UTP Semantics for Shared-State, Concurrent, Context-Sensitive Process Models
Total Page:16
File Type:pdf, Size:1020Kb
View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by University of Limerick Institutional Repository UTP Semantics for Shared-State, Concurrent, Context-Sensitive Process Models Andrew Butterfield Anila Mjeda John Noll Lero @ TCD Lero @ TCD Lero @ UL School of Computer Science and Statistics School of Computer Science and Statistics Tierney Building Trinity College, Dublin 2, Ireland Trinity College, Dublin 2, Ireland University of Limerick Email: Andrew.Butterfi[email protected] Email: [email protected] Email: [email protected] Abstract—Process Modelling Language (PML) is a notation semantics for shared global state concurrency, as a way to for describing software development and business processes. It get a suitable semantics for strict and flexible PML, inspired takes the form of a shared-state concurrent imperative language by the work of Woodcock and Hughes on unifying parallel describing tasks as activities that require resources to start and provide resources when they complete. Its syntax covers programming (UTPP, [13]). We present both a formal seman- sequential composition, parallelism, iteration and choice, but tics for a “weak” interpretation of PML, as well as a unified without explicit iteration and choice conditions. It is intended theory of concurrent programs (UTCP) that will provide a to support a range of context-sensitive interpretations, from a baseline theory for modelling more “flexible” and “strong” rough guide for intended behaviour, to being very prescriptive interpretations of PML. Part of our contribution is extending about the order in which tasks must occur. We are using Unifying Theories of Programming (UTP) to model this range of semantic the UTP methodology to use non-homogenous relations that interpretations, with formal links between them, typically of the mix dynamic state-change (observations with before- and nature of a refinement. We address a number of challenges after-values) along with static context parameters (observations that arise when trying to develop a compositional semantics whose value is unchanged during program execution). We also for PML and its shared-state concurrent underpinnings, most develop a notion of label generators to allow us to describe notably in how UTP observations need to distinguish between dynamic state-changes and static context parameters. The formal flow of control in a compositional manner. semantics are intended as the basis for tool support for process The structure of this paper is as follows: In xII we give analysis, with applications in the healthcare domain, covering a quick introduction to an abstract form of PML, while in such areas as healthcare pathways and software development xIII we provide a quick overview of UTP. We then move on and certification processes for medical device software. c IEEE to present the weak semantics for PML in xIV, the baseline 2016 http://doi.ieeecomputersociety.org/10.1109/TASE.2016.22 UTCP semantics in xV, and then to relate the two in xV-H, I. INTRODUCTION where we also discuss future work. We then describe related Programming-like notations have been used to describe work (xVI) and conclude (xVII). business processes and workflows for many years [1]–[3]. There is considerable interest at present in healthcare systems II. PROCESS MODELLING LANGUAGE in so-called clinical pathways, that describe processes for Process Modelling Language (PML) [10] is a shared-state managing patient care. These too can be described using concurrent imperative language describing named basic ac- general business process notations [4]–[6]. Deploying process tions (N?rr!pr) as activities that require resources to start (rr) models in the medical domain in practise requires flexible and provide resources when they complete (pr). Actions are interpretations of those models [2], [4], [6]–[9] . non-destructive in that the required resources are not consumed PML is such a language [10], developed originally for but remain in place. Its concrete syntax is C-like, but we modelling software development processes, but applicable to present a simpler abstract syntax here: a much wider range of activities, including clinical pathways [11]. It is designed to encourage a flexible approach to its N 2 Name interpretation and deployment. This is most obvious when A 2 Action ::= N?rr!pr one considers that the condition and iterative constructs of ! P; Q 2 PML ::= A j P ;; Q j P CB Q j P k Q j P the language have no condition predicates, relying on the judgement of those enacting the process to determine which We use P ;; Q and P k Q to denote respectively sequential conditional branch should be taken, or when a loop should and parallel composition. Both the conditional (P CB Q) and terminate. the loop construct P ! are unusual in that they have no explicit In this paper we present results obtained while developing conditions. Instead the decision of which branch to take or a range of formal semantics for PML using the Unifying whether or not to end the loop is left unspecified—this is one Theorems of Programming (UTP) framework [12] to sup- aspect of the flexible nature of the language. In its original port reasoning about flexible deployment. We define a UTP intended use, it was left to the people enacting the business process described by PML to use their judgement to determine value of expression e in the before-state, while the other which branch to take or when a process has been repeated variables, denoted collectively by ν, remain unchanged. In enough. UTP, a predicate of the form ok ^ P =) ok0 ^ Q is called We are developing a formal PML semantics framework a Design, denoting a total-correctness assertion, is typically which can investigate and relate at least three interpretations shortened to P ` Q. UTP supports specification languages as of a PML description: well as programming ones, and a general notion of refinement • Strict: the behaviour follows strictly according to the as universally-closed reverse implication: control-flow structure, becoming deadlocked if control S v P = [P =) S] requires execution of actions whose required resources b are not available. A key part of the UTP framework is the use of healthiness • Flexible: the behaviour is guided by the control flow, but conditions to ensure that the predicates actually correspond to actions can run out of sequence if their required resources feasible program outcomes. These are typically defined using become available before the control flow has determined idempotent and monotonic predicate-transformers (H) that that they should start. make an un-healthy predicate healthy (H(Bad) = Better), • Weak: control flow is completely ignored, and exe- while leaving healthy ones untouched (H(Good) = Good). cution simply iterates the non-deterministic choice of For example, the unhealthy predicate :ok ^ ok0 (I’ve finished actions whose resources are available (also known as the even though I didn’t start!) is ruled out by the following “dataflow interpretation”). predicate-transformer: In our framework, the three interpretations form a refinement hierarchy: H1(P ) = :ok _ P W eak v F lexible v Strict In contrast, applying H1 to the definition of assignment leaves As an example, consider the following PML description: it unchanged. Most of the healthiness conditions define sets of healthy predicates that form complete lattices, where the A?!r1 ;; (B?r1!r2 k C?r2!r3) ;; D?r1!r4 bottom element is the most liberal specification (“chaos”), and In the strict interpretation, only one sequence is possible, the top element is the infeasible program that satisfies any namely A; B; C; D because (i) A is required by control-flow specification (“miracle”). The healthiness conditions that do to precede both B and C, and (ii) D is forced to be last. not produce lattices are typically optional ones that can be In the weak interpretation, we ignore the flow control, and invoked to rule out miracles, and which effectively chop off the are left with resource constraints only (B must follow A, upper infeasible predicates, and leaving fully refined programs C must follow B and D must followA) This admits three as maximal elements. possible enactment sequences: A; B; C; D, or A; D; B; C, or IV. WEAK PML A; B; D; C. In this paper we focus on the weak semantics, and on We give the semantics of the weakest interpretation of PML, developments we have done within the Unifying Theories where we only consider the dataflow-like behaviour induced of Programming (UTP) framework [12] to create a semantic by the “requires”(?) and “provides” (!) annotations on basic baseline on top of which both the flexible and strict semantics actions. We shall assume a simple model of resources, as can be constructed. uninterpreted entities that are distinguishable, and where the only property of interest is whether or not any given resource III. UNIFYING THEORIES OF PROGRAMMING is present in the system. What we want to observe is how the The Unifying Theories of Programming framework [12] resources in the system evolve over time, as well as keeping uses predicate calculus to define before-after relationships track (by name) of which basic actions were executed. We over appropriate collections of free observation variables. introduce three observations, all of which can be made both The before-variables are undashed, while after-variables have before and after a PML run: starting, termination (ok; ok0 : B); dashes1. Some observations correspond to the values of pro- resources in the system (r; r0 : P Res); and basic actions gram variables (v; v0), while others deal with important obser- executed (h; h0 : Name∗). vations one might make of a running program, such as start Due to space limitations, we do not give a detailed account (ok) and termination (ok0) or event traces (tr; tr0). The set of the healthiness conditions here, but note that we have the of observation variables associated with a theory or predicate usual Design conditions (H1; H2; H3) as well as modified is known as its alphabet.