Verification of Data-Aware Processes Exploiting DCDSs: models, methods, concrete systems

Transcription

1 Verification of Data-Aware Processes Exploiting DCDSs: models, methods, concrete systems Diego Calvanese, Marco Montali Research Centre for Knowledge and Data (KRDB) Free University of Bozen-Bolzano, Italy 29th European Summer School in Logic, Language, and Information (ESSLLI 2017) Toulouse, France July 2017

2 Outline 1 The story so far 2 Checking/ensuring state boundedness 3 Boundedness and resources 4 Unbounded systems 5 Towards concrete systems Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (1/20)

3 Outline 1 The story so far 2 Checking/ensuring state boundedness 3 Boundedness and resources 4 Unbounded systems 5 Towards concrete systems Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (2/20)

4 The story so far, with main references The need of combining (business) processes and data. [Calvanese, De Giacomo, and Montali 2013] A pristine formalism for data-aware business processes: DCDS. [Bagheri Hariri, Calvanese, De Giacomo, et al. 2013; Montali and Calvanese 2016] Suitable verification logics for data-aware processes. [Bagheri Hariri, Calvanese, De Giacomo, et al. 2013; Calvanese, De Giacomo, Montali, and Patrizi 2017] Corresponding characterization theorems. [Calvanese, De Giacomo, Montali, and Patrizi 2017] A decidability map, with an unexpected dichotomy between µl A and LTL-FO A. [Bagheri Hariri, Calvanese, De Giacomo, et al. 2013; Calvanese, De Giacomo, Montali, and Patrizi 2017] Note: Incorrect results in [Bagheri Hariri, Calvanese, De Giacomo, et al. 2013; Okamoto 2010] fixed in [Calvanese, De Giacomo, Montali, and Patrizi 2017]. Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (3/20)

5 Outline 1 The story so far 2 Checking/ensuring state boundedness 3 Boundedness and resources 4 Unbounded systems 5 Towards concrete systems Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (4/20)

6 How to check/ensure state boundedness? Theorem Checking whether a DCDS is state-/run-bounded is: Decidable for a given bound. Undecidable for an unknown bound. Three possible strategies: Single out classes of DCDSs for which checking state-/run-boundedness is decidable. Identify sufficient syntactic conditions that are decidable to check, and that guarantee state-/run-boundedness cf. syntactic conditions for chase termination in data exchange. Devise modeling methodologies that guarantee state boundedness. Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (5/20)

7 DCDSs with decidable state-boundedness Fact DCDSs using only unary relations correspond to variants of Petri nets. The specific variant depends on the features used in the DCDS. Note: State-boundedness relate to boundedness in Petri nets. Petri nets with name management Decidable boundedness. [Rosa-Velardo and Frutos-Escrig 2011] Reset-Transfer Nets Undecidable boundedness. [Dufourd, Jancar, and Schnoebelen 1999] p 1 a a c p 2 c e xxy xxν 1 y t ν 1ν 2 p 3 p 4 p 5 p 0 p 1 t 1 p 2 t 2 p 3 p 2 p 4 p 2 p 2 t 3 [Montali and Rivkin 2016] Translation to DCDSs and µl P verification. [Bagheri Hariri, Calvanese, Deutsch, et al. 2014] Lossy correspondence with DCDSs. Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (6/20)

8 Attacking state-boundedness The class of DCDSs with decidable state-boundedness very restrictive These variants of Petri nets corresponds to DCDSs with only unary relations, limited use of negation, no or limited joins,... How to check/guarantee that a DCDS is state-bounded? Sufficient, syntactic conditions: Extract a data flow graph from the DCDS. Check sources of unboundedness through this graph. See [Bagheri Hariri, Calvanese, De Giacomo, et al. 2013] and [Bagheri Hariri, Calvanese, Deutsch, et al. 2014]. State-boundedness by design: Design methods for state-bounded DCDSs. In [Solomakhin et al. 2013]: Processes are bound to evolving business objects (artifacts). Each business object manipulate boundedly many data. (New) business objects pick their names from a fixed pool of ids. More sophisticated techniques in [Montali and Calvanese 2016; Calvanese, Montali, et al. 2014]. Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (7/20)

9 State-boundedness in concrete process modeling languages Classical BPM languages/suites Central notion of case representing a process instance. Each case carries its own case data, in isolation to the other cases (e.g., order details, customer address,... ). Cases interact by accessing a central, persistent data storage. Artifact-centric approaches: Central notion of business object gluing data and behaviour together. All data relevant to a business object are attached to it. Processes may query multiple business objects at once, to determine the possible next steps. External and internal stakeholders... New cases/business objects are created upon events issued by external stakeholders (e.g., new order request). But then they are bound to internal resources, responsible for progressing the corresponding process instances. Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (8/20)

10 Outline 1 The story so far 2 Checking/ensuring state boundedness 3 Boundedness and resources 4 Unbounded systems 5 Towards concrete systems Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (9/20)

11 RIAW-nets [Montali and Rivkin 2016] in-house repair ν x x t g check i external repair RIAW-nets = ν-pns + workflow nets ɛ x x x x x x do repair x ɛ HW expert x x write report start shipping x x x shipping clerk x x prepare package x x write summary x x assemble Emitter transition generating a new process id when fired. ɛ ɛ ɛ ɛ print receipt x x x o t r ɛ ɛ secretary Control-flow name matching to selectively spawn/synch tokens using their id. Resource places to bound the number of simultaneously coexisting active process instances! (but unboundedly many over time). Decidability of model checking via translation to state-bounded DCDSs. Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (10/20)

12 Outline 1 The story so far 2 Checking/ensuring state boundedness 3 Boundedness and resources 4 Unbounded systems 5 Towards concrete systems Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (11/20)

13 Data isolation and case unboundedness What if the number of simultaneously active cases cannot be bounded? In [Montali and Calvanese 2016; Calvanese, Montali, et al. 2014], we show that decidability of model checking can be retained, if the system obeys to: relative boundedness (each case manipulates boundedly many data); data isolation (cases interact very weakly). State Group MarryM group state id id combatlevel group 12 out pro null 4 in 4 19 basic running ok basic ok 431 Modeling guidelines to guarantee data isolation and relative boundedness: 1 Queries must be navigational (no arbitrary access to relations). 2 1-to-many relations require a number restriction on the many side. 3 Each case cannot create a chain of tuples of unbounded lenght. 4 Cases can share tuples only in a controlled way (no construction of chains). Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (12/20)

14 Beyond State-Boundedness Question Are there classes of DCDSs that are unbounded, but still amenable to verification? Key result in [Abdulla et al. 2016]. Recency-bounded data-aware processes Unbounded DB, but only the latest inserted/accessed values can bound to parameters. Verification via under-approximation Decidability by focusing only on runs that are k-recency-bounded for an explicitly given key. Open problem Investigate the relationships between all such results and those where the initial DB is not fixed, and verification is studied for every possible initial DB. Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (13/20)

15 Incorporation of datatypes Databases have datatypes Numeric domains, domain-specific predicates, arithmetic. Many coordination algorithms and auctions require dense orders. Processes with costs and payment policies require integers and arithmetic. Dense orders combine well with state-boundedness Data-aware, state-bounded distributed systems with reals [Calvanese, Delzanno, and Montali 2015]: OK to include dense linear orders: minor extension to the standard DCDS abstraction technique. Intuition... Rigid > relation Non-rigid GreaterT han relation over the entire domain over active domain elements. No hope to include the successor relation (or integers): 2 data slots are sufficient to encode two counters. Discrete orders and arithmetic combine well with run-boundedness Ongoing work... Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (14/20)

16 Outline 1 The story so far 2 Checking/ensuring state boundedness 3 Boundedness and resources 4 Unbounded systems 5 Towards concrete systems Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (15/20)

17 Relational multiagent systems and commitments Relational MAS [Montali, Calvanese, and De Giacomo 2014] Agents have names and hold/manipulate local, state-bounded DBs. Agents exchange data using their names for addressing. An institutional agent manages agent creation and deletion. Due to state-boundedness: unboundedly many agents can dynamically enter into the system, but at each moment only boundedly many are active. Paid Paid Paid Paid MyCust Item Item Cust Item Cust Item Cust Item Cust i1 Alice i1 Alice i1 Alice Name ID Alice i1 i2 Alice i2 Alice Bob i2 PAY-BT(Alice, i2) Seller John ACCEPT-REG PAY-CC(i1) Alice's Bank Carrier deliver(i1,...) Customer Alice Owns Owns Owns Owns Item Item Item Item i1 DeliveryCC DeliveryCC DeliveryCC DeliveryCC Institutional agent D. C. D. C. D. C. D. C. JohnAlice JohnAlice JohnAlice JohnAlice DeliveryC DeliveryC DeliveryC DeliveryC D. C. Item State D. C. Item State D. C. Item State D. C. Item State JohnAlice i1 active JohnAlice i1 active JohnAlice i1 sat JohnAlice i2 active JohnAlice i2 active Relational commitments In the same work: first proposal for modeling and verifying interaction protocols based on relational commitments, i.e., commitments with data payload and multiple instances. Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (16/20)

18 daphne: implementing DCDSs with relational technology daphne RDBMS DCDS Spec. DCDS state Persistent Storage DB Engine Flow Engine Service Manager Native modeling and execution of DCDSs using relational DBMSs: SQL-like syntax for DCDSs with datatypes. Automated translation into relational DBMSs, as (temporal) tables, constraints, and stored procedures. Java APIs to support enactment and integration with concrete services. Native explicit model checking of DCDSs using relational DBMSs: Same model for execution and verification! Special tables for storing the RTS induced by a DCDSs. Factoring of tables into temporal and atemporal parts. Computation of equality commitments and value recycling in services. Java APIs for RTS construction and search. Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (17/20)

19 The story so far State-boundedness reason : String Boundedness and resources Unbounded systems Concrete systems 0..* is presented in Visual Paradigm for Community Edition [not for commercial use] BAUML: artifact-centric processes with UML Fig. 1. Class diagram showing the artifacts and objects involved in the submission of articles to conferences. Review Submission [success] AcceptedSubmission * NonUser registered by Create New UserAuthor as User 1 sends String Submit Paper PendingReviewSubmission * Promote to User registered {disjoint, complete} Submission * 1 Conference 1..* * Review Submission [failure] Author id : Natural is sent to name : String Create New Author as writes NonUser Withdraw Submission id : String title : String NonUser beginning : Date RejectedSubmission name : String end : Date affiliation : String status {disjoint,complete} country : String IEEE TRANSACTIONS WithdrawnSubmission ON KNOWLEDGE AND DATA ENGINEERING, VOL. XXX, NO. YYY, [MONTH-YEAR] 5 1 Fig. 3. State machine diagram WithdrawnSub showing thependingreviewsub evolution of artifact Author. ReviewedSub is divided into withdrawaldate : Date those submissiondate combinations : Date reviewdate of : Date artifact instances where Fig. 5. Activity diagram of Review Submission. Fig. 2. State machine diagram showing the evolution of artifact Submission. evaluation : Integer comments : String * all the picked instances are in Session a proper state Fig. 4. Activity diagram of Submit Paper. id : String User Submit Paper date : Date is enabled). {disjoint, complete} result time : Time have Create itsnew own. Author Figure as User 2 shows the lifecycle for Submission. Register New Add Author to room : String Submission Submission When a paper is submitted to a conference, the corresponding Submission is createdpromote in state to UserPendingReviewSubmission. deterministically pickreason one. : String iii) If there is at least one executable transition, non- [add more authors] AcceptedSubmission RejectedSubmission 1 When it is reviewed, it changes to state AcceptedSubmission, [no more authors iv) to add} Fire the transition, 0..* is presented depending on the corresponding label. if the reviewers consider it is appropriate to be presented Create New Author as NonUser at the conference (event-dependent NonUser condition success), or RejectedSubmission, if they decide it is not (event-dependent A) Each condition of them, failure). therefore, Before will submission have an is accepted operation or rejected, andone a postcondition. of its authors maythe decide contracts to withdraw corresponding it: then it nodetoatthe end), this process is repeated. Otherwise, the contract is added with to it. If more authors need to be added (see decision pre changes its state to WithdrawnSubmission. Notice that all of activity diagram ends. tasksbusiness activity diagram objects, SubmitPaper states, are shown associations below, in 4and REASONING attributes: ON BAUML class MODELS diagrams. THROUGH the transitions in the state machine diagram correspond to Figure 5 shows the activity diagram for event Review Listings external 1events. and 2. Submission. To begin DCDSS with, the reviewers evaluate the submission statechart and decide whether diagram. it is good enough to be pre- Similarly, Business as shownobject in Figure 3, authors lifecycle: can be created UML as 5 RELATED WORK Listing a User1. orcode a NonUser.ANonUser for service RegisterNewSubmission will become a User when the sented at the conference. If is not, the reviewers add a operation system Complex receives RegisterNewSubmission(subId: additional event informationtriggering by means Natural, of externala title: lifecycle comment and the transition: 6 activity CONCLUSIONS diagram finishes UMLin activity failure. This diagram. event String, Promoteconf: to User. String) corresponds to the transition that leads to state RejectedSubmission in thecontracts. state ACKNOWLEDGMENTS machine diagram. On the other hand, if pre: Each Conference.allInstances()->exists(c external Tasks event inmodeled the state machine asdiagram(s) OCL c.name=conf) will operation be refined and not by means Submission.allInstances()->exists(s of an activity diagram. particular, we the paper is accepted, it is assigned to a certain session and wills.id=subid show the details andofs.conference.name=conf) Submit Paper Review Submission the activity diagram Thisfinishes workinhas success. been It corresponds partiallytosupported the by the Ministerio post: PendingReviewSubmission.allInstances()->exists(s in the state machine diagram of Submission. transition that leads to state AcceptedSubmission in the state s.oclisnew() and s.id=subid and s.title=title and de Ciencia e Innovación under project TIN and Figure s.submissiondate=today() 4 shows the activity diagram and s.conference.name=conf of event Submit machine diagram. by UPC Paper. andthe result=s) first task registers a new submission in the Notice that all the activities in the activity diagram system (Register New Submission), and afterwards an author correspond to tasks: atomic units of work within the process. BAUML approach 1 User (i.e., a state where the same type of transition In [Calvanese, Montali, et al. 2014]: methodology to guarantee decidability of model checking (see before). Estanol PhD thesis: BAUML to DCDS! Calvanese, Montali (FUB) Verification of Data-Aware REFERENCES Processes ESSLLI /07/2017 (18/20)

20 raw-sys: marrying workflow nets and databases i i i Task Task local local Task Case local o Case Case o o read global write raw-sys model [De Masellis et al. 2017]: Data-aware processes using well-known formalisms: Data: global and local relational databases. Process control-flow: workflow nets, enriched with: Guards (queries over the DBs). STRIPS-like actions with external inputs from an infinite domain, invoked upon firing net transitions. raw-sys verification [De Masellis et al. 2017]: Map of (un)decidability, exploiting translation to DCDSs. Encoding into planning systems to handle reachability problems. Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (19/20)

21 db-nets: marrying colored Petri nets and databases... TAXI sid Proceed To Booking F reedrivers tid, pn sid Reserve (tid, pn) Create Booking sid sid sid, tid BOOKING Reserved T axi sid Leave Phone Number sid, νn sid Leave Pickup Data sid, νa, νt sid, n P none Number P ickup Data sid, tid AddBooking (sid, tid, ν pdid, n, a, t) sid, a, t TID: int PlateNum : string IsFree : bool BID : int TaxiID : int PickupID : int PhoneID : int db-net model [Montali and Rivkin 2017], three layers: 1 Persistence: relational database with constraints. PICKUP DATA Finalize Booking 2 Data logic: queries and actions over the persistence layer. PHONE... PID : int Phone : string PDID : int Address : string Time : date 3 Control: colored Petri net with ν-variables, enriched with view places and transition-action bindings to inspect/update the persistence layer. Note: Natural formalization of contemporary process modeling suites! Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (20/20)

22 db-nets: marrying colored Petri nets and databases... TAXI sid Proceed To Booking F reedrivers tid, pn sid Reserve (tid, pn) Create Booking sid sid sid, tid BOOKING Reserved T axi sid Leave Phone Number sid, νn sid Leave Pickup Data sid, νa, νt sid, n P none Number P ickup Data sid, tid AddBooking (sid, tid, ν pdid, n, a, t) sid, a, t TID: int PlateNum : string IsFree : bool BID : int TaxiID : int PickupID : int PhoneID : int PICKUP DATA Finalize Booking PHONE... PID : int Phone : string PDID : int Address : string Time : date db-nets execution, simulation, verification [Montali and Rivkin 2017]: Foundational results thanks to translation to DCDSs. Ongoing implementation effort inside Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (20/20)

23 Acknowledgements Thanks to the many people who contributed interesting ideas, suggestions, discussions, and collaborated to the presented results. Giuseppe De Giacomo Fabio Patrizi Babak Bagheri Hariri Riccardo De Masellis Alin Deutsch Paolo Felli Rick Hull Maurizio Lenzerini Alessio Lomuscio Andy Rivkin Ario Santoso Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (21/20)

24 Thank you for your attention! Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (22/20)

25 References References I References [1] Diego Calvanese, Giuseppe De Giacomo, and Marco Montali. Foundations of Data-Aware Process Analysis: A Database Theory Perspective. In: Proc. of the 32nd ACM SIGACT SIGMOD SIGAI Symp. on Principles of Database Systems (PODS). ACM Press, 2013, pp [2] Babak Bagheri Hariri, Diego Calvanese, Giuseppe De Giacomo, et al. Verification of Relational Data-Centric Dynamic Systems with External Services. In: Proc. of the 32nd ACM SIGACT SIGMOD SIGAI Symp. on Principles of Database Systems (PODS). Extended version available at , pp [3] Marco Montali and Diego Calvanese. Soundness of Data-Aware, Case-Centric Processes. In: Int. J. on Software Tools for Technology Transfer (2016). doi: /s [4] Diego Calvanese, Giuseppe De Giacomo, Marco Montali, and Fabio Patrizi. First-Order mu-calculus over Generic Transition Systems and Applications to the Situation Calculus. In: Information and Computation (2017). To appear. Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (23/20)

26 References References II References [5] Keishi Okamoto. Comparing Expressiveness of First-Order Modal µ-calculus and First-Order CTL*. In: RIMS Kokyuroku 1708 (2010), pp [6] Fernando Rosa-Velardo and David de Frutos-Escrig. Decidability and Complexity of Petri Nets with Unordered Data. In: Theoretical Computer Science (2011), pp [7] Marco Montali and Andrey Rivkin. Model Checking Petri Nets with Names Using Data-Centric Dynamic Systems. In: Formal Aspects of Computing (2016), pp [8] Catherine Dufourd, Petr Jancar, and Ph. Schnoebelen. Boundedness of Reset P/T Nets. In: Proc. of the 26th Int. Coll. on Automata, Languages and Programming (ICALP). Vol Lecture Notes in Computer Science. Springer, 1999, pp [9] Babak Bagheri Hariri, Diego Calvanese, Alin Deutsch, et al. State-Boundedness in Data-Aware Dynamic Systems. In: Proc. of the 14th Int. Conf. on the Principles of Knowledge Representation and Reasoning (KR). AAAI Press, Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (24/20)

27 References References III References [10] Dmitry Solomakhin et al. Verification of Artifact-Centric Systems: Decidability and Modeling Issues. In: vol Lecture Notes in Computer Science. Springer, 2013, pp [11] Diego Calvanese, Marco Montali, et al. Verifiable UML Artifact-Centric Business Process Models. In: Proc. of the 23rd Int. Conf. on Information and Knowledge Management (CIKM). 2014, pp doi: / [12] Parosh Aziz Abdulla et al. Recency-Bounded Verification of Dynamic Database-Driven Systems. In: Proc. of the 35th ACM SIGACT SIGMOD SIGAI Symp. on Principles of Database Systems (PODS). ACM Press, [13] Diego Calvanese, Giorgio Delzanno, and Marco Montali. Verification of Relational Multiagent Systems with Data Types. In: Proc. of the 29th AAAI Conf. on Artificial Intelligence (AAAI). AAAI Press, 2015, pp Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (25/20)

28 References References IV References [14] Marco Montali, Diego Calvanese, and Giuseppe De Giacomo. Verification of Data-Aware Commitment-Based Multiagent System. In: Proc. of the 13th Int. Conf. on Autonomous Agents and Multiagent Systems (AAMAS). IFAAMAS, 2014, pp [15] Riccardo De Masellis et al. Add Data into Business Process Verification: Bridging the Gap between Theory and Practice. In: Proc. of the 31st AAAI Conf. on Artificial Intelligence (AAAI). AAAI Press, 2017, pp url: [16] Marco Montali and Andrey Rivkin. DB-Nets: on The Marriage of Colored Petri Nets and Relational Databases. In: LNCS Transactions on Petri Nets and Other Models of Concurrency (2017). To appear. Calvanese, Montali (FUB) Verification of Data-Aware Processes ESSLLI /07/2017 (26/20)