Formal Verification of Workflow Patterns with SPIN

3 WORKFLOW PATTERNS TRANSLATION 7}::n==sizeq -> n=0; break;od;skip;L: if::((len(activeqs[n])>0) && count1activeqs[n]?aux[n];count1++;if::aux[n]==1 -> total++::aux[n]==0 ->skipfi;::(count1==sizeq) -> n=0; goto Sfi;n++;if::(n==sizeq) -> n=0; timeout; goto L::(n goto Lfi;S: if::((aux[n]==1) && (len(qs[n]) > 0) && count2aux[n]=2; qs[n]?msgs[n]; count2++:: (count2 >= total) -> goto Efi;n++;if::(n==sizeq)-> n=0::(n skipfi;goto S;E: skip;With respect to the above denition, for each alterative path resulted from aprevious multi-choice, a message will be sent through its channel in the array qs(e.g qs[n]) and thus, a token is also sent through the corresponding channel inthe array activesq (e.g activesq[n]). These tokens will provide informationabout which channels have been activated. In addiction, it is also needed in thistranslation an auxiliary array, aux, to distinguish between the active channelsin the array qs through which it was already received a message, from the activechannels in the array qs which is still necessary to wait for. The process thatrepresents the activity which makes the merging must use the above denition,and the processes that represent the activities whose control ow will be mergedmust use the send denition.Multi-Merge - The Multi-Merge pattern represents the convergence of multiplepaths in a process into a single path. In this pattern there is no synchronizationand each thread of control which is currently active in any of the precedingpaths will instanciate de subsequent activity. This pattern is translated to thefollowing inline denition.inline multiMerge(qs,activeqs,sizeq,msgs,id){int n, aux;