Formal Verification of Workflow Patterns with SPIN

More documents

Recommendations

Info

3 WORKFLOW PATTERNS TRANSLATION 12activity (or sub-process) where the process instance is at a given state. The activityis enabled only if the process instance is at a specic state (the milestone);otherwise, the activity can not be enabled.We denote by idqx the index of the channel in the array qs that activatesthe activity whose execution is conditional to the state of the process instance.Each channel in the array qs corresponds to alternative paths of control owthat can exist. The information if the process is at a milestone is given by theparameter x: if x=1 it is; if x=0, it is not.inline milestone(qs,sizeq,choice,msg,idxq,x){if:: x>=1 -> exclusiveChoice(qs,sizeq,choice,msg);:: x==0 -> if::(choice>=0 && choiceidxq)) ->qs[choice]!msg;::(choice==idxq) -> skip;fi;fi;}The process representing the activity whose thread of control could activatethe activity whose execution is conditional to a milestone should use thisdenition.3.6 Cancellation PatternsWith respect to the Cancellation Patterns, we will present the translation of theCancel Activity and Cancel Case patterns. To translate these it is necessarythat each Promela process that may be canceled have a specic channel for thispurpose. Thus, if the process receives a message from that channel, it shouldterminate. We will denote a single cancel channel as qCancel and an array ofcanceling channels as qsCancel.Cancel Activity - The Cancel Activity pattern provides a mean of withdraw anenabled activity before starting to execute. However, if the activity has alreadystarted, it is disabled and, where possible, the currently running instance ishalted. To translate this pattern it is necessary that the Promela processwhich represents the activity to be canceled includes an escape sequence asfollows.unless { len(qCancel)>0; skip; }Cancel Case - This pattern describes the situation where is necessary to removea complete process instance. This includes executing activities, thosewhich may execute at some time and all sub-processes. More generally, thismay be used to cancel individual activities, regions or the whole workow instance.The Promela model needs to have a global array piIds representingthe relations between the processes, e.g., the parent of the process with identi-cation number x is the process with identication number piIds[x]. In thefollowing inline denition, id is the identication number of the process wherethis inline denition is being included.
4 CASE STUDIES 13inline cancelCase(qsCancel,sizeq,piIds,msgs,id){int i;i=0;do :: i qsCancel[i]!msgs[i];i++;:: i==sizeq ->break;:: else -> i++;od;}To implement this pattern, the process and all its activities and sub-processesmust include an escape sequence as follows.unless{ len(qsCancel[id])>0;cancelCase(qsCancel,sizeq,piIds,msgs,id) }Each process that receives a message from its canceling channel qsCancel[id],sends a canceling message, before terminate, to each one of its sub-processes oractivities in order to cancel them.4 Case StudiesIn order to ensure the reliability of business process, formal verication methodsare needed. This section shows how the above translation of workowpatterns can be useful for the formal verication of business process models.Two standard examples of business processes are the Loan Approval and theTravel Agency. In this section it will be illustrated how to apply the translationdescribed above to both business process examples and, subsequently, propertiesof these processes will be checked. It will be also illustrated how these businessprocesses can be modeled in Business Process Modeling Notation (BPMN) [4].4.1 Loan RequestThis case study consists of a simple loan approval where customers can submittheir requests for loans. A description of this process can also be found in [5].The loan process starts with the activity Loan Request. This activity isinitiated with a request made by a costumer for a loan. The costumer must llan application specifying personal information and the amount being requested.The activity Validate Application will check the request made in the previousactivity and will send the result to the next activity, Application Ok. Inthe activity Application Ok it may occur one of the three possible situations:the application is correct and is necessary to send that information to the nextactivity, Approve; the application must be checked again and it is necessaryto send a message to the activity Validate Application in order to revalidatethe application; the application is not correct and is necessary to send that informationto the next activity, Send Rejection. In the activity Approve thereceived information is processed and sent to the activity Approved?. Finally,in the activity Approved? there are three possible decisions: the loan requestcan be approved and thus it sends a message to notice the Send Approvalactivity; the loan request cannot be approved yet, but it is possible to approve
Page 3 and 4: 3 WORKFLOW PATTERNS TRANSLATION 3us
Page 5 and 6: 3 WORKFLOW PATTERNS TRANSLATION 5is
Page 7 and 8: 3 WORKFLOW PATTERNS TRANSLATION 7}:
Page 9 and 10: 3 WORKFLOW PATTERNS TRANSLATION 9}:
Page 11: 3 WORKFLOW PATTERNS TRANSLATION 11d
Page 15 and 16: 4 CASE STUDIES 15qs1[0]=qs[8]; /* T
Page 17 and 18: 4 CASE STUDIES 17Figure 2: Message
Page 19 and 20: 4 CASE STUDIES 19Book - This Promel
Page 21 and 22: 5 RELATED WORK 21Properties Vericat
Page 23: REFERENCES 23[12] Stefansen, C.: SM

Formal Verification of Workflow Patterns with SPIN

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?