Pattern-based analysis of computer-interpretable guidelines: Don't forget the context

In the paper by Grando et al. [1], the authors use formal methods to prove whether a computer-interpretable guideline modeling language satisfies a set of control-flow workflow patterns [2]. They contrast the formal proof with an earlier informal analysis [3] in which we had compared different guideline modeling languages according to workflow patterns that they supported. Grando et al. find differences between their analysis and our analysis on the support of certain patterns by the PROforma guideline modeling language and conclude that "As tools for comparing languages these formal techniques make misinterpretation of the semantics of target patterns less likely, add much-needed rigor and give greater confidence in the results, but they cannot guarantee that all language features have been fully understood by the investigator". However, while formal proof certainly could provide additional rigor, naturally, it still depends on correct understanding of the semantics of the modeling language and of the workflow patterns. When errors in understanding of these semantics occur, then formal methods are no better than informal ones. In fact, the formal proof strategy presented in Grando's paper includes an initial informal step in which the modeler tries to specify a workflow W in language L, which could potentially provide the behavior described by pattern P. If the modeler finds such workflow, then the formal proof continues from it; if he does not, then he exhaustively tries all possible combination of components from L that can provide the behavior described by pattern P to conclude that the pattern in not satisfied. This informal step was exactly the strategy that we had used in our study [3]. However, the quality of this informal proof step depends on the correct understanding of the modeler regarding the semantics of the guideline modeling language and of the workflow patterns. Clearly Grando et al. are experts in PROforma semantics, which allowed them in an earlier paper [4] to find an error in our analysis, where we did not realize a way for PROforma to support pattern 10 (Arbitrary Cycles). But, Grando et al. misunderstood the context condition for pattern 5 (Simple Merge), concluding erroneously that our analysis was incorrect and that PROforma does not satisfy pattern 5, where in fact it does. Specifically, this context condition, which is an assumption of the pattern, states that the place at which the merge occurs (i.e., place p1 in figures 4-a) is safe and can never …