Analysis of Inconsistency in Graph-Based Viewpoints: A Category-Theoretic Approach

Transcription

1 Analysis o Inconsistency in Graph-Based Viewpoints: A Category-heoretic Approach Mehrdad Sabetzadeh Steve Easterbrook Department o Computer Science, University o oronto oronto, ON M5S 3G4, Canada {mehrdad,sme}@cstorontoedu Abstract Eliciting the requirements or a proposed system typically involves dierent stakeholders with dierent expertise, responsibilities, and perspectives Viewpoints-based approaches have been proposed as a way to manage incomplete and inconsistent models gathered rom multiple sources In this paper, we propose a category-theoretic ramework or the analysis o uzzy viewpoints Inormally, a uzzy viewpoint is a graph in which the elements o a lattice are used to speciy the amount o knowledge available about the details o nodes and edges By deining an appropriate notion o morphism between uzzy viewpoints, we construct categories o uzzy viewpoints and prove that these categories are (initely) cocomplete We then show how colimits can be employed to merge the viewpoints and detect the inconsistencies that arise independent o any particular choice o viewpoint semantics We illustrate an application o the ramework through a case-study showing how uzzy viewpoints can serve as a requirements elicitation tool in reactive systems 1 Introduction Requirements elicitation and analysis is signiicantly complicated by the incompleteness and inconsistency o the inormation available in early stages o sotware development lie-cycle Dierent stakeholders oten talk about dierent aspects o a problem, use dierent terminologies to express their descriptions, and have conlicting goals Viewpoints-based approaches have been proposed as a way to manage incomplete and inconsistent inormation gathered rom multiple sources [8] We may use viewpoints to speciy dierent eatures o a system, describe dierent perspectives on a single unctionality, or model individual processes that need to be composed in parallel [6] By separating the descriptions provided by dierent stakeholders, viewpoints-based approaches acilitate the detection o inconsistencies between the descriptions In the classical viewpoint approach, incompleteness and inconsistency within a viewpoint cannot be modeled explicitly Consistency checking is achieved by expressing a set o consistency rules in a rich meta-language, such as irst order logic [8, 7] With this approach, viewpoints can be merged only by making them consistent irst, and then using classical composition operators Alternatively, one could translate a set o viewpoints, together with their consistency rules, into the same logic However, this approach discards both the structure o the original viewpoints, and the syntactic aspects o their original notations Hence, such merges cannot be based on structural mappings between viewpoints Neither approach is satisactory, and the question o how to compose viewpoints that are incomplete and inconsistent has remained an open problem or the past decade his paper introduces a category-theoretic ormalism or the syntactic representation o a amily o graph-based viewpoints, hereater called uzzy viewpoints, that are capable o modeling incompleteness and inconsistency explicitly Inormally, a uzzy viewpoint is a graph in which the details o nodes and edges are annotated with the elements o a lattice to speciy the amount o knowledge available about them By deining an appropriate notion o morphism between uzzy viewpoints, we construct uzzy viewpoint categories and prove that they are (initely) cocomplete We then show how merging a set o interconnected uzzy viewpoints can be done by constructing the colimiting viewpoint in an appropriate uzzy viewpoint category Colimits will also be used as a basis or deining a notion o syntactic inconsistency between a set o interconnected viewpoints Our proposed approach to modeling incompleteness and inconsistency is very general and should apply to any o the large number o graph-based notations commonly used in Sotware Engineering In this paper, our ocus will be on a airly simple kind o uzzy viewpoints inspired by χ views [6] We will use simple state-machine models to 1

2 show how nodes and edges in graphical notations can be decorated with the additional structures required or modeling incompleteness and inconsistency he mathematical machinery in this paper builds upon the category-theoretic properties o uzzy sets noted in [10, 11] he use o colimits as an abstract mechanism or putting structures together has been known or quite some time (c [12] or reerences) In [14, 15], colimits have been used or merging viewpoints In that approach, viewpoints are described by open graph transormation systems and colimits are used to integrate them Our work is, as ar as we know, the irst use o category theory or merging inconsistent viewpoints he paper is organized as ollows: Section 2 reviews the required mathematical background Section 3 outlines the deinitions and lemmas on uzzy set categories needed in this paper Section 4 proposes a category-theoretic ormalism or uzzy viewpoints Section 5 describes the merge operation or uzzy viewpoints and provides a deinition or syntactic inconsistency based on colimits Section 6 demonstrates a modeling process using uzzy viewpoints in the context o a case-study; and inally, Section 7 presents our conclusions and uture work 2 Mathematical Preliminaries In this section, we briely review the deinitions o graphs, lattices, and the category-theoretic constructs used in the remainder o the paper 21 Graphs and Graph Homomorphisms Deinition 21 A graph is a quadruple G = (N, E, s G, t G ) where N is a set o nodes, E a set o edges, and s G, t G : E N are unctions respectively giving the source and the target or each edge A graph homomorphism rom G = (N, E, s G, t G ) to G = (N, E, s G, t G ) is a pair o unctions h = h n : N N, h e : E E such that: h n s G = s G h e and h n t G = t G h e 22 Partially Ordered Sets and Lattices Deinition 22 A partial order is a relexive, antisymmetric, and transitive binary relation A non-empty set with a partial order on it is called a partially ordered set or a poset, or short We use Hasse diagrams (c eg [5]) to visualize inite posets Deinition 23 Let Q be a poset An element Q is said to be the top element i a Q : a Dually, an element Q is said to be the bottom element i a Q : a Deinition 24 Let Q be a poset and let A Q An element q Q is an upper bound o A i a A : a q I q is an upper bound o A and q x or all upper bounds x o A, then q is called the supremum o A Dually, an element q Q is a lower bound o A i a A : q a I q is a lower bound o A and x q or all lower bounds x o A, then q is called the inimum o A We write Q A (resp Q A) to denote the supremum (resp inimum) o A Q, when it exists Deinition 25 Let Q be a poset I both Q {a, b} and Q {a, b} exist or any a, b Q, then Q is called a lattice I both Q A and Q A exist or any A Q, then Q is called a complete lattice Lemma 26 (c eg [5]) Every inite lattice is complete Lemma 27 (c eg [5]) Every complete lattice has a bottom ( ) and a top ( ) element 23 Category heory We assume acquaintance with basic concepts o category theory and only review diagrams, colimits, and comma categories in order to provide context and establish notation An excellent introduction to category theory rom a computer science perspective is [1] Detailed discussion about comma categories can be ound in [13, 16] 231 Diagrams and Colimits Deinition 28 A (inite) diagram D in a category C consists o: a (inite) graph G(D); a C -object D n or each node n in G(D); and a C -morphism D e : D sg(d) (e) D tg(d) (e) or each edge e in G(D) A diagram D is said to commute i or any nodes i and j in G(D) and any two paths i s1 s k 1 k n t n 1 j and i 1 t l1 l m m 1 j rom i to j in G(D): D sn D s1 = D tm D t1 Deinition 29 A pushout o a pair o morphisms : C A and g : C B in a category C is a C - object P together with a pair o morphisms j : A P and k : B P such that: j = k g; and or any C -object P and pair o morphisms j : A P and k : B P satisying j = k g, there is a unique morphism h : P P such that the ollowing diagram commutes: A C j g j Pushout is a special type o a more general construct known as colimit (see Deinition 210) In order to help a reader without working knowledge o category theory ollow the paper, we spell out the construction o pushouts in k P B h k P 2

3 {{X1, Y2},{Y1},{Z1, 2},{X2}} {{X1, Y1, M2}, {Z1, N2, O2},{1},{P2}} Among the numerous results on cocompleteness o categories, the ollowing lemma is o interest to us: j {X, Y, Z} {X, Y, } X1 Y1 Z1 X2 Y2 2 {A, B} g k j {X, Y, Z, } {M,N,O, P } X1 Y1 Z1 1 M2 N2 O2 P2 {A, B, C, D} Figure 1 Pushout examples in Set Set (category o sets and unctions) without directly appealing to the underlying category-theoretic constructs (ie binary coproducts and coequalizers) he canonical pushout o a pair o Set-morphisms (ie unctions) : C A and g : C B is constructed as ollows: take the disjoint union o sets A and B, denoted A B Let ı A : A A B, ı B : B A B be the injection unctions respectively taking A and B to their images in A B he unctions ı A and ı B g now yield a binary relation R = {( ı A (c), ı B g(c) ) c C } on A B Consider the undirected graph G in which the set o nodes is A B and or any nodes x, y in G, there is an (undirected) edge between x and y i and only i (x, y) R Let P be the set o G s connected components and let q : A B P be the unction taking every x A B to the connected component o G which x belongs to he ollowing diagram will be a pushout square: C ı A ı B g g A A B B ı A ı B j = q ı A q P k = q ı B Figure 1 shows two examples o pushout computation in Set he maps corresponding to the morphisms, g, j, and k o the pushout square have been marked in both examples Deinition 210 Let D be a diagram in C and let N and E denote the set o G(D) s nodes and edges, respectively A cocone α over D is a C -object X together with a amily o C -morphisms α n : D n X n N such that or every edge e E with s G(D) (e) = i and t G(D) (e) = j, we have: α j D e = α i A colimit o D is a cocone α n : D n X n N such that or any cocone α n : D n X n N, there is a unique morphism h : X X such that or every n N, we have: α n = h α n Deinition 211 A category C is (initely) cocomplete i every (inite) diagram in C has a colimit g k Lemma 212 (c eg [1]) A category with an initial object, binary coproducts o object pairs, and coequalizers o parallel morphism pairs is initely cocomplete he general intuition behind colimits is that they put structures together with nothing essentially new added, and nothing let over [12] his is the main reason behind our interest in (inite) cocompleteness results he examples given in Figure 1 illustrate that the pushout o a pair o morphisms : C A and g : C B in Set can be considered as the combination o A and B with respect to a shared part C For reasons that will become clear in Section 232, we are also interested in unctors that preserve (inite) colimits: Deinition 213 A unctor F : C D is said to be (initely) cocontinuous i it preserves the existing colimits o all (inite) diagrams in C, that is, i or any (inite) diagram D in C, the unctor F maps any colimiting cocone over D to a colimiting cocone over F (D) Lemma 214 (c eg [1]) I C is a initely cocomplete category and i a unctor F : C D preserves initial objects, binary coproducts o all object pairs, and coequalizers o all parallel morphism pairs, then F is initely cocontinuous 232 Comma Categories Deinition 215 Let A, B, and C be categories and let L : A C and R : B C be unctors he comma category (L R) has as objects, triples (A, : L(A) R(B), B) where A is an object o A and B is an object o B A morphism rom (A,, B) to (A,, B ) is a pair (s : A A, t : B B ) such that the ollowing diagram commutes in C : L(A) R(B) L(s) R(t) L(A ) R(B ) Identities are pairs o identities and composition is deined component-wise, ie or a pair o morphisms (s, t) and (s, t ), we have: (s, t) (s, t ) = (s s, t t ) Lemma 216 [19, 16] Let L : A C and R : B C be unctors with L (initely) cocontinuous I A and B are (initely) cocomplete so is the comma category (L R) A remarkable act about colimit construction in (L R) is that (inite) colimits are inherited rom those in A and B when L is (initely) cocontinuous [19, 16] 3

4 Using a triple (E, s G, t G : E N N, N) to denote a graph G, it can be veriied [16] that the category o graphs, denoted Graph, is isomorphic to the comma category (I Set ) where I Set : Set Set is the identity unctor on Set and : Set Set, known as the Cartesian product unctor, is the unctor that maps every set N to N N and every unction : N N to Here, is the unction that takes every (x, y) N N to ( (x), (y) ) N N Since Set is cocomplete and the identity unctor is cocontinuous, Lemma 216 implies that Graph is cocomplete Moreover, colimits are computed component-wise or nodes and edges In Section 4, we give an analogous deinition or uzzy viewpoint categories by using uzzy set categories in place o Set and in Section 6, we will exploit the component-wise nature o colimit construction in comma categories without urther remarks 3 Categories o Fuzzy Sets Since its inception in the 1960s, uzzy set theory has received considerable attention rom dierent computing disciplines his section presents the deinitions and results on uzzy set categories needed in the paper Most o the deinitions and lemmas given here can be ound in [10, 11] and are probably very well-known in the literature on topos theory; however, we were not able to ind any reerence that includes all the results we need in a context close to that o our work Deinition 31 Let Q be a poset A Q-valued set is a pair (S, σ) consisting o a set S and a unction σ : S Q We call S the carrier set o (S, σ) and Q the truth-set o σ For every s S, the value σ(s) is interpreted as the degree o membership o s in (S, σ) Deinition 32 Let (S, σ) and (, τ) be two Q-valued sets A morphism : (S, σ) (, τ) is a unction : S such that σ τ, ie the degree o membership o s in (S, σ) does not exceed that o (s) in (, τ) he unction : S is called the carrier unction o Lemma 33 For a ixed poset Q, the objects and morphisms deined above together with the obvious identities give rise to a category, denoted Fuzz(Q) Figure 2 (inormally) shows two Fuzz(K) objects (S, σ) and (, τ) along with the carrier unction : S o a Fuzz(K)-morphism : (S, σ) (, τ) where K is the three-point poset shown in the same igure Lemma 34 [10, 11] Fuzz(Q) is initely cocomplete when Q is a complete lattice Proo (sketch) We show how to construct the initial object, binary coproducts, and coequalizers Finite cocompleteness o Fuzz(Q) then ollows rom Lemma 212 σ : S K s 1 s 2 s 3 S t : S τ : K t 1 t 2 t 3 Figure 2 Example o uzzy sets Initial object: 0 = (, λ) where λ : Q is the empty unction Binary coproduct: given objects X 1 = (S 1, σ 1 ) and X 2 = (S 2, σ 2 ), a coproduct is X 1 + X 2 = (S 1 + S 2, κ) where S 1 + S 2 is a Set-coproduct (disjoint union) o S 1 and S 2 with injections ı n : S n S 1 + S 2 or n = 1, 2; and κ ( ı n (s) ) = σ n (s) or s S n and n = 1, 2 Coequalizer: given objects X = (A, σ) and Y = (B, τ) with parallel morphisms h 1 : X Y and h 2 : X Y, we irst take the canonical Set-coequalizer o the carrier unctions h 1 : A B and h 2 : A B to ind a set C and a unction q : B C hus, C is the quotient o B by the smallest equivalence relation on B such that h 1 (a) h 2 (a) or all a A; and q is the unction such that q(b) = [b] or all b B hen, we put Z = (C, µ) where µ([b] ) = Q {τ(b ) b b} his lits the unction q : B C to a morphism q : Y Z, which is a coequalizer o h 1 and h 2 Since we want to avoid using the details o the above proo in Section 6, we explain the procedure or computing uzzy set pushouts separately: let Q be a complete lattice For computing the pushout o a pair o Fuzz(Q)- morphisms : (C, γ) (A, σ) and g : (C, γ) (B, τ), irst compute the canonical Set-pushout o the carrier unctions : C A and g : C B (as discussed in Section 2) to ind a set P along with unctions j : A P and k : B P hen, compute a membership degree or every p P by taking the supremum o the membership degrees o all those elements in (A, σ) and (B, τ) that are mapped to p his yields an object (P, ρ) and lits j and k to Fuzz(Q)-morphisms which together with (P, ρ), constitute the pushout o and g in Fuzz(Q) Deinition 35 he map that takes every Fuzz(Q)-object (S, σ) to its carrier set S and every Fuzz(Q)-morphism : (S, σ) (, τ) to its carrier unction : S yields a unctor K Q : Fuzz(Q) Set, known as the carrier unctor Lemma 36 he carrier unctor K Q : Fuzz(Q) Set is initely cocontinuous when Q is a complete lattice 1 1 he carrier unctor is initely cocontinuous even when Q is an arbitrary poset, but a separate proo is required 4

5 {(a, ), (b, )} {(a, ), (b, )} {(a, ), (b, )} D M F n1 x = M y = F p1 x = y = F z = {(a, )} {(a, )} {(a, ), (b, )} {(b, )} {(b, )} Figure 3 Powerset lattice example Proo Based on the proo o Lemma 34, it is obvious that K Q : Fuzz(Q) Set preserves the initial object, binary coproducts, and coequalizers Finite cocontinuity o K Q then ollows rom Lemma 214 Deinition 37 Let Q be a poset and let Z = (S, σ) be a Fuzz(Q)-object he powerset o Z, denoted P(Z), is the set o all Fuzz(Q)-objects (C, ξ) such that C S and or every element c C: ξ(c) σ(c) Lemma 38 [10, 11] he powerset o any Fuzz(Q)-object is a complete lattice when Q is Proo (sketch) [10, 11] For an index set I, the supremum o an I-indexed amily o P(Z) elements (Ci, ξ i ) is a uzzy set (X, θ) where X = i I i I C i and θ : X Q is a unction such that or every element x X: θ(x) = Q {ξ i(x) x C i ; i I} he inimum is computed, dually As an example, suppose the truth-set is the two-point lattice L 2 = {, } with < hen, the powerset o the Fuzz(L 2 )-object Z = ( {a, b}, {a, b } ) is the lattice shown in Figure 3 For easier readability, the igure uses tuples o the orm (element, membership degree) instead o the original notation 4 FView Categories In this section, we deine the terms uzzy viewpoint and uzzy viewpoint morphism and prove that the category o uzzy viewpoints over a complete lattice L and an arbitrary but ixed set U o atomic propositions is initely cocomplete Deinition 41 Let L be a complete lattice o truth values and let U (called the universe o atomic propositions) be an arbitrary but ixed set A (L, U)-uzzy viewpoint V is a (directed) graph in which every edge e is labeled with a value rom L and every node n is labeled with an L-valued set (U n, ζ n ) where U n U is the set o atomic propositions visible in node n and ζ n : U n L is a unction assigning a value rom L to each element in U n By orgetting the labels o the nodes and edges in V, we obtain a graph which is called the carrier graph o V n3 x = F z = M V1 F n2 x = y = M z = F D p2 x = F z = F w = Figure 4 Example o uzzy viewpoints V2 F p3 y = F w = M It is clear rom the above deinition that the edges in a (L, U)-uzzy viewpoint orm an L-valued set he question that remains is constructing the appropriate category that captures the structure o nodes along with their labels his can be done in the ollowing way: let ɛ : U L be the constant map {x x U} (notice that is known to exist by Lemma 27) hus, (U, ɛ) is a Fuzz(L)-object Now, by Lemma 38, we iner that the powerset lattice o (U, ɛ) is a complete lattice X he node-set o a uzzy viewpoint V along with the node labels can be described by an object o Fuzz(X ) Deinition 42 Let V and V be (L, U)-uzzy viewpoints A viewpoint morphism h : V V is a pair h n, h e where h n is a Fuzz(X )-morphism and h e is a Fuzz(L)-morphism such that K X (h n ), K L (h e ) is a graph homomorphism rom the carrier graph o V to the carrier graph o V Here, K X : Fuzz(X ) Set and K L : Fuzz(L) Set are the carrier unctors It can be veriied that the above choice o objects and morphisms (with the obvious identities) constitutes a category o (L, U)-uzzy viewpoints, which we will hereater denote FView(L, U) As an example, suppose L = A 4 (the lattice shown on the top-let corner o Figure 4), and U = {x, y, z, w} Figure 4 shows two FView(A 4, U)-objects along with a FView(A 4, U)-morphism In this and all the igures in Section 6, the viewpoint edges have been let anonymous and only the truth values labeling them have been shown Notice that we can replace U in FView(A 4, U) with any inite or ininite U such that {x, y, z, w} U and yet characterize the viewpoints and the viewpoint morphism in Figure 4 as FView(A 4, U ) objects and morphisms It is easy to see that FView(L, U) is isomorphic to the comma category (K L K X ) where : Set Set is the Cartesian product unctor deined in Section 232 Since L and X are complete lattices, both Fuzz(L) and Fuzz(X ) are initely cocomplete by Lemma 34 Moreover, by Lemma 36, we know that the carrier unctor 5

6 K L : Fuzz(L) Set is initely cocontinuous when L is a complete lattice Now, by Lemma 216, we get: heorem 43 FView(L, U) is initely cocomplete or any complete lattice L and any set U his, by Lemma 26, implies that FView(L, U) is initely cocomplete or any inite lattice L and any set U Although not elaborated here, Lemma 36 makes it possible to enrich viewpoints nodes and edges with other structures such as types and additional labels through wellknown comma categorical techniques without violating the cocompleteness result achieved in heorem 43 For some preliminary work in this direction, see [17] A limitation to FView categories which is implicit in the notion o viewpoint morphism is that we assume the existence o a uniied universe o atomic propositions (denoted U) his implies that the name o a proposition suices or uniquely identiying the concept represented by that proposition regardless o where the proposition appears; moreover, no two distinctly named propositions can represent a same concept he restriction is not a problem i there is a reerence model made available at early stages o requirements elicitation, which describes the elements o U I U is not given beorehand, it is suicient to assume U is the set o natural numbers, his would allow using as many propositions as needed; however, it is still up to the analysts to develop a shared vocabulary o atomic propositions during the elicitation phase and speciy how the set o atomic propositions used in each viewpoint binds to this shared vocabulary Alternatively, we anticipate that the limitation could be addressed by introducing explicit signatures and signature morphisms, similar to the approach described in [18]; however, we have not yet investigated this idea 5 Viewpoint Integration and Characterization o Inconsistency It is well-known that or a given species o structure, say widgets, the result o interconnecting a system o widgets to orm a super-widget corresponds to taking the colimit o the diagram o widgets in which the morphisms show how they are interconnected [12] In our problem, the species o structure is FView(L, U) or some ixed complete lattice L and some ixed set U A diagram in FView(L, U) can be regarded as a system in which viewpoints are represented by FView(L, U)-objects and viewpoint interconnections are represented by FView(L, U)-morphisms he cocompleteness result given in heorem 43 states that the colimit exists or any inite diagram in FView(L, U); thereore, we can integrate any inite set o viewpoints with known interconnections by constructing the colimit his categorytheoretic approach ormalizes the ad hoc merge operation sketched in [6] Disagreeing Partially Known Incompatible F Unknown FM FF Figure 5 he lattice A 10 Agreeing Viewpoint integration via colimits is abstract rom how viewpoint interconnections are identiied In Section 6, we will illustrate a very simple case in which the interconnections between two viewpoints are identiied by introducing a third viewpoint he reader should also reer to [15] where some useul patterns or viewpoint interconnection have been identiied In the rest o this section, we will try to clariy how an appropriate choice o L in FView(L, U) enables us to model and detect inconsistencies Our argument will also lead to a deinition or syntactic inconsistency based on colimits he simplest and maybe the most widely used lattice capable o modeling uncertainty and disagreement is Belnap s our-valued lattice [2] which was earlier reerred to as A 4 In A 4, every value shows a possible amount o knowledge available about a concept he value M (ie MAYBE) denotes a lack o inormation, (ie RUE) and F (ie FALSE) denote the desired levels o knowledge, and D (ie DISAGREEMEN) denotes a disagreement (or overspeciication) Another interesting lattice is the ten-valued lattice A 10 shown in Figure 5 his lattice arises naturally in modeling a system with two stakeholders and will be used or the case-study presented in Section 6 In A 10, the value indicates that no inormation is available he values and FM (resp and ) indicate that the irst (resp second) stakeholder has given a decisive RUE or FALSE answer but no inormation has yet been provided by the other stakeholder We also use these values when stakeholders are interviewed separately: or example, i we are interviewing the irst (resp second) stakeholder and (s)he says something is RUE, the answer is recorded as (resp ) he values, FF indicate that both stakeholders agree on whether something is RUE or FALSE while F and F indicate a disagreement between the stakeholders he value arises when an incompatibility occurs his value is not directly assigned during elicitation and only arises in colimit construction We will explain this urther in Section 6 A nice property o both A 4 and A 10 is that once we remove the top element rom either lattice, the rest o logical values can be reordered based on their level o truth he truth ordering lattices corresponding to A 4 and A 10 have been shown in Figures 6a and 6b, respectively he F 6

7 M F (a) F FM FF (b) Figure 6 ruth ordering lattices existence o the truth orders is not by mere chance In act, the lower semi-lattice that results rom removing the top element rom A 4 (resp A 10 ) together with the associated truth ordering in Figure 6a (resp 6b) is an instance o a amily o multivalued logics known as Kleene-like [9] logics In this paper, we shall only appeal to the intuitive nature o such logics and thereore, omit the ormal procedure or constructing them he interested reader should reer to [9] or urther details he procedure explained there yields A 4 (without D) and its corresponding truth order when the input to the procedure is the lattice B 2 = {F, } with F < he lattice A 10 (without ) and its corresponding truth order arise when the input is B 2 B 2 (c eg [5] or the deinition o product lattice) A suitable logic or a system with three stakeholders will arise when the input is B 2 B 2 B 2, and so on he existence o such truth ordering lattices is an advantage when we want to interpret viewpoints according to certain semantics For example, we may want to treat a viewpoint as a χkripke [3] structure and veriy certain temporal properties in it through multivalued model-checking [3] For such an application, we are naturally interested in measuring the amount o truth or the desired temporal properties that should hold In the ramework we have proposed in this paper, we are not concerned with any truth ordering lattices and the only reason or mentioning them here was to give a general idea o the links between the syntactic and the semantic aspects o viewpoints All we take or granted here is the existence o a complete knowledge ordering lattice which we denote by L I we assume that the context o the system at hand can speciy which elements o L represent consistent amounts o knowledge and which elements represent inconsistent amounts o knowledge, we can deine syntactic inconsistency between a set o interconnected viewpoints as ollows: Deinition 51 A system o interconnected (L, U)-uzzy viewpoints is syntactically inconsistent i the colimit o the diagram corresponding to the system has some edge or proposition with an inconsistent truth value In A 10, or example, we may choose to designate and FF as consistent and the rest o the values as inconsis- F L he Camera Speciication Midroll Rewind U Shutter Button he camera should have a saety switch with two states: locked and unlocked he locked state prevents accidental operation Saety Switch In Focus Indicator When the camera is not locked and a new ilm is loaded, the ilm should automatically advance to the irst rame once the camera back is closed Ater the ilm s last rame is exposed, the camera should rewind the ilm automatically back into the cartridge he camera should also have a midroll rewind button to rewind the ilm beore reaching the last rame he camera should have a shutter button that can be depressed halway or all the way here should be a click-stop at the halway point When the camera is not locked, the shutter button should work as ollows: When pressed halway, auto-ocusing starts; When pressed completely, the shutter is released to take the picture and then the ilm advances by one rame he scenario or taking a picture is as ollows: he shutter button is pressed halway When ocus is achieved, the in-ocus indicator will light he shutter button can then be pressed completely to take the picture Under low-lit conditions, the built-in lash should ire automatically Figure 7 Camera s early reerence model tent his is a reasonable choice when the system we are modeling mandates total agreement o both stakeholders on every aspect I we are only interested in explicit conlicts and incompatibilities, we can relax this constraint and only designate F, F and as inconsistent Once we have a measure or how much inconsistency we want to tolerate, the colimit construction can also serve as a mechanism or determining when an inconsistency amelioration phase [7] is required When using A 10, or example, we may decide to live with all A 10 values except or incompatibilities ( ) 6 Case-Study In this section, we investigate a simple Requirements Engineering problem with the aim o showing how our proposed ramework can be used in practice: suppose Bob and Mary want to engineer a camera rom scratch with the help o a requirements analyst named Sam Based on the early interviews, Sam has created a reerence model or the operational behavior o the camera his early reerence model, shown in Figure 7, serves as a basis or elaborating Bob s and Mary s requirements using a (ictional) CASE tool called FDraw he primary role o Sam in this case-study is eliciting the requirements and identiying the relationships between Bob s and Mary s perspectives his implies that the camera project has only two stakeholders, namely Bob and Mary; thus, the lattice A 10 (Figure 5) with Bob as the irst and Mary as the second stakeholder is a suitable choice o knowledge ordering or this project Since a vocabulary o atomic propositions has not yet been developed, the project 7

8 is conigured to use FView(A 10, ) where is the set o natural numbers In practice, we do not use natural numbers as proposition names; rather, we assume that every proposition has a unique natural number assigned to it (we will not use any numbers throughout the case-study) he set o propositions used by Bob and Mary must have no name clash and no two distinctly named propositions should represent the same thing In order to enorce these restrictions, whenever either Bob or Mary needs a new proposition named p or some purpose, (s)he has Sam check the project s data dictionary to ensure that adding p causes no name clash and that no proposition (probably with a name dierent rom p) has already been deined or that particular purpose he viewpoints in the camera project are similar to χkripke structures [6, 3] In a viewpoint V, each node denotes a state (world) and each edge denotes a transition labeled with the degree o certainty about the possibility o going rom the source to the target state o the transition Furthermore, there exists a unique transition t : i j rom any V -state i to any state V -state j his constraint is not automatically enorced by the structure o FView(A 10, ), so FDraw should explicitly be conigured to do so FDraw disallows parallel transitions between states; but, or convenience, it allows transitions to be omitted and internally interprets the absent transitions as transitions Notice that FDraw could as well be conigured to interpret absent transitions in Bob s (resp Mary s) viewpoint as FM (resp ) transitions his would be closer to how absent transitions are normally interpreted in classical models In this case-study, all propositions are treated as global When a proposition x does not appear in a state s o a viewpoint V, we assume that the owner o V either is unaware o the existence o x, or (s)he does not care about the value o x in state s, at least rom the particular perspective that V relects In either case, an unspeciied proposition in a state is interpreted as his is somehow analogous to the interpretation o absent transitions Figures 8 and 9 respectively show Bob s and Mary s viewpoints 2 he important acts about each o Bob s and Mary s perspectives on the camera can be summarized as ollows: Bob: he does not dierentiate between dierent shooting modes; he believes pressing the shutter button ullway is allowed even beore achieving ocus; he (mistakenly) believes the shutter is open during ocusing; he believes midroll ilm rewind can occur even when the camera is locked; he does not model the cartridge loading procedure Mary: she distinguishes between dierent shooting modes; she believes pressing the shutter button ullway 2 In both igures, SH BN is an abbreviation or SHUER BUON Frame Fetch MOOR_ON = FLASHING = MOOR_ON = Cartridge Unmount Film Advance O SH_BN_HALFWAY = FM SH_BN_FULLWAY = FM Focus SH_BN_HALFWAY = SH_BN_FULLWAY = FM SHUER_OPEN = Shooting SH_BN_HALFWAY = FM SH_BN_FULLWAY = SHUER_OPEN = Figure 8 Bob s viewpoint Flash Shooting SHUER_OPEN = FLASHING = SH_BN_FULLWAY = Locked Ready Auto Focusing SH_BN_HALFWAY = Normal Shooting SHUER_OPEN = FLASHING = SH_BN_FULLWAY = Figure 9 Mary s viewpoint Catridge Mount MOOR_ON = is inhibited until ocus is achieved; she does not capture the situation in which the shutter button is pressed halway but is released without taking a picture; she knows that the camera has a motor that rolls the ilm; she models the cartridge loading procedure and also emphasizes that mounting a new cartridge can not take place when the camera is locked Sam now identiies the structural interconnection between the two viewpoints He irst identiies the state interconnections his has been shown in Figure 10 Notice that Sam uses his own set o names or the states Once the state interconnections are speciied, the transition interconnections can be identiied automatically his is because there is a unique transition rom any state i to any state j o every viewpoint V hus, i a viewpoint morphism h : V V maps states i and j in V to states i and j in V respectively, then h must map the unique transition rom i to j in V to the unique transition rom i to j in V Figure 11 shows Sam s viewpoint his viewpoint has been computed by FDraw directly rom the state interconnections For clarity, we have chosen to show those tran- 8

9 Locked Focusing Flash Shooting Non Flash Shooting Film Advance Sam O Focusing Shooting Frame Fetch Bob Locked Ready Auto Focusing Flash Shooting Normal Shooting Film Advance Cartridge Unmount Cartridge Mount Mary Figure 10 State interconnections sitions in Sam s viewpoint that are mapped to non- transitions in Bob s and Mary s viewpoints he igure also sketches the viewpoint morphism rom Sam s to Bob s viewpoint he morphism rom Sam s to Mary s viewpoint (which has been omitted or saving space) is analogous Since Sam does not engage in determining the truth or alsehood o transitions and propositions, his viewpoint solely relects the structural relationships between Bob s and Mary s viewpoints As a result, all transitions in Sam s viewpoint are labeled by Sam can also orget about propositions all together when identiying the interconnections and use as the set o visible propositions in all states o his viewpoint FDraw now computes the pushout o Bob s and Mary s viewpoints with respect to the shared part identiied by Sam he result o merge operation (excluding transitions) is shown in Figure 12 For assigning names to the states in the pushout, we have assumed that Sam s choice o state names overrides those o Bob and Mary wherever possible Here, the only state not mentioned by Sam is Cartridge Mount in Mary s viewpoint, so Sam s state names override all state names except or Cartridge Mount his assumption is o no theoretical importance; however, it can be used to devise a built-in solution to the name mapping problem he pushout in Figure 12 clearly relects the result o merging Bob s and Mary s viewpoints Assuming F, F, and are the only inconsistent values, there are three cases o syntactic inconsistency in the pushout he F values or SHUER OPEN in Focusing and the transition rom to Flash Shooting/Non-Flash Shooting respectively show disagreeing perspectives on the shutter s behavior during ocusing operation and on picture-taking without achieving ocus he other inconsistency is the value or FLASHING in Flash Shooting/Non-Flash Shooting state Intuitively, the value in A 10 arises when a stakeholder wants a proposition x to hold in a state s o a viewpoint V and also wants x not to hold in a state s o a viewpoint V but the interconnections are in such a way that s and s are mapped to the same state in the colimit In our example, the Frame Fetch Bob O SH_BN_HALFWAY = FM SH_BN_FULLWAY = FM Focusing SH_BN_HALFWAY = SH_BN_FULLWAY = FM SHUER_OPEN = Shooting SH_BN_HALFWAY = FM SH_BN_FULLWAY = SHUER_OPEN = Film Advance Sam Flash Shooting Locked Focusing Non Flash Shooting Figure 11 Interconnecting the viewpoints MOOR_ON = Film Advance FLASHING = MOOR_ON = Shared Part (Sam s Viewpoint) Bob s Viewpoint Locked SH_BN_HALFWAY = FM SH_BN_FULLWAY = FM Focusing SHUER_OPEN = F SH_BN_HALFWAY = SH_BN_FULLWAY = FM Flash Shooting / Non Flash Shooting SHUER_OPEN = SH_BN_FULLWAY = FLASHING = Mary s Viewpoint Catridge Mount MOOR_ON = Figure 12 Colimit computation simplest reason or coming up with FLASHING = in the Flash Shooting/Non-Flash Shooting state o the pushout is that Sam has made a mistake in inding the (state) interconnections For example, Bob might have meant Non-Flash Shooting by saying Shooting; or maybe, at the time Sam identiied the interconnections, Mary had not yet used FLASHING to distinguish between Flash Shooting and Non-Flash Shooting and thereore, Sam thought two distinct states or shooting would be redundant It is also possible that the incompatible inormation is indeed due to the incompatible perspectives o Bob and Mary on the shooting behavior: or example, Mary may believe the lash clearly distinguishes between two modes o shooting while Bob believes the lash is a separate autonomous peripheral and deliberately reuses to dierentiate between the states that result rom the combination o F 9

10 the shooting and the lashing behaviors he inal issue to note regarding this case-study is that although the result o merge operation in our particular scenario has a unique transition rom any state i to any state j, this is not necessarily the case in general Based on how the edge-map component o every viewpoint morphism is identiied, it can be veriied that parallel transitions between states never arise in the colimiting object; however, the colimiting object may have some missing transitions For example, i Bob saw a state X that Mary did not see, the pushout would have had no transition rom X to Cartridge Mount and vice versa his is natural, because X and Cartridge Mount would have never appeared together in a same elicitation context his phenomenon can be taken advantage o or speciying the activities that should be perormed in the next round o elicitation to ill in the gaps We may as well choose to interpret missing transitions in colimiting objects as transitions 7 Conclusions and Future Work We proposed a category-theoretic approach to representation and analysis o inconsistency in graph-based viewpoints he main contribution o this work is providing an abstract mechanism or merging incomplete and inconsistent viewpoints and deining a notion o syntactic inconsistency Our mathematically rigorous approach is a step toward a general ramework or the composition o inconsistent viewpoints which has so ar remained an open problem A major advantage o our proposed ramework is its support or parameterizing inconsistency through lattices his makes the ramework suitable or dierent types o analysis Another advantage that naturally results rom the use o category theory or conceptualizing the merge process is the explicit identiication o interconnections between viewpoints prior to the merge operation rather than relying on naming conventions to give the desired uniication he work reported here can be carried orward in many ways Our uture work includes adding support or hierarchical structures like Statecharts, and studying possible ways to capture the evolution o the vocabulary o atomic propositions and the underlying knowledge ordering through viewpoint morphisms Exploring possible ways o taking semantics-related details into account is yet another part o our uture work that will involve several casestudies Another interesting subject is using the ramework presented in this paper or developing graph transormation systems based on the double-pushout approach [4] In [17], some initial steps have been taken in this direction, but urther work remains to be done Acknowledgments We thank Wolram Kahl or his extensive help in improving this paper, Andrzej arlecki or the proo o Lemma 34, Shiva Nejati or help with knowledge ordering lattices, members o the Formal Methods Group at Uo or their helpul remarks, Colin Potts or suggesting the case-study, and the anonymous reerees or their insightul comments Financial support was provided by NSERC Reerences [1] M Barr and C Wells Category heory or Computing Science Les Publications CRM Montréal, third edition, 1999 [2] N Belnap A useul our-valued logic In Modern Uses o Multiple-Valued Logic, pages 5 37 Reidel, 1977 [3] M Chechik, S Easterbrook, and B Devereux Model checking with multi-valued temporal logics In Intl Symposium on Multi-Valued Logics, pages , 2001 [4] A Corradini et al Algebraic approaches to graph transormation, part I In Handbook o Graph Grammars and Computing by Graph ransormation, volume 1 World Scientiic, 1997 [5] B Davey and H Priestley Introduction to Lattices and Order Cambridge University Press, second edition, 2002 [6] S Easterbrook and M Chechik A ramework or multivalued reasoning over inconsistent viewpoints In Intl Conerence on Sotware Engineering, pages , 2001 [7] S Easterbrook and B Nuseibeh Using viewpoints or inconsistency management Sotware Engineering Journal, 11:31 43, 1996 [8] A Finkelstein et al Inconsistency handling in multiperspective speciications IEEE rans on Sotware Engineering, 20: , 1994 [9] M Fitting Kleene s logic, generalized Journal o Logic and Computation, 1: , 1992 [10] J Goguen Categories o Fuzzy Sets: Applications o Non- Cantorian Set heory PhD thesis, University o Caliornia, Berkeley, 1968 [11] J Goguen Concept representation in natural and artiicial languages Intl Journal o Man-Machine Studies, 6: , 1974 [12] J Goguen A categorical maniesto Mathematical Structures in Computer Science, 1:49 67, 1991 [13] J Goguen and R Burstall Some undamental algebraic tools or the semantics o computation, part I heoretical Computer Science, 31: , 1984 [14] R Heckel Open Graph ransormation Systems PhD thesis, echnical University o Berlin, 1998 [15] R Heckel et al A view-based approach to system modeling based on open graph transormation systems In Handbook o Graph Grammars and Computing by Graph ransormation, volume 2 World Scientiic, 1999 [16] D Rydeheard and R Burstall Computational Category heory Prentice Hall, 1988 [17] M Sabetzadeh A category-theoretic approach to representation and analysis o inconsistency in graph-based viewpoints Master s thesis, University o oronto, 2003 [18] D Smith Constructing speciication morphisms Journal o Symbolic Computation, 16: , 1993 [19] A arlecki Bits and pieces o the theory o institutions In Summer Workshop on Category heory and Computer Programming, pages Springer,