2 Preliminaries

req_c

p0

p1

p2 p3

p6

p5

p4

p7

r_low r_high

cc_y cc_n

rej acc

t1

t3

t₂

t4 t5 t₆ t₇

t₁₁ t₁₀ t9

t8

(a) Open net Nc modeling the credit approval process of an on- line banking service.

req_c

r_low r_high

cc_y cc_n

rej acc p8

p9

p10

p11

p12

t12

t13 t₁₄

t15

t₁₇ t16

(b) Open netM1.

req_c

r_low r_high

cc_y cc_n

rej acc p13

p14

p16

p18

p19

t18

t19 t20

t21

t24

t₂₃ t22

p15

p17

(c) Open netM2.

Fig. 1.The running example processNc and two strategiesM1andM2

coincide ifN has an empty interface. The inner ofNc,innerNc, is the net inside the dashed frame in Fig. 1(a).

As a correctness criterion for an open netN we require the absence of dead- locks inN.

Definition 2 (Deadlock). Let N be an open net. A deadlock is a nonfinal marking inN that does not enable a transition. IfN does not have deadlocks, it is called deadlock-free.

Two open nets M and N are composable if all constituents (except for the interfaces) are pairwise disjoint. This can be achieved easily by renaming. For the interfaces, we require that the input places ofM are the output places ofN and vice versa (i.e.IM =ON andOM =IN). For markingsmM ∈M, mN ∈N, their composition m = mM ⊕mN is defined by (mM ⊕mN)(p) = mM(p) + mN(p) (assuming mM(p) = 0 forp /∈ PM and mN(p) = 0 forp /∈ PN). These considerations lead to the following definition of composition.

Definition 3 (Composition of open nets). Let M, N be composable open nets. Then, the composition of M and N is the open net M ⊕N defined as follows:

– P =P_M ∪P_N, – T =TM∪TN, – F =FM ∪FN, – I=O=∅,

– m0=m0_M⊕m0_N, and

– Ω={mM⊕mN |mM ∈ΩM, mN ∈ΩN}.

Consider the two open nets M1 and M2 depicted in Fig. 1(b) and Fig. 1(c), respectively and assumem_0M

1 = [p₈],Ω_M1 ={[p₁₂]},m_0M

2 = [p₁₃], andΩ_M2 = {[p₁₉]}. Then, N_c and M₁ as well as N_c and M₂ are composable. Notice that placecc ybecomes internal in the compositionN_c⊕M₁, but it is never marked.

Clearly, we are mostly interested in composing open nets such that the com- position is deadlock-free. To this end, we define the notion of a strategy.

Definition 4 (Strategy). An open net M is a strategyfor an open net N if M⊕N is deadlock-free. Strat(N)denotes the set of all strategies for N. Both,M₁⊕N_candM₂⊕N_c, are deadlock-free and thus,M₁andM₂are strategies forN_c.

2.2 Operating Guidelines

In the following we recapitulate our concept of anoperating guideline [8,5]. With the help of operating guidelines we are able to represent the set of all strategies M for an open netN in a compact way. Technically, an operating guideline is a special annotated automaton. An annotated automatonA^Φ consists of a finite deterministic automaton A and a functionΦ that assigns to each state q ofA a Boolean formulaΦ(q). A^Φ represents a set Strat(A^Φ) of open nets. For each element of N ∈ Strat(A^Φ), we say that N matches with A^Φ. We continue by first defining the notions of annotated automata and matching in general and then introducing operating guidelines.

Definition 5 (Annotated automaton).A^Φ= [Q, C, δ, q₀, Φ]is an annotated automaton iff Q is a nonempty finite set of states, C is a set of labels, δ ⊆ Q×C ×Q is a transition relation such that every state q ∈ Q is reachable fromq0 via transitive applications of δ,q0∈Qis the initial state, andΦ is an annotationfunction, where, for allq∈Q,Φ(q)is a Boolean formula over literals inC.

We use annotated automata to represent a set ofopen nets. Therefore, we take an annotated automatonA^Φ with Boolean formulae over literals inC=I∪Oand a special literalfinal and define when a service described in terms of an open net M with the interfaceI∪O matches withA^Φ. Intuitively,M matches withA^Φ if (1) itsbehavior is simulated byA^Φand (2) if a markingmofM is simulated by a stateqofA^Φ, then the arcs leavingm— interpreted as an assignment assigning true to the corresponding literals of the formulaΦ(q) — satisfyΦ(q). For more details, we refer to [9,5].

In order to simplify presentation, we assume that each transition of an open net is connected to at most one interface place. This assumption does, however, not restrict generality as every open net can be transformed into an equivalent one that obeys this restriction [5].

Definition 6 (Matching with A^Φ). Let M be an open net that obeys the assumption stated above and let Y be the set of all reachable markings of the Petri net M^∗ =innerM. Let A^Φ = (Q, C, δ, q0, Φ) be an annotated automaton with C =IM ∪OM ∪ {final}. Then M matches with A^Φ iff there is a relation ρ⊆Y ×Qinductively defined as follows:

1. (m0_M, q0)∈ρ;

2. Ift is an internal transition ofM (i. e., tis not connected to any interface place),m, m∈Y, andm−→^t m, then(m, q)∈ρimplies (m, q)∈ρ;

3. If t is a receiving transition of M with c ∈ I_M, c ∈ ^•t, m, m ∈ Y, and (m+ [c]) −→^t m, then (m, q) ∈ ρ implies (m, q) ∈ ρ for some q with (q, c, q)∈δ;

4. If t is a sending transition of M with c ∈ OM, c ∈ t^•, m, m ∈ Y, and m −→^t (m + [c]), then (m, q) ∈ ρ implies (m, q) ∈ ρ for some q with (q, c, q)∈δ;

5. For allm∈Y, at least one of the following properties holds:

– An internal transitiontis enabled at m; or,

– for all q such that (m, q)∈ ρ, Φ(q) evaluates to true for the following assignmentβ:

- β(c) = true if c∈OM and there is a transitiont with c∈t^• that is enabled at m;

- β(c) = true if c∈IM and there is a transition t with c∈^•t that is enabled at m+ [c];

- β(c) = trueif c=final andm∈Ω_M; - β(c) = false, otherwise.

Let Match(A^Φ)denote the set of all M such that M matches A^Φ.

In the formal definition,ρrepresents the informally described (weak) simulation relation. The assignment used for evaluating an annotation represents transitions tofM that leave the considered markingmofM^∗.

An operating guidelineOG_N of an open netNis a special annotated automa- ton, such that an open netM matches withOG_N if and only ifM is a strategy forN.

Definition 7 (Operating guideline).An annotated automaton is an operat- ing guidelineOGN of an open net N iff Strat(N) =Match(OGN).

Figure 2 depicts the operating guideline OGN_c for the credit approval process Nc (see Fig. 1(a)). It consists of 16 nodes and 31 edges and was calculated by our tool Fiona [10]. In the initial stateq₀, the annotation is!cc y∨!cc n∨!req c reflecting the possible choices of a strategyM forNc. More precisely, M must be able to send at least one (expressed by the disjunction) of the three messages cc y,cc n, andreq cin its initial state. In contrast, annotation?acc∧?rejin state q₁₄ reflects the fact that M being in markingm with (m, q14)∈ρmust be able to receive messageaccand messagerej. The two open netsM1andM2fulfil the requirements of Def. 6 and thus match withOGNc.

!cc_n !cc_y

!req_c

!req_c

!req_c

!cc_n ?r_low !cc_y ?r_high

?acc

?r_low ?rej

?r_high

!cc_n

!cc_y

?acc ?r_low ?rej

?r_high

!cc_n

!cc_y

?rej ?r_high

?acc ?rej

?r_low ?r_high ?r_low ?acc ?acc

?rej

q₁₅: final q₁: !req_c

q₀: !cc_yB!cc_nB!req_c

q₆: (?rejB?r_high) A(?acc B?r_low) A(?acc B?r_high)

q₅: !cc_yB!cc_n q₇: !cc_yB!cc_n

q₄: (?rejB?r_high) A(?acc B?r_low) A(?rejB?r_low)

q₈: ?r_low q₉: ?acc A?rej q₁₀: ?r_highA?r_low q₁₁: ?acc q₁₂: ?rej q₁₃: ?r_high q₁₄: ?acc A?rej q₂: (!cc_yB!cc_nB?r_high) A(!cc_yB!cc_nB?r_low) q₃: !req_c

Fig. 2.The operating guidelineOGNc for the credit approval processNc depicted in Fig. 1(a). For better readability, we add a leading “!” (“?”) to a literalxin the graphics of anOGN ifxis an output (input) place of a strategyM forN.