ofamedicalinformationsystemisconsideredandisshowntobepreservedunder

Transcription

1 StepwiseDevelopmentofHigh-LevelPetriNets CompatibilityofNetInvariantsand RenementversusVerication: J.Padberg,M.Gajewsky,C.Ermel TechnischeUniversitatBerlin asanintegrationofalgebraicspecicationsandpetrinets.inalargecasestudy powerfulconceptforverticalstucturingofpetrinets.thisincludeslow-leveland high-levelpetrinets,especiallyalgebraichigh-levelnetswhichcanbeconsidered rule-basedmodicationofalgebraichigh-levelnetshasbeenappliedsuccessfully transformationsandhigh-levelreplacementsystemshasrecentlyshowntobea fortherequirementsanalysisofamedicalinformationsystem.themainnew Theconceptofrule-basedmodicationdevelopedintheareaofalgebraicgraph Abstract ofamedicalinformationsystemisconsideredandisshowntobepreservedunder asaverticaldevelopmentstrategythisextensionisanimportantnewtechnique.it resultinthispaperextendsrule-basedmodicationofalgebraichigh-levelnets suchthatitpreservessafetypropertiesformulatedintermsoftemporallogic.for iscalledrule-basedrenement.asarunningexampleanimportantsafetyproperty softwaredevelopmentbasedonrule-basedmodicationofalgebraichigh-levelnets (Humboldt-UniversitatzuBerlin),supportedbytheGermanResearchCouncil(DFG). betweenh.weber(coordinator),h.ehrig(bothfromthetechnischeuniversitatberlin)andw.reisig Thisworkispartofthejointresearchproject\DFG-ForschergruppePetrinetz-Technologie" 1

2 Contents 4CompatibilityofRule-BasedModication 3PreservingInvariantswithAHLNetMorphisms 1Introduction 2VericationandRenementinHDMS andinvariants Conclusion 39 2

3 1Introduction Petrinetsarewell-knownasabasicmodelforthegeneraltheoryofconcurrencyand asaformalspecicationtechniquefordistributedandconcurrentsystems.high-level netscanbeconsideredastheintegrationofprocessanddatatypedescription,most [GL81,Gen91]andalgebraichigh-levelnets[Vau87,Rei91,PER95].Thepractical relevanceofhigh-levelpetrinetsisconsideredtobeveryhigh,astherearemanyhighlevelpetrinettoolsusedinrealsoftwareproduction(e.g.leu[sm97],design/cpn abstractdatatypes(seee.g.[em85])weusealgebraichigh-levelnets,butthereisno [JCHH91],INCOME[OSS94]).Sincealgebraicspecicationsarewelldevelopedfor prominentclassesarecolouredpetrinets[jen92,jen95],predicate/transitionnets veriedproperties. problemoftranferringresultstootherhigh-levelnetclassesastheseclassescanbe IntheareaofPetrinetstherearemanycontributionsconcerningvericationwithtemporallogic[DDGJ90,BS90,HRH91]andrenement[BGV90,DM90,GG90,BDH92, Onemainproblemofvericationinformalsoftwareengineeringcanbedescribed restrictedandanentirelynewvericationateachstepisusuallyconsideredtobetoo expensiveandtimeconsuming.thus,verticalstructuringtechniquesshouldpreserve tionduringallphasesofthesoftwaredevelopmentprocess.nevertheless,resourcesare bythefollowingdemand:rigoroussoftwaredevelopmentrequirescontinuousverica- conceivedasdierentinstancesofageneraltheoryofabstractpetrinets(see[pad96]). safetyproperties.thetheoryofrule-basedmodicationisaninstanceofthetheory Peu97].Theyaremainlyintheareaoflow-levelnets.Intheareaofhigh-levelnets, sideoftherule)andwhichnewpartsaretobeadded(rightsideoftherule).this levelnets(developedin[per95])andextendittorule-basedrenementpreserving ofhigh-levelreplacementsystems[ehkp91],ageneralizationofgraphtransformation [Ehr79]inacategoricalway.Rulesdescribewhichpartsofanetaretobedeleted(left systempropertieswithrenement. verication[jen95,sch96]ismuchmoredicultandevenmorethecompatibilityof transformationofnetsyieldsaresultingnetwhichiswell-denedandnounspecied changeshavebeenmade.theadvantageofthisapproachisthelocaldescriptionof Inthisreportweconsiderournotionofrule-basedmodicationofalgebraichighphisms,calledplacepreservingmorphisms,allowtransferringspecictemporallogiphismsin[PER95]{preservesafetyproperties,inthesenseof[MP92].Thesemor- formulasexpressingnetpropertiesfromthesourcetothetargetnet.thisfactiscapturedbyourrstmaintheorem3.17thatstatesthefactthatplacepreservingmorphisms obtainsafetypropertypreservingalgebraichigh-levelnetmorphisms. Moreover,wecombinetheseplacepreservingmorphismswithrule-basedmodication. ofthenewconcept4.1thatistheextensionofrule-basedmodicationtorule-based videdwithsuchasafetypropertypreservingmorphism.thisallowstheformulation Thesecondmainresultofthisreportisformulatedintheorem4.15.Itstatesthe preservationofsafetypropertiesundertransformationofnetsviasomerulethatispro- renement,aformaltechniqueforverticalstructuringinsoftwaredevelopment. change. Inordertoextendrule-basedmodicationofalgebraichigh-levelnetsweintroduce morphismsforalgebraichigh-levelnets,that{incontrasttotransitionpreservingmor- preserveinvariantformulas.asinvariantformulasdescribesafetypropertieswehereby 3

4 resultsofthispaperinthecontextofacasestudy[erm96,epe96]concerningthe developmentofamedicalinformationsystem.asketchofthiscasestudyaswellas areviewofthebasicnotionsofalgebraichigh-levelnetsandrule-basedmodication isgiveninthenextsection.insection3weintroducethenotionofplacepreserving morphisms.ourrstmainresultstatesthatthesemorphismspreservesafetyproperties. Insection4,rule-basedmodicationisintegratedwiththesemorphisms.Wepresentour secondmaintheorem,showingthatrule-basedrenementpreservessafetyproperties. Throughoutthewholereportwegiveanongoingexamplewhichillustratesthe Moreover,wediscusstherelevanceofourresultsforsoftwareengineering,especiallythe combinationofhorizontalstructuringandrenement. aswellasampleillustrationofthetechnicalnotionsbymeansofourrunningmedical informationssystemexample.acompactversionofthisreportbythesameauthors discussedinfulldepth. of[pge98]areelaboratedinthisreport,thetechnicalbasicsandtheexamplesare ([PGE98])hasbeenpresentedatETAPS-FASE98inLisbon.Thesketchedproofideas Inthisreport,acompanionreportto[PGE98],wegivethefullproofsofourtheorems ReisigfromHumboldt-UniversitatzuBerlinwithinthe\DFG-ForschergruppePetrinetz- Acknowledgements areforexample[kin97,kp98]. ThisworkwasdevelopedonthebasisofacooperationwiththegroupofProf.W. vativeextensionsofpetrinetsviamorphismstogetherwiths.peukerandw.reisig Technologie"(seealsothefootnoteonpage1).ThecooperationonthesubjectConser- ofthenets.otherworksofthereisiggrouponcompositionalapproachesofverication forlow-levelpetrinetsandshowingthatthesemorphismspreserveinvariantproperties resultedinthecontribution[peu97]deningthenotionofplace-preservingmorphisms 4

5 Anylargeandcomplexsystemcanonlybedevelopedusinghorizontalandvertical ofourcasestudy.themotivationaddressesgeneralproblemsinsoftwareengineering. Inthissectionwemotivatethenotionsandresultsofthesubsequentsectioninterms structuringthatis,stepwisedevelopmentofsubsystem.thisimpliesthattheentire 2VericationandRenementinHDMS Thenwebrieydenealgebraichigh-level(AHL)nets,theirbehaviourandAHLnet engineering.last,wegiveanexampleofverifyingasafetyproperty,rstinanetand systemisgivenonlyimplicitly.thus,vericationhastobeachievedaccordingto modicationviatransformationrulesusedtodescribedevelopmentstepsinsoftware thenforonedevelopmentstep.note,thisismerelyasmallexamplefromthelarger horizontalandverticalstructuring. contextofthemedicalinformationsystem. Wewillrstsketchtheaimandscopeofourmedicalinformationsystemcasestudy. ThemedicalinformationsystemHDMS Themedicalinformationsystem,calledHeterogeneousDistributedInformationManagementSystem(HDMS),hasbeenalargeprojectincludingthewholereorganisatioducedduringthetreatmentofDHZBpatients,whichisabletocommunicatethesedata Medizin/InformatikattheDHZBandtheTechnicalUniversityBerlin(foranoverview Herz-ZentrumBerlin(DHZB).ThisprojecthasbeendevelopedbytheProjektgruppe kindsofcardiacdiseases.theaimoftheprojecthasbeenthe\developmentofasupport andinformationsystemforallactivitiesofthemedicalandthenon-medicalpersonnel atthedhzb,whichisabletodigitallyrecordandstoreallmedicaldatawhicharepro- see[bj97])1thedhzbisaclinicalcenterwhichisdedicatedtothetreatmentofall ofthemedicalandmanagementdataofthegermancardiaccenterberlin,deutsches furtherhumanprocessing"([fhmo91]). withinthewholesystemandtopresenttheseinauniqueformattheuserinterfacefor functionalessencecomprisesabout100rulesandusesinasignicantwaycompatibility wepresentonerenementstepofthewholerule-basedrenementgivenexplicitlyin resultsform[per95]betweenhorizontalstructuringandrule-basedrenement.our ofhdms,theelectronicpatientdatarecord,usingalgebraichigh-levelnets.here techniquesdevelopedin[per95].thetransformationsequencefromactualstateto [Erm96].Infact,theAHLnetsmodellingtheactualstatein[Erm96]containabout 130placesand50transitionsandaremodelledusingsuitablehorizontalstructuring Inourcasestudy[Erm96]weprovideaformalrequirementanalysisforapart kindofahlnetmorphismsforthenettransformation. thatitispossibletoshowthatinvariantpropertiesarepreservedwhenusingaspecial goalinthischapterafterhavingintroducedthebasictechnicalnotions,istodemonstrate 1991and1994[CHL95]. KORSO,(KORrekteSOftware),nancedbytheMinisterofResearchandTechnology(BMFT)between 1ThecasestudyHDMS?A,thebasisforourwork,hasbeenapartoftheGermanBMFT-project 5

6 formaldescriptions.oneofthemainissuesforthepracticaluseofcategoricalspecicationformalismsisthepossibilityofhorizontalandverticalstructuring.fortheconcept AlgebraicHigh-LevelNetsandRenementTechniques InthecontextofPetrinets,categorytheoryhasbeenusedinliteraturetoformulate propertiesofspecicnetclasses,tostudycompositionalityandtherelationtoother withintheframeofhigh-levelreplacementsystems[el93].resultsfromthetheoryof AHLnetabstraction/renementstepsinthesenseofsoftwareengineering. AHLnets[PER95]comprisehorizontalstructuringtechniqueslikeunion(composition oftwonetswithrespecttoacommoninterfaceineachofthecomponents)andfusion ofalgebraichigh-levelnetsasusedinthispaper,structuringtechniquesareformulated viamorphismsandrulesasgivenin[per95].furtherinformationaboutdierentkinds likelocalconuenceandparallelism,andcompatibilityofhorizontalstructuringwith (thegluingofsubnetswithinagivennet),concurrencypropertiesoftransformations thatservesasabasistodenepreandpostdomainsoftransitions,ringsequencesand markingsofahlnets. ofalgebraicpetrinetscanbefoundforinstancein[vau86,ks91,rei91,epr94,lil94]. ThissectioncontainsbasicdenitionsofAHLnets,theirbehaviourandmodication Denition2.1(FreeCommutativeMonoid) LetPbeaset.ThenP=def(P;;)iscalledthefreemonoidgeneratedbyP, wherepisthesetofallwordsoverp,suchthatforallu;v;w2pthefollowing equationshold: BeforewedeneAHLnetsweintroducefreemonoids,analgebraicconstruction thatistosay,isanassociative,commutativebinaryoperationinpwithidentity. u(vw)=(uv)w, v=v=v, \2ab3cd".Inthiscase,wewillsticktothenotationPinordertodenotethe thenabcacdc=aabcccd2pcanberepresentedas freecommutativemonoidgeneratedbyp. AnywordofPcanberepresentedasalinearsum.Forinstance,ifP=deffa;b;c;dg, wv=vw Remark: 1.Ingeneral,wehavethefollowingformaldenitionforanyw2Pexpressedin linearsumform: w=defnxi=1kiai;ki2n;ai2p: 4 6

7 2.Theoperations, 3.CommutativemonoidstogetherwithmonoidhomomorphismsdeneasubcategoryCMonofMon,thelatteronebeingthecategoryofmonoidsandmonoid homomorphisms.,andaretheobviousaddition,inverseandpreorder operationsonlinearsums:forexample,vwiforallcoecientsviwiholds thenumberofelementsinthelinearsum. (within).aj2wikj>0andjwjdenotesthecardinalityofw2pthatis, 4.Thenotionofcommutativemonoidscorrespondstomultisets. SPEC=(S;OP;E)inthesenseof[EM85],setsPandT(placesandtransitions), namelyactualization,renamingandinclusionasdenedin[cew93]. AnAHLnetN=(SPEC;P;T;pre;post;cond;A)consistsofanalgebraicspecication Denition2.2(AlgebraicHigh-LevelNet) ofthedatapartisachievedbytheusualstructuringtechniquesofalgebraicspecication, tionsofanalgebraicspecicationdeningthedatatypepartofthenet.thestructuring Analgebraichigh-levelnetconsists-roughlyspeaking-ofaPetrinetwithinscrip- functionspre;post:t!(top(x)p)assigningtoeachtransitiontanelementof thecommutativemonoidoverthecartesianproductoftermstop(x)withvariablesin XandthesetofplacesPandafunctioncond:T!Pfin(EQNS(SIG))assigningto eachtransitiontanitesetofequationsoversig=(s;op),thesignatureofspec, Denition2.3(AHLNetMarking) andaspec-algebraa.ncanberepresentedbythediagram LetN=(SPEC;P;T;pre;post;A;cond)beanAHLnet.ThenamarkingMofNis anelementofthecommutativemonoid(ap).hereaisthedisjointunionofall carriersetsofthealgebraa,thatisa=u Pfin(EQNS(SIG))T ocond post(top(x)p) pre/ / s2sas hospital:thepatientislocatedattheward.hisbloodpressureistaken,forexample, TheideaofthenetVVMingure1istomodelthefollowingsituationattheDHZB ifthishasbeendemandedintheprescriptionsheet.thevalueistakendownintothe Figure1showsanexamplenetfromourcasestudy,theVitalValueMeasurement.The Example2.4(TheAHLNetVitalValueMeasurement) netisinscribedwithtermsoverthespecicationvvm-specwhichissketchedbelow. 4 Note,thatwerestrictourexampletothesmallsubsystemvitalvaluemeasurement. chartbelongstothepatientrecordthatiskeptattheward.alltheseactivitiesare representedastransitionsinthenetvvmingure1. pulse,...arealsomeasured,ifdemandedintheprescriptionsheet.thetemperature temperaturechart.othervitalvalues,asmediumarterialbloodpressure,temperature, 7

8 Taking blood pressure getpat(patient)=patid Prescr=get_Prescr(get_Treats(PatRecord)) bl_pressure_wantd(prescr)=true v(bpd,bps,t,patid) Patient vital value taken v(p,t,patid) v(temp,t,patid) Taking pulse getpat(patient)=patid Prescr=get_Prescr(get_Treats(PatRecord)) pulse_wanted(prescr)=true PatRecord PatRecord Taking temperature getpat(patient)=patid Prescr=get_Prescr(get_Treats(PatRecord)) temp_wanted(prescr)=true V Patient Adding vital value to TC PatRecord patient getpat(v)=patid at ward TC=get_TC(PatRecord) v(cvp,t,patid) PatRecord Patient Patient Taking central venous pressure ch_patrecord (PatRecord,ch_TC(TC,V)) getpat(patient)=patid Prescr=get_Prescr(get_Treats(PatRecord)) cvp_wanted(prescr)=true quentargument. sorts:name,patient,patid,patrecord,... Fig.1:TheAlgebraicHigh-LevelNetVitalValuesMeasurement(VVM) WemerelystatethesortsandoperationsofVVM-Specusedexplicitlyinthesubse- PatRecord v(map,patid) Taking medium arterial pressure getpat(patient)=patid ward PatRecord Prescr=get_Prescr(get_Treats(PatRecord)) documents map_wanted(prescr)=true PatRecord v(io,t,patid) Measuring import/export getpat(patient)=patid tokensareelementsofavvm-spec-algebra.wehereconsiderthea-quotienttermalgebra(see[em85]),thealgebrageneratedaccordingtothespecicationovercarriersets opns:patient:name,sex,adress,patid!patient Inthefollowing,wegiveoneexemplarymarkingofthenetVVMexplicitly.Generally, getpat:patient!patid getpat:patrecord!patid getpatient:patid!patient Prescr=get_Prescr(get_Treats(PatRecord)) imp/exp_wanted(prescr)=true 8 Patient

9 warddocumentsrespectively. representedbythetokens(patient(smith;:::)anddontheplacespatientatwardand ThismarkingmeansthatthereisapatientSmithandhispatientrecordattheward (d;warddocuments)whered2apatrecordwithgetpat(d)=getpat(patient(smith;:::)). wecansupposethefollowingmarking(mvvm):(patient(smith;:::);patientatward) fornames,doctors,resourcesetc.assumingacarriersetaname=fsmith;miller;:::g LetNbeanAHLnet,undAbedenedasindenition2.3.ThesetCTofconsistent expressthenotionofafollowermarking,werstformalizewhichassignmentsmakethe Denition2.5(ConsistentTransitionAssignment) variablesofatransitionconsistentlyassigned: LetusnowformalizetheringbehaviourofAHLnets.Inordertobeableto 3 transitionassignmentsis awayfromthepredomainoraddedtothepostdomainwhenatransitionisring: CT=f(t;asg)jt2T;asg:Var(t)!A, Denition2.6(A-inducedFunctions) Here,Var(t)isthesetofallvarablesoccurringinpre(t),post(t)orcond(t).4 Nowwecandenethefunctionsthatgiveusthedataelementswhicharetaken suchthatthedataelementsinaundertheassignmentasg LetN,AandCTbedenedasabove.ThentheA-inducedfunctionspreA;postA: satisfytheequationsincond(t)g transitionresultsin: Denition2.7(EnabledTransition,FollowerMarking) CT!(AP)aredenedforall(t;asg)2CTbypreA(t;asg)=ASG(pre(t))and post(t;asg)=asg(post(t))withasga=(top(var(t))p)!(ap)denedas consistenttransitionassignmentaccordingtodenition2.5.then,thetransitiontis LetM2(AP)beamarkingaccordingtodenition2.3and(t;asg)2CTa ASGA(term;p)=(asg(term);p)forallp2Pandterm2TOP(Var(t)). Wearereadynowtodenethefollowermarkingthatis,themarkingtheringofa 4 suchthatthetransitiontakingbloodpressureisenabledandcomputethefollower LetMbethemarkingofnetVVMasgiveninexample2.4.Wewillgiveanassignment markingm0ofmthatisweletthetransitionre. Example2.8(FiringBehaviouroftheAHLNetVVM) by:m[t;asg>m0.thesetofallfollowermarkingsofmisdenotedby[m>.4 markingm0thenisconstructedbym0=m enabledunderthemarkingmfortheassignmentasgifasg(pre(t))m.thefollower LetVar(Takingbloodpressure)=fPatient;PatRecord;BPd;BPs;T;PatId;Prescrg. ASG(pre(t))ASG(post(t)),denoted Anassignmentasg:Var(Takingbloodpressure)!Aisgivenasfollows: asg(patrecord)=d;9 asg(patient)=patient(smith;:::;idsmith);

10 asg(bpd)=diastolicvalue; clarifytheirmeaning,assumingthecarriersetsofthecorrespondingsortscontainthese Remark:Fortheconcretemeasuredvaluesweheregiveconstantsassubstitutesto asg(prescr)=prescr(bloodpressure;:::) asg(patid)=idsmith; asg(bps)=systolicvalue; constantsaselements. asg(t)=timeofvvm; denition2.5becausetheequationsincond(takingbloodpressure)aresatised: bloodpressureiscontainedinthetermprescr(bloodpressure;:::),thereforetheboolean theprescriptionsheetoutofthelistoftreatmentsoutoftherecordofpatient'sdata Accordingtothealgebraicspecication,theequation getpat(patrecord)=getpat(patient)=getpat(patient(smith;:::;idsmith))=idsmith whichbelongstothesamepatientasthevariablepatidrefersto.here,theelement holds.thespecicationoftheselectoroperationsgetprescrandgettreatsyields (Takingbloodpressure;asg)isaconsistenttransitionassignmentasdenedin operationblpressurewantd(prescr)evaluatestotrue. asg,thatiswehaveasg(pre(takingbloodpressure))m: WeshownowthatthetransitionTakingbloodpressureisenabledunderMfor Thefollowermarkingiscomputedby =ASG((Patient;patientatward)(PatRecord;warddocuments) =(patient(smith;:::;idsmith);patientatward)(d;warddocuments) =(asg(patient);patientatward)(asg(patrecord);warddocuments) M Weseethattwotokensarereturnedtotheplacestheyaretakenfrom.Theonlynew tokeninthefollowermarkingisthedataelementrepresentingthemeasuredvalueson M0=M (v(diastolicvalue;systolicvalue;timeofvvm;idsmith);vitalvaluetaken) (patient(smith;:::;idsmith);patientatward)(d;warddocuments) [(patient(smith;:::;idsmith);patientatward)(d;warddocuments)] ASG(pre(Takingbloodpressure))ASG(post(Takingbloodpressure)) theplacevitalvaluetaken. sitionofnetsandforthecompatibilityofverticalandhorizontalstructuringtechniques. tiesofthiscategory,especiallyitscocompleteness,isanimportantbasisforthecompo- TogetherwithsuitableAHLnetmorphisms,AHLnetsformacategory.Theproper- 3 10

11 Denition2.9(MorphismsbetweenAHL-nets) A(transitionpreserving)AHLnetmorphismf:N1!N2betweentwoAHL-nets Ni=(SPECi;Pi;Ti;prei;posti;condi;Ai);i=1;2isgivenbyf=(fSPEC;fP;fT;fA), where {fspec:(sig1;e1)!(sig2;e2)isaspecicationmorphismwithf]spec(e1) suchthatthefollowingdiagramcommutescomponentwise(forpre-andpost-function): {fp:p1!p2andft:t1!t2arefunctionsonthesetsofplaces,resp.transitions. {(fspec;fa):a1!a2isageneralizedhomomorphisminthecategorygalgof generalizedalgebras,andfa:a1!vfspec(a2)isanisomorphismincat(spec1), E2,wheref]SPECistheextensionoffSPECtotermsandequations. thecategoryofspec1-algebras(fordetailssee[per95]). Pfin(EQNS(SIG1)) Pfin(f]SPEC) = ocond1 T1 ft post1 pre1/ / =(TOP(X)P1) Remark:AHLnetsandAHLnetmorphismsaredeningthecategoryAHLofalgebraic ThesetsofvariablesaredenedbyindexingaxedsetXi:=(Xfixs)s2Sifori=1;2. Pfin(EQNS(SIG2))T2 ocond2 post2(top(x)p2) pre2/ /(f]specfp) morphisms: high-levelnets(foraproofsee[per95]). MarkingsandSymbolicMarkings(termswithvariables)aremappedviathefollowing Denition2.10(MappingofMarkings) 4 Petrinets[PER95].Theideaistopresentrulesdenotingthereplacementofonesubnet Wewillnowreviewrule-basedmodicationasaverticalstructuringtechniquefor fs:(top1(x1)p1)!(top2(x2)p2):=(f#specfp) fm:(a1p1)!(a2p2):=((fspec;fa)fp) considertohavearulerwithaleft-handsidenetlthatisreplacedbyaright-hand byanotherwithoutchangingtheremainingpartofthewholenet.thishastheadvantageofalocaldescriptionofchangesinducingglobalchangeswithoutsideeects.we 4 sidenetr.thisrulecanbeappliedtosomenetn,yieldingthenewnetm.this DeletedarethosepartsofthenetLthatarenotintheimageofthemorphismK!L. byr=(l squares(1)and(2)indef.2.11inthecategoryahlofahlnetsandahlnetmorphisms.thenetcisthecontextnet(thatisnafterthedeletionofitemsbytherule Addingworkssymmetrically,allthosepartsofRareaddedthatarenotintheimage applicationofarule,calledtransformation,isdenotedbynr ofthemorphismk!r.thetransformationnr andbeforeadditionofthenewitemsfromr). K!R)whereK!LandK!RareinjectiveAHLnetmorphisms. =)Misdenedusingtwopushout =)M.Theruleisgiven 11

12 Aruler=(L Denition2.11(RuleandTransformation) handsidesoftherule),anahlnetk(calledinterface)andtwoinjectiveahlnet morphismsl NL? (1) KandK!R. KC? K!R)consistsoftwoAHLnetsLandR(calledleftandright (2)-MR? viaruler=(l A(direct)transformationofanetNtoM rulesandcompatibilitywithhorizontalstructuringcanbefoundin[per95]. basedmodication.furtherresultsconcerningparallelandconcurrentapplicationof Thisdenitionisthetechnicalbasisfortheverticalstructuringtechniqueofrule- showninthediagraminthecategoryahl.4 isdenedusingtwopushoutsquares(1)and(2) K!R)atthematchL!N Example2.12(BloodHypertensionProblem) hypertension.inthiscasethedoctorshallbeinformed. Wenowwanttodescribetherenementstepaddinganexceptionincaseofblood thenetvvmdepictedingure1byanexceptionforbloodhypertension.foreach bloodpressurevaluetakenanadditionaltestforhypertensionisperformed.incaseof hypertensionthedoctorisnotied. bloodpressure.thecorrespondingalgebraicspecicationvvm?spechyperisgained isdeleted.additionally,therighthandsidenetrcontainstheplacesvaluesfor hypertensiontestanddoctor,andthetransitionsnotifyingdoctorandtaking Thetransformationruler:L TheinclusionmorphismK!LmeansthatthetransitionTakingbloodpressure K!Ringure2describestherenementof netcandtheadditionoftheplacesvaluesforhypertensiontest,doctor,andthe thespecicationvvm?spec. transitionsnotifyingdoctorandtakingbloodpressureyieldsthenetbex(short forbloodhypertensionexception). byaddingthenewoperationsandequationsusedforthetestofbloodhypertensionto ingure2:thedeletionofthetransitiontakingbloodpressureyieldsthecontext formalizesafetypropertiesasinvariants(temporallogicformulasusingthealwaysoperator"")overthemarkings.inthenetvvm,weconsiderthesafetyproperty Wenowintroducetheproblemofpreservationofsafetypropertiesbyrules.We TheapplicationofrulertothenetVVMyieldsthefollowingtransformationshown AddingvitalvaluetoTCthepatientrecordisonlyread,denotedbydoublearrows for(a;p)2apisanatomicformula(seedenition3.6). forsomed2apatrecordwithgetpat(d)=getpat(patient(smith;:::)).notethat(a;p) withtheinscriptionofavariableofsortpatrecord.thetransitionaddingvital operationchangestheinitialpatientidentity.thusafterringofanytransitionthe valuetotcchangestherecord,butbystructuralinductionwecanprovethatno Weinformallyarguethatthissafetypropertyholds.Foreachtransitionexcept (patient(smith;::::);patientatward)()(d;warddocuments) s.t.getpat(ai)=getpat(di)forai2apatientanddi2apatrecord. safetypropertystillholds. Moregenerally,weassumeamarkingofthenetVVM MVVM:=Pni=1(ai;patientatward)(di;warddocuments) 12

13 L K R Taking blood pressure Taking blood pressure VVM-Spec getpat(patient)=patid patient getpat(patient)=patid Prescr=get_Prescr(get_Treats(PatAkte)) Prescr=get_Prescr(get_Treats(PatAkte)) bl_pressure_wanted(prescr)=true ward bl_pressure_wanted(prescr)=true v(bpd,bps,t,patid) Patient v(bpd,bps,t,patid) Patient vital patient vital vital patient value at value value at taken PatRecord ward taken taken PatRecord ward V V V v(bpd,bps,t,patid) Adding vital value to TC Adding vital value to TC Adding vital value to TC values for getpat(v)=patid getpat(v)=patid getpat(v)=patid hypertension test TC=get_TC(PatRecord) TC=get_TC(PatRecord) TC=get_TC(PatRecord) v(bpd,bps,t,patid) PatRecord PatRecord ch_patrecord ch_patrecord Notifying the doctor ch_patrecord (PatRecord,ch_TC(TC,V)) (PatRecord,ch_TC(TC,V)) (PatRecord,ch_TC(TC,V)) getpat(v)=patid hypert(bpd,bps)=true Doctor ward documents ward ward documents documents doctor PatRecordVVM-Spec -?? VVM-Spechyper C? - Taking blood pressure Taking blood pressure getpat(patient)=patid Prescr=get_Prescr(get_Treats(PatRecord)) values for v(bpd,bps,t,patid) getpat(patient)=patid bl_pressure_wantd(prescr)=true hypertension Prescr=get_Prescr(get_Treats(PatRecord)) test v(bpd,bps,t,patid) bl_pressure_wanted(prescr)=true Patient v(bpd,bps,t,patid) v(bpd,bps,t,patid) PatRecord PatRecord Notifying the doctor Taking pulse Taking pulse getpat(v)=patid getpat(patient)=patid getpat(patient)=patid hypert(bpd,bps)=true Prescr=get_Prescr(get_Treats(PatRecord)) Prescr=get_Prescr(get_Treats(PatRecord)) pulse_wanted(prescr)=true pulse_wanted(prescr)=true Doctor v(p,t,patid) Patient v(p,t,patid) Patient PatRecord PatRecord doctor Taking temperature Taking temperature vital vital v(temp,t,patid) v(temp,t,patid) value getpat(patient)=patid value getpat(patient)=patid taken Prescr=get_Prescr(get_Treats(PatRecord)) taken Prescr=get_Prescr(get_Treats(PatRecord)) temp_wanted(prescr)=true temp_wanted(prescr)=true V Patient VVM-Spec V Patient Patient Adding vital value to TC Adding vital value to TC PatRecord patient PatRecord patient getpat(v)=patid at getpat(v)=patid VVM at ward ward TC=get_TC(PatRecord) v(cvp,t,patid) TC=get_TC(PatRecord) Figure2:VitalValueMeasurementwithHypertensionException VVM-Spechyper v(cvp,t,patid) PatRecord Patient PatRecord Patient Patient Patient ch_patrecord Taking central venous pressure ch_patrecord Taking central venous pressure (PatRecord,ch_TC(TC,V)) (PatRecord,ch_TC(TC,V)) getpat(patient)=patid getpat(patient)=patid Prescr=get_Prescr(get_Treats(PatRecord)) Prescr=get_Prescr(get_Treats(PatRecord)) cvp_wanted(prescr)=true cvp_wanted(prescr)=true PatRecord v(map,patid) PatRecord v(map,patid) Taking medium arterial pressure Taking medium arterial pressure 13 BEX PatRecord getpat(patient)=patid getpat(patient)=patid ward Prescr=get_Prescr(get_Treats(PatRecord)) ward PatRecord Prescr=get_Prescr(get_Treats(PatRecord)) documents PatRecord map_wanted(prescr)=true documents map_wanted(prescr)=true v(io,t,patid) PatRecord v(io,t,patid) Measuring import/export Measuring inport/export getpat(patient)=patid getpat(patient)=patid Prescr=get_Prescr(get_Treats(PatRecord)) Prescr=get_Prescr(get_Treats(PatRecord)) imp/exp_wanted(prescr)=true imp/exp_wanted(prescr)=true

14 sameargumentasabove. s.t.getpat(a)=getpat(d)fora2apatientandd2apatrecord. ifandonlyifthecorrespondingpatientrecordisattheward."andholdsduetothe thenetbex.thistransfershouldbeinducedbytheruler=(l Themoregeneralformulationofoursafetyproperty'VVMis NowthemainproblemisthetransferofthesafetypropertyfromthenetVVMto Thissafetypropertymeans"Atanytimewehave:thereissomepatientattheward [(a;patientatward)()(d;warddocuments)] property.wearelookingforproofrulesofthefollowingform: wehavetondapropertyoftherulesuchthatthetransformationpreservesthesafety somepropertyforr,vvmsatises'vvm BEXsatises'VVM K!R).Therefore, VVM L? fvvm KC? -BEX R? Themainideaofourapproachistouseaclass levelnets.inthispaperinsection3weshowthat onehandpreservesafetyproperties:asaresult ofmorphisms,calledplacepreserving,thatonthe theotherhand,placepreservingmorphismsarestableundertransformationswhichisshowninsection theideacanbetransferredtohigh-levelnets.on beenshownin[peu97]thatsafetypropertiesare preservedbyplacepreservingmorphismsforlow Petrinetztechnologie"(seepage1),ithasrecently ofacooperationwithinthedfg-forschergruppe thatfvvm:vvm!bexpreservessafetyproperties(theorem4.15).thuswehave thedesiredpropertysothatthefollowingproofruleholds: ThefactthatfVVM:L!Rpreservessafetyproperties(theorem3.17)alwaysimplies (rvvm;fvvm:l!r)preservessafetyproperties,vvmsatises'vvm formations. 4).Thus,wecantransfersafetypropertieviatrans- BEXsatises'VVM 3 14

15 transitionscouldaddordeletetokenson"old"(mapped)placesinanunpredictable themorphismandnoold(mapped)arcsaredeletedfromtheircontext.otherwisenew way.wethereforecallmorphismswiththesefeaturesplacepreserving.weshowin 3PreservingInvariantswithAHLNetMorphisms Inthissectionwedenemorphismspreservingsafetypropertiesofalgebraichigh-level nets.tobeabletopreservesafetyproperties(expressedviainvariantformulasonmarkings),wemusttakecarethatnonewarcsareaddedtothecontextofmappedplacesby whichwayplacepreservingmorphismspreserveinvariants.weformalizethenotions formulasarepreservedbyourmorphisms. notionsandnotationconventions. Denition3.1(Persistency) LetfSPEC:SPEC1!SPEC2beaspecicationmorphism.WecallfSPECpersistent inthesensethattop1(x1)=vfspec(top2(x2)). BeforedeningplacepreservingAHLnetmorphismsletusintroducesometechnical ofstaticandinvariantformulas,theirevaluationandtheirtranslationviamorphisms, denearestrictionofmarkingswrt.anahlnetmorphismandshowthatinvariant Cat(SPEC2).Ournotionofpersistencyisequivalentasthefreefunctorisuniquewrt. In[EM85],8.13thenotionpersistencyisdenedforthefreefunctorF:Cat(SPEC1)! Remark: VfSPECandwehaveespecially VfS(X2)=(X2fS(s1))s12S1=XfixfS(s1)=XfixS1=X1 4 Denition3.2(PreandPostDomainsofPlaces) ofpwith Letp2Pbeaplace.Wecall(term;p)thepredomainand(term;p)thepostdomain (term;p)=ftj(term;p)pre(t)g (term;p)=ftj(term;p)post(t)gand LetNi=(Pi;Ti;SPECi;prei;posti;condi;Ai);i2f1;2gbetwoAHLnetsaccordingto Denition3.3(PlacePreservingAHLNetMorphism) morphismasthefollowingdiagramshows: denition2.2.thenf=(fp;ft;fspec;fa):n1!n2isaplacepreservingahlnet NowwecandeneournotionofplacepreservingAHLnetmorphisms: 4 ithefollowingholds: Pfin(EQNS(SIG2))T2 Pfin(EQNS(SIG1)) Pfin(f]SPEC) (1) ocond1 ocond2 T1 ft post1 post2(top(x)p2) pre1/ pre2/ //(TOP(X)P1) 15 (f]specfp)

16 1.Preservationofringconditions:Diagram(1)commutes. 2.PlacePreservingCondition:Themorphismisplacepreservinginthesensethat 3.fT;fPandfSPECareinjectiveandfSPECispersistent(seedenition3.1). 4.EmbeddingCondition:N2isanembeddingofN1inthesensethattherecan therearenonewarcsaddedtomappedplaces: correspondingdomainsoftheoriginaltransition: bemoreplacesinthepreorpostdomainofamappedtransitionthaninthe (fs(term1;p1))=ft((term1;p1)) (fs(term1;p1))=ft((term1;p1)) 5.fA:A1?!VfSPEC(A2)isanisomorphisminAlg(SPEC1). fs(post1(t))post2(ft(t))forallt2t1 fs(pre1(t))pre2(ft(t))and diagramontherighthandsideindef.2.9yieldsapreservationoftransitionsinthe tionpreserving)ahlnetmorphismsasdenedindef.2.9.thecommutativityofthe sensethatnonewarcsareaddedtomappedtransitionsandnoold(mapped)arcsare deletedfromtheirpreandpostdomains.placepreservingmorphismsareingeneral nottransitionpreservingbecausecondition4indef.3.3expressesthatthepreandpost Notethedierencebetweenplacepreservingmorphisms(def.3.3)andthe(transi- 4 setofatransitioninn2cancontainmoreplacesthantheoriginaltransitioninn1.a icationmorphismfvvmspecisaninclusionasonlyoneoperationandoneequation timemerelyyieldsadisjointembeddingofn1inton2. Example3.4(PlacePreservingMorphisminHypertensionTest) TheinclusionsfVVMPandfVVMTaregivenimplicitlyusingnameidentity.Thespec- morphismf:n1!n2thatisplacepreservingandtransitionpreservingatthesame WesketchthatthemorphismfVVM:L!Rdeterminedbygure2isplacepreserving. opns:hypert:bloodpressuresystolicbloodpressurediastolic!bool eqns:hypert(bps,bpd)=(maxbpsbps)_(maxbpdbpd) persistent: VVM-Spechyper=VVM-Spec+ concerningthehypertensiontestareaddedinvvm-spechypersuchthatfvvmspecis DiastolichavebeendenedrenamingthesortNatofnaturalnumbers.Toeverysort stantsinvvm-speclikemaxbps:bloodpressuresystolicandmaxbpd:blood- PressureDiastolicaremeanttodenotecriticalvalues(here:maximalbloodpressure) denotingvitalvaluesthereareplausibilityborders(naturalnumberconstants)denedin VVM-Specthatallowtotestwheterthemeasuredvaluesarerealisticornot.Othercon- InthespecicationVVM-Spec,thesortsBloodPressureoSystolicandBloodPressure- 16

17 thecriticalvalueasgivenintheconstantsmaxbpsandmaxbpdrespectively. VVM-Spechypertotestwhetherthebloodpressurevalueactuallymeasuredliesbeyond valuesofthesesorts.thisoperationalsoisusedinthenewpartofthespecication thatindicateacriticalstateofthepatientwhosevitalvaluesaretaken.onthevital operationinvvm-spechyper,hypert,alwaysyieldstermsequivalenttotrueorfalse. ItisobviousthatfVVMSPECispersistentbecauseapplyingtheforgetfulfunctorVfSPEC (TOP2(X2)),weobtainatermalgebrathatisisomorphictoTOP1(X1)astheonlynew valuesortsdenedinvvm-spec,apreorderrelationisdenedthatallowstocompare shown,fortheotherplacesitisanalogous: (fvvms(v(bpd;bps;t;patid);vitalvaluetaken)) newarcsareadjacenttomappedplaces.fortheplacevitalvaluetakenthisisformally =ftakingbloodpressureg havethesameringconditionsastheiroriginalsinnetl.condition2issatisedasno preserving: Condition1issatisedbecausethetransitionsinnetRthatlieintheimageoffVVM Theconditionsofdenition3.3holdsuchthatthemorphismfVVM:L!Risplace analogously(fvvms(v;vitalvaluetaken))=fvvmt((v;vitalvaluetaken)) =fvvmt((v(bpd;bps;t;patid);vitalvaluetaken)) transitiontakingbloodpressureinrhasmoreplacesinitspostsetthantheoriginal Moreover,fVVM:L!Risanembedding(condition4)asnoarcsaredeleted. =fvvmt(ftakingbloodpressureg) phisms: Corollary3.5(PreservationofMarkingRelation) TakingbloodpressureinL. ThemorphismfVVMisnottransitionpreservinginthesenseofdef.2.9becausethe LetM;M02(A1P1)betwomarkingsoftheAHLnetN1.Then,MM0() fm(m)fm(m0)holdsduetothefactthatahlnetmorphismsaremonotonic. Thenextcorollaryshowshowtherelationofmarkingsispreservedbyourmor- 3 Denition3.6(StaticFormulas) backwardoperatorsareallowed. morphismsinaformalway. thatweusearestrictednotionas'ismerelyastaticformulawhereasin[mp92] morphismstobeabletoexpresssafetypropertiesandprovetheirpreservationvia Theinvariantformula'expressessafetypropertiesinthesenseof[MP92].Note WewillnowdeneformulasoverAHLnetmarkingsandtheirtranslationsvia StaticformulasdescribeastateofanAHLnet.Theyareconstructedsyntactically ofatomicformulas(a;p)denotingthemarkingofoneplacepwiththedataelement a2aandtheusuallogicconnectors^and:.thesetofstaticformulasoveranahl netisthesmallestsetofstringsavailablebyniteapplicationofthefollowingrules: For'1,'2staticformulas::'1;'1^'2arestaticformulas (a;p)2(ap):(a;p)isstaticformula 17

18 ofastaticformulaunderthemarkingmisdenedasfollows: LetM2(AP)beamarkingandlet'1and'2bestaticformulas.Theevaluation LetNbeanAHLnetand'astaticformulaoverN.Then'isaninvariantformula. Denition3.7(InvariantFormula) Mj='1^'2()(Mj='1)^(Mj='2) Mj=:'1():(Mj='1) Mj='1()'1Mfor'1=(a;p) LetM2(AB)beamarkingofN.Theinvariantformula'holdsinNunderM i'holdsinallstatesreachablefromm: Mj='()8M02[M>:M0j=' anahlnetn2viaplacepreservingahlnetmorphisms: Denition3.8(TranslationofFormulas) Letf=(fP;fT;fSPEC;fA):N1!N2beaplacepreservingAHLnetmorphism.Then, thetranslationtfofformulasisgivenasfollows,wherefmisdenedasindef.2.10: WenowcandeneatranslationofformulasoveranAHLnetN1toformulasover 4 Tf('1^'2)=Tf('1)^Tf('2) Tf(')=Tf(') Tf(:')=:Tf(') Tf(')=fM(')for'=(a;p)2(A1P1) Letf:N1!N2beaplacepreservingAHLnetmorphism,M12(A1P1)amarking markingm22(a2p2).letusdenethenotionofatranslatedmarkingm2viathe Denition3.9(RestrictionofMarking) notionofarestrictionofthemarkingm2withrespecttof: Next,weexplainhowatranslatedformulaTf(')isevaluatedunderatranslated ofn1andm22(a2p2)amarkingofn2 s.t. ThentherestrictionM2jfofthemarkingM2tothenetN1withrespecttofisgiven asfollows:m2jf:=m1 M2=fM(M1)Pmj=1j(aj;pj) withj(aj;pj)=2fm(a1p1) teristicsofrestrictionsofmarkings(denition3.9): Thefollowinglemma3.10andthecorollaries3.11and3.12describesomecharac- M2jfiswell-denedduetotheinjectivityoftheunderlyingmorphisms. 18 4

19 LetM22(A2P2)beamarkingoftheAHLnetN2withf:N1!N2beingaplace Lemma3.10(CharacterizationofRestriction) preservingahlnetmorphism.therestrictionm2jfofthemarkingm2tothenetn1 withrespecttofischaracterizedasfollows: Proof: Condition1issatisedduetothedenitionofM2jf.Weprovethesatisfactionofcondition2bycontradiction: 2.M2jfisthelargestofallpossiblemarkingsofN1satisfyingcondition1: 8M012(A1P1):fM(M01)M2=)M01M2jf fm(m2jf)m2 1.ThetranslationofmarkingM2jfviafispartofM2: Letf:N1!N2beaplacepreservingAHLnetmorphismandM2(A1P1)a Corollary3.11(IdempotencyofRestriction) thatm0m2jf. (a;p)2(a1p1)suchthatm0=(a;p)pni=1ki(ai;pi).thus,fm(a;p)m,that is((fspec;fa)(a);fp(p))mandso(a;p)m2jfwhichcontradictsourassumption LetM0Pni=1ki(ai;pi)withfM(M0)M.Thenthereisatleastonetoken markingofnetn1.thenwehave(fm(m))jf=m 4 duetolemma3.10. Corollary3.12(RestrictionandMonoidalOperators) Letf:N1!N2beaplacepreservingAHLnetmorphismandM12(A1P1)and M22(A2P2)bemarkingsofthenetsN1andN2.Then,duetolemma3.10,the followingholds:(m1m2)jf=m1jfm2jf (1) "newparts"oftheembeddingn2areconnectedto"oldparts"(objectsintheimage off)atmostviatransitionsofthe"oldpart"andnotviaplaces,asthenextlemma OurAHLnetmorphismsareplacepreserving(seedenition3.3).Thisimpliesthat M1M2=)M1jfM2jf M2)jf=M1jf M2jfforM1M2 (3) (2) shows: Lemma3.13(RestrictionandPlacePreservingMorphisms) Letf:N1!N2beaplacepreservingAHLnetmorphism.Thenalltransitionsin theimageoffinn2haveatleastthoseplacesintheirpre(post)domainthatare translationsofthepre(post)domainoftheoriginaltransitionsinn1: 19

20 ThetransitionsinN2thatarenotintheimageoffcannothaveplacesintheirpre (post)domainthataretranslatedplacesfromn1viafp: (1)forallt22T2withfT(t1)=t2: (2)forallt22T2nfT(T1)(i)pre2(t2)jf=and (ii)post2(t2)jf=post1(t1) (i)pre2(t2)jf=pre1(t1)and Proof: (1)Weshowthat(a)pre2(fT(t1))jfpre1(t1)and (b)pre2(ft(t1))jfpre1(t1) (ii)post2(t2)jf= Proofof(a):pre1(t1)=fS(pre1(t1))jf(corollary3.11) fs(term1;p1)pre2(ft(t1))jf=)ft(t1)2(fs(term1;p1))(denition3.2) Proofof(b)(bycontradiction): Letpre1(t1)(term1;p1)=pre2(fT(t1))jf.Then pre2(ft(t1))jf(denition3.3,part3) Thiscontradictsourassumptionthat(term1;p1)isnotinthepredomainoft1. Theproofof(1)(ii)isanalogous. =)t12(term1;p1)(asftisinjective) =)(term1;p1)pre1(t1)(denition3.2) =)ft(t1)2ft((term1;p1))(denition3.3,part1) (2)Let(term2;p2)pre2(t2)withfS(term1;p1)=(term2;p2).Then t22(term2;p2)=)t22(fs(term1;p1)) WeshowthatatranslatedvariableassignmentintheembeddingN2restrictedtoN1 Theproofof(2)(ii)isanalogous. Thiscontradictsourassumptionthatt22T2nfT(T1). Thenextlemmaconcernsthepreservationofvariableassignmentsbymorphisms. =)t22ft((term1;p1)) symbolicmarking: wrt.f:n1!n2isthesameastheoriginalvariableassignmentoftherestricted 20 4