2011 Eighth International Conference on Quantitative Evaluation of SysTems

MARCIE - Model checking And

Reachability analysis done effiCIEntly
Martin Schwarick and Monika Heiner

Christian Rohr

Computer Science Department

BTU Cottbus, Germany
Email: ms@informatik.tu-cottbus.de
monika.heiner@informatik.tu-cottbus.de

Magdeburg Centre for Systems Biology (MaCS)

Magdeburg, Germany
Email: rohrch@tu-cottbus.de

space size, but in general need some pre-conditions to be

fulfilled. Often the models must exhibit a modular structure
(Kronecker), or the domain of the real-valued transition rates
must be relatively small (MTDD). BDD-based techniques
require prior knowledge of the domain of the model variables
(boundedness degree of the places) and only work for a
moderate domain size. Generally, the success of DD-based
approaches for qualitative and quantitative analyses relies on
a suitable variable order, which may be implicitly given by a
modular structure.
Recently, (G)SPNs have also been used in Systems Biology
[7, 8, 9, 10] as they allow an intuitive modeling of biochemical
reaction networks. Tokens on places may represent molecules
or concentrations levels, and the transitions firing rates define
biochemical kinetics. Often, such models do not exhibit a
modular structure and the usually state-dependent firing rates
generate a large variety of individual rate values. Moreover,
the state space explosion is aggravated by the combinatorial
distribution of a large number of tokens in a relatively smallsized model, which usually results in a high boundedness
degree of all places. Even worse, biological networks often
exhibit an infinite state space, which restricts the analysis to
approximative and simulative techniques.
These aspects were our main motivations to develop an
efficient and easy to use analysis tool, tailored to the particularities of biochemical reaction networks. We address high
boundedness degree, without requiring its prior knowledge,
by a symbolic state space representation based on Interval
Decision Diagrams (IDDs) [11], and the possibly huge number
of different rate values by a symbolic on-the-fly [12] engine
which is used for numerical CTMC analysis. Our automatic
computation of suitable variable orders exploits the net structure without relying on a predefined modularization of the
model. Complementary, we provide efficient approximative
and simulative analysis methods in order to support unbounded
nets. Many analysis algorithms are parallelized.
The resulting tool is MARCIE, which has been developed
with these issues in mind. It extends its predecessor IDD-MC
[6], which was a purely symbolic model checker of standard
CTL and CSL, by new features as rewards and simulative
or approximative model checking. It outperforms established
tools for many benchmarks [6, 12, 13, 14]. This paper gives

AbstractMARCIE is a multi-threaded tool for the analysis

of Generalized Stochastic Petri Nets. Its capabilities range from
standard properties of qualitative Petri nets to CTL and CSL
model checking, recently extended by rewards. The core of MARCIE builds upon Interval Decision Diagrams for the symbolic
representation of marking sets of bounded Petri nets (finite state
space) and on-the-fly matrix computation for numerical analysis.
Approximative engines supporting fast adaptive uniformization
and Gillespie simulation open the door to quantitative reasoning
on unbounded Petri nets (infinite state space). This paper presents
MARCIEs architecture and its most important distinguishing features. Extensive computational experiments demonstrate
MARCIEs strength in comparison with related tools.

I. M OTIVATION
Stochastic Petri Nets (SPN) [1] and Generalized Stochastic
Petri Nets (GSPN) [2] are frequently used formalisms to model
and analyze concurrent systems. In the last three decades they
have specifically been used in technical application domains
to investigate, e.g., communication protocols or manufacturing
systems [3, 4]. An SPN associates firing rates to transitions
of the underlying qualitative Petri net and can be seen as a
high-level description of a Continuous-Time Markov Chain
(CTMC). The SPN class can be generalized to GSPN by
adding so-called immediate transitions, which immediately
fire when becoming enabled. States with enabled immediate
transitions have a zero sojourn time and are called vanishing
states. The GSPNs semantics is not a CTMC anymore, but
can still be reduced to it.
The structural description of (G)SPNs and their Markovian
semantics offer the modeler a large variety of qualitative and
quantitative analysis methods which have been implemented
in numerous software tools. Many methods consider the set
of reachable states and thus suffer from the state space
explosion problem. Symbolic approaches relying on Decision
Diagrams (DD), e.g., Binary Decision Diagrams (BDD) [5]
or related generalizations, permit qualitative reasoning over
reachable states in new dimensions (beyond 1028 states [6]).
This includes also model checking of, e.g., CTL formulas.
However, quantitative analyses of the induced CTMC require efficient processing of the state transitions which are
weighted with real values. Kronecker algebra [4] or generalizations of BDDs, such as Multi-Terminal Decision Diagrams
(MTDD), allow for the analysis of models of remarkable state
978-0-7695-4491-5/11 $26.00 2011 IEEE
DOI 10.1109/QEST.2011.19

91

for the first time an overview of MARCIEs architecture and

its most important distinguishing features.

(Fig. 1), written in Java, which can be easily configured by

means of an XML description. The GUI is part of our Petri
net analyser Charlie [17].

II. T HE TOOL
In the following we assume basic knowledge of the Petri
net formalism. A general introduction can be found in [2], a
tutorial tailored to Systems Biology in [8].

B. Implementation
In the following we present the basic tool architecture,
which is depicted in Fig. 2. We will sketch the main ideas behind the single components which have been considered during
MARCIEs development to achieve highly efficient analysis
capabilities. In this paper we will concentrate on quantitative
analysis aspects because this is the most challenging part.

A. Overview
MARCIE is a tool for GSPN analysis, supporting qualitative
and quantitative analyses including model checking facilities.
Particular features are symbolic state space analysis including
efficient saturation-based state space generation, evaluation of
standard Petri net properties as well as CTL model checking.
Further it offers symbolic CSL model checking and permits
to compute reward expectations. Most of MARCIEs features
are realized on top of an IDD implementation [11]. IDDs are
used to efficiently encode interval logic functions representing
marking sets of bounded Petri nets. Thus, MARCIE falls
into the category of symbolic analysis tools as SMART [15]
and PRISM [16]. However, recently it has been extended by
approximative and simulative engines, which work explicitly,
to support also stochastic analysis of unbounded nets.
MARCIE is entirely written in C++, and uses the libraries
GMP, pthreads flex/bison and boost. It comprises about 40, 000
source lines of code. MARCIE is available for non-commercial
use; we provide statically linked binaries for Mac OS X
and Linux. The tool, the manual and a benchmark suite
can be found on our website http://www-dssz.informatik.tucottbus.de/DSSZ/Software/Marcie. Currently, MARCIE itself
comes with a textual user interface. Options and input files can
also be specified by a generic Graphical User Interface (GUI)

Fig. 1.

.csl

.rw

.apnn

.po/.to

APNN

Orders

.ctl

Parser

Marcie
(9)

Rewards

CSL

Approximative
CTMC
Analysis (7)

CTL

GSPN
CTL

Representation (1)

Model Checker (5)

Gillespie
FAU

Place/Transition

CSL
Model Checker (8)

Quantitative

Statespace
Analysis (4)

Order
Generator (3)

Exact CTMC
Analysis (6)
Uniformization
Jacobi
GaussSeidel
PseudoGauss
Seidel

Qualitative
Analysis

Analysis

Yes/No
probabilities

Fig. 2.

Place/Transition
Traces
.csv

BFS
Chaining
Saturation

Interval Decision
Diagram
Engine (2)

Order
.po/to

Liveness
Reversibility
#States
#Dead States

Yes/No

MARCIEs architecture and its nine components.

1) GSPN Representation: MARCIE analyses Generalized

Stochastic Petri Nets (GSPN) as defined in [2] and tailored to
the specific needs of Systems Biology in [10]. They have to be
specified in an adaption of the APNN format [18] which we
call APNN*. Such model descriptions can be created with the
export function of our dedicated Petri net editor Snoopy [19];
see [20] for more details. In addition to standard and inhibitory
arcs, MARCIE knows read, equal and reset arcs. Currently
there is no support for marking-dependent arc weights.
GSPN associates functions to transitions. For a stochastic
transition, this function defines the firing rate, for an immediate transition, the function defines a weight which may be
necessary to resolve conflicts between simultaneously enabled
immediate transitions. MARCIE permits these functions to
be marking-dependent; thus places can occur as function
variables. However, for each transition, the functions domain
is restricted to its pre-places. To allow arbitrary functions, the
user may add so-called modifier arcs, which make places to
pre-places of a transition without affecting their enabledness.
The model specification supports constants to parameterize
initial markings, functions and arc weights.
The net structure is crucial for the performance of most
analyses techniques in MARCIE. The GSPN Representation
component is responsible for an efficient access to all structural informations and all defined rate and weight functions.

Generic Graphical User Interface.

92

4) State Space Analysis: Bounded Petri nets can be analysed based on the knowledge of all states, which are reachable
from the initial marking. Thus the first step is often to construct
the state space. MARCIE implements three different state
space generation algorithms upon its IDD engine.
1) Common Breadth-First Search (BFS): an iteration fires
sequentially all transitions (according to the transition
ordering) before adding the new states to the state space.
2) Transitions chaining: like BFS, but the state space is
updated after the firing of each single transition.
3) Saturation algorithm (SAT): transitions are fired in conformance with the decision diagram, i.e. according to
an ordering, which is defined by the variable ordering.
A transition is saturated if its firing does not add new
states to the current state space. Transitions are bottomup saturated (i.e. starting at the terminal nodes and going
towards the root). Having fired a given transition, all preceding transitions have to be saturated again, either after
a single firing (single) or the exhausted firing (fixpoint)
of the current transition.
Having the state space, MARCIE permits to find dead states
and to decide reversibility and liveness of transitions, which
involves a symbolic decomposition of the state space into
strongly connected components.

2) IDD Engine: The core of MARCIE is an efficient IDD

implementation. An IDD is a directed, rooted and acyclic
graph which consists of non-terminal nodes labeled with
variables and two terminal nodes labeled with 1 and 0. IDDs
can be seen as generalization of the popular BDDs, but allow
non-terminal nodes to have an arbitrary number of outgoing
arcs. These arcs are labeled with intervals over the natural
numbers. As usual, we assume a fixed order over the set of
variables which must hold on every path starting at the IDD
root and going to one of the two terminal nodes. A Reduced
Ordered Interval Decision Diagram (ROIDD) does not contain
isomorphic sub-diagrams and the labels of the outgoing arcs
of a non-terminal node create a non-reducible partition of the
natural numbers. It yields a canonical representation of an
interval logic function; an example is given in Fig. 3.
In our setting, the set of variables is equal to the set of places
of the given Petri net. Marking sets can now be represented
by interval logic functions and thus encoded by IDDs.
The implemented IDD engine exhibits several features to
address efficiency issues, as for instance the concept of shared
DDs, fast detection of isomorphic sub-diagrams by use of an
unique table, and efficient operation caches; see [11] for a
detailed discussion. Furthermore, the engine offers dedicated
operations for the forward and backward firing of Petri net
transitions.

5) CTL Model checker: The Computation Tree Logic

(CTL) [22] is a widely used branching time logic. It permits to
specify properties over states and paths of a labelled transition
system (LTS), the Kripke structure. So-called path quantifiers
specify whether path formulas, which can be written by means
of temporal operators, should be fulfilled on all paths or at
least on one path starting in some state. One can interpret the
reachability graph of a Petri net as a Kripke structure and thus
apply CTL model checking algorithms. The basic idea is to
label all LTS states with the sub-formulas they satisfy. This is
done by a postorder traversal of the given CTL formula tree.
In an explicit setting, the evaluation of path formulas can be
done by a depth-first-search strategy to find a witness path or
a counter example. In a symbolic setting, one computes for all
sub-formulas the set of satisfying states. This can be achieved
for path formulas by applying fixpoint computations based on
backward reachability analysis as it is efficiently realized in
MARCIE. For a detailed discussion of IDD-based CTL model
checking we refer to [11].

#!

%"&'(

%+&))(

%*&+(

#$

%"&'(

Fig. 3.

%'&))(

"

An IDD representing f = (x1 < 3) (x1 [4, 6) x2 2).

3) Order Generator: It is well known that the variable

order used in constructing a DD may have a strong influence
on its size in terms of number of nodes, and thus on the
performance of related operations. To find an optimal variable
order is an NP-hard problem. MARCIE uses heuristics to precompute static variable orders. The simple underlying idea
is to examine the structure of the given Petri net and to
arrange dependent places close to each other. Two places
are dependent if there are transitions whose firing affect the
marking of both places [21]. In [12] we used this idea to
significantly improve PRISMs performance. MARCIE offers
the user seven different options to influence the generation of
the place order.
Transition Chaining and Saturation are improved algorithms
for the state space generation (see component 4). Their efficiency depends in general on the order in which the Petri
net transitions are considered. Thus MARCIE takes care of
creating suitable transition orders. There are six different
options to influence the used transition order.

6) Exact CTMC Analysis: In addition to the qualitative

analysis MARCIE supports quantitative analysis of SPNs.
While qualitative analysis can be realized symbolically based
on the reachable states, quantitative analysis requires the
computation of probability distributions of the induced CTMC.
CTMC analysis is a well studied subject and established
algorithms are available [23]. In general the computation
of a probability distribution must be done numerically. For
this purpose, all real-valued non-zero state transitions and a
number of computation vectors have to be stored in memory
in addition to the state space of the CTMC. The set of state
transitions can be written as a matrix, the so-called rate matrix,

93

Transient probabilities. The computation of transient probabilities can be achieved by solving the system of Kolmogorov
differential equations, which can be done using different methods, as for instance uniformization, Krylov subspace methods,
or ordinary differential equations [23]. When dealing with very
large and cyclic CTMCs, as it is often the case, the method
of choice is uniformization. The basic idea is to embed a
discretization of the CTMC into a Poisson process. Doing so,
the computation of the transient probability distribution for a
specific time point reduces to that of Discrete Time Markov
Chains (DTMCs), which can be done by a repeated matrixvector multiplication. MARCIE provides multi-threaded transient analysis based on uniformization.
Steady state probabilities. The computation of a steady
state probability distribution requires to solve a homogeneous
system of equations. In the light of a symbolic matrix representation, iterative methods as Jacobi and Gauss-Seidel are
favoured over direct methods as Gauss elimination, because
they do not change the matrix. Currently, MARCIE offers a
multi-threaded Jacobi solver and a Gauss-Seidel solver. The
Gauss-Seidel method requires a single computation vector
and converges in many cases much faster than Jacobi, but
requires a row-wise extraction of the matrix entries. MARCIEs caching approach does not allow an efficient rowwise extraction. As a compromise, MARCIE also provides
a Pseudo-Gauss-Seidel solver [28].
Rewards. Often it is not sufficient to just reason about the
probability to be in a certain state at a certain time point
or in steady state. The expected time spent in certain states,
the expected number of transition firings within a given time
interval, and comparable measures can be of interest, too.
For this purpose, it is possible to extend a stochastic Petri
net to a stochastic reward net [29] by adding rewards, which
define additional measures; they can be associated to states and
transitions. A reward for a given state will be accumulated and
weighted with its sojourn time. A transition reward is acquired
each time a transition fires.
MARCIE supports the addition of rewards to a GSPN by
loading a set of reward structures. A reward structure is a set
of reward items state reward items and transition reward
items. A reward item must specify a set of states by means
of an interval logic function and a possibly state-dependent
reward function defining the actual reward value.
MARCIE represents rewards internally as additional, implicit Petri net transitions, which allows us to apply the onthe-fly approach also to compute rewards; see [14].
Immediate transitions. All quantitative analyses can be
applied without any exception to GSPNs. In this case, the
on-the-fly engine has also to consider the vanishing states,
which may represent the majority of reachable states, as
one can see in Table II. This will substantially increase the
memory effort. MARCIE needs an additional computation step
to propagate the probabilities from the vanishing states to the
tangible states. In summary, dealing with GSPNs is much more
expensive, and we recommend, if possible, to transform the
GSPN in a SPN as proposed in [2].

which is in general extremely sparse. Then, the core operation

is a matrix-vector multiplication.
There are several approaches to compactly store the rate
matrix either explicitly in some sparse matrix format or
symbolically using Kronecker representations or some kind of
decision diagrams. The latter approach is the most promising
one as it does not require specific model properties (besides
being bounded). The basic idea is to encode a state transition,
which consists of a pair of states and a real value, as a
path in a decision diagram. One can distinguish two different
approaches to store the real values: either in the terminal nodes
(MTDD) or distributed over the edges of the diagram (EdgeValued Decision Diagrams); see, e.g., [24, 25] for a brief
overview. In any case, the extraction of the matrix entries is
done by a traversal of the decision diagram. In a full symbolic
approach one would also encode the computation vectors
by decision diagrams, but this turned out to be inefficient.
Thus, most approaches are hybrid; a symbolic matrix encoding
combined with explicitly stored computation vectors.
MARCIE follows the hybrid approach in a slightly different
way. It combines a symbolic state space representation with
an on-the-fly strategy. The idea of such a matrix-free approach was introduced in [26] with explicitly storing the state
space. MARCIE computes the matrix entries by simulating
the firing of the Petri transitions. This is done by traversing
the IDD which represents the state space and which has been
augmented by additional information to allow the computation
of state indices similar to [27, 28]. During a traversal MARCIE
considers the effect of firing all transitions of the net for
each state and computes the relevant state indices. Further it
collects the arguments for the state-dependent rate functions
of the Petri net transitions. There is no approximation; all
existing state transitions will be considered. Considering the
transition firing in forward (backward) direction permits to
realize a matrix-vector (vector-matrix) multiplication [12, 13].
This on-the-fly approach is significantly less sensitive to the
number of different non-zero values in the rate matrix than
the MTDD approach; see [12] for details.
A DD traversal has in general exponential effort. Thus it is
important to realize an efficient caching mechanism. The usual
operation caches are not suitable in our setting. Thus MARCIE
follows a strategy similar to that in [28]. The traversal will
stop at a predefined node layer, where the information of
all possible path extensions are compactly stored. The actual
matrix entries will be computed from the information of
the current path and the stored cache data. The computation
vectors and the entries of the matrix diagonals are explicitly
stored in arrays of double precision type.
Another way to increase the efficiency is to make use
of todays multi-core computers by multi-threading. The implemented matrix-vector/vector-matrix multiplication can be
performed in a multi-threaded fashion.
Upon these basic capabilities to efficiently perform operations on the CTMCs rate matrix which is induced by a
stochastic Petri net, MARCIE implements standard algorithms
to compute transient and steady state probability distributions.

94

7) Approximative CTMC Analysis: Exact quantitative analyses consider all reachable states and all state transitions of
a GSPN; thus they are restricted to finite state spaces. But
in many cases, even the analysis of bounded models is not
feasible. Moreover, the investigated models may be unbounded
as it is often the case in many fields, among them Systems and
Synthetic Biology. Then approximative techniques may help,
which use just a finite and often very small subset of all states.
MARCIE supports two such techniques.
Approximative numerical analysis. To overcome the problem of an unmanageable state space size, the approximative
numerical analysis prunes insignificant states. The basic idea
is to combine a breadth-first variant of the state space construction with a transient analysis using uniformization. During
construction, all explored states having a probability below
a specified threshold will be removed from the current state
space. Thus, only a finite subset of a possibly infinite state
space will be considered. This sliding window method [30]
can be further enhanced by a technique called adaptive uniformization, where the Poisson process is replaced by a birth
process. This combination was first introduced in [31] as fast
adaptive uniformization (FAU). In contrast to the exact CTMC
analysis (see component 6), MARCIEs implementation of this
algorithm uses an explicit state space representation.
Simulation. If the approximate numerical analysis exceeds
the available memory, the method of choice has to be simulation. MARCIE provides the stochastic simulation algorithm
introduced by Gillespie [32]. It generates paths of finite length
of a possibly infinite CTMC. Unlike for the numerical analysis, the memory consumption of the simulation is constant,
because only the current state is hold in memory.
Generally it is necessary to perform a sufficient amount of
simulation runs due to the variance of the stochastic behaviour.
We choose the confidence interval method as described in [33]
to determine the required number of simulation runs. The user
can specify the confidence interval by defining the confidence
level, usually 95% or 99%, and the estimated accuracy, e.g.,
1103 or 1104 . MARCIE calculates the required number
of simulation runs to achieve this confidence interval. Besides
that, the user can manually set the number of simulation runs.
Each simulation run is done independently of the others.
Thus, it is not challenging to parallelize stochastic simulations.
MARCIE provides a multi-threaded simulation engine.
Immediate Transitions. The approximative numerical analysis as well as the simulation are capable of handling immediate transitions. The approximative numerical analysis has to
handle two types of states for this purpose. Besides tangible
states (only stochastic transition are enabled), vanishing states
can appear, where one or more immediate transitions are
enabled. Vanishing states are processed as soon as they occur,
because of the (per definition) higher priority of immediate
transitions.
The simulative processing of immediate transitions is rather
straightforward, see [34] for details. MARCIEs stochastic
simulation can not only deal with GSPN, but can also analyse
eXtended Stochastic Petri Nets (XSPN); see [35] for details.

8) CSL Model checker: The Continuous Stochastic Logic

(CSL) introduced in [36] is the stochastic counterpart to CTL
and permits to define complex properties. The path quantifiers
of CTL are replaced by the probability operator P. The usual
temporal operators are decorated with time intervals.
In [37], CSL has been extended by the steady state operator
S and by time-unbounded versions of the temporal operators.
The basic CSL model checking algorithm is similar to that for
CTL, but now the evaluation of path formulas requires in general the computation of a probability distribution. Depending
on the given time interval, this can be achieved by transient
analysis [38] or by solving a linear system of equations using
one of the iterative solvers. The evaluation of the steady state
operator is of course done by steady state analysis.
Reward Extensions. CSL has been extended in [39] by
special operators to trigger the computation of expectations of
instantaneous and cumulative rewards.
When excluding the S operator, the remaining CSL fragment is a proper subset of the Continuous Stochastic Reward Logic (CSRL) [40]. Now, the temporal operators are
additionally decorated with a reward interval. CSRL model
checking requires to compute the joint distribution of the
CTMC and the stochastic process representing the evolution
of the accumulated rewards. This is much more involved
than computing transient probabilities, since the latter does
not feature the Markov property. However, there are various
algorithms to compute the joint distribution [41].
Exact analysis. Currently, MARCIE supports model checking of CSL as it is defined in [37], extended by the reward
operators given in [39], mostly in a multi-threaded way.
Furthermore, MARCIE implements the Markovian approximation algorithm [41] and allows to check a subset of CSRL
for state rewards. However, this feature is not documented yet
and still under test.
Approximative analysis. In our current implementation
MARCIE supports a subset of CSL for approximative numerical analysis and simulation; unnested P-operator with timebounded temporal operators can be checked.
9) Parser: This component contains the parsers for the
actual Petri nets, CTL and CSL formulas, reward structures, as
well as place and transition orders. Currently, most of them are
realized using the lexical analyzer flex and the parser generator
bison, but we are about to move to the lightweight parser
generator Spirit from the boost library. For a detailed syntax
specification of all inputs we refer to [20].
III. R ELATED TOOLS
One could create a long list of tools, supporting the analysis of CTMCs and related formalisms and, thus, indirectly
stochastic Petri nets as well. Due to the lack of space we
restrict ourselves to a very short selection from which we will
choose one tool for computational comparison with MARCIE.
An elaborated comparison of available CSL model checkers
can be found in [42], comprising explicit, symbolic and
simulative engines.

95

besides MARCIE the only publicly available implementation.

But in contrast to MARCIE, Sabre does not include any model
checking capabilities which precludes it from being considered
for tool comparison.

The probabilistic model checker PRISM [16] is considered

to be the most popular and advanced tool in the field [43]. It
supports analysis of CTMCs as well as DTMCs and Markov
Decision Processes (MDPs) by means of CSL, PCTL, and
LTL. It further allows the use of CSL extensions to compute
expectations of reward measures. PRISM is based on MTBDDs. It defines its own high level model description language
which can be easily used to define SPN specifications.
Another CSL model checker is the Markov Reward Model
Checker (MRMC) [43]. It also offers analysis capabilities for
CTMCs and related formalisms based on temporal logics. It
is the only tool which supports model checking of CSRL
formulas. MRMC uses sparse representations to encode the
state space and matrices. Particular features are the support for
state space reduction based on bisimulation and a simulative
steady state detection. MRMC provides simulative model
checking of full CSL. It requires third party tools as PRISM to
generate the actual Markov model, which results in handling
possibly huge files.
A further popular tool is SMART [15]. It offers qualitative
and quantitative analysis of GSPNs with marking-dependent
arcs and defines its own high level description language.
SMART supports CTL, but not CSL model checking, although
it is able to efficiently compute transient and steady state
probabilities. The user can choose between various explicit
and symbolic storage strategies for the state space (e.g., AVL
trees, Multi-valued Decision Diagrams (MDDs)) and for the
rate matrix (e.g., Kronecker representations, Multi-Terminal
MDDs, Edge-Valued MDDs, Matrix Diagrams). However,
some of these storage strategies force the user to obey some
modelling restrictions. The use of MDDs, which for instance
permit efficient saturation-based reachability analysis, requires
to specify a suitable place partition. SMART also implements
discrete event simulation.
All three tools can be used for simulative as well as
numerical analysis of stochastic Petri nets. None of the tools
currently supports multi-threading.
In the end we have chosen PRISM for comparison with
MARCIE. It is easy to use and the case studies which we will
consider in the following were either already available or easy
to create in the PRISM language. To employ its efficient hybrid
engine does not require specific modelling restrictions as it is
the case when using, e.g., SMARTs MDD engine. Generally,
PRISM is the tool most comparable with MARCIE (in terms of
the features that they both have). We made experiments using
PRISMs hybrid and sparse engine. See also [12], where we
already compared PRISM and MARCIEs predecessor IDDMC concerning transient analysis of biological models.
A comparison with SMART, specifically with its Edge
Valued Decision Diagrams would be of interest as well. But
this paper is written from a users perspective and currently
we were not aware of a documented and stable 64 bit version.
None of the mentioned tools supports the numerical approximation algorithm for computing transient solutions of
stochastic models as described in II-B7 and implemented in
MARCIE. To the best of our knowledge, the tool Sabre [44] is

IV. C OMPARISON
In this section we provide benchmark results to empirically
prove MARCIEs efficiency. We concentrate on quantitative
analyses and use CSL properties to trigger the computation of
transient and steady state probabilities. We will compare our
performance results with PRISM using five different stochastic
Petri nets. Besides established CTMC benchmarks we will also
use two models from Systems Biology.
All Petri net models have been done with our Petri net editor
Snoopy [19] and are available on our website http://wwwdssz.informatik.tu-cottbus.de/DSSZ/Examples. There we also
provide Petri nets for further biochemical models which we
have previously used as benchmarks [12, 35].
A. Case Studies
We will use the following technical systems.
FMS. The Flexible Manufacturing System with three machines has been published in [3]. The original model contains
immediate transitions; thus it is a GSPN. As discussed, our
exact CTMC analysis engine suffers from immediate transitions, and PRISM does not support immediate commands.
Thus we will consider a pure SPN model which has been
derived from the GSPN model by applying the elimination
rules for immediate transitions given in [2]. Furthermore, the
FSM model contains arcs with marking-dependent weights.
MARCIE does not support such arcs as they potentially
destroy the locality principle. Instead, our model simulates
the marking dependencies by additional transitions, each representing a specific firing situation in the original model. The
FMS is scalable concerning the number of items which can
be processed by the machines. The places P 1, P 2 and P 3
carry initially N tokens. The model can be easily scaled
be increasing the value of N . Our SPN model is limited
to N = 15 due to the explicit modelling of the markingdependent arcs.
Kanban. The kanban system has been used in [4] to
demonstrate efficient CTMC encoding and solution using the
Kronecker approach. The model is scalable by the initial
marking.
PSS. The SPN model of a polling server system has been
derived from that given in the PRISM case study collection
which is based on [45]. The model is scalable by the number
of stations communicating with the server. Thus scalability is
here given by the net structure, not only by the initial marking.
Additionally, we use the following models from Systems
Biology.
AKAP. This model, see Fig. 4, of the AKAP scaffoldmediated crosstalk between the cAMP and the Raf1/MEK/ERK pathways has been specified and analysed using
PRISM in [46]. The AKAP model is scalable by the initial
marking and the arc weights.

96

ANG. This model of signal transduction events involved in

the angiogenetic process has been published in [9]. The model
is scalable by the initial marking.

TABLE I
S IZE OF THE REACHABILITY GRAPHS FOR DIFFERENT MODEL
CONFIGURATIONS . R EACHABILITY GRAPH AND CTMC ARE ISOMORPHIC
IF THERE ARE NO PARALLEL TRANSITIONS . T HE REACHABILITY GRAPHS
OF THE AKAP MODEL CONTAIN SUCH PARALLEL TRANSITIONS .

.$%& 8796:87; ,!-. (

.$%& 8796:87; ,!-. #

model

,!-.
<AB;<AB .$%& <C:5

,!-.

<AB;<AB C:5

.$%& 8796:87; ,!-. '

:,/0?:/7 .@! #

2##"

<AB;<AB C:5 <.$%&

2"""

F MS

4
<AB;<AB .$%&
2"#"

4
2###

2#""

4
,!-.

.. 87<AB;<AB <.$%& ( 87<AB;<AB# C:5

2#"#

67>7:;7#,!-.

.$%& 8796:87; ,!-. )

""
4

..

Kanban

.. 87<AB;<AB <.$%& #
2"##
87<AB;<AB( C:5

2""#

<.$%& 8796:87; ,!-.(

,!-.

P SS

<.$%& 8796:87; ,!-.#

<AB;<AB 3 .$%& D0;

87<AB;<AB 5677 .$%&

AKAP

4
.$%& .

.$%&

/0,1

<AB;<AB 3 .$%&
.. 3
4
5677 .$%& 8796:87; ,!-.

,!-.

""

2##
4

87<AB;<AB 3 C:5
4

2""

""

#"

AN G

67>7:;7#,!-. 3

<AB;<AB 3 C:5
:,/0?:/7 3 .@! #

#
5677 <.$%& 8796:87; ,!-.

80553;7# 0= ,!-. 80553;7' 0= ,!-.

| states |
810
35,910
537,768
4,459,455
25,397,658
111,414,940
403,259,040
4,600
454,475
11,261,376
133,865,325
240
15,360
737,280
31,457,280
1,632,240
15,611,175
74,612,328
386,805,104
5,384
2,413,480
277,789,578

| transitions |
3,699
237,120
4,205,670
38,533,968
234,523,289
1,078,917,632
4,047,471,180
28,120
3,979,850
115,708,992
1,507,898,700
800
89,600
6,144,000
340,787,200
12,691,360
141,398,580
734,259,344
4,116,788,172
26,193
21,810,412
24,813,347,031

80553;7( 0= ,!-.

4
""4

#"4!"

""4

TABLE II
T HE EVOLUTION OF THE STATE SPACE OF THE FMS MODEL GIVEN AS
SPN AND GSPN. |Sq | DENOTES THE NUMBER OF STATES WHEN
COMPLETELY CONSIDERED QUALITATIVELY, I . E . IMMEDIATE
TRANSITIONS ARE NOT PRIORIZED OVER STOCHASTIC TRANSITIONS . A

2"#

N
2
4
6
8
10
12
14
2
4
6
8
5
10
15
20
3
4
5
6
2
4
6

,!-.
..

2#"

PRIORIZATION OF IMMEDIATE TRANSITIONS AS IT IS THE CASE IN THE

GSPN SEMANTICS YIELDS THE SET OF REACHABLE STATES S WHICH
CONSISTS OF THE VANISHING STATES Sv AND THE TANGIBLE STATES St .

Fig. 4. A Petri net model of the AKAP scaffold-mediated crosstalk. The

net consists of 18 places and 28 transitions which are connected by 108 arcs.
The grey colored places are fusion places (multiple logical occurrences of the
same place) used to achieve a clear layout.

N
2
4
6
8
10

B. Experiments
All computational experiments were done on a 82.26 Mac
Pro workstation with 32GB RAM running Cent OS 5.5. We
restricted all experiments to a run-time of at most 12 hours.
We considered for all models different state spaces which
are shown in Table I. MARCIEs capabilities concerning state
space generation and CTL model checking are not appropriately reflected by these figures. For instance, MARCIE is able
to compute the state space for the FMS and Kanban model
up to N = 300 which means to have about 3.65 1028 or
2.65 1024 states [6].
However, in this paper we focus on the quantitative analysis;
thus the feasible model size is limited by the memory effort for
the probability vectors. On our test system this would permit
to consider models as Kanban, N=10, with about 1109 states,
depending on the used solver. For the FSM we use the SPN
model which permits a more efficient analysis as explained in
Section II-B6.
All experiments were triggered by CSL formulas, which
possibly refer to model-specific reward structures. The CSL
formulas and reward structures are available on our website.
Our numerical experiments can be divided into three categories.

|Sq |
3,444
438,600
15,126,440
248,002,785
2,501,413,200

|S|
2,202
138,060
2,519,580

|Sv |
1,392
102,150
1,981,812

|St |
810
35,910
537,768
4,459,455
25,397,658

1) Steady State Analysis: To trigger the computation of

the steady state distribution we used either the CSL template
S=? [sp] with a model-specific state property sp or the CSL
reward template R{rs}=? [S] with a model-specific reward
structure rs. We used the Jacobi solver which is the default
steady state solver both in MARCIE and PRISM. Only for the
kanban system and the angiogenetic process we had to move
to Gauss-Seidel, because the Jacobi solver did not converge
within 10,000 iterations. Steady state analysis requires to
determine the reversibility of the SPN (irreducibility of the
CTMC) and, if necessary, a SCC decomposition. It turned
out that for the PSS model the computed variable order
was not the best choice for this precomputation step. The
SCC decomposition required much more time than the actual
analysis. Thus we used the plain place order.
FMS. We used transition rewards to specify and compute
the productivity of the system; see [3] for more details.
Kanban. We used transitions rewards to specify and compute the throughput of the system.

97

TABLE III
T OTAL RUN - TIME FOR STEADY STATE ANALYSIS INCLUDING STATE SPACE GENERATION , INITIALIZATION , REWARD COMPUTATION - IF NECESSARY, AND
PROBABILITY COMPUTATION . T HE NUMBER OF REQUIRED ITERATIONS IS GIVEN IN THE COLUMNS iter. T HE LAST TWO COLUMNS SHOW RESULTS OF
PRISM USING ITS HYBRID AND SPARSE ENGINE . I F POSSIBLE WE USED THE JACOBI SOLVERS . F OR THE K ANBAN AND ANG MODELS WE USED THE
G AUSS -S EIDEL SOLVERS . T HE NUMBER OF ITERATIONS REQUIRED BY THE G AUSS -S EIDEL SOLVERS DIFFER BETWEEN MARCIE AND PRISM BECAUSE
OF DIFFERENT VARIABLE ORDERS .
model

F MS

Kanban

P SS
AKAP
AN G

N
2
6
10
12
14
2
4
6
8
10
15
20
4
5
6
2
3
4

MARCIE
PRISM
1
2
4
8
iter
hybrid
1s
1s
1s
1
378
2s
59s
42s
57s
34s
1,084
41s
1h11m15s
45m07s
30m31s
24m47s
1,812
2h25m42s
6h13m53s
3h52m32s
2h26m17s
2h04m45s
2,193

9h10m04s

1s
189
2
15s
Gauss-Seidel
323
12s
11m07s
no multi-threading support
622
9m48s
3h57m23s
999
3h27m27s
1s
1s
1s
1s
406
2s
14s
9s
5s
3s
657
24s
16m16s
10m58s
6m21s
3m08s
920
31m28s
21m17s
13m07s
7m04s
4m40s
1,433
17m37s
1h46m52s
1h05m12s
37m39s
23m03s

8h00m02s
3h53m29s
2h43m48s

48s
n.a.
4m05s
1s24m55s
Gauss-Seidel

no multi-threading support

means that the experiment was canceled after 12 hours

means that the CTMC could not be created using the default tool settings

iter
378
1,084
1,812
2,193
2,589
48
122
224
356
406
657
920
1,433
1,348
1,659
n.a.
n.a.
n.a.

PSS. We computed the steady state probability that station

1 is waiting, which gives the state property (s1 = 1) (s =
1 a = 1).
AKAP. We used state rewards to specify and compute the
average number of tokens on place cAM P .
ANG. We used state rewards to specify and compute the
average number of tokens on place DAG.

sparse
3s
30s
37m15s
3h32m11s

2s
10s
6m18s
1h59m59s
2s
21s
26m31s
17m08s

28s

the performance of MARCIEs Jacobi solver lies between

PRISMs sparse and hybrid engine, as expected without multithreading. An exception is the PSS model, where MARCIE
performs better in all cases.
MARCIEs multi-threading feature reduces the computation
time for all models and all supported analysis methods,
although the actual speedup varies.
Because of space limitations we just give the total run-time and
ignore the memory consumption. A closer look at the obtained
results reveals that there are significant differences regarding
the time needed to construct the state space, to compute the
rewards, and the probability distribution or to initialise cache
data. Thus our tables only represent a very rough comparison.
Both tools can be used more efficiently when using dedicated options. For instance, the computed cache layer for
the FMS, which is 8, is not the best choice. A value of
12 would drastically reduce initialization time and memory
consumption. The cache initialization for N=12 takes 866
seconds when using 4 threads, while the computation of
transient probabilities takes just 583 seconds. Thus the total
run-time increases with 8 threads, although the computation
time decreases. In this case the overhead for initialization is
accompanied by too few iterations required.

2) Transient Analysis: We use either the CSL template

P=? [F [t, t]sp] which computes the probability to be in a state
satisfying the model-dependent state property sp at time point
t when starting in the initial state, or the CSL reward template
R{rs}=? [I = t] which computes the expected instantaneous
reward at time point t when starting in the initial state and
considering the model-specific reward structure rs. The time
parameter t was set to 1.0 for all experiments.
FMS. We computed the probability for time t to have N
tokens on place P 1.
Kanban. We computed the probability for time t to have
N tokens on place x1.
PSS. We computed the probability at time t that station 1
is waiting.
AKAP. We used state rewards to specify and compute the
expected number of tokens on place cAM P at time point t.
ANG. We used state rewards to specify and compute the
expected number of tokens on place DAG at time point t.

4) Approximative Analysis: For the fast adaptive uniformization as well as the simulation we use the CSL template
P=? [F [t, t] place = N ] which computes the probability to be
in a state satisfying the model-dependent state property that
place has N token at time point t when starting in the initial
state. We used the same places as for the transient analysis.
Results. Table V shows the total run-time for transient analysis using simulation in MARCIE and PRISM. The stochastic

3) Results: In Table III and IV we provide results of our

numerical experiments. For the transient analysis, MARCIEs
IDD engine outperforms PRISMs hybrid engine as well as
its sparse engine for increasing values of N even in the
single-threaded mode. For the steady state analysis, MARCIE
can not compete with PRISMs Gauss-Seidel solver, while

98

TABLE IV
T OTAL RUN - TIME FOR TRANSIENT ANALYSIS INCLUDING STATE SPACE GENERATION , INITIALIZATION AND PROBABILITY COMPUTATION . T HE COLUMN
iter GIVES THE NUMBER OF REQUIRED ITERATIONS . T HE LAST TWO COLUMNS SHOW PRISM RESULTS USING ITS HYBRID AND SPARSE ENGINE .
model
N
8
F MS
10
12
14
4
Kanban
6
8
10
P SS
15
20
4
AKAP
5
6
4
AN G
5
6

Marcie
PRISM
1
2
4
8
hybrid
sparse
2m27s
2m28s
1m51s
1m28s
3m47s
2m50s
13m11s
9m44s
7m51s
8m22s
27m39s
15m57s
55m54s
42m41s
31m56s
29m57s
2h10m47s
1h39m05s
4h07m51s
3hm35ms07s
2h48m59s
2h41m41s
8h26m38s
OutOfMemory
6s
3s
2s
2s
12s
8s
1m57s
1m34s
48s
34s
5m16s
3m09s
23m59
17m53s
9m18s
6m41s
1h08m15s
43m23s
1s
1s
1s
1s
2s
2s
17s
7s
4s
3s
33s
17s
9m02s
5m32s
2m59s
2m06s
29m18s
14m22s
25m15s
17m09s
7m49s
5m13s
52m20s
24m12s
2h40m14s
1h34m36s
47m54s
30m26s

5h44m53s
3h49m45s

1m53s
1m18s
54s
44s
2m27s
7m24s
31m08s
20m50s
13m45s
11m46s
34m06s
4h25m34s
7h36m57s
4h39m52s
3h17m47s
3h00m16s

means that the experiment was canceled after 12 hours

means that the CTMC could not be created using the default tool settings
iter
202
202
208
208
181
181
181
377
377
377
1,532
1,850
2,218
547
794
1,093

TABLE V
T OTAL RUN - TIME FOR SIMULATIONS DONE WITH MARCIE AND PRISM.
T HE CONFIDENCE LEVEL IS 99%, THE DESIRED ACCURACY 1 105 ,
WHICH LEADS TO 66, 348, 303 SIMULATION RUNS .
model

F MS

14

Kanban

10

10

P SS

20

AKAP

AN G

Threads
1
8
1
8
1
8
1
8
1
8

MARCIE
40m43s
5m4s
13m48s
1m58s
4h10m4s
31m53s
2m37s
25s
38m48s
5m20s

We gave an overview of its current features, which particularly

include symbolic CTL and CSL model checking for bounded
nets and approximative model checking of unnested timebounded formulas, which also works for unbounded nets. The
quantitative analyses are based on efficient solvers to compute
transient and steady state probabilities. To the best of our
knowledge, MARCIE is the first available tool offering these
features symbolically and multi-threaded.
We demonstrated MARCIEs efficiency by presenting a bulk
of experimental results and a comparison with PRISM. The
experimental results which we presented in this paper and
in [12, 13] suggest that specifically for biological networks
MARCIE is currently the most efficient model checking tool.
In the future we are going to extend the model checking
capabilities by full CSRL model checking based on our onthe-fly engine and by simulative PLTLc [47] model checking.
Furthermore we are preparing out-of-core support and distributed symbolic computation of probability distributions.
Acknowledgements.: We would like to thank Verena Wolf
for fruitful discussions and for the support in MARCIEs FAU
implementation.

PRISM
3h24m13s
n.a.
2h23m58s
n.a.
62h32m33s
n.a.
10m23s
n.a.
8h26m57s
n.a.

simulation in PRISM seems not to be optimized for simulative

model checking. The stochastic simulation greatly benefits
from multi-threading. The speedup is almost linear with the
number of threads.
TABLE VI
T OTAL RUN - TIME AND NUMBER OF STATES OF THE APPROXIMATED
CTMC S OF MARCIE S FAST ADAPTIVE UNIFORMIZATION ALGORITHM .
model
F MS
Kanban
P SS
AKAP
AN G

N
14
10
20
6
6

t
1
10
1
1
1

time
29s
8m46s
33s
3s
42m21s

|Sappr |
821,199
20,444,464
296,991
81,657
12,619,037

R EFERENCES

|S|
403,259,040
1,005,927,208
31,457,280
386,805,104
277,789,578

[1] P. M. Merlin and D. J. Farber, Recoverability of communication protocols - implications of a theoretical study, IEEE
Transactions on Communications, vol. 24, no. 9, pp. 1036
1043, 1976.
[2] M. A. Marsan, G. Balbo, G. Conte, S. Donatelli, and G. Franceschinis, Modelling with Generalized Stochastic Petri Nets. Wiley Series in Parallel Computing, John Wiley and Sons, 1995,
2nd Edition.
[3] G. Ciardo and K. S. Trivedi, A Decomposition Approach
for Stochastic Reward Net Models, Performance Evaluation,
vol. 18, no. 1, pp. 3759, 1993.
[4] G. Ciardo and M. Tilgner, On the use of Kronecker operators
for the solution of generalized stocastic Petri nets, Institute
for Computer Applications in Science and Engineering, ICASE
Report 96-35, 1996.

Table VI shows the size of approximated CTMCs and the

total run-time using MARCIEs fast adaptive uniformization.
The CTMCs are approximated by at most 4.5% of their
complete size.
V. C ONCLUSION
In this paper we presented MARCIE, a tool for qualitative
and quantitative analysis of Generalized Stochastic Petri Nets.

99

[5] R. E. Bryant, Graph-Based Algorithms for Boolean Function

Manipulation, vol. C-35, no. 8, pp. 677691, 1986.
[6] M. Heiner, M. Schwarick, and A. Tovchigrechko, DSSZ-MC A Tool for Symbolic Analysis of Extended Petri Nets, in Proc.
Petri Nets 2009. LNCS 5606, Springer, 2009, pp. 323332.
[7] D. Gilbert, M. Heiner, and S. Lehrack, A unifying framework
for modelling and analysing biochemical pathways using Petri
nets, in Proc. CMSB 2007. LNCS/LNBI 4695, Springer, 2007,
pp. 200216.
[8] M. Heiner, D. Gilbert, and R. Donaldson, Petri nets in systems
and synthetic biology, in SFM. LNCS 5016, Springer, 2008,
pp. 215264.
[9] L. Napione, D. Manini, F. Cordero, A. Horvath, A. Picco,
M. D. Pierro, S. Pavan, M. Sereno, A. Veglio, F. Bussolino, and
G. Balbo, On the Use of Stochastic Petri Nets in the Analysis
of Signal Transduction Pathways for Angiogenesis Process, in
Proc. CMSB 2009. LNCS/LNBI 5688, Springer, 2009, pp.
281295.
[10] M. Heiner, S. Lehrack, D. Gilbert, and W. Marwan, Extended
Stochastic Petri Nets for Model-Based Design of Wetlab Experiments. LNCS/LNBI 5750, Springer, 2009, pp. 138163.
[11] A. Tovchigrechko, Model checking using interval decision
diagrams, Ph.D. dissertation, BTU Cottbus, Dep. of CS, 2008.
[12] M. Schwarick and M. Heiner, CSL model checking of biochemical networks with interval decision diagrams, in Proc.
CMSB 2009. LNCS/LNBI 5688, Springer, 2009, pp. 296312.
[13] M. Schwarick and A. Tovchigrechko, IDD-based model validation of biochemical networks, TCS 412, pp. 28842908, 2010.
[14] M. Schwarick, IDD-MC - a model checker for bounded
Stochastic Petri nets, in Proc. 17th AWPN. CEUR-WS 643,
2010, pp. 8087.
[15] G. Ciardo, R. L. Jones, A. S. Miner, and R. Siminiceanu,
Logical and stochastic modeling with SMART, Perform.
Eval., vol. 63, no. 1, pp. 578608, 2006.
[16] A. Hinton, M. Kwiatkowska, G. Norman, and D. Parker,
PRISM: A tool for automatic verification of probabilistic
systems, in Proc. TACAS 2006. LNCS 3920, Springer, 2006,
pp. 441444.
[17] A. Franzke, Charlie 2.0 - a multi-threaded Petri net analyzer,
Diploma Thesis (in German), BTU Cottbus, Dep. of CS, 2009.
[18] F. Bause, P. Kemper, and P. Kritzinger, Abstract Petri Net
Notation, Univ. Dortmund, Dep. of CS, Tech. Rep., 1994.
[19] C. Rohr, W. Marwan, and M. Heiner, Snoopya unifying
Petri net framework to investigate biomolecular networks,
Bioinformatics, vol. 26, no. 7, pp. 974975, 2010.
[20] M. Schwarick, Manual: Marcie - An analysis tool for Generalized Stochastic Petri nets, BTU Cottbus, Dep. of CS, 2010.
[21] A. Noack, A ZBDD Package for Efficient Model Checking of
Petri Nets (in German), BTU Cottbus, Dep. of CS, Tech. Rep.,
1999.
[22] E. M. Clarke, E. A. Emerson, and A. P. Sistla, Automatic
verification of finite state concurrent systems using temporal
logic specifications, ACM TOPLAS, vol. 8, no. 2, pp. 244263,
1986.
[23] W. Stewart, Introduction to the Numerical Solution of Markov
Chains. Princeton Univ. Press, 1994.
[24] A. Miner and D. Parker, Validation of Stochastic Systems: A
Guide to Current Research. LNCS 2925 , Springer, 2004, ch.
Symbolic Representations and Analysis of Large Probabilistic
Systems, pp. 296338.
[25] G. Ciardo, Data representation and efficient solution: A decision diagram approach, in Proc. SFM. LNCS 4486, Springer,
2007, pp. 371394.
[26] D. Deavours and W. H. Sanders, On-the-Fly solution techniques for Stochastic Petri nets and extensions, in IEEE Transactions on Software Engineering, 1997, pp. 132141.
[27] A. S. Miner and G. Ciardo, Efficient Reachability Set Gen-

[28]
[29]

[30]
[31]
[32]
[33]
[34]
[35]
[36]
[37]

[38]
[39]
[40]
[41]
[42]

[43]

[44]
[45]
[46]
[47]

100

eration and Storage Using Decision Diagrams, in Proc. 20th

ICATPN. LNCS 1639, Springer, 1999, pp. 625.
D. Parker, Implementation of symbolic model checking for
probabilistic systems, Ph.D. dissertation, University of Birmingham, 2002.
G. Ciardo, A. Blakemore, P. F. Chimento, J. K. Muppala, and
K. S. Trivedi, Automated generation and analysis of Markov
reward models using stochastic reward nets. IMA Volumes
in Mathematics and its Applications: Linear Algebra, Markov
Chains, and Queueing Models / Meyer, C.; Plemmons, R.J,
vol. 48, pp. 145191, 1993.
T. Henzinger, M. Mateescu, and V. Wolf, Sliding window
abstraction for infinite Markov chains, in Proc. CAV. Springer,
LNCS 5643, 2009, pp. 337352.
F. Didier, T. A. Henzinger, M. Mateescu, and V. Wolf, Fast
Adaptive Uniformization for the Chemical Master Equation,
in HIBI. IEEE Comp. Soc., 2009, pp. 118127.
D. Gillespie, Exact stochastic simulation of coupled chemical
reactions, The Journal of Physical Chemistry, vol. 81(25), pp.
23402361, 1977.
W. Sandmann and C. Maier, On the statistical accuracy of
stochastic simulation algorithms implemented in Dizzy, in
Proc. WCSB 2008, 2008, pp. 153156.
R. German, Performance analysis of communication systems
with non-Markovian stochastic Petri nets. Wiley, 2001.
M. Heiner, C. Rohr, M. Schwarick, and S. Streif, A comparative study of stochastic analysis techniques, in Proc. CMSB
2010. ACM, 2010, pp. 96106.
A. Aziz, K. Sanwal, V. Singhal, and R. Brayton, Model
checking continuous-time Markov chains, ACM Trans. on
Computational Logic, vol. 1, no. 1, pp. 162170, 2000.
C. Baier, H. Hermanns, and J.-P. Katoen, Approximative Symbolic Model checking of Contiuous-Time Markov Chains, in
Proc. 10th CONCUR. LNCS 1664, Springer, 1999, pp. 163
175.
C. Baier, B. Haverkort, H. Hermanns, and J.-P. Katoen, Model
checking continuous-time Markov chains by transient analysis,
in Proc. CAV 2000. LNCS 1855, Springer, 2000, pp. 358372.
M. Kwiatkowska, G. Norman, and D. Parker, Stochastic model
checking, in SFM. LNCS 4486, Springer, 2007, pp. 220270.
B. Haverkort, L. Cloth, H. Hermanns, J.-P. Katoen, and C. Baier,
Model Checking Performability Properties, IEEE CS Press,
pp. 103112, 2002.
L. Cloth and B. R. H. M. Haverkort, Five performability
algorithms. A comparison, in MAM 2006: Markov Anniversary
Meeting, Charleston, SC, USA. Boson Books, 2006, pp. 3954.
D. N. Jansen, J.-P. Katoen, M. Oldenkamp, M. Stoelingan,
and I. Zapreev, How fast and fat is your probabilistic model
checker? in HVC 2007. LNCS 4899, Springer, 2008, pp.
6985.
J.-P. Katoen, I. S. Zapreev, E. M. Hahn, H. Hermanns, and D. N.
Jansen, The Ins and Outs of The Probabilistic Model Checker
MRMC, in Proc. QEST. IEEE Computer Society, 2009, pp.
167176.
F. Didier, T. A. Henzinger, M. Mateescu, and V. Wolf, Sabre: A
tool for stochastic analysis of biochemical reaction networks.
in Proc. QEST. IEEE Computer Society, 2010, pp. 217218.
O. Ibe and K. Trivedi, Stochastic Petri net models of polling
systems, IEEE Journal on Selected Areas in Communications,
vol. 8, no. 9, pp. 16491657, 1990.
O. Andrei and M. Calder, A model and analysis of the AKAP
scaffold, Electron. Notes Theor. Comput. Sci., vol. 268, pp.
315, December 2010.
R. Donaldson and D. Gilbert, A Monte Carlo model checker
for probabilistic LTL with numerical constraints, University of
Glasgow, Dep. of CS, Tech. Rep., 2008.