upon both a search cently come under investigation is the through a finite tree of possible solutions computational complexity of the problem. and the recursive solution of reachability While it is not yet possible to determine problems for lower-dimensional state- the complexity exactly, it is possible to spaces. However, regardless of the com- give its lower bounds. Lipton has shown plexity of the algorithm, its existence that the reachability problem is exponen- shows that the reachability problem is tial time-hard and exponential space-hard solvable (although possibly at a high cost). [64]. That is, the amount of time and mem- Since the liveness problem is equivalent ory space needed to solve the reachability to the reachability problem [35], it also is problem must be at least an exponential solvable. function of the length of the input descrip-

Compum~g Surveys, Vol. 9, No. 3, September 1977 Petri Nets • 243 tion of the Petri net (in the worst case). Several varieties of Petri net languages This is a lower bound; the actual complex- result from slightly different approaches to ity could be much worse. Lipton also shows defining the languages of a Petri net. One that the coverability problem has an expo- entire group of languages results from the nential space lower bound. Rackoff [83] use of different labeling policies, since re- has obtained an algorithm for solving cov- strictions on the allowable labeling func- erability in exponential space, showing tions create restricted classes of Petri net this to be a tight lower bound. The com- languages. plexity of some other problems in Petri The free languages are those obtained nets has also been considered [49]. when one introduces the requirement that These complexity analyses are very im- all transition labels be distinct and non- portant in determining the usefulness of null, i.e., ~(t~) 4= ~(t~ for t~ dffi t~. This re- Petri nets for the modeling and analysis of quirement reflects the view that since systems. The recent discovery that the distinct transitions model distinct events, reachability problem is decidable marked they should be distinctly labeled. a significant advance in the search for A more general class of languages re- analysis techniques; however, the com- suits if one allows a more general label plexity bounds as well as the large number function in which many transitions may of places and transitions needed to model be labeled with the same symbol. This re- even simple systems tend to indicate that, flects the view that the same action can although analysis questions may be decid- result from different circumstances, and able using Petri nets, in the worse case the hence may be modeled by different transi- cost of answering even simple questions tions. The modeling process may even in- may make such analysis unfeasible. troduce some "extra" transitions that are necessary for proper token movement but 5. PETRI NET LANGUAGES do not correspond to actions of interest in Another area in which Petri nets have the modeled (real) system. been used is the study of formal languages A third class of labeling functions allows (see [79, 37]). Here Petri nets are used to transitions to be labeled with the null la- model the flow of information and control bel h. A null label is defined as a label of actions in a system. The firing of a which does not show up in the string re- transition models the occurrence of an op- sulting from an execution of the Petri net. eration in the modeled system. A Petri net As an example of the differences of these properly models a system if every se- labeling policies, consider the Petri net of quence of actions in the modeled system is Fig. 22. Let the language under considera- possible in the Petri net and every se- tion be the set of sequences whose net re- quence of actions in the Petri net repre- sult is to move the token in place Pl to sents a possible sequence in the modeled place P4 (i.e., the set of sequences {t E system. T*18((1, 0, 0, 0), t) = (0, 0, 0, I)}). If we To represent these concepts, we label label the transitions with the free labeling the transitions of a Petri net; with each transition we associate a symbol naming ~l(t,) = a al(t3) = b the transition. Since there are only a finite ~r~(t~) = c (r~(t~) = d, number of transitions, we can define a then the language is {ancbndln >-- 0}. A finite alphabet Z which is the set of all these symbols. A labeling function (r maps nonfree but h-free labeling such as transitions to symbols, i.e., a:T--*Z. A la- Or2(tl ) = a O'2(t3) ffi b beled marked Petri net defines a set of ~(t~) = a a~(tJ = b strings over Z, each string corresponding to a possible execution of the net. The set yields the language {a"b" In > 0}. If transi- of all possible strings corresponding to the tion tl is assigned a null label, then the possible executions of a marked labeled language which results could be the regu- Petri net defines a Petn net language. lar language {ab*c}.

Computmg Surveys, Vol. 9, No. 3, September 1977 244 • J. L. Peterson

t~ t3 -[ Qp a b 4 k.L/pl \I2 "k.Jp 3 -It4 -- FIaum~ 22. A Petn net with marking (1,0,0,0). FIGURE 23. Labeled marked Petm net correspond- mg to the net of Fig. 22. The class of labeling functions is only one of the determinates of Petri net lan- related. Preliminary investigations have guages. Another is the definition of the set shown that a number of containment rela- of final states. Remember that a language tionships hold between the classes. For ex- is the set of all possible sequences result- ample, since the labeling functions are ing from the execution of a labeled Petri successively more general, all Petri net net starting in an initial marking (or one languages with free labelings are also Pe- of a finite set of initial markings) and ter- tri net languages with k-free labelings minating in any element of a set of final which in turn are also Petri net languages markings. Different classes of languages with arbitrary labelings. It can be shown correspond to different definitions of the that all P-type languages are also G-type set of final markings. languages, that all G-type and T-type lan- Four types of Petri net languages have guages with arbitrary or k-free labelings been defined in terms of the definition of are L-type languages with the same type final markings [39]: of labeling, and that L-type languages L-type: The set of final markings is de- with arbitrary labelings are also T-type fined by a finite final marking setF; languages. These relationships are shown G-type: Given a finite marking set F, a in Fig. 24, in which an arc between classes final marking is any marking is used to indicate that one class is con- which is greater than or equal to tained within the other. It is not known any element of F; whether other arcs might also exist or T-type: A final marking is any terminal which containments are proper. marking (a marking in which no The L-type and P-type languages have transition is enabled); been investigated in greater depth. L-type P-type: All reachable markings are final languages have been shown to be closed markings. under union, intersection, concatenation, As an example of the differences be- concurrency, reversal and k-free homo- tween these different language classes, ARBITRARY A-FREE FREE consider the Petri net of Fig. 23, which is a LABELING LABELING LABELING labeled version of the net of Fig. 22. (The labeling shown is free, but that is not im- portant.) For a final state set F = {(0, 0, 1, T-type TA ~ T Tf 0)}, the L-type language is {a"cb" In >- 0}, the G-type language is {amcb ~ t m >- n >- 0}, the T-type language is {amcb"d l rn >_ n >- L-type ~ L Lf 0}, and the P-type language is {am I m - 0} t.) {amcb" I m >- n ~ O} U {amcb"d I m >- n 0}. G-type !A ~_! Gf With three different kinds of labeling functions and four different kinds of final- 1 state sets, twelve different classes of Petri P-type !A ~ ! ~ pf net languages can be defined. Despite FIGURE 24. Relationships among the different their differences, these classes are closely classes of Petri net languages.

Computing Surveys, Vol. 9, No 3, September 1977 Petri Nets • 245 morphism [77, 37]. P-type languages are TYPE- 0 more restrictive but are still closed under union, intersection, concatenation and concurrency [37]. Hack has developed a CONTEXT-SENSITIVE characterization theorem for L-type lan- guages showing that the class of L-type / \ languages is the smallest of languages PETRI NET CONTEXT-FREE that includes a finite language and the LANGUAGES~ ~ I complete parenthesis language and is closed under inverse homomorphism, con- REGULAR BOUNDED currency, intersection and k-free homo- CONTEXT-FREE morphism. (The complete parenthesis lan- FmURE 25. Relationshipsamong Petri net lan- guage is the context-free language over guages and the clasmcal language classes. two symbols {(,)} whose strings are properly nested parenthesis strings [37].) The relation of Petri net languages (of stances of the nonterminals. The major the L-type) and other classes of languages difference of this approach is the lack of has also been examined. All regular lan- ordering information in the Petri net con- guages are Petri net languages. Some con- tained in the sentential form of the deriva- text-free languages are Petri net lan- tion. To accommodate it, Crespi-Reghizzi guages and some Petri net languages are and Mandrioli defined the commutative context-free, but neither class includes the grammars, which are isomorphic to (gen- other. Their common intersection includes eralized) Petri nets. In addition, they con- regular languages and bounded context- sidered the relationship of Petri nets to free languages, among others. Surpris- matrix, scattered-context, non-terminal- ingly, the complement of a free Petri net bounded, derivation-bounded, equal-ma- language is context-free [18]. All k-free trix, and Szilard languages. For example, Petri net languages are context-sensitive it is not difficult to see that the class L r is [77]. These relationships are illustrated in the set of Szilard languages of matrix con- Fig. 25. In this diagram, an arrow between text-free languages [21]. Similar work by two classes of languages indicates proper Keller considered the class of commutative containment. Note that Petri net lan- semi-Thue systems [53]. Keller has also guages appear to be roughly equivalent to pointed out that k-free languages are a context-free languages in complexity (and subset of real-time counter languages [26]. interest). It should be pointed out that this entire The original impetus for studying Petri approach to Petri nets and languages may net languages was to try to settle some of represent an approach from the wrong di- the decidability questions for Petri nets. It rection: Petri nets were designed to repre- has been shown [37] that the membership sent concurrent activity, yet the represen- problem for Petri nets with k-free or free tation of a Petri net execution by a string labelings is decidable, but the inclusion forces all activity to be represented seri- and equivalence problems for P, P~, L and ally, incorrectly implying a total ordering L ~ languages are undecidable. Many de- between events. Some work has consid- cidability problems are equivalent to the ered other representations of the partial reachability problem and thus decidable. orderings resulting from concurrent activi- A different approach to the study of Pe- ties [43, 85], but further research is needed tri nets by the use of formal language the- in this area. ory has been considered by Crespi-Re- ghizzi and Mandrioli [19]. They noticed 6. EXTENSIONS AND SUBCLASSES the similarity between the firing of a transition and the application of a produc- The success of any model is due to two tion in a derivation in which places are factors: its modeling power and its decision nonterminals and tokens are separate in- power. Modeling power refers to the abil-

Computing Surveys, Vol. 9, No. 3, September 1977 246 • J. L. Peterson ity to correctly represent the system to be modeled by transitions and may occur modeled so that the model will be a faith- whenever tokens indicate the availability ful representation of the modeled system. of the reactants. The firing of the transi- Decision power refers to the ability to ana- tion models the reaction, which consumes lyze specific versions of the model and de- inputs (reactants) and produces outputs termine properties of the modeled system (products). Notice that a chemical reaction [54]. may well require more than one unit of a These two factors generally work at particular reactant. This is modeled by al- cross purposes. Consider, for example, fi- lowing multiple arcs between transitions nite-state systems. Since the set of reach- and places, signifying the number of to- able states is finite, it is possible to answer kens needed. Figure 26 illustrates a Petri almost any question about a finite-state net model of a reaction that needs three model; hence such a model has very high C12 and two P to produce two PCI~. In order decision power. On the other hand, the for the transition to fire, at least three Cl2 class of systems which can be modeled is and two P must be available. The firing of severely limited, which means that such a the transition absorbs these tokens and model has very low modeling power. Tur- produces two tokens in its output place. ing machines, by contrast, have good Petri nets that allow multiple arcs have modeling power but, since most general been called generalized Petri nets [34, 54]. questions are undecidable, have poor deci- Hack has shown that these nets are equiv- sion power. When we increase modeling alent to ordinary Petri nets (at most one power (and hence the complexity of the arc between a place and a transition). models and the modeled systems), our Hence although this change may increase ability to algorithmically determine the the convenience of use, it does not change properties of the models is generally de- the fundamental modeling power or deci- creased. sion power of Petri nets. Most researchers Petri net models represent an attempt to thus use generalized Petri nets in their compromise between these two factors. work, often ignoring the distinction be- They have better modeling power than fi- tween them and what we have defined as nite-state models while (one hopes) retain- Petri nets in this paper. ing most of the farter'sdecision power. As A more fundamental extension of Petri a matter of fact, Petri nets were originally nets was undertaken by a number of au- defined in answer to the limited modeling thors [1, 5, 73] in response to difficultiesin power of finite-state models. the modeling of priority systems with Petri Not all researchers have been satisfied nets. This extension involves so-called with the modeling power of Petri nets, zero-testing [53]: the introduction of arcs however. It is difficult to model some from a place Pi to a transition t~ which events or conditions in systems by Petri allow the transition to fire only if the place nets, and it has been shown that the cor- rect modeling of other relatively reasona- ble systems is impossible [3, 57]. Thus sev- eral proposals have been put forth for ex- tending the modeling power of Petri nets. 1 © Extended Petri Nets PCl3 One of the first extensions is to remove the constraint that a place may contribute or receive only one token from the firing of a transition. Consider the modeling of chem- ical reactions. Here a token in a place Fmun 26. Petri net model of a chemical reaction, represents the availability of a certain illustrating the concept of multiple input and out- molecule or atom. Chemical reactions are put ares between a transition and a place.

Comlzlting Surveys, Vol. 9, No. 3, September 19"/7 Petri Nets • 247 has been shown to be decidable. However, Pl ~ P2 research on the complexity of the reacha- bility problem has shown that even though 7 it is decidable, it is very difficult to solve. Thus, from a practical point of view, Petri nets may be too powerful to be analyzed. The result of this has been the definition of a number of subclasses of Petri nets, in hopes of finding a subclass with (known) P3 P4 decision power and still adequate model- ing power for practical purposes. These subclasses are defined by restrictions on their structure intended to improve their analyzability. FIOUaE 27. An extended Petri net which has no Two subclasses are most commonly con- equivalent narrowly defined Petrl net. sidered, state machines and marked graphs [44]. State machines are Petri nets p, has zero tokens in it. These special arcs which are restricted so that each transi- have been drawn in several ways. We rep- tion has exactly one input and one output. resent them as shown in Fig. 27. Note that These nets are obviously conservative and transition c2 can fire only if places P4 and hence finite-state. In fact, they are exactly b~ each have at least one token in them the class of finite-state machines. This is and place b l has exactly zero tokens. The clearly shown by considering the state arc from b~ to c2 is called an inhibitor arc; graph of a finite-state machine, as in Fig. it gives transition cl priority over transi- 28a. The nodes of this graph represent the tion c2. states of the finite-state machine. An arc The addition of inhibitor arcs is a major from state i to state j labeled x indicates extension of the concept of Petri nets. that there is a transition from state i to Agerwala has shown that Petri nets ex- state j with input x. Note that this state tended in this manner have the modeling graph is nondeterministic. The graph of power of a Turing machine and hence can Fig. 28a can be converted to an equivalent also be used to show that many decision Petri net by simply making each state a problems are undecidable [1]. Many other place, and making each arc between two extensions of Petri nets including the in- places a transition. This is illustrated in troduction of priorities between transi- Fig. 28b. Note that this Petri net is con- tions, time bounds on transition firings servative. If the state graph had been non- [66], or constraint sets that prohibit tokens deterministic, then the Petri net would residing simultaneously in two places [73] also have this characteristic. Finite-state are equivalent to Petri nets with inhibitor machines, being finite, have very high de- arcs and hence to Turing machines. In cision power, but they are of limited use- terms of modeling power Petri nets seem fulness in modeling systems which are not to be just below Turing machines, so that finite. any significant extension results in Tur- Marked graphs, the dual of state ma- ing-machine equivalence [78]. chines, have also been studied extensively [17, 44]. A marked graph is a Petri net in Subclasses o! Petri Nets which each place has exactly one input It was hoped that the limitations on the transition and one output transition. Algo- modeling power of Petri nets relative to rithms are known for showing that a Turing machines would be balanced by a marked graph is live and safe, and for compensating increase in decision power. solving the reachability problem for This appears to be the case, since for Petri marked graphs. Thus, marked graphs nets many decision problems are equiva- have high decision power. They have lim- lent to the reachability problem, which ited modeling power, however, since they

Computing Surveys, Vol. 9, No. 3, September 1977 248 J. L. Peterson

b tiple outputs for the place, then there is a free choice as to which of the transitions is fired. a P Hack and Commoner have shown that liveness and safeness for free-choice Petri nets are decidable and have given neces- sary and sufficient conditions for these b a properties. Hack has also shown that free- choice nets can model a class of systems called production schemata which are sim- ilar to assembly-line systems. Other subclasses of Petri nets have been b defined [32], for example simple Petri nets, but little analysis of them has been done to (a) date. Figure 29 shows allowed and disal- lowed situations for three subclasses. Landweber and Robertson [58] have stud- ied the classes of conflict-free and persist- a b ent Petri nets.

Related Models Any discussion of Petri nets would be in- complete without a mention of vector addi- tion systems. These systems were defined

a by Karp and Miller [51] and are equivalent

ALLOWED NOT ALLOWED

MARKED GRAPHS (b) FIGURE 28 Eqmvalent models of a finite-state ma- chine. (a) State graph model (b) Petri net model. are able to model only those systems whose control flow has no branches. In F~E- other words, parallel activities can be eas- ~TsCHOICE ily modeled, but not alternative activities. The problem with modeling data-de- pendent decisions (branches) in a Petri net is that conflicts may arise, and nets with conflicts seem to be difficult to analyze. Hack has investigated the class of free- choice Petr~ nets [32] in which each arc NETSSIMPLE from a place is either the unique output of the place, or the unique input to a transi- tion. This restriction means that if there is a token in a place then either the token will remain in that place until its unique Fmu~ 29 Differences between the subclasses of output transition fires or, if there are mul- Petri nets.

Computing Surveys, Vol. 9, No 3, September 1977 Petri Nets • 249 to Petri nets [34]. A vector addition system Thus they have gained increasing accept- is essentially a mathematical formulation, ance in the last decade, and their use is in terms of vectors, of the markings and growing. transitions of a Petri net. Since the mathe- A major modeling system must provide matical formulation is more convenient more than simply a convenient represen- for formal manipulation than Petri net tation system, however. It must also pro- graphs, many results are given in terms of vide analysis procedures that can be used vector addition systems, although they ap- to determine properties of the modeled sys- ply equally to Petri nets. Vector replace- tem through the model. Some such analy- ment systems [53] are a related (and sis procedures for Petri nets do exist, al- equivalent) model based on a generaliza- lowing the analysis of systems for bound- tion of the vector addition systems. edness, conservation, coverability, and It should also be pointed out that Petri reachability of a marking. However, other nets are far from the only model of concur- properties, such as inclusion or equiva- rent systems to have been developed. The lence of two Petri nets, have been shown to many other models developed to date in- be undecidable. Even though problems clude program graphs [87], computation such as reachability may be decidable, graphs [50], message transmission sys- complexity results tend to indicate that tems [85], flow graph schemata [89], and these problems may be intractable, requir- complex bilogic directed graphs [31]. Baer ing too much computational time and has published a survey of some of these space to be practical. Any significant ex- models [6]. A comparison of the properties tension of the Petri net model tends to be of many of these models [78] has shown equivalent to a Turing machine, and that most of them are either subclasses of hence analysis of these extensions is not Petri nets or equivalent to Petri nets. possible due to decidability problems. The These results have been reinforced by the subclasses which have been examined comparisons of Agerwala [2] which arrive have good decision properties, but may be at much the same conclusion concerning too limited for useful modeling. On this the relative modeling power of the various topic as on many others relating to Petri models. The definition of equivalence must nets, much work remains to be done. be carefully considered, however. Lipton, Snyder, and Zalcstein [63] have compared ACKNOWLEDGMENTS models using a definition of equivalence considerably different but no less valid I am grateful to R. M. Keller, M. Hack, L. H than those of Peterson and Bredt or Ager- Landweber, D. Mandrioh, E. L. Robertson, the ref- wala, and arrived at important differences erees, and the editors for their suggestions and com- in the modeling power of the various ments. models of concurrent systems. BIBLIOGRAPHY

CONCLUSIONS [1] AGERWALA, T. A complete model for repre- senttng the coordinatmn of asynchronous proc- The Petri net has been defined as a model esses, Hopkins Computer Research Report No. for systems exhibiting concurrent asyn- 32, Computer Scmnce Program, Johns Hop- kins Univ., Baltimore, Md., July 1974, 58 pp. chronous activities. The major factors that [2] AGERWALA, T. An analysis of controlhng might affect its acceptance are concerns agents for asynchronous processes, Hopkins regarding the modeling power and deci- Computer Research Report No. 35, Computer Scmnce Program, Johns Hopkins Univ., Balti- sion power of the model. Although Petri more, Md., Aug. 1974, 85 pp. nets are not the only models of asynchro- [3] AGERWALA, T.; AND FLYNN M. "Comments on capabihtms, hmitations and 'correctness'of nous concurrent systems, they are equiva- Petri nets," in Proc. Ist Annual Symp Com- lent to or include most other models. In puter Architecture, G. J. Lipovsh, and S. A. addition they have a certain clearness and Szygenda (Eds.), ACM, N.Y., 1973, pp. 81-86. [4] ANDERSON, D W ; SPARACIO, F. J.; ANDTOMA- cleanness which permits a simple and nat- SVLO, R.M. "The IBM System/360 Model 91: ural representation of many systems. Machine philosophy and instruction han-

Computing Surveys, VoL 9, No. 3, September 1977 250 • J.L. Peterson

dling,"IBMJ. R. & D. 11, 1 (Jan. 1967), 8-24. computation, ACM, N. Y,, 1970, 199 pp. [5] BAss, J.L. '~Modelling for parallel computa- [24] DRNms, J.B., Concurrency in software sys- tion: a case study," in Proc. 1973 Sagamore tems, Computation Structures Group Memo Computer Conf. Parallel Processing, Springer- 65-1, Project MAC, MIT, June 1972, 18 pp.; Verlag, N.Y., 1973. also in Advanced course in software engineer- [6] BABS, J. L, "A survey of some theoretical ing, F. L. Bauer (Ed.), Springer-Verlag, Ber- aspects of multiprocessing," Computing Sur- lin, W. Germany, 1973, pp. 111-127. veys 5, 1 (March 1973), 31-80. [25] DIJ~RA, E. W., ~'Cooperating sequential [7] BAKER, H. G. Petri nets and languages, processes," in Programming languages, F. Computation Structures Group Memo 68, Genuys (Ed.), Academic Press, N. Y., 1968, Project MAC, MIT, Cambridge, Mass., May pp. 43-112. 1972, 6 pp. [26] FISCHER, P. C.; MBYES, A. R.; Am) ROSES- [8] BAKES, H.G. ~Equivalence problems of Pe- BS~, A.L. ~Counter machines and counter tri nets," MS Thesis, Dept. Electrical Engi- languages," Mathemaacal Systems Theory 2, 3 neering, MIT, Cambridge, Mass., June 1973, (1968), 265-283. 53 pp. [27] FUSTBK,F. "Modular implementation of Pe- [9] BAKES,H.G. Rabin" s proof of the undecida- tri nets," MS Thesis, Dept. Electrical Engi- bility of the reachability set inclusion problem neering, MIT, Cambridge, Mass., Sept 1971. of vector addition systems, Computation Struc- [28] FURTBK,F. C. "The logic of systems," PhD tures Group Memo 79, Project MAC, MIT, Thesis, Dept. ElectricalEngineering, MIT, Cambridge, Mass., July 1973, 18 pp. Cambridge, Mass., May 1976; also Tech. Rep. [10] BEsN~rEIS, A.J. 'Trogram analysis for par- 170, MIT Laboratory Computer Science, June allel processing," IEEE Trans. Electronic 1976. Comp. EC-15, (Oct. 1966), 757-762. [29] GSNRICH, H. J. Einfache nieht-sequentieUe [11] BERNSTEm,P.A. Description problems in the Prozesse (Simple nonsequential processes), modeling of asynchronous computer systems, Gesellschaft ftir Mathematlk und Datenverar- Tech. Rep. 48, Dept. Computer Science, Univ. beitung, Birlinghoven, W. Germany, 1970. Toronto, Toronto, Canada, Jan. 1973. [30] GENSICH,H. J. The Petr~ net representation [12] CBRF, V. G. '~Multiprocessors, semaphores, of mathematical knowledge, GMD-ISF Inter- and a graph model of computation," PhD The- nal Report 75-06, Institut fur Informationssys- sis, Computer Science Dept., Univ. Calif., Los temforschung, Gesellschaft fiir Mathematik Angeles, April 1972. und Datenverarbeitung, Birlinghoven, W. [13] CHv.N, T. C. "Overlap and pipeline process- Germany, 1975. ing," in Introduction to computer architecture, [31] GO,SLOW, K.P. 'Tlow of control, resource H. S. Stone (Ed.), Science Research Associ- allocation and the proper termination of pro- ates, Chicago, Ill., 1975, pp. 375-431. grams," PhD Thesis, Computer Science Dept., [14] CLARK,W.A. "Macromodular computer sys- Univ. Calif., Los Anlgeles, Dec. 1971, 219 pp. tems," in Proc. 1967 Spring Jr. Comp Conf., [32] HACK, M. ~Analysls of production schemata Thompson Book Co., Washi" "ngton, D.C., 1967, by Petri nets," MS Thesis, Dept. Electrical pp. 335-336. Engineering, MIT, Cambridge, Mass.; also: [15] COrFMAS, E. G.; AND DENNmC, P. MAC TR-94, Project MAC, MIT, Feb. 1972, J. Operating systems theory, Ch. 2, Prentice- 119 pp; Errata: Hack, M. Correcttons to 'Anal- Hall, Englewood Cliffs, N. J., 1973, pp. 31-82. ysis of production schemata by Petri nets; [16] COMMON~R, F. G. Deadlocks in Petri nets, Computation Structures Note 17, Project CA-7206-2311, Applied Data Research, Wake- MAC, M_IT, June 1974, 11 pp. field, Mass., June 1972, 50 pp. [33] HACK, M. A Petri net version of Rabin's un- [17] COMMONER,F.; HOLT, A. W.; EVBN, S.; AND decidability preof for vector addmon systems, PNUELI, A. "Marked directed graphs," J. Computation Structures Group Memo 94, Computer and Systems Science 5, (Oct. 1971), Project MAC, MIT, Cambridge, Mass., Dec. 511-523. 1973, 12pp. [18] CRF~PI-REGHIZZI, S.; AND MANDRIOLI, D. [34] HACK, M. Decision problems for Petrl nets "Properties of firing sequences," presented at and vector addition systems, Computation MIT Conf. Petr~ Nets and Related Methods, Structures Group Memo 95, Project MAC, MIT, Cambridge, Mass., July 1975. MIT, Cambridge, Mass., March 1974; also [19] CRESPI-REGHIZZI, S.; AND MANDRIOLI, D. Technical Memo 59, Project MAC, MIT, Petri nets and commutative grammars, Inter- March, 1975. nal Report No. 74-5, Laboraterio di Calcola- [35] HACK, M. The recursive equwalence of the tori, Instituto di Elettrotecnica ed Elettromca reachability problem and the liveness problem del Politecnico di Milano, Italy, March 1974. for Petri nets and vector addiaon systems, [20] CRESPI-REGHIZZI,S.; AND MANDRIOLI, D. "A Computation Structures Group Memo 107, decidability theorem for a class of vector-addi- Project MAC, MIT, Cambridge, Mass., Aug. tion systems," Information Processing Letters 1974, 9 pp.; also in Proc. 15th Annual Syrup. 3, 3 (Jan. 1975), 78-80. Switching and Automata, IEEE, N. Y., 1974. [21] CEESPI-REGHIZZI, S.; AND MANDEIOLI, D. [36] HACK,M. The equality problem for vector ad- 'Tetri nets and Szilard languages," Informa- dition systems ~s undecidable, Computation tion and Control 33, 2 (Feb. 1977), 177-192. Structures Group Memo 121, Project MAC, [22] DBNNIS, J. B. "Modular asynchronous con- MIT, Cambridge, Mass., April 1975, 32 pp.; trol structures for a high performance proces- also in Theoretical Computer Science 2, 1 sor," in Record of the Project MAC Conf. Con- (June 1976). current and Parallel Computatwn, ACM, [37] HACK, M. Petri net languages, Computation N. Y., 1970, pp. 55-80. Structures Group Memo 124, Project MAC, [23] DENmS, J. B. (Ed.), Record of the project MIT, Cambridge, Mass., June 1975, 128 pp.; MAC conf. concurrent systems and parallel also TR 159, Laboratory Computer Science,

Computing Surveys, Vol. 9, No. 3, September 1977 Petri Nets • 251 MIT, March 1976. [56] KELLER,R.M. ~Formal verif~ation of paral- [38] HACK, M. "Decidability questions for Petri lel programs," Comm. ACM 19, 7 (July 1976), nets," PhD Thesis, Dept. Electrical Engineer- 371-384. i_ng, MIT, Cambridge, Mass., Dec. 1975; also [57] KOSARA~U, S. R. Limitations of Dijkstra's TR-161, Laboratory Computer Science, MIT, semaphore primitives and Petri nets, Tech. June 1976, 194 p~. Rep. 25, Jol~ns Hopkins Univ., Baltimore, Md. [39] HACK, M.; AND VETESSON, J. L. "Petri nets May 1973, 5pp.; also in Operating Systems and langnages," presented at MIT Conf. Petn Review 7, 4 (Oct. 1973), 122-126. Nets and Re~ted Methods, MIT, Cambridge, [58] LANDWEBER, L. H.; AND ROSZRTSON, E. Mass., July 1975. L. Properties of conflict Me and perscstent [40] HANSAL,A.; AND SCHWAB, G.M. On marked Petr~ nets, Tech. Rep. 264, Computer Sciences graphs 111, Report LN 25.6.038, IBM Vienna Dept., Univ. Wisconsin-Madison, Madison, Laboratories, Vienna, Austria, Sept. 1972. Wise., Dec. 1975, 30 ~p. [41] HENHAPL, W. Firing sequences of marked [59] LAUER, P. E.; AND ~A~B~LL, R. H. A de- graphs, Report LN 25.6.023, IBM Vienna scription of path expressions by Petri nets, Laboratories, Vienna, Austria, June 1972. Tech. Rep. 64, Computing Laboratory, Univ. [42] HENHAPL, W. Firing sequences of marked Newcastle Upon Tyne, England, May 1974, 39 graphs II, Report LN 25.6.036, IBM Vienna P!P Laboratories, Vienna, Austria, June 1972. [60] LAUER, P. E. Path expressions as Petri nets, [43] HOLT, A. W.; SAINT, H ; SHAPIRO, R. M.; AND or Petri nets with fewer tears, MRM 70, Com- WARSHALL,S. Final report of the mformatton puting Laboratory, Univ. Newcastle Upon system theory project, Tech. Rep. RADC-TR- Tyne, England, Jan. 1974, 61 pp. 68-305, Rome Air Development Center, Grif- [61] LAUTENBACH,K.; AND SCHMID, H.A. "Use of fiss Air Force Base, N. Y., Sept. 1968. Petri nets for proving correctness of concur- [44] HOLT,A. W.; AND COMMONER, F. E~;entsand rent process systems," in Proc. IFIP Congress condition, Applied Data Research N.Y., 1970; 74, North-Holland Publ. Co., Amsterdam, also in Record Project MAC Conf. Concurrent The Netherlands, 1974, pp. 187-191. Systems and Parallel Computatmn, (Chapters [62] LIEN, Y.E. ~Termination properties of gen- I, II, IV, and VI) ACM, N.Y., 1970, pp. 3-52. eralized Petri nets," SIAM J. Computing 5, 2 [45] HOLT, R. C. "On deadlock m computer sys- (June 1976), 251-265. tems," PhD Thesis, Dept. Computer Science, [63] LIPTON, R. J.; SNYDER, L.; AND ZALCSTZIN, Cornell Umv., Ithaca, N Y., Jan. 1971; also Y. "A comparative study of models of paral- TR 71-91, Dept. Computer Science, Cornell lel computation," inProc. 15th Annual Syrup. Univ.; and TR CSRG-6, Computer Science Re- Switching and Automata, IEEE, N.Y., 1974, search Group, Umv. Toronto, Toronto, Can- pp. 145-155. ada, July 1972. [64] LIPTON, R. "The reaehability problem and [46] IZmCKL H. On marked graphs, Repo_rt LR the boundedness problem for Petri nets are 25.6.023, IBM Vienna Laboratories, Vienna, exponential-space hard," presented at MIT Austria, Sept. 1971. Conf. Petri Nets and Related Methods, MIT, [47] IZBICKLH. On marked graphs H, Rel~_ rt LN Cambridge, Mass., July 1975; also TR-62, 25.6.029, IBM Vienna Laboratories, Vienna, Dept. Computer Science, Yale Univ., New Austria, Jan. 1972. Haven, Conn., Jan. 1976. [48] JACK,L. "Graphical representation for fault [65] MELDMAN, J. A.; AND HOLT, A. W. ~Petri tolerant phenomena," presented at Seminar, nets and legal systems," Jurimetrics J. 12, 2 Dept. Electrical Engineering, Univ. Texas, (Dec. 1971). Austin, Jan. 1976. [66] MERLIN, P.A. "A study of recoverability of [49] JONES,N. D.; LANDWEEER,L. H.; ANDLxEN, Y. computing systems," PhD. Thesis, Dept. In- E. Complexity of some problems in Petri nets, formation and Computer Science, Univ. Calif. TR-276, Comp. Science Dept., Umv. Wiscon- Irvine, 1974, 165 pp. sin-Madison, Sept. 1976, 43 pp.; to appear in [67] MmUNAS,D. "Petri nets and speed independ- Theor. Comp. Sci. ent design," Comm. ACM 16, 8 (Aug. 1973), [50] KARP,R. M.; ANn MILLER, R.E. Troperties 474-481. of a model for parallel computation: determi- [68] MILLER,R. E. A comparison of some theoreti- nacy, termination, queueing," SIAM J. Appl. cal models of parallel computation, RC 4230, Math. 14, 6 (Nov. 1966) 1390-1411. IBM T.J. Watson Research Center, Yorktown [51] KARP, R. M.; AND MILLER, R. E. "Parallel Heights, N.Y.; also lEEE Trans. Comp. C-22, rogram schemata," J. Computer and Systems 8 (Aug. 1973), 710-717. cience 3, 4 (May 1969), 167-195. [69] MURATA,T.; AND CHURCH, R.W. Analysis of [52] KASAMI,T.; TOKURA, N.; AND PETERSON, W. marked graphs and Petri nets by matrix equa- W. "Vector addition systems and synchroni- t/ons, Research Report MDC 1.1.8, Dept. In- zation problems of concurrent processes," formation Engineering, Univ. Illinois, Chi- draft manuscript, 1974. cago Circle, Nov. 1975, 25 pp. [53] KELLER,R.M. Vector replacement systems: a [70] NASH, B. O. "Reaehability problems in vec- formalism for modell~ng asynchronous sys- tor addition systems," American Math. tems, Tech. Rep. 117, Computer Science Labo- Monthly 80, 3 (March 1973), 292-295. ratory, Princeton Univ., Princeton, N.J., Dec. [71] NOE, J. D. A Petri net model of the CDC 1972; Revised: Jan. 1974, 57 pp. 6400, Report 71-04-03, Computer Science [54] KELLER, R. M. Generaltzed Petrz nets as Dept., Unlv'. Washington, 1971; also in Proc. models for system verification, Tech. Rep. 202, ACM SIGOPS Workshop on System Perform- Dept. Electrical Engineering, Princeton ance Evaluation, ACM, N.Y., 1971, pp. 362- Univ., Princeton, N.J., Aug. 1975. 378. [55] KELLER, R. M. "Look-ahead processors," [72] NoB, J. D.; At~-vNu~r, G.J. "Macro E-Nets Computing Surveys 7, 4 (Dec. 1975), 177-196. for representation of parallel systems," IEEE

Computing Surveys, Vol. 9, No. 3, September 1977 252 • J.L. Peterson

Trans. Comp. C-22, 8 (Aug. 1973), 718-727. terrier Bericht 75-07, Gesellschaft fur Mathe- [73] PATIL, S.S. Coordination of asynchronous matik und Datenverarbeltung, Bonn, W. Ger- events," PhD Thesis, Dept. Electrical Engi- many, July 1975, 34 pp. neering, MIT, Cambridge, Mass., May 1970; [83] RACKOFF,C. The covering and boundedness also MAC TR-72, Project MAC, MIT, June roblems for vector addition systems, Tech. 1970, 236 pp. p. 97, Dept. Computer Science, Umv. To- [74] PATIL, S. S. Limitations and eapabdtttes of ronto, Toronto, Canada, July 1976, 14 pp. Dijkstra's semaphore prtmitives for coordina- [84] RAMCHANDAm, C. Analysis of asynchro- tton among processes, Computation Structures nous concurrent systems by timed Petn nets," Group Memo 57, Project MAC, MIT, Cam- PhD Thesis, Dept. Electrical Engineermg, bridge, Mass., Feb. 1971. MIT, Cambridge, Mass., 1974; also MAC-TR- [75] PATIL, S. S. Ctrcutt tmplementatmn of Petri 120, Project MAC, MIT, Feb. 1974. nets, Computation Structures Group Memo [85] RIDDLE,W.E. "The modelling and analysis 73, Project MAC, MIT, Cambridge, Mass., of supervisory systems," PhD Thesis, Com- Dec. 1972, 14 pp. puter Science Dept., Stanford Univ., Stan- [76] PATIL,S. S.; AND DENNIS, J.B. The descnp- ford, Calif., March 1972, 173 pp. twn and real~zatwn of d~g~tal systems, Compu- [86] RIDDLE, W.E. The equwalence of Petr~ nets tation Structures Group Memo 71, Project and message transmissmn models, SRM 97, MAC, MIT, Cambridge, Mass., Oct. 1972; also Univ. Newcastle Upon Tyne, England, Aug. in Proc. S~xth Annual IEEE Computer Society 1974, 11 pp. Internatl. Conf. Digest of Papers, IEEE, N.Y., [87] RODRIGUEZ,J.E. "A graph model for parallel 1972. computation," PhD Thesis, Dept. Electrical [77] PETEmS,ON, J. L. "Modelling of parallel sys- Engineering, MIT, Cambridge, Mass., Sept. tems,' PhD Thesis, Dept. Electrical Engineer- 1967, 120 pp. ing, Stanford Univ., Stanford, Calif., Dec. [88] SACERDOTE,G.; AND TENNEY, R.L. "The de- 1973, 241 pp. cidability of the reachability problem for vec- [78] PETZRSON, J. L ; AND BREDT, T. H. "A com- ter addition systems," (submitted for publica- arison of models of parallel computation," in tion), Nov. 1976, 8pp. roc. IFIP Congress 74, North-Holland Publ. [89] SLUTZ, D. R. '~The flow graph schemata Co., Amsterdam, The Netherlands, 1974, pp. model of parallel computation," Phi) Thesis, 466-470. Dept Electrical Engineering, MIT, Cam- [79] PETERSON, J. L. "Computation sequence bridge, Mass., Sept. 1968. sets," J. Computer and System Scwnces 13, 1 [90] SHAPIRO,R. M.; AND SAINT, H. ~A new ap- (Aug. 1976), 1724. proach to optimization of sequencing deci- [80] P~.~I, C.A. 'Kommumkatlon mit Automa- sions," Annual Review of Automatic Program- ton," Schriflen des Rheinlsch-Westfal-ischen mzng 6, 5, (1970), 257-288. Ins~tutes ~r Instrumentelle Mathemat~k an [91] THORNTON, J. E. Design of a computer, the der Univers~mt Bonn, Heft 2, Bonn, W. Ger- Control Data 6600, Scott, Foresman and Co., many 1962; translation: C. F. Greene, ~upple- Glenview, Ill., 1970, 181 pp. ment 1 to Tech. Rep. RADC-TR-65-337, Vol. [92] TSICHRITZIS,D. Modular system descr~ptmn, 1, Rome Air Development Center, Griffiss Air Tech. Rep. 33, Dept. Computer Science,Univ. Force Base, N.Y., 1965, 89 pp. Toronto, Toronto, Canada, Oct. 1971, 20 pp. [81] PRTRI, C. A. "Concepts of net theory," in [93] VAN LE~UWEN, J. "A partial solution to the Proc. Syrup. and Summer School on Mathe- reachabflity-problem for vector addition sys- mattcal Foundations of Computer Science, toms," in Proc 6th Annual ACM Symp. The- High Tatras, Sept. 3-8, 1973, Math. Inst. Slo- ory of Computing, ACM, N.Y., 1974, pp. 303- vak Academy of Science, 1973, pp. 137-146. 309. [82] PETRI, C.A. Interpretattons of net theory, In-

Computing Surveys, Vol 9, No. 3, September 1977