Page 266 -

248 9 Operational Support

Fig. 9.4 Detecting violations at run-time: the moment a deviation is detected, an alert is generated

do no consider the log as a whole but focus on the partial trace of a particular
case, and (b) in case of a deviation there should be an immediate response when
the deviation occurs. Figure 9.4 illustrates this type of operational support. Users
are interacting with some enterprise information system. Based on their actions,
events are recorded. The partial trace of each case is continuously checked by the
operational support system, i.e., each time an event occurs, the partial trace of the
corresponding case is sent to the operational support system. The operational sup-
port system immediately generates an alert if a deviation is detected. The enterprise
information system and its users can take appropriate actions based on this alert,
e.g., a manager is notified such that corrective actions can be taken.
All cases in the event log shown in Table 9.1 conform to the transition system
of Fig. 9.3, the WF-net shown in Fig. 1.1, and the BPMN model shown in Fig. 1.2.
Therefore, when these cases were executing, no deviations could be detected with
respect to these models. Assume now that the more restrictive WF-net shown in
Fig. 9.5 describes the desired normative behavior. Compared to the original model
activity d (i.e., checking the ticket) should occur after b or c (i.e., one of the exami-
nations). 1
Let us now consider the first case: σ 1 = a 12 ,a 19 ,b 25 ,d 26 ,b 32 ,
start complete start start complete
d 33 ,e 35 ,e 40 ,h 50 ,h 54 . After each event it is checked whether
complete start complete start complete
there is a deviation or not. At time 12, after executing the first event a 12 no de-
start
12
viation is found, because trace a start can be replayed in Fig. 9.5 without missing
2
tokens. The next two events can also be replayed, i.e., a 12 ,a 19 ,b 25 is a
start complete start
possible firing sequence of the WF-net in which each activity is refined into a start
and complete transition. The state after replaying the three events is [c2,b].The
26
next event, i.e., d start is not possible in this state. Hence, an alert is generated at time
1 Note that this diagram can be simplified by removing place c2, the arc from c3to e,and the
arc from d to c3(i.e., N 2 in Fig. 7.2). The simplified model has the same behavior, i.e., both are
bisimilar.
2
The WF-net Fig. 9.5 has only one transition per activity while the log contains start and complete
events. As described in Sect. 5.2.4, each activity can be described by a small subprocess. Assume
that all transitions in Fig. 9.5 are split into a start transition and complete transition connected
through a place named after the activity. For example, transition a is refined into transitions a start
and a complete connected by a place a. Note that the transition system in Fig. 9.3 used the same
naming convention.