When Concurrent Control Meets Functional Requirements, or Z + Petri-Nets

It is our belief that the formal design of real-world concurrent systems does not fit well with model/state-oriented specification languages such as the Z notation. The problem with such systems is that they not only expose complex functional requirements but also critical control-level aspects such as concurrency. On the other hand, the most widely-spread formal languages dealing with concurrency, namely Petri-nets, reveal weaknesses (mostly state-space explosion) when dealing with complex functional requirements. In this paper, we propose a hybrid methodology, based on the traditional Z notation for the functional part of the system and using Petri-nets to model its concurrent control. We describe a simple method to derive new proof obligations in case of possible concurrent activation of Z operations, as modeled by the associated Petri-nets. By keeping the interface between both worlds as thin as possible, we do not put into question the interesting properties of the Z language: expressiveness, modularity and support for refinement. Moreover, our petri-based concurrent activation networks only address concurrency issues. Hence, it is likely that they remain manageable in term of state-space and so analyzable using existing Petri-net tools. We experimented this exploratory method on a real application, a research middleware kernel, which is now fully operational.