Marc Voorhoeve

Soundness of workflow nets: classification, decidability, and analysis

Workflow nets, a particular class of Petri nets, have become one of the standard ways to model and analyze workflows. Typically, they are used as an abstraction of the workflow that is used to check the so-called soundness property. This property guarantees the absence of livelocks, deadlocks, and other anomalies that can be detected without domain knowledge. Several authors have proposed alternative notions of soundness and have suggested to use more expressive languages, e.g., models with cancellations or priorities. This paper provides an overview of the different notions of soundness and investigates these in the presence of different extensions of workflow nets. We will show that the eight soundness notions described in the literature are decidable for workflow nets. However, most extensions will make all of these notions undecidable. These new results show the theoretical limits of workflow verification. Moreover, we discuss some of the analysis approaches described in the literature.

Nested nets for adaptive systems

We consider nested nets, i.e. Petri nets in which tokens can be Petri nets themselves. We study the value semantics of nested nets rather than the reference semantics, and apply nested nets to model adaptive workflow, i.e. flexible workflow that can be modified during the execution. A typical domain with a great need for this kind of workflow is health care, from which domain we choose the running example. To achieve the desired flexibility we allow transitions that create new nets out of the existing ones. Therefore, nets with completely new structure can be created at the run time. We show that by careful selection of basic operations on the nets we can obtain a powerful modeling formalism that enforces correctness of models. Moreover, the formalism can be implemented based on existing workflow engines.

Model-driven design-space exploration for embedded systems: the octopus toolset

The complexity of todays embedded systems and their development trajectories requires a systematic, model-driven design approach, supported by tooling wherever possible. Only then, development trajectories become manageable, with high-quality, cost-effective results. This paper introduces the Octopus Design-Space Exploration (DSE) toolset that aims to leverage existing modeling, analysis, and DSE tools to support model-driven DSE for embedded systems. The current toolset integrates Uppaal and CPN Tools, and is centered around the DSE Intermediate Representation (DSEIR) that is specifically designed to support DSE. The toolset architecture allows: (i) easy reuse of models between different tools, while providing model consistency, and the combined use of these tools in DSE; (ii) domain-specific abstractions to support different application domains and easy reuse of tools across domains.

Soundness of resource-constrained workflow nets

We study concurrent processes modelled as workflow Petri nets extended with resource constraints. We define a behavioural correctness criterion called soundness: given a sufficient initial number of resources, all cases in the net are guaranteed to terminate successfully, no matter which schedule is used. We give a necessary and sufficient condition for soundness and an algorithm that checks it.

Consistency in model integration

State-of-the-art systems engineering uses many models reflecting various aspects of the modeled system. A major task of system engineers is to ensure consistency between the many models. We present an approach to the engineering of complex systems based on the modeling of use cases and object life cycles as Petri nets. Synchronization by place fusion allows the derivation of an integrated model that can be verified and validated. We illustrate our approach by a case study.

Relating fair testing and accordance for service replaceability

Abstract The accordance pre-order describes whether a service can safely be replaced by another service. That is, all partners for the original service should be partners for the new service. Partners for a service interact with the service in such a way that always a certain common goal can be reached. We relate the accordance pre-order to the pre-orders known from the linear–branching time spectrum, notably fair testing. The differences between accordance and fair testing include the modeling of termination and success, and the parts of the services that cannot be used reliably by any partner. Apart from the theoretical results, we address the practical relevance of the introduced concepts.

Proof Techniques for Adapter Generation

We study the composition and substitution of services from a theoretical perspective. An important notion is the operating guideline of a service y , which is defined as the set of services x such that the result of connecting x and y has a certain desired property. We define several related notions and derive results for them in a general context, thus abstracting from the underlying formalism, be it process algebra, Petri nets or something else. We then focus on the open Petri-net (and oWFN) formalism, and address the automated generation of adapters.

Z and High Level Petri Nets

High level Petri nets have tokens with values, traditionally called colors, and transitions that produce tokens in a functional way, using the consumed tokens as arguments of the function application. Large nets should be designed in a topdown approach and therefore we introduce a hierarchical net model which combines a data flow diagram technique with a high level Petri net model. We use Z to specify this net model, which is in fact the metamodel for specific systems. Specific models we specify partly by diagrams and partly in Z. We give some advantages and disadvantages of using Z in this way. Finally we show how to specify systems by means of an example.

Compositional Modeling and Verification of Workflow Processes

Workflow processes are represented as Petri nets with special entry and exit places and labeled transitions. The transition labels represent actions. We give a semantics for such nets in terms of transition systems. This allows us to describe and verify properties like termination: the guaranteed option to terminate successfully. We describe the composition of complex WF nets from simpler ones by means of certain operators. The simple operators preserve termination, giving correctness by design. Only the advanced communication operators are potentially dangerous. A strategy for verification of other properties is described.

Formal Modeling and Scheduling of Datapaths of Digital Document Printers

We apply three different modeling frameworks -- timed automata ( Uppaal ), colored Petri nets and synchronous data flow -- to model a challenging industrial case study that involves an existing state-of-the-art image processing pipeline. Each of the resulting models is used to derive schedules for multiple concurrent jobs in the presence of limited resources (processing units, memory, USB bandwidth,..). The three models and corresponding analysis results are compared.