Correct Composition of Dephased Behavioural Models

Abstract

Scenarios of execution are commonly used to specify partial behaviour and interactions between different objects and components in a system. To avoid overall inconsistency in specifications, various automated methods have emerged in the literature to compose (behavioural) models. In recent work, we have shown how the theorem prover Isabelle can be combined with the constraint solver Z3 to efficiently detect inconsistencies in two or more behavioural models and, in their absence, generate the composition. Here, we extend our approach further and show how to generate the correct composition (as a set of valid traces) of dephased models. This work has been inspired by a problem from a medical domain where different care pathways (for chronic conditions) may be applied to the same patient with different starting points.

An Integrated Approach to a Combinatorial Optimisation Problem

“…The efficiency of modern SMT solvers makes them feasible to search for a solution satisfying the criteria above. However, only (P2) above makes use of the arithmetic capabilities of the solver, while we otherwise only made use of the basic SAT solver for the remaining computations in our previous work [5,6,7]. Given that SMT solvers are SAT solvers with awareness of additional facts (e.g., arithmetics), we wonder whether this can be used to better exploit SMT solvers capabilities.…”

“…Our own recent works [5,6,7] propose the use of SMT solvers for finding optimal paths along processes executed in parallel, combined with the problem of picking resources at each selected path node under the constraint of mutual resource interaction. None of them can accommodate either cyclic graphs or interactions with arity greater than 2, which is a first contribution of the present paper; in those works, we expose the issue (largely under-explored in the current literature) of ascertaining the correctness of the SMT code we use, and provide a theorem-prover based solution.…”

“…where |R| must be replaced by its actual numerical value, since the length of a Bit-Vector cannot be a variable in SMT. This is not a problem because our model considers a fixed, finite universe of available resources (see (5)). Now, the problem of a union set operation appearing in (7) is also solved, because we can express (7) as Listing 1.1.…”

“…This method is general and can be applied to whichever correctness theorem one could desire for their SMT code (which we already did, e.g., in [5,6,7]). One aspect of this generality is that the method is not limited to a pair of SMT assertion sets (such as unionPredicateOriginal and unionPredicateIsabelle above): one could refine her SMT code, for example to improve performance, in a third set of SMT assertions (let us call it unionPredicateOptimised, and then show, in the same manner as done with the assertion above, that it is also equivalent to the other two assertion sets.…”

Automated conflict resolution between multiple clinical pathways: a technology report

“…These care pathways are similar to workflow models,28 , 29 which represent the partially ordered occurrence of events and interactions between components in a software system. As a result, automated constraint solvers such as Z3,17 , 30 can be used to automatically detect whether the ordering of events specified in one model is in conflict with the ordering of events in others 13 , 31. In the context of healthcare, one example is when two pathways prescribe drugs which should not be used at the same time.…”