Verification of Workflow Nets

Transcription

1 Verfcatn f Wrkflw Nets W.M.P. van der Aalst Endhven Unversty f Technlgy, P.O. Bx 513, NL-5600 MB, Endhven, The Netherlands. wsnwa@wn.tue.nl Abstract. Wrkflw management systems wll change the archtecture f future nfrmatn systems dramatcally. The explct representatn f busness prcedures s ne f the man ssues when ntrducng a wrkflw management system. In ths paper we fcus n a class f Petr nets sutable fr the representatn, valdatn and verfcatn f these prcedures. We wll shw that the crrectness f a prcedure represented by such a Petr net can be verfed by usng standard Petr-net-based technques. Based n ths result we prvde a cmprehensve set f transfrmatn rules whch can be used t cnstruct and mdfy crrect prcedures. 1 Intrductn At the mment mre than 250 Wrkflw Management Systems (WFMSs) are avalable. Ths number sgnfes the mprtance f the wrkflw paradgm ([3,4,6,13,18,23]). Unfrtunately, tday s WFMSs suffer frm a number f serus drawbacks. A theretcal bass fr wrkflw management tls s mssng. As a result there are, even at a cnceptual level, mprtant dfferences between the tls. Despte the effrts f the Wrkflw Management Caltn [26] there are n real standards. Mrever, the absence f tls t supprt the analyss f wrkflws s a serus drawback fr the success f tday s WFMSs. In ths paper we present a Petr-net-based apprach t vercme sme f these prblems. In partcular we wll address the prblem f analyzng the crrectness f wrkflw prcedures. Busness prcesses supprted by a WFMS are centered arund prcedures. A prcedure s the methd f peratn used by a busness prcess t prcess cases. Examples f cases are rders, clams, travel expenses, tax declaratns, etc. The prcedure specfes the set f tasks requred t prcess these cases successfully. Mrever, the prcedure specfes the (partal) rder n whch these tasks have t be executed. The gal f a prcedure s t handle cases effcently and prperly. T acheve ths gal, the prcedure shuld be tuned t the ever changng envrnment f the busness prcess. A WFMS supprts the defntn and mdfcatn f prcedures. Unfrtunately, mst f the WFMSs allw fr the specfcatn f ncrrect prcedures. We have evaluated many WFMSs. Nne f these WFMSs allw fr the verfcatn f essental prpertes such as the absence f deadlck and lvelck. In ths paper we fcus n the use f Petr nets ([20 22]) as a tl fr the representatn, valdatn and verfcatn f wrkflw prcedures. It s nt dffcult t map a prcedure nt a Petr net. As t turns ut, we can even restrct urselves t a subclass f Petr nets. Representatves f ths class are called WrkFlw nets (WF-nets). A WF-net s a Petr net wth tw specal places: and. These places are used t mark the begn and the

2 end f a prcedure, see Fgure 1. The tasks are mdeled by transtns and the partal rderng f tasks s mdeled by places cnnectng these transtns. WF-net Fg. 1. A prcedure mdeled by a WF-net. The prcessng f a case starts the mment we put a tken n place and termnates the mment a tken appears n place. One f the man prpertes a prper prcedure shuld satsfy s the fllwng: Fr any case, the prcedure wll termnate eventually, and at the mment the prcedure termnates there s a tken n place and all the ther places are empty. Ths prperty s called the sundness prperty. In ths paper we present a technque t verfy ths prperty usng standard Petr-net tls. If we restrct urselves t freechce Petr nets (cf. Best [8], Desel and Esparza [12]), ths prperty can be verfed n plynmal tme. WF-nets have sme nterestng prpertes. Fr example, t turns ut that a WF-net s sund f and nly f a slghtly mdfed versn f ths net s lve and bunded! We wll use ths prperty t shw that there s a cmprehensve set f transfrmatn rules whch preserve sundness. These transfrmatn rules shw hw a sund prcedure can be transfrmed nt anther sund prcedure. The remander f ths paper s rganzed as fllws. In Sectn 2 we ntrduce sme f the basc ntatns fr Petr nets. Sectn 3 deals wth WF-nets. In ths sectn we als defne the sundness prperty. In Sectn 4 we present a technque t verfy the sundness prperty. A set f transfrmatn rules that preserve sundness s presented n Sectn 5. 2 Petr nets Hstrcally speakng, Petr nets rgnate frm the early wrk f Carl Adam Petr ([22]). Snce then the use and study f Petr nets has ncreased cnsderably. Fr a revew f the hstry f Petr nets and an extensve bblgraphy the reader s referred t Murata [20]. The classcal Petr net s a drected bpartte graph wth tw nde types called places and transtns. The ndes are cnnected va drected arcs. Cnnectns between tw

3 ndes f the same type are nt allwed. Places are represented by crcles and transtns by rectangles. Defntn 1 (Petr net). A Petr net s a trple (P, T, F): - P s a fnte set f places, - T s a fnte set f transtns (P T = ), - F (P T ) (T P) s a set f arcs (flw relatn) A place p s called an nput place f a transtn t ff there exsts a drected arc frm p t t. Place p s called an utput place f transtn t ff there exsts a drected arc frm t t p. We use t t dente the set f nput places fr a transtn t. The ntatns t, p and p have smlar meanngs, e.g. p s the set f transtns sharng p as an nput place. Nte that we restrct urselves t arcs wth weght 1. In the cntext f wrkflw prcedures t makes n sense t have ther weghts, because places crrespnd t cndtns. At any tme a place cntans zer r mre tkens, drawn as black dts. The state, ften referred t as markng, s the dstrbutn f tkens ver places,.e., M P IN. We wll represent a state as fllws: 1p 1 + 2p 2 + 1p 3 + 0p 4 s the state wth ne tken n place p 1, tw tkens n p 2, ne tken n p 3 and n tkens n p 4. We can als represent ths state as fllws: p 1 + 2p 2 + p 3. Fr any tw states M 1 and M 2, M 1 M 2 ff fr each p P: M 1 (p) M 2 (p). M 1 > M 2 ff M 1 M 2 and M 1 = M 2. The number f tkens may change durng the executn f the net. Transtns are the actve cmpnents n a Petr net: they change the state f the net accrdng t the fllwng frng rule: (1) A transtn t s sad t be enabled ff each nput place p f t cntans at least ne tken. (2) An enabled transtn may fre. If transtn t fres, then t cnsumes ne tken frm each nput place p f t and prduces ne tken fr each utput place p f t. Gven a Petr net (P, T, F) and an ntal state M 1, we have the fllwng ntatns: t - M 1 M 2 : transtn t s enabled n state M 1 and frng t n M 1 results n state M 2 t - M 1 M 2 : there s a transtn t such that M 1 M 2 σ - M 1 Mn : the frng sequence σ = t 1 t 2 t 3... t n 1 leads frm state M 1 t state M n,.e. M 1 t 1 M 2 t 2... t n 1 M n A state M n s called reachable frm M 1 (ntatn M 1 Mn ) ff there s a frng t 1 t 2 sequence σ = t 1 t 2... t n 1 such that M 1 M 2... t n 1 M n. We use (PN, M) t dente a Petr net PN wth an ntal state M. Let us defne sme prpertes fr Petr nets. Defntn 2 (Lve). A Petr net (PN, M) s lve ff, fr every reachable state M and every transtn t there s a state M reachable frm M whch enables t.

4 Defntn 3 (Bunded). A Petr net (PN, M) s bunded ff, fr every reachable state and every place p the number f tkens n p s bunded. Defntn 4 (Strngly cnnected). A Petr net s strngly cnnected ff, fr every par f ndes (.e. places and transtns) x and y, there s a drected path leadng frm x t y. In ths paper we use a restrcted class f Petr nets fr mdelng and analyzng wrkflw prcedures. As we wll see n Sectn 4.3, t ften suffces t cnsder Petr nets satsfyng the s-called free-chce prperty. Defntn 5 (Free-chce). A Petr net s a free-chce Petr net ff, fr every tw places p 1 and p 2 ether (p 1 p 2 ) = r p 1 = p 2. Free-chce Petr nets have been studed extensvely (cf. Best [8], Desel and Esparza [12,11,14], Hack [17]) because they seem t be a gd cmprmse between expressve pwer and analyzablty. It s a class f Petr nets fr whch strng theretcal results and effcent analyss technques exst. 3 WF-nets 3.1 What s a WFMS? A WFMS s a system that defnes, creates and manages the executn f wrkflws thrugh the use f sftware, runnng n ne r mre wrkflw engnes, whch s able t nterpret the prcess defntn, nteract wth wrkflw partcpants and, where requred, nvke the use f IT tls and applcatns (WFMC [26]). A WFMS can be seen as the peratng system f admnstratve rgansatns. The WFMS takes care f the ffce lgstcs. At the mment mre than 250 WFMSs are avalable. Examples are: COSA (Sftware-Ley), Staffware (Staffware), Flwmark (IBM), InCncert (XSft), Open Wrkflw (Wang), TeamWARE (TeamWARE), Vsual WrkFl (Flenet) and Wrkparty (Semens). These systems fcus n busness prcesses and are centered arund the defntn f a busness prcess, ften referred t as wrkflw. The bjectve f a wrkflw prcess s the prcessng f cases (e.g. clams, rders, travel expenses). T supprt the prcessng f these cases usng a WFMS we need t specfy tw aspects f the wrkflw ([5]): () Prcedure Fr each wrkflw prcess we have t specfy the prcedure that s used t handle a case. In essence the prcedure defnes a partally rdered set f tasks. Cases are ruted thrugh the prcedure usng AND-splts, OR-splts, AND-jns and ORjns. As a result t s pssble t specfy sequental, selectve and parallel rutng and teratn. In the prcedure there are n explct references t the resurces (persns) that wll execute the tasks. () Resurce classfcatn Besdes the prcedure we need t specfy wh s gng t d the wrk. Therefre, resurces (persns, departments, machnes, etc.) are classfed nt resurces

5 classes. A resurces class represents a rle (a grup f peple wth a specfc set f attrbutes, qualfcatns and/r sklls) r an rgansatnal unt (department, cmpany r team). Tasks are asscated wth resurce classes. Ths way t s pssble t lnk the resurce classfcatn t the prcedure. The wrkflw engne (.e. the wrkflw enactment servce) allcates resurces t tasks gven the cnstrants specfed n the prcedure and resurce classfcatn. resurces persns rles resurce classes rganzatnal unts resurce classfcatn wrkflw prcess specfcatn prcedure teratn parallel rutng task OR-splt selectn AND-jn sequental rutng AND-splt OR-jn Fg. 2. The tw dmensns f a wrkflw prcess specfcatn. Fgure 2 llustrates the fact that the specfcatn f a wrkflw prcess s cmpsed frm tw elements: a prcedure and a resurce classfcatn. Many WFMSs prvde tw wrkflw defntn tls: ne fr the specfcatn f prcedures and ne fr the specfcatn f resurce classes. In ths paper we abstract frm resurce classes and fcus n technques t supprt the cnstructn and analyss f prcedures. We als abstract frm case data. In a WFMS t s pssble t use case attrbutes when rutng a case. We abstract frm ths nfrmatn by ntrducng nn-determnstc chces. Snce case attrbutes are set and mdfed by applcatns and may nvlve human decsns, we have n ther chce but t abstract frm case data. 3.2 What s a wrkflw prcedure? The prcedure specfes the set f tasks requred t prcess cases successfully. (Synnyms fr task are prcess actvty, step and nde.) Mrever, the prcedure specfes the rder n whch these tasks have t be executed. (Tasks may be ptnal r mandatry and are executed n parallel r sequental rder.) The allcatn f resurces t tasks s requred t decde wh s gng t execute a specfc task fr a specfc case. Each resurce (e.g. a secretary) s able t perfrm certan functns (e.g. typng a letter) and each task requres certan functns. A resurce may be allcated t a task, f the resurce prvdes the requred functns. Recall that we cncentrate n mdelng

6 wrkflw prcedures,.e. we abstract frm the resurces requred t execute these prcedures. T llustrate the term (wrkflw) prcedure we wll use the fllwng example. Cnsder an autmble nsurance cmpany. The wrkflw prcess prcess clam takes care f the prcessng f clams related t car damage. Each clam crrespnds t a case t be handled by prcess clam. The wrkflw prcedure that s used t handle these cases can be descrbed as fllws. There are fur tasks: check nsurance, cntact garage, pay damage and send letter. The tasks check nsurance and cntact garage may be executed n any rder t determne whether the clam s justfed. If the clam s justfed, the damage s pad (task pay damage). Otherwse a letter f rejectn s sent t the clamant (task send letter). 3.3 Mdelng a prcedure We use Petr nets fr mdelng and analyzng wrkflw prcedures. Bascally, a prcedure s a partally rdered set f tasks. Therefre, t s qute easy t map a prcedure nt a Petr net. Tasks are mdeled by transtns and precedence relatns are mdeled by places. Cnsder fr example the wrkflw prcedure prcess clam, see Fgure 3. The tasks check nsurance, cntact garage, pay damage and send letter are mdeled by transtns. Snce the tw tasks check nsurance and cntact garage may be executed n parallel, there are tw addtnal transtns: frk and jn. The places p1, p2, p3, p4 and p5 are used t rute a case thrugh the prcedure n a prper manner. p1 frk p2 check_nsurance cntact_garage jn p3 p5 p4 pay_damage send_letter Fg. 3. The wrkflw prcedure prcess clam. Cases are prcessed ndependently,.e. a task executed fr sme case cannt nfluence a task executed fr anther case. Nevertheless, the thrughput tme f a case may ncrease

7 f there are many ther cases cmpetng fr the same resurces. In ths paper we abstract frm resurces; cases d nt affect each ther n any way. Therefre, t suffces t cnsder ne case at a tme. The tken n place n Fgure 3 crrespnds t ne case. Durng the prcessng f a case there may be several tkens referrng t the same case. (If transtn frk fres, then there are tw tkens, ne n p1 and ne n p2, referrng t the same clam.) The prcessng f the case s cmpleted f there s a tken n place and there are n ther tkens als referrng t the same case. Petr nets whch mdel wrkflw prcedures have sme typcal prpertes. Frst f all, they always have tw specal places and, whch crrespnd t the begnnng and termnatn f the prcessng f a case respectvely. Place s a surce place and s a snk place. Secndly, fr each transtn t (place p) there shuld be drected path frm place t va t (p). A Petr net whch satsfes these tw requrements s called a Wrkflw net (WF-net), see Fgure 1. Defntn 6 (WF-net). A Petr net PN = (P, T, F) s a WF-net (Wrkflw net) f and nly f: () PN has tw specal places: and. Place s a surce place: =. Place s a snk place: =. () If we add a transtn t t PN whch cnnects place wth (.e. t = {} and t = {}), then the resultng Petr net s strngly cnnected. A WF-net has ne nput place () and ne utput place () because any case handled by the prcedure represented by the WF-net s created f t enters the WFMS and s deleted nce t s cmpletely handled by the WFMS,.e., the WF-net specfes the lfecycle f a case. The secnd requrement n Defntn 6 (the Petr net extended wth t shuld be strngly cnnected), states that fr each transtn t (place p) there shuld be drected path frm place t va t (p). Ths requrement has been added t avd danglng tasks and/r cndtns,.e. tasks and cndtns whch d nt cntrbute t the prcessng f cases. It s easy t verfy that the Petr net shwn n Fgure 3 s a WF-net. 3.4 Sund prcedures The tw requrements stated n Defntn 6 can be verfed statcally,.e. they nly relate t the structure f the Petr net. There s hwever a thrd requrement whch shuld be satsfed: Fr any case, the prcedure wll termnate eventually, and at the mment the prcedure termnates there s a tken n place and all the ther places are empty. Mrever, there shuld be n dead tasks,.e., t shuld be pssble t execute an arbtrary task by fllwng the apprprate rute thugh the WF-net. These tw addtnal cnstrants crrespnd t the s-called sundness prperty.

8 Defntn 7 (Sund). A prcedure mdeled by a WF-net PN = (P, T, F) s sund f and nly f: () Fr every state M reachable frm state, there exsts a frng sequence leadng frm state M t state. Frmally: M ( M) (M ) () State s the nly state reachable frm state wth at least ne tken n place. Frmally: M ( M M ) (M = ) () There are n dead transtns n (PN, ). Frmally: t T M,M M t M Nte that there s an verladng f ntatn: the symbl s used t dente bth the place and the state wth nly ne tken n place (see Sectn 2). The sundness prperty relates t the dynamcs f a WF-net. The frst requrement n Defntn 7 states that startng frm the ntal state (state ), t s always pssble t reach the state wth ne tken n place (state ). If we assume farness (.e. a transtn that s enabled nfntely ften wll fre eventually), then the frst requrement mples that eventually state s reached. The farness assumptn s reasnable n the cntext f wrkflw management; all chces are made (mplctly r explctly) by applcatns, humans r external actrs. Clearly, they shuld nt ntrduce an nfnte lp. The secnd requrement states that the mment a tken s put n place, all the ther places shuld be empty. Smetmes the term prper termnatn s used t descrbe the frst tw requrements [15]. The last requrement states that there are n dead transtns (tasks) n the ntal state. Fr the WF-net shwn n Fgure 3 t s easy t see that t s sund. Hwever, fr cmplex wrkflw prcedures t s far frm trval t check the sundness prperty. 4 Analyss f WF-nets 4.1 Intrductn In ths sectn, we fcus n analyss technques that can be used t verfy the sundness prperty. The sundness prperty s a prperty whch relates t the dynamcs f a WF-net. Therefre, the cverablty graph (Petersn [21], Murata [20]) seems t be an bvus technque t check whether the WF-net s sund. Fgure 4 shws the cverablty graph whch crrespnds t the Petr net shwn n Fgure 3 (the ntal state s ). There are nly 7 reachable states, therefre t s easy t verfy the three requrements stated n Defntn 7. In general the cverablty graph can be used t decde whether a WF-net s sund. (In Sectn 4.2 we shw that a sund WF-net s bunded. If the cverablty graph has an unbunded state (an ω-state ), then the WF-net s nt sund. Otherwse, we can use a smple algrthm t check the three requrements stated n Defntn 7.) Hwever,

9 p1 + p2 p1 + p4 p3 + p2 p3 + p4 p5 Fg. 4. The cverablty graph f the Petr net shwn n Fgure 3. fr cmplex prcedures, the cnstructn f the cverablty graph may be very tme cnsumng. The cmplexty f the algrthm t cnstruct the cverablty graph can be wrse than prmtve recursve space. Even fr free-chce Petr nets the reachablty prblem s knwn t be EXPSPACE-hard (cf. Cheng, Esparza and Palsberg [9]). Therefre, any brute-frce apprach t check sundness s bund t be ntractable. Frtunately, the prblem f decdng whether a gven WF-net s sund crrespnds t standard Petr-net prpertes. In the remander f ths sectn, we present a technque t decde sundness. Alng the way, we encunter sme nterestng prpertes f sund WF-nets. Mrever, we wll shw that fr mst WF-net encuntered n practce, the sundness prperty can be verfed n plynmal tme. 4.2 A necessary and suffcent cndtn fr sundness Gven WF-net PN = (P, T, F), we want t decde whether PN s sund. Fr ths purpse we defne an extended net PN = (P, T, F). PN s the Petr net that we btan by addng an extra transtn t whch cnnects and. The extended Petr net PN = (P, T, F) s defned as fllws: P = P T = T {t } F = F {, t, t, } Fgure 5 llustrates the relatn between PN and PN. Fr an arbtrary WF-net PN and the crrespndng extended Petr net PN we wll prve the fllwng result: PN s sund f and nly f (PN, ) s lve and bunded. Frst, we prve the f drectn. Lemma 8. If (PN, ) s lve and bunded, then PN s a sund WF-net.

10 t * PN Fg. 5. PN = (P, T {t }, F {, t, t, }). Prf. (PN, ) s lve,.e., fr every reachable state M there s a frng sequence whch leads t a state n whch t s enabled. Snce s the nput place f t, we fnd that fr any state M reachable frm state t s pssble t reach a state wth at least ne tken n place. Cnsder an arbtrary reachable state M +,.e. a state wth at least ne tken n place. In ths state t s enabled. If t fres, then the state M + s reached. Snce (PN, ) s als bunded, M shuld be equal t the empty state. Hence requrements () and () hld and prper termnatn s guaranteed. Requrement () fllws drectly frm the fact that (PN, ) s lve. Hence, PN s a sund WF-net. T prve the nly f drectn, we frst shw that the extended net s bunded. Lemma 9. If PN s sund, then (PN, ) s bunded. Prf. Assume that PN s sund and (PN, ) nt bunded. Snce PN s nt bunded there are tw states M and M j such that M, M M j and M j > M. (See fr example the prf that the cverablty tree s fnte n Petersn [21] (Therem 4.1).) σ Hwever, snce PN s sund we knw that there s a frng sequence σ such that M σ. Therefre, there s a state M such that M j M and M >. Hence, t s nt pssble that PN s bth sund and nt bunded. S f PN s sund, then (PN, ) s bunded. Frm the fact that PN s sund and (PN, ) s bunded, we can deduce that (PN, ) s bunded. If transtn t n PN fres, the net returns t the ntal state. Nw we can prve that (PN, ) s lve. Lemma 10. If PN s sund, then (PN, ) s lve. Prf. Assume PN s sund. By Lemma 9 we knw that (PN, ) s bunded. Because PN s sund we knw that state s a s-called hme-markng f PN,.e., fr every state M reachable frm (PN, ) t s pssble t return t state. In the rgnal net (PN, ), t s pssble t fre an arbtrary transtn t (requrement ()). Ths s als the case n the mdfed net. Therefre, (PN, ) s lve because fr every state M reachable frm (PN, ) t s pssble t reach a state whch enables an arbtrary transtn t. Therem 11. A WF-net PN s sund f and nly f (PN, ) s lve and bunded. Prf. It fllws drectly frm Lemma 8, 9 and 10.

11 Therem 11 s an extensn f the results presented n [2,24]. In [2] we restrct urselves t free-chce WF-nets. Independently, Straub and Hurtad [24] fund necessary and suffcent cndtns fr sundness f COPA nets. (COPA nets crrespnd t a subclass f free-chce Petr nets.) Perhaps surprsngly, the verfcatn f the sundness prperty bls dwn t checkng whether the extended Petr net s lve and bunded! Ths means that we can use standard Petr-net-based analyss tls t decde sundness. In Sectn 5 we wll use Therem 11 t prve that there s a cmprehensve set f transfrmatn rules whch preserve sundness. Hwever, frst we cnsder an mprtant subclass f WF-nets. 4.3 Free-chce WF-nets Mst f the WFMSs avalable at the mment, abstract frm states between tasks,.e., states are nt represented explctly. These WFMSs use buldng blcks such as the AND-splt, AND-jn, OR-splt and OR-jn t specfy wrkflw prcedures. The ANDsplt and the AND-jn are used fr parallel rutng. The OR-splt and the OR-jn are used fr cndtnal rutng. Because these systems abstract frm states, every chce s made nsde an OR-splt buldng blck. If we mdel an OR-splt n terms f a Petr net, the OR-splt crrespnds t a number f transtns sharng the same set f nput places. Ths means that fr these WFMSs, a wrkflw prcedure crrespnds t a free-chce Petr net (see Defntn 5). We have evaluated many WFMSs (e.g. the nes mentned n Sectn 3.1) and just ne f these systems (COSA) allws fr a cnstructn whch s cmparable t a nn-free chce WF-net. Therefre, t makes sense t cnsder freechce Petr nets. Parallelsm, sequental rutng, cndtnal rutng and teratn can be mdeled wthut vlatng the free-chce prperty (cf. Sectn 5). Anther reasn fr restrctng WF-nets t free-chce Petr nets s the fllwng. If we allw nn-freechce Petr nets, then the chce between cnflctng tasks may be nfluenced by the rder n whch the precedng tasks are executed. The rutng f a case shuld be ndependent f the rder n whch tasks are executed. A stuatn where the free-chce prperty s vlated s ften a mxture f parallelsm and chce. In ur pnn parallelsm tself shuld be separated frm the chce between a parallel and a nn-parallel executn f tasks. Free-chce Petr nets have been studed extensvely and are marked by strng theretcal results and effcent analyss technques (cf. Best [8], Desel and Esparza [12,11,14], Hack [17]). As a result sundness can be determned n plynmal tme fr free-chce WF-nets. Therem 12. Fr a free-chce WF-net t s pssble t decde sundness n plynmal tme. Prf. As a drect result f the Rank therem ([12]), t s pssble t decde lveness and bundedness n plynmal tme. Therefre, the prblem f checkng whether a WF-net s sund can be slved n plynmal tme usng standard technques. Clearly, the crrectness f a free-chce WF-nets Mrever, t s pssble t smplfy Defntn 7. can be analyzed very effcently.

12 Prpstn 13. Fr free-chce WF-nets, the frst tw requrements n Defntn 7 mply the thrd requrement. Prf. Let PN be a free-chce WF-net satsfyng the frst tw requrements n Defntn 7 (() and ()). These requrements state that the WF-net s prper termnatng. It s easy t prve that the extended net (PN, ) s bunded wthut usng the thrd requrement (see Lemma 9). Mrever, t s als easy t shw that s a s-called hmemarkng f PN. Therefre (PN, ) s deadlck-free. Snce (PN, ) s a deadlck-free, bunded, strngly cnnected, free-chce Petr net, we deduce that (PN, ) s lve (see Therem 4.31 n Desel and Esparza [12]). Snce (PN, ) s lve and bunded, PN s sund (Therem 11) and the thrd requrement () hlds. Mst f the wrkflw prcedures we have seen n practce bey the free-chce prperty. Ths s a drect result f the fact that mst f the wrkflw systems abstract frm the explct mdelng f states. Hwever, a Petr-net-based WFMS such as COSA (Sftware-Ley, Pullhem, Germany) allws fr the cnstructn f nn-free-chce WFnets. Frtunately, fr nn-free-chce WF-nets we can check a suffcent cndtn fr sundness n plynmal tme. In the fllwng therem we assume that the reader s famlar wth sme advanced ntns: rank, sphn and cluster. A cluster s a mnmal set C f ndes satsfyng the fllwng cndtns. If the set cntans a place s, then s C. If the set cntans a place t, then t C. Fr mre nfrmatn n these advanced tpcs, we refer t [12] and [20]. Therem 14. A WF-net PN s sund f the rank f PN s equal t the number f clusters mnus 1 and every prper sphn cntans at least ne tken. Prf. PN s strngly cnnected. Therefre we can apply Therem n [12]. Ths therem states that a weakly cnnected Petr net wth at least ne place and ne transtn, a rank equal t the number f clusters mnus 1 (.e. Rank(PN) = C N 1) and a tken n every prper sphn, s lve and bunded. By applyng Therem 11 we deduce that PN s sund. The cndtns stated n Therem 14 are suffcent fr sundness and can be checked n plynmal tme. Fgure 6 shws a WF-net whch s nt free-chce. The tw transtns pay damage and send letter are n cnflct wth the new transtn nfrm custmer but the sets f nput places dffer. The rank f the extended WF-net s 5, the number f clusters s 6 and every prper sphn cntans at least ne tken. Therefre, we can use Therem 14 t prve that the WF-net s sund (n plynmal tme). Unfrtunately, there are sund WF-nets whch d nt satsfy the cndtns stated n Therem 14. Hwever, we can extend the class f free-chce WF-nets such that these cndtns are necessary and suffcent fr sundness. A Petr net that belngs t ths class s called an almst free-chce WF-net. Defntn 15 (Almst free-chce). A Petr net s an almst free-chce Petr net ff, fr every tw transtns t 1 and t 2 ether

13 p1 frk check_nsurance cntact_garage p2 jn nfrm_custmer p3 p5 p4 p6 pay_damage send_letter Fg. 6. The mdfed prcedure prcess clam. - ( t 1 t 2 ) =, r - t 1 = t 2, r - t 1 = t 1 and t 1 t 2, r - t 2 = t 2 and t 2 t 1. An almst free-chce Petr net s a free-chce Petr net extended wth zer r mre transtns whch can nt change the state f the net and preserve (nn)lveness f the net. The addtnal transtns crrespnd t nqury tasks,.e. tasks whch d nt cntrbute t the prcessng f a case. These tasks are executed f smene requres nfrmatn abut a partcular case. The WF-net n Fgure 6 s almst free-chce; nfrm custmer crrespnds t a s-called nqury task. Therem 16. Fr an almst free-chce WF-net t s pssble t decde sundness n plynmal tme. Prf. An almst free-chce WF-net can be transfrmed nt a free-chce WF-net wthut changng lveness and bundedness prpertes. Ths can be dne by smply remvng the nqury transtns. An nqury transtn s a transtn t 1 such that (1) t 1 = t 1 and (2) there s anther transtn t 2 such that t 1 t 2. Remvng t 1 des nt change bundedness, because t 1 cannt change the state. Lveness s als nt affected because t 1 cannt change the state and t 1 s lve f t 2 s lve. By remvng all nqury transtns we btan a free-chce WF-net. Then we can apply the Rank therem t decde sundness. These results shw that fr a farly large class f WF-nets we can decde sundness very effcently. We have been nvlved n a number f wrkflw prjects (Dutch Custms

14 department, Dutch Justce department and a number f banks and nsurance cmpanes). In these prjects we hardly ever experenced the need fr WF-nets whch are nt almst free-chce. 5 Transfrmatn rules One f the majr benefts f a WFMS s the ablty t change busness prcesses very easly,.e., wthut a cmplete redesgn f the nfrmatn system. Mrever, wrkflw mangement sftware s an essental enabler fr management phlsphes such as Busness Prcess Reengneerng (BPR) and Cntnuus Prcess Imprvement (CPI). BPR and CPI are als a stmulus fr the mdfcatn f busness prcesses. As a result, the prcedures supprted by the WFMS are subject t frequent changes. These changes may ntrduce errrs. In ths paper we have shwn that t s pssble t check the sundness f a prcedure very effcently. Hwever, we can use an alternatve apprach t make sure that the prcedure remans sund. Ths apprach s based n sundness preservng transfrmatn rules. In ur pnn there are eght basc transfrmatn rules (T1a, T1b, T2a, T2b, T3a, T3b, T4a and T4b) whch can be used t mdfy a sund wrkflw prcedure. These transfrmatn rules are shwn n Fgures 7, 8, 9 and 10 and elucdated n the sequel. The transfrmatn rules crrespnd t the basc rutng cnstructs dentfed by the Wrkflw Management Caltn ([26]). These rules shuld nt be cnfused wth the reductn rules presented n Petr-net lterature (cf. Berthelt [7], Desel [10], Desel and Esparza [12] and Kvalyv [19]). The transfrmatn rules presented n ths sectn are nt used fr analyss purpses; they are used fr the mdfcatn f WF-nets. T1a Task t1 s replaced by tw cnsecutve tasks t2 and t3. Ths transfrmatn rule crrespnds t the dvsn f a task: a cmplex task s dvded nt tw tasks whch are less cmplcated. (See Fgure 7.) Rule T1a t2 t1 p Rule T1b t3 Fg. 7. Transfrmatn rules: T1a and T1b.

15 T1b Tw cnsecutve tasks t2 and t3 are replaced by ne task t1. Ths transfrmatn rule s the ppste f T1a and crrespnds t the aggregatn f tasks. Tw tasks are cmbned nt ne task. (See Fgure 7.) T2a Task t1 s replaced by tw cndtnal tasks t2 and t3. Ths transfrmatn rule crrespnds t the specalzatn f a task (e.g. handle rder) nt tw mre specalzed tasks (e.g. handle small rder and handle large rder). (See Fgure 8.) Rule T2a t1 t2 t3 Rule T2b Fg. 8. Transfrmatn rules: T2a and T2b. T2b Tw cndtnal tasks t2 and t3 are replaced by ne task t1. Ths transfrmatn rule s the ppste f T2a and crrespnds t the generalzatn f tasks. Tw rather specfc tasks are replaced by ne mre generc task. (See Fgure 8.) T3a Task t1 s replaced by tw parallel tasks t2 and t3. (See Fgure 9.) The effect f the executn f t2 and t3 s dentcal t the effect f the executn f t1. The transtns c1 and c2 represent cntrl actvtes t frk and jn tw parallel threads. T3b The ppste f transfrmatn rule T3a: tw parallel tasks t2 and t3 are replaced by ne task t1. (See Fgure 9.) T4a Task t1 s replaced by an teratn f task t2. (See Fgure 10.) The executn f task t1 (e.g. type letter) crrespnds t zer r mre executns f task t2 (e.g. type sentence). The transtns c1 and c2 represent cntrl actvtes that mark the begn and end f a sequence f t2-tasks. Typcal examples f stuatns where teratn s requred are qualty cntrl and cmmuncatn. T4b The ppste f transfrmatn rule T4a: the teratn f t2 s replaced by task t1. (See Fgure 10.) Frmalzatn f these transfrmatn rules s straghtfrward. T llustrate ths we defne T1a. (See Fgure 7.) Defntn 17 (T1a). Let PN = (P, T, F) be WF-net. Ths net can be transfrmed by rule T1a nt a net PN = (P, T, F ) ff there exst t1 T, t2, t3 T and p P such that P = P {p}, p P, T = (T \ {t1}) {t2, t3}, {t2, t3} T = and

16 Rule T3a p1 p3 c1 t1 t2 t3 Rule T3b p2 c2 p4 Fg. 9. Transfrmatn rules: T3a and T3b. Rule T4a c1 t1 t2 p1 Rule T4b c2 Fg. 10. Transfrmatn rules: T4a and T4b.

17 F = { x, y F (x = t1) (y = t1)} { x, t2 P T x, t1 F} { t3, y T P t1, y F} { t2, p, p, t3 }. It s easy t see that f we take a sund WF-net and we apply ne f these transfrmatn rules, then the resultng Petr net s stll a WF-net. Mrever, the resultng WF-net s als sund. Therem 18. The transfrmatn rules T1a, T1b, T2a, T2b, T3a, T3b, T4a and T4b preserve sundness,.e. f a WF-net s sund, then the WF-net transfrmed by ne f these rules s als sund. Prf. Let PN be a sund WF-net. Let PN be a net whch s btaned by applyng ne f the transfrmatn rules n PN. We have t prve that PN s a sund WF-net. It s easy t see that PN s a WF-net. There s stll ne nput and ne utput place and the PN s strngly cnnected. (PN s the Petr net PN wth an extra transtn t whch cnnects place and place.) By Therem 11 we knw that, t prve sundness, t suffces t shw (PN, ) s lve and bunded. (PN, ) s lve and bunded. Therefre, we have t prve that each f the rules preserves lveness and bundedness. Because t s bvus that the rules preserve lveness and bundedness, we d nt gve a detaled prf. It s fr example pssble t prve ths by usng the 6 lveness and bundedness preservng peratns descrbed n Murata [20]. The eght transfrmatn rules shwn n fgures 7, 8, 9 and 10 preserve sundness. We can use these basc transfrmatn rules t cnstruct mre cmplex transfrmatn rules. Fgure 11 shws tw f these rules: T5a and T5b. T5a Tw cnsecutve tasks are replaced by tw parallel tasks. T5b Tw parallel tasks are replaced by tw cnsecutve tasks. t2 Rule T5a p1 c1 p3 p t2 t3 t3 Rule T5b p2 c2 p4 Fg. 11. Transfrmatn rules: T5a and T5b. The applcatn f transfrmatn rule T5a crrespnds t the applcatn f T1b fllwed by the applcatn f T3a. Transfrmatn rule T5b s a cmbnatn f T3b and

18 T1a. Therefre, sundness s als preserved by the transfrmatn rules T5a and T5b. We use the term sund transfrmatn rule t refer t a transfrmatn rules whch preserves sundness. The WF-net whch cmprses nly ne task t s sund. We can use ths net as a startng pnt fr a sequence f sund transfrmatns. By Therem 18 we knw that the resultng WF-net s sund. Crllary 19. If the Petr net PN = ({, }, {t}, {, t, t, }) s transfrmed nt a Petr net PN by applyng a sequence f sund transfrmatn rules (e.g. T1a, T1b, T2a, T2b, T3a, T3b, T4a, T4b, T5a and T5b), then PN s sund. Cnsder fr example the WF-net shwn n Fgure 3. We can cnstruct ths net by applyng the transfrmatn rules T1a, T2a and T3a, see Fgure 12. p1 frk p2 check_nsurance cntact_garage Rule T1a Rule T2a Rule T3a jn p3 p5 p4 pay_damage send_letter Fg. 12. Cnstructn f the WF-net shwn n Fgure 3. Nte that the cnverse f Crllary 19 s nt true. There are sund WF-nets whch cannt be cnstructed by the transfrmatn rules defned n ths sectn. Cnsder fr example the WF-net shwn n Fgure 6; ths net s sund but cannt be cnstructed by usng the transfrmatn rules. Nevertheless, the rules crrespnd t the basc rutng prmtves present n mst WFMSs. 6 Related wrk Many researchers have nversgated prpertes smlar t the sundness prperty. Straub and Hurtad [24] have analyzed a smlar prperty fr COPA nets. The sundness prperty s als clsely related t Valette s cncept f a well-frmed blck [25] and Gstellw s cncept f prper termnatn [15]. There s als a relatn between reversblty (the pssblty t return t the ntal state,.e., the ntal state s a hme-markng)

19 and sundness. The results presented n ths paper are marked by the fact that they are vald fr any WF-net. Mrever, we have shwed that fr an mprtant subclass (almst free-chce) the sundness prperty can be verfed n plynmal tme. The use f Petr nets n the wrkflw dman s ncreasng. At the mment several Petr-net-based wrkflw tls are avalable. COSA (Sftware-Ley) s a Petr-net-based wrkflw management system. COSA s ne f the leadng wrkflw prducts n Eurpe. LEU (LION/Vebacm) s a WFMS based n FUNSOFT nets ([16]). INCOME (Prmats) and StructWare/BusnessSpecs (IvyTeam) are bth Petr-net-based BPR tls whch can be used t cnfgure a WFMS. INCOME nterfaces wth Desgner/2000 (Oracle), Plexus (BacTec) and CSE/Wrkflw (CSE systems). StructWare/BusnessSpecs nterfaces wth Staffware (Staffware), ne f the wrlds leadng WFMSs. These tls shw that wrkflw managemant s becmng an mprtant applcatn dman fr Petr nets. Hwever, these Petr-net-based wrkflw tls d nt supprt advanced analyss technques. Therefre, we have develped WOFLAN (WOrkFLw ANalyser). WOFLAN s a Petr-net-based analyss tl fr the verfcatn f wrkflws. Amngst thers t supprts the analyss technques descrbed n ths paper. 7 Cnclusn In ths paper we have presented a class f Petr nets, the s-called WF-nets, sutable fr the representatn, valdatn and verfcatn f wrkflw prcedures. One f the merts f ths class s that we can verfy the sundness prperty usng standard technques. Mrever, we have dentfed an mprtant class f WF-nets that can be verfed n plynmal tme. Even thugh sund WF-nets have sme nce prpertes frm a theretcal pnt f vew, they are pwerful enugh t mdel any wrkflw prcedure. Mrever, we have shwn that the plausble transfrmatn rules encuntered n practce preserve sundness. In ths paper we fcused n the wrkflw prcedures supprted by a WFMS. T cmpletely specfy a wrkflw prcess we als have t specfy the management f resurces: gven a task that needs t be executed fr a specfc case we have t specfy the resurce (persn r machne) that s gng t prcess the task (cf. Van der Aalst and Van Hee [5]). A drectn fr further research s t ncrprate ths dmensn. We hpe t fnd a necessary and suffcent cndtn fr sundness gven a WF-net extended wth sme mechansm t allcate resurces t tasks. References 1. W.M.P. van der Aalst. Puttng Petr nets t wrk n ndustry. Cmputers n Industry, 25(1):45 54, W.M.P. van der Aalst. A class f Petr net fr mdelng and analyzng busness prcesses. Cmputng Scence Reprts 95/26, Endhven Unversty f Technlgy, Endhven, W.M.P. van der Aalst. Petr-net-based Wrkflw Management Sftware. In A. Sheth, edtr, Prceedngs f the NFS Wrkshp n Wrkflw and Prcess Autmatn n Infrmatn Systems, pages , Athens, Gerga, May 1996.

20 4. W.M.P. van der Aalst. Three Gd reasns fr Usng a Petr-net-based Wrkflw Management System. In S. Navathe and T. Wakayama, edtrs, Prceedngs f the Internatnal Wrkng Cnference n Infrmatn and Prcess Integratn n Enterprses (IPIC 96), pages , Camebrdge, Massachusetts, Nv W.M.P. van der Aalst and K.M. van Hee. Busness Prcess Redesgn: A Petr-net-based apprach. Cmputers n Industry, 29(1-2):15 26, W.M.P. van der Aalst and K.M. van Hee. Wrkflw Management: Mdellen, Methden en Systemen (n Dutch). Academc Servce, Schnhven, G. Berthelt. Transfrmatns and decmpstns f nets. In W. Brauer, W. Resg, and G. Rzenberg, edtrs, Advances n Petr Nets 1986 Part I: Petr Nets, central mdels and ther prpertes, vlume 254 f Lecture Ntes n Cmputer Scence, pages Sprnger-Verlag, Berln, E. Best. Structure thery f Petr nets: the free chce hatus. In W. Brauer, W. Resg, and G. Rzenberg, edtrs, Advances n Petr Nets 1986 Part I: Petr Nets, central mdels and ther prpertes, vlume 254 f Lecture Ntes n Cmputer Scence, pages Sprnger-Verlag, Berln, A. Cheng, J. Esparza, and J. Palsberg. Cmplexty results fr 1-safe nets. In R.K. Shyamasundar, edtr, Fundatns f sftware technlgy and theretcal cmputer scence, vlume 761 f Lecture Ntes n Cmputer Scence, pages Sprnger-Verlag, Berln, J. Desel. Reductn and desgn f well-behaved cncurrent systems. In J.C.M. Baeten and J.W. Klp, edtrs, Prceedngs f CONCUR 1990, vlume 458 f Lecture Ntes n Cmputer Scence, pages Sprnger-Verlag, Berln, J. Desel. A prf f the Rank therem fr extended free-chce nets. In K. Jensen, edtr, Applcatn and Thery f Petr Nets 1992, vlume 616 f Lecture Ntes n Cmputer Scence, pages Sprnger-Verlag, Berln, J. Desel and J. Esparza. Free chce Petr nets, vlume 40 f Cambrdge tracts n theretcal cmputer scence. Cambrdge Unversty Press, Cambrdge, C.A. Ells and G.J. Nutt. Mdellng and Enactment f Wrkflw Systems. In M. Ajmne Marsan, edtr, Applcatn and Thery f Petr Nets 1993, vlume 691 f Lecture Ntes n Cmputer Scence, pages Sprnger-Verlag, Berln, J. Esparza. Synthess rules fr Petr nets, and hw they can lead t new results. In J.C.M. Baeten and J.W. Klp, edtrs, Prceedngs f CONCUR 1990, vlume 458 f Lecture Ntes n Cmputer Scence, pages Sprnger-Verlag, Berln, K. Gstellw, V. Cerf, G. Estrn, and S. Vlansky. Prper Termnatn f Flw-f-cntrl n Prgrams Invlvng Cncurrent Prcesses. ACM Sgplan, 7(11):15 27, V. Gruhn. Valdatn and Verfcatn f Sftware Prcess Mdels. In A. Endres and H. Weber, edtrs, Sftware Develpment Envrnments and CASE Technlgy, vlume 509 f Lecture Ntes n Cmputer Scence, pages Sprnger-Verlag, Berln, M.H.T. Hack. Analyss prductn schemata by Petr nets. Master s thess, Massachusetts Insttute f Technlgy, Cambrdge, Mass., T.M. Kulpuls. The Wrkflw Imperatve. Van Nstrand Renhld, New Yrk, A.V. Kvalyv. On cmplete reducablty f sme classes f Petr nets. In Prceedngs f the 11th Internatnal Cnference n Applcatns and Thery f Petr Nets, pages , Pars, June T. Murata. Petr Nets: Prpertes, Analyss and Applcatns. Prceedngs f the IEEE, 77(4): , Aprl J.L. Petersn. Petr net thery and the mdelng f systems. Prentce-Hall, Englewd Clffs, C.A. Petr. Kmmunkatn mt Autmaten. PhD thess, Insttut für nstrumentelle Mathematk, Bnn, 1962.

21 23. T. Schäl. Wrkflw Management fr Prcess Organsatns, vlume 1096 f Lecture Ntes n Cmputer Scence. Sprnger-Verlag, Berln, P.A. Straub and C. Hurtad. The Smple Cntrl Prperty f Busness Prcess Mdels. In XV Internatnal Cnference f the Chlean Cmputer Scence Scety, R. Valette. Analyss f Petr Nets by Stepwse Refnements. Jurnal f Cmputer and System Scences, 18:35 46, WFMC. Wrkflw Management Caltn Termnlgy and Glssary (WFMC-TC-1011). Techncal reprt, Wrkflw Management Caltn, Brussels, 1996.