Formal Verification of Workflow Patterns with SPIN

5 RELATED WORK 21Properties VericationIt is possible to check if the Travel Agency business process model satisescertain properties using the SPIN model checker. It will be checked one propertythat this model should verify. We will express it with the help of one globalint variable s, which has the value 0 when the process begins, the value 1before process ChargeBuyer nishes and the value 2 before process SendFailurenishes.The property is that whenever we invocate this business process, the processeither charge the buyer or send him a failure notice to tell him that the bookingwas not possible. By making the following denitions #define p (s==0),#define q (s==1) and #define r (s==2), it is possible to formally expressthis property in LTL as [] (p -> (q || r)). This property was automaticallyveried with the SPIN model checker.5 Related WorkCurrently research has been done into the application of SPIN to workowspecication and verication. In [6] is proposed a method to check correctnessproperties of workows implemented in BPEL. Dataow networks are used todene the formal semantics of the workow. The BPEL model is mapped intodataow network and the dataow network is mapped into a Promela model.A method of verifying Web Services Flow Language (WSFL) [7] description byusing SPIN is introduced in [8]. In particular, it presents an encoding methodthat translates WSFL primitives to Promela. These approaches are both focusedon the translation of a workow language to Promela, while this work isfocused on the translation of workow patterns to Promela, which are languageand technology independent, in order to formally verify workow systems.An approach of giving a representation of the workow patterns has beendeveloped with π-calculus [9], although it is not oriented towards automatedverication. A benet of using SPIN is in terms of visualizing counterexamplesfor negative results. Also, as the verication in π-calculus is done by checkingbisimulation equivalence, some times results are not obtained in reasonableamount of time, even for the proofs of very simple correctness requirements [10].There is also being used a subset of π-calculus to model workow patterns, Calculusof Communicating Systems (CCS) [11], but does not conform to standardCCS, and does not have a verication tool. [12].In [13] is given a representation of these patterns in Communicating SequentialProcesses (CSP) [14]. Comparing CSP and Promela, Promela is richerand strictly more expressive (e.g. asynchronous communication is supportedand channels are rst class objects in Promela but not in CSP). Furthermore,Promela's C-like syntax makes it more accessible to non-experts [15].Yet Another Workow Language (YAWL) [16] was also used to representworkow patterns. However, we believe that since SPIN is a model checker andPromela has a similar syntax to C it has an advantage over YAWL.