Cross-Organization Emergency Response Process Mining: An Approach Based on Petri Nets

To support effective emergency disposal, organizations need to collaborate with each other to complete the emergency mission that cannot be handled by a single organization. In general, emergency disposal that involves multiple organizations is typically organized as a group of interactive processes, known as cross-organization emergency response processes (CERPs). ,e construction of CERPs is a time-consuming and error-prone task that requires practitioners to have extensive experience and business background. Process mining aims to construct process models by analyzing event logs. However, existing process mining techniques cannot be applied directly to discover CERPs since we have to consider the complexity of various collaborations among different organizations, e.g., message exchange and resource sharing patterns. To tackle this challenge, a CERP model mining method is proposed in this paper. More specifically, we first extend classical Petri nets with resource and message attributes, known as resource and message aware Petri nets (RMPNs). ,en, intra-organization emergency response process (IERP) models that are represented as RMPNs are discovered from emergency drilling event logs. Next, collaboration patterns among emergency organizations are formally defined and discovered. Finally, CERPmodels are obtained by merging IERPmodels and collaboration patterns.,rough comparative experimental evaluation using the fire emergency drilling event log, we illustrate that the proposed approach facilitates the discovery of high-quality CERP models than existing state-of-the-art approaches.


Introduction
Since the 9/11 terrorist attack, there have been considerable efforts to improve the effectiveness and efficiency to respond to emergencies. Generally speaking, an emergency is a situation that imposes immediate risk to life, property, and environment, which requires urgent disposal and intervention to prevent its worsening [1]. To support effective emergency disposal, organizations need to collaborate with each other to complete the emergency mission that cannot be handled by one single organization. In general, emergency disposal that involves multiple organizations are typically organized as a group of loosely-coupled interactive processes, known as crossorganization emergency response processes (CERPs) [2]. e construction of CERPs can improve the efficiency and effectiveness of emergency decision-making. However, the design of CERPs is typically a time-consuming and error-prone task that requires modelers to have extensive experience and business background.
During the execution of emergency responses, event logs are recorded and stored by emergency management systems [3]. Process mining aims to construct process models by analyzing event logs collected from various information systems [4,5]. However, existing process mining techniques cannot be applied to discover CERPs since we have to consider the complexity of various collaborations among different organizations, e.g., message exchange and resource sharing patterns. erefore, an automated method to mine CERP models from emergency drilling event logs is urgently needed to improve the efficient model construction.
To this end, we present a CERP model mining method that takes as input an emergency drilling event log. e contributions of this paper are summarized as follows: (1) Petri nets are extended with resource and message attributes, denoted as RMPNs, to model CERPs. (2) For each organization, a novel algorithm is proposed to discover the intraorganization emergency response process (IERP) model. (3) ree kinds of collaboration patterns, including message exchange pattern, resource sharing pattern, and task synchronization pattern, are formalized based on RMPNs. In addition, the corresponding discovery techniques are presented; and (4) CERP models are discovered by merging all involved IERP models and collaboration patterns. e remainder of the paper is organized as follows. Section 2 presents a review of the related work. Section 3 introduces some terminologies and notations used throughout the paper. A fire emergency response process case is introduced to be used as a case study in Section 4. Section 5 introduces the mining method for CERP models. Section 6 performs comparative evaluation. Finally, Section 7 concludes the paper.

Related Work
In this paper, we summarize work related to cross-organization business process modeling, process mining and crossorganization process mining, and emergency response process modeling and mining.

Cross-Organization Business Process Modeling. Van Der
Aalst extended traditional workflow nets to a cross-organization scenario to model cross-organizational workflows and verify the correctness from a structure perspective in [6]. In [7], Mo et al. proposed a cross-organization business process modeling approach that applies finite state machine and asynchronous communication model. In [8], existing cross-organizational modeling methods are classified from the interorganizational angle and qualitative and quantitative analysis on the correctness and effectiveness are performed. Jiang et al. [9] described a timed colored Petri net and process-view combined approach to construct cross-organization business processes and a threelayered framework is proposed to support the interoperability.
In our previous work, we introduced four kinds of collaboration patterns, including message interaction, resource interaction, task collaboration, and service outsourcing patterns, based on which a cross-organization collaborative medical business process is modeled and its correctness is verified via reachability analysis of Petri nets in [10]. More recently, we investigated the modeling and correctness verification of cross-organizational business processes that interact through task synchronization patterns in [11].

Process Mining and Cross-Organization Process Mining.
Process mining can extract useful information from event logs commonly generated by information systems. is technology provides new means for process discovery, monitoring, and improvement in various applications [12]. As an often cited example, the a-Algorithm [4] first defines four kinds of ordering relations. en, a workflow net is derived from these task dependency relations. To further its application for less-structured event log and overcome the spaghetti-like models which contain all details without any hierarchies, Christian and Wil proposed the fuzzy mining approach in [13]. Leemans et al. proposed the inductive miner to handle infrequence and incomplete event logs, and the discovered Petri net-based process model is guaranteed to be correct in [14].
In [5], four coordination patterns among different organizations are first defined and process mining approaches are used to discover the process model of each organization and corresponding coordination patterns based on which the whole cross-organization process is obtained by integration. In our recent work, the privacy problem of crossorganizational business process mining is investigated and a privacy-preservation mining method is proposed to construct the organization-specific cross-organization collaborative process model in [15]. In [16], a top-down process mining approach is proposed to construct the cross-organization model in service out-sourcing scenario from heterogeneous logs collected from distributed environment. Petri net refinement technique is used to merge the main process and the out-sourced ones.

Emergency Response Process Modeling and Mining.
In [1,17], we investigated the modeling and analysis methods for an emergency response process constrained by resources and uncertain durations. e number of available resources and minimum resource demand for an emergency response process is analyzed. Moreover, resource conflict detection and resolution strategies are also investigated to optimize the universal process performance. Li et al. proposed Petri netbased modeling techniques for subway station fire emergency response processes in [15]. A hierarchical Petri net that includes a logic net, a semantic net, and a set of case models is introduced for modeling and verification of emergency response processes in [18]. e applicability of this approach is validated by an emergency treatment process of highways under snow/ice weather conditions. More recently, we proposed a top-down approach for model construction and correctness verification of cross-organization emergency response processes in [19]. To support efficient emergency resource management, Zeng et al. [20] proposed an approach to support emergency resource management including both intra-organization private resource management and cross-organization public resource management.
In the emergency response process mining area, He et al. applied process mining techniques to uncover emergency rescue process of coal mine gas explosion accidents from the historical event logs in [3]. However, this approach focuses on single emergency response process and does not consider interactions and collaborations among different emergency organizations, and the resource attributes and message attributes are not considered.

Terminologies
Given a set S, where |S| denotes the number of elements in S.
x ∈ S denotes that x is an element of S. We use ∅ to denote the empty set. f: X ⟶ Y is a function, i.e., dom(f) � X is the domain and rng(f) � f(x)|x ∈ dom(f) ⊆Y is the range. If σ(1) � a 1 and σ(2) � a 2 , . . . σ(n) � a n , we write σ � 〈a 1 , a 2 , . . . , a n 〉. |σ| � n represents the length of sequence σ is n(n is a natural number). e set of all finite sequences over S is denoted as S * .
where P is a finite set of places and T is a finite set of transitions; A Petri net that describes a process is called workflow net (or WF-net). Its definition is reviewed below [25].
Because a process is created once it enters the workflow engine and destroyed when completed, we use a source place and a sink place to explicitly denote the initial and final states. Transitions are used to represent tasks in a process.

A Fire Emergency Response Process Case
When a fire emergency occurs, its disposal usually involves multiple emergency organizations. A typical fire emergency response process usually involves the following organizations: police station, emergency command center (ECC), explosive ordnance disposal (EOD) team, fire brigade, and hospital. Figure 1 shows the overall cross-organization fire emergency response process and an overview of the main emergency tasks for each organization.
is emergency response scenario includes the following steps. (1) e police station first receives a fire alarm and then reports the information to ECC. (2) e police rushes to the fire site and performs its detailed disposal missions and then reports the site conditions to ECC. (3) After receiving the fire information, ECC first establishes the temporary emergency command group and then makes and issues emergency plans to its subordinate organizations, i.e., medical rescue instruction to the hospital, search EOD instruction to the EOD team, and fire rescue instruction to the fire brigade. (4) e EOD team rushes to the site once it receives the search EOD instruction from ECC, conducts its specific disposal tasks according to the emergency plan, and finally reports the EOD search results. (5) e fire brigade rushes to the site once it receives the fire rescue instruction from ECC, conducts its specific disposal tasks according to the emergency plan, and finally reports the fire rescue results. (6) e hospital personnel rushes to the site once it receives the medical rescue instruction from ECC, conducts its specific disposal tasks according to the plan, and finally reports the results. (7) After receiving all the feedback information from the hospital, EOD team, and fire brigade, ECC makes a summary and finally does the file archive. (8) ECC arranges the media coverage for this emergency response; and (9) Finally, ECC, hospital, and the fire brigade do the media coverage together.
During the execution of the fire emergency response processes, emergency drilling event logs are recorded and stored by the emergency management systems. In general, the collected fire emergency drilling event log, denoted as firelog 1 , contains 126 cases, 3528 events, and 28 emergency tasks in total. is log will be used in the next sections to explain our concepts and techniques, and every event in the emergency drilling event logs have the resource attributes, message attributes, and timestamp.

Cross-Organization Emergency Response Process Mining
is section details the cross-organization emergency response process (CERP) model mining from emergency drilling event logs.

Emergency Drilling Event Logs.
e event logs captured during the execution of emergency response processes are essentially a collection of events such that each event refers to an emergency task and includes a group of attributes, such as timestamp, resources, and sent and received messages. Formal definition of events and attributes are given below.
Definition 3 (events and attributes). Let ξ be the event universe, i.e., the set of all possible event identifiers and N be the attribute universes, i.e., the set of all possible event attributes. For any event e ∈ ξ and n ∈ N, # n (e) represents the value of attribute n for e.
For an arbitrary event e ∈ ξ, the following attributes are involved in the emergency drilling event logs: (i) # case (e) represents the case to which e belongs to, and each event belongs to only one independent case (ii) # act (e) represents the task name of e (iii) # mR (e) represents the messages received by e (iv) # mS (e) represents the messages sent by e (v) # rR (e) represents the resource set of e (vi) # org (e) represents the organization name of e (vii) # time (e) represents the timestamp of e Definition 4 (case, event log). A case over some event universe ξ is a finite sequence of events σ ∈ ξ * such that each Mathematical Problems in Engineering event appears only once and all events have the same case id, i.e., 1 ≤ i < j ≤ |σ|: σ(i) ≠ σ(j)∧# case (σ(i)) � # case (σ(j)). An event log is defined as a finite set of cases, i.e., L⊆ξ * . Table 1 depicts a fragment of the fire emergency drilling event log firelog. It contains one case that records all events generated during one run of the process. In total, 30 events are included and they are fully ordered by the timestamp. For example, we have the following observation for e 2 : (1) # case (e 2 ) � 1 means that the event belongs to case with ID 1; (2) # act (e 2 ) � t 2 means that the task name of this event is t 2 ; (3) # mR (e 2 ) � ∅ { } means that no message is sent after the event finished; (4) # mS (e 2 ) � p m1 means that this event needs to receive message p m1 before execution; (5) # rR (e 2 ) � ∅ { } means that the event does not use resources; and (6) # time (e 2 ) � 14: 21 Jan 02 2014 is the time that this event ends.

Intra-Organization Emergency Response Process Model
Mining. Different from traditional business processes, CERPs are more complex and typically involve various elements, e.g., messages and resources. erefore, we first extend classical Petri nets with message and resource attributes as follows.
and P L ⊆P represent the logic place set, P M ⊆P represents the message place set, and P R ⊆P represents resource place set; (2) F � F L ∪ F R ∪ F M , where F L represents the control-flow, F R represents the resource flow, and F M represents the message flow; and (3) ∀p ∈ P if p ∈ P R ∪ i { }, i ∈ P L ∧ • i � ∅, and M 0 (p) � 1, and otherwise M 0 (p) � 0.
RMPNs are used to represent CERPs, and the mining methods are all based on this model. We first introduce how to mine IERP models. To this end, we need to obtain the emergency drilling event logs of each organization by projecting the whole event log based on the organization attribute. Taking event log in Table 1, the emergency drilling event log of the police station includes e 1 , e 2 , e 3 , e 4 , e 5 , e 6 , e 7 , and e 8 . en, the following algorithm is presented to discover the IERP model represented by an RMPN by taking as input the event log of single organization.
Algorithm 1 extends the existing inductive miner [14] that mines the control-flow model with message sending and receiving information as well as resource accessing information and finally returns an RMPN. Considering the police station as an example, task t 2 sends message p m1 and task t 7 sends message p m2 when finished. By taking as input the firelog, the obtained RMPN for each organization is shown in Table 2.

Cross-Organization Collaboration Pattern Mining.
After obtaining the RMPN for each emergency organization, we introduce how to discover collaboration patterns. To this end, three kinds of patterns, including message exchange pattern, resource sharing pattern, and task synchronization pattern, are formalized as follows.

Cross-Organization Emergency Response Process Model
Mining. After mining IERP models and collaboration patterns among different emergency organizations, the whole CERP model comes into reach. In general, the CERP model is obtained by merging all IERP models and the collaboration patterns based on Petri net composition technique. Detailed steps are shown in Algorithm 3.
By taking as input the IERP models in Table 2 and the collaboration patterns in Table 3, the CERP model of the cross-organization fire emergency response process model is obtained and shown in Figure 2.
Note that the model discovered by our approach is correct, and therefore, it can be used for further conformance checking, e.g., fitness and precision measure. However, the approach does not guarantee that all discovered models by our approach are correct. Actually, we are working on extending existing correctness verification and correction techniques, such as [26,27], to be applicable for the discovered cross-organization process models by our approach.

Comparative Evaluation
In this section, we compare the quality of existing process mining approaches with our approach to discover the CERP model using the firelog. A laptop with a 2.40 GHz CPU, Windows 8.1, and Java SE 1.7.0 67 (64 bit) with 16 GB of allocated RAM is used.

Setup.
e following three mining approaches are compared.
(i) By taking as input the whole firelog, the inductive miner that is known as the state-of-the-art process discovery technique is directly used. is approach is denoted as A1. (ii) By taking as input the whole firelog, we first project the whole log to each emergency organization based on the organization attribute in the firelog. en, the inductive miner is used to discover a submodel for each organization. Finally, all discovered submodels are merged in a parallel manner. is approach is denoted as A2. In addition, the model discovered by approach A2 is essentially a workflow net-like structure with dedicate source and sink places and transitions. (iii) Our proposed CERP model discovery approach is applied on the firelog. is approach is denoted as A3.
To quantify the effectiveness of different approaches, the well-defined metrics, e.g., fitness and precision, are applied to measure the quality of the discovered CERP models with respect to input firelog.
Fitness quantifies the extent to which the discovered model can accurately reproduce the traces recorded in the event log. Low fitness indicates that the event log allows for much more behaviour that is not allowed by the model. e paper applies the fitness defined in [28]. Precision quantifies the fraction of the behavior allowed by the model which is not seen in the event log. Low precision means that the model allows for much more behaviour compared to the event log. e paper applies the precision defined in [29].
Note that there is a trade off between fitness and precision [30]. erefore, we introduce the F-measure. e F-measure is defined as the harmonic mean of the fitness and precision metrics as shown in the following equation: 6.2. Experimental Results. By taking as input the firelog, A1 is first applied. is approach does not consider the organization information and collaboration patterns and only discovers the control flow of all emergency tasks directly by the inductive miner. e discovered CERP model represented as a classical Petri net is shown in Figure 3. en, by taking as input the firelog and discovered model, the fitness, precision, and F-measure values are obtained and depicted in Table 4.
en, the inductive miner is used to discover a submodel for each organization. Finally, all discovered submodels are merged in a parallel manner. e discovered CERP model is shown in Figure 4 where two transitions colored as black form the parallel relation among all organizations. By taking as input the firelog and discovered model, the fitness, precision, and F-measure values are obtained and depicted in Table 4. Note that the organization information is supported by A2, but the collaboration patterns are not discovered.
Finally, by taking as input the firelog, our proposed approach, denoted as A3, is applied.
is approach first projects the whole log to each emergency organization based on the organization attribute. is step is same to A2. en, Algorithm 1 is applied to perform IERP mining where an RMPN is used to represent the discovered IERP model. Next, collaboration patterns are discovered using INPUT: Ξ � Σ x |Σ x is the RMP Noforganization x , Ψ � Σ x,y |Σ x,y is the collaboration model between organizations x and y} OUTPUT: CERP model Σ � (P, T, F, M 0 ) (1) P ⟵ ∅, P L ⟵ ∅, P R ⟵ ∅, P M ⟵ ∅, F ⟵ ∅, F L ⟵ ∅, F R ⟵ ∅, F M ⟵ ∅, T ⟵ ∅, M 0 ⟵ ∅, P s ⟵ ∅; //initialize the integration model (2) For each Σ x ∈ Ξ //merging RMPN model (3) P M ⟵ P M ∪ P Mx ; (4) P R ⟵ P R ∪ P Rx ; (5) P L ⟵ P L ∪ P Lx ; (6) For each p ∈ P Lx (7) If • p �� ∅ (8) P s ⟵ P s ∪ p; (9) End if (10) End for (11)  patterns that indicate cross-organization task dependencies; and (3) the F-measure of the CERP model discovered by A3 is the highest, which indicates that the quality of the CERP model discovered by A3 is better than that discovered by A1 and A2.
As a conclusion, our proposed approach (A3) can discover more precise cross-organization emergency response process models compared with existing approaches.

Conclusion
is paper proposes a cross-organization emergency response process model mining method to support effective emergency disposal process construction. More specifically, we first extend classical Petri nets with resource and message attributes, known as RMPN. en, IERP models are discovered as RMPNs. Next, collaboration patterns among emergency organizations are formally defined and discovered. Finally, CERP models are obtained by merging IERP models and the collaboration patterns. rough the comparative evaluation using the fire emergency drilling event log, we illustrate that the proposed approach facilitates the discovery of the high-quality CERP model than existing approaches.
is paper also opens the door for the following research area that needs to be investigated in our future work. (1) More complex collaboration patterns, e.g., business outsourcing, need to be explored for more accurate process discovery. (2) Evaluation techniques to quantify the quality of the mined CERP model against the input emergency drilling event logs are urgently required to consider not only control-flow conformance but also message and resource conformance. (3) Considering the volume of emergency response process event logs, log sampling techniques, e.g., [31,32], maybe useful for efficient mining.

Data Availability
e data used to support the findings of this study are included within the article.

Conflicts of Interest
e authors declare that they have no conflicts of interest.