Modeling and Analysis of Workflow Based on TLA

Transcription

1 JOURNAL OF COMPUTERS, VOL. 4, NO. 1, JANUARY Modeling and Analysis o Worklow Based on TLA CHEN Shu Wu Han University Computer Science Department, Wu Han China Chenshu181@yahoo.com.cn WU Guo Qing Wu Han University Computer Science Department, Wu Han China wgq@whu.edu.cn Abstract We proposed an approach in modeling and analysis o worklow based on temporal logic o action. A worklow model is divided in to two parts: the description o scheduler as well as database updating and the description o properties, each part is expressed in a TLA ormula. The analysis o properties is composed by scheduling analysis and database properties analysis and their proo process is equivalence to the veriication o the implementation relationship between the model ormula and the ormula o its properties. Thus, established an uniied ramework or modeling and property analysis o worklow in deerent levels. Index Terms worklow, TLA, modeling, property analysis Figure 1. Control Graph or Worklow. I. INTRODUCTION A worklow is a collection o activities that designed or the purpose o carrying out a target process, while a worklow model is a ormalized description or the abstract process as well as their dependencies[1]. Worklow technology is widely used to manage services composition, business-to-business e-commerce process integration and e-science application. A worklow model consists o several components, including activities, controllers, database, roles etc. Thus a worklow model stands on the base o its running. Besides, the property analysis o a worklow model is becoming a critical step. However, the worklow property analysis needs the worklow be modeled in a ormalized way and with a well-deined semantics. The modeling o a worklow would concern two layers, control layer and database layer. Control layer ocuses on the scheduling o the worklow activities, while the underlying database layer relects the update o the data states. An intact ramework o a worklow consists o a control graph, triggers and properties. Control graph as showed in Figure 1 provides a global view or the dependencies o the activities. A typical control graph consists o a initial state, a set o termination states, a set o activity states, and a set o directed edges that connect these state nodes. Figure 1 shows a super control graph that eliminates the pseudo nodes. The edges that connect the nodes could be Figure 2. Trigger or Worklow. considered as a conditional transition. As part o the control graph, triggers are interpreted by ECA rules, that is event, condition and action. As showed in Figure 2, when event happen and condition holds, then the corresponding action would be activated. Events could also be considered as special activities and incorporate them directly into the control graph in appropriate spots. Under the control layer lays the database layer, which relects the update o the data states by the operations o users. Properties o worklow are divided into control properties and data properties, in which control properties deines the scheduling constraints such as sequence or dependencies o the running activities, while data properties describes the data constraints during the worklow execution lie cycle. Common approaches or the modeling o worklow are Petri-net[2, 3], UML activities graph[4, 5], process algebra[6] etc. However, these approaches did not provide an uniied ramework or the modeling o control and data as well as property analysis. The most popular approach is to use Petri-net to model worklow, however, This paper is supported by 863 National High-Tech Research and Development Plan, China, (2007AA01Z185)

2 28 JOURNAL OF COMPUTERS, VOL. 4, NO. 1, JANUARY 2009 has ignored deects in the interpreting o data states. UML activity graph is also used in modeling worklow, but have diiculties in reasoning and veriication o properties because o its semi- ormalized semantics. Process algebra such as CCS, CSP, LOTOS modeling worklow by making every activity as a process, and executed in the system transition. Properties are described in temporal logic, and veriied by model checker, however, can not avoid the state space explosion. And more over, this approach still has problems in interpreting data states. Logic could provide a precise description or the worklow model, and comprehensive mechanism or reasoning and veriication o properties. Davulcu[7] used concurrent transaction logic(ctr) to model worklow, however, limited in control layer, thus can not provide the reasoning and veriication in data properties. For the problems that existed, we proposed an approach to model and analysis worklow based on temporal logic o actions (TLA), not only supplies the modeling o control and data, but also provides reasoning and veriication or their properties. The paper is organized as ollowing: section shows an over view o temporal logic o actions, and section discuss about the modeling o worklow using TLA, as well as the property analysis. Besides, a case or our approach is also given in section to demonstrate its using. Finally, we give conclusion and urther works in section. II. OVER VIEW OF TLA Temporal logic o actions as an extension o traditional temporal logic, is used or developing, describing and reasoning about concurrent and reactive systems [8, 9]. The semantic o TLA is based on behaviors, which is a inite or ininite sequence o states. A state is a mapping rom the variable to its value. Let s be a state, x as a variable, then the value o x is s(x). We then give the ollowing deinition that may appear in TLA: (1) A state unction is a non-boolean expression built rom variables and constant symbols, such as x 2 +y+3, and always written as. The semantic o a state unction is expressed as [], which means the value o that unction under a given state s. Formally described as: s[ ] ( ' v': s[ v]/ v). (2) A state predicate, called a predicate or short, is a boolean expression built rom unprimed variables and constant symbols, always write as P. like state unction, semantic o predicate is expressed as s[p], which means the boolean value o that predicate under a given state s. Formally described as : s[ P] P( ' v': s[ v]/ v). (3)An action is a boolean-valued expression ormed by unprimed variables, primed variables, and constant symbols. always write as A. Primed variables are labeled by, which means the ater-value o a variable ater an action was executed. Semantic o action is expressed as s[a]t, thus an action is considered as a beore and ater predicate, and speciies a possible step in a behavior o a system, in which unprimed variables reer to the irst state o a step and primed variables reer to its second state. Besides, a predicate could be considered as an action with out primed variables. Formally described as: s[ At ] A( ' v': sv [ ]/ vtv, [ ]/ v). The pair o states s, t is called an A step i and only i s[a]t equals true. I action A represents an atomic operation o a system, then s, t is an A step i and only i executing the operation in an old state s o the system can produce a new state t. A typical raw TLA ormula called RTLA or is a composition o state unctions, predicates and actions that introduced above. Its syntax could be described in BNF ormat as: or p or or or or. A TLA ormula is on the base o RTLA by adding initial condition, and airness property. In order to make it clearer to describe, we call them as T-TLA, short or Traditional-TLA. Thus, a T-TLA ormula is consist o three parts such as : Init [ N] F, and we give descriptions or each part as ollowing: Init: a predicate that speciying the initial values o variables. N: donates the next-state relation which represent the executions o individual atomic perormances. : donates all the lexible variables in a n-tuple. F: represents the conjunction o ormulas o the orm o WF ( A ) or SF ( A) which donates the weak or strong airness o a system, and symbol A donates an atomic action in the ormula. T-TLA ormulas that added process algebra are called P-TLA[10]. P-TLA diered with T-TLA in adding concurrent operators on them, to express the dependencies o the TLA actions. Let A and B be dierent TLA actions, we then have the ollowing P-TLA operator deinitions: AB ; : a sequential execution, which means execute A and then B. A B : an indeterminate execution, which means execute A or B, can be used to express or relation in control graph o a worklow. A B : a concurrent execution, which means interleave execute A and B, can be used to express and relation in control graph o a worklow. ( A )*: a loop execution, which means keep doing A orever. A : an interrupt o a loop, which means execute A, then exit rom the innermost containing ( )*.

3 JOURNAL OF COMPUTERS, VOL. 4, NO. 1, JANUARY Each action or called P-TLA sub-expression that connected by the operators showed above could be considered as an RTLA ormula, however, extended with a label, such as l: A. A label can be attached to any sub-expression o a P-TLA ormula, and should be unique within the corresponding P-TLA ormula. Then the ollowing actions and predicates are deined:,,,,,, l pc v v v : A TLA action. A step o this action 1 2 n consists o perorming a step o one o the sub actions o A. AT l pc, v1, v2,,, v n, : This predicate asserting that control is at the beginning o the sub-expression. IN l pc, v1, v2,,, v n, : This predicate asserting that control is at the beginning or somewhere inside the subexpression. AFTER l pc, v1, v2,,, vn, : This predicate asserting that control is immediately ater the sub-expression. Assume a control variable pc, distinct rom all variables that appear in primitive actions. We could have the semantics or P-TLA ormulas by deining, or each P- TLA p: A collection o constants Lp called labels, with a distinguished element AT(p) called the AT label. Collection o actions Ap o the orm ( pc l) ( pc ' k) A, where A is an P-TLA subexpression action in which pc does not occur, l LP, and k is either a label in Lp or one o the special constants Done or Exit, which means the termination o P- TLA actions. Hiding is expressed with the ordinary TLA quantiier. The ormula x : F is true o a behavior i and only i there exists some sequence o values, one in each state o the behavior that can be assigned to the variable x that will make ormula F true. With the introduction or TLA given above, we could start using TLA or the modeling and analysis o worklow.. MODELING AND ANALYSE OF WORKFLOW A. Modeling worklow Control graph o a worklow is a directed graph, and could be deined by a our group: <ATINIFIN>, in which A is a set o activity nodes, T is a set o edges that connect those activity nodes. INI is the initial node, while FIN is a set o terminated nodes. Just like we stated above, the model o a worklow is divided into two parts, the part that describe the control graph with the underlying database, and the part that describe properties. A control graph is described in a P-TLA ormula, updates o data base state are represented as P-TLA sub-expressions that relects to each activity. Properties are deined in a T- TLA ormula in which contains an initial predicate, a next state relation and a airness. The ollowing TLA ormulas describes the model showed in Figure 1. low( pc) ( con1; d; ) a ; b; ; g; con4 e ( con3; h) c ; ; j ; lk : k i; con2) Spec pc, hidden : initial( hidden) AT ( low( pc)) constrs [ lowpc ( )] SF ( lowpc ( )) pc, hidden, state pc Formula low(pc) demonstrate how the control graph o a worklow could be transormed into a P-TLA ormula. Activities in the control graph are labeled by a b, and single activity appears in the orm o (pcaction), which describes the beore-and-ater data state o the execution o that activity. For example, activity a in this model could be deined as: a( pc) l : acta( x, x.. x ) x x x. a 1 2 n state { 1, 2.. n } in which la is the value o parameter pc that used to label an activity. TLA action act_a(..) describes the nextrelation o that execution. State unction state shows the current data state. By the deinition o TLA action, a TLA action is a binary relation over a pair o states such as s1, s2, thus a TLA action could be considered as an update o a global date state state. In the example above, the execution o activity a(pc) update the value x1,x2 xn in state and leaves other values unchanged, this was expressed by adding an stuttering step: state x1 x2 x n {,,,, }. Symbols con1..con4 are predicates, deines the transition condition in the control graph. As predicate is s special TLA action, thus predicates could be treated as a special query activity in TLA worklow model without updating data state. T-TLA ormula Spec deines the basic properties o the worklow, and consisted by our parts: Initial condition, control properties, next relation and airness constraints. In the example above, initial condition AT(low(pc)) asserts that the worklow should start rom the initial activity. Control properties constrs deines the scheduling constraints. TLA action [low(pc)] shows that the worklow should keep on working. Strong airness asserts that either the activities in worklow is eventually executed, or its execution is not ininitely oten possible. B. Analyse o worklow According to the modeling approach that we have introduced previously, a worklow model is divided into P-TLA part that deines the global dependencies o the activities with data update, and the T-TLA part that deines the properties. The properties made restrictions on the scheduling as well as database. However, the initial condition, next-step relation and airness are all

4 30 JOURNAL OF COMPUTERS, VOL. 4, NO. 1, JANUARY 2009 generic constraints, thus speciic constraints should be established or every certain worklows to meet the requirements. In TLA, properties could be simply divided into invariance properties and eventuality properties. An invariance property is always expressed by a TLA ormula P, where P is a predicate, and an eventuality property is always expressed by P or P~>Q. Based on these two kinds o properties, we would extend them in control properties and data properties. For example, TLA ormula (T<100) describes a data based invariance property, which has the meaning o system temperature should not beyond 100 degree, and TLA ormula: l b ~>l g describes a control based eventuality property, and has the meaning o i activity b is executed, then activity g should be executed eventually. In the modeling approach that introduced in in section part A, predicate constrs describes a control property that a worklow should hold. predicate constrs is a conjunction o a set o sub predicates, in the way o: constrs c c2 c n and determined by requirements. So let low be a P-TLA worklow model, then we would have the relation as: low' low constrs. in which low donates the P-TLA worklow model low that iltered by constraints constrs. The relation between low and low are represented by a special operator spec deined as : low' spec( constrs, low). The meaning o spec is that applying constraints constrs on model low and get a model low that satisies constrs. By the use o spec, the example showed in section part A should be modiied as: Spec pc, hidden : initial( hidden) AT ( spec( constrs, low( pc) )) [ spec( constrs, low( pc))] pc, hidden, state SF ( spec( constrs, low( pc))) pc and equivalence to the ollowing ormula: Spec init low' [ low'] state SFpc ( low'). We irst discuss about control properties. Based on the operator spec, we give the ollowing axioms: spec( a, a) a (1) spec( a, b) nulli a b (2) spec( a, a) null (3) spec( a, b) b (4) spec( a, a b) a (5) spec( a, a b) a b (6) Let T and K be two dierent T-TLA ormula, we then have the ollowing deduction Inerences rom the axioms above: spec( a, T; K) (7) spec( a, T); K T; spec( a, K) spec( a, T K) spec( a, T ) spec( a, K) (8) spec( a, T K) (9) spec( a, T ) K spec( a, K) T i G T K and have spec( a, T ) T, spec( b, K ) K, then we have spec( a, G) spec( b, G) (10) i G T K and have spec( a, T ) T, spec( b, K ) K, then we have G spec( a, G) spec( b, G) (11) Examples o how to use spec to describe properties are given as ollowing: Let G a P-TLA model o a worklow, property a b, which means in model G, i a is executed, then b would eventually be executed, is represented as : spec(, G) and spec(, G) spec( b, spec( ag)) spec( ag) Property work low would terminate normally could be represented as: spec(, G) FIN in which FIN is the set o terminated activities. Now we come to data properties. Invariance properties are always expressed in the orm o P, in which P is a predicate, such as (T<100), (x>y). Eventually properties are always represented in the way o P, P~>Q, where P and Q are both predicates. Let c be a data property, then the proo o c is equivalence to the proo o Spec=>c, where Spec is the basic constraint deined in model. Proo o invariance properties could be reasoned by the ollowing common rules(details o proo rules are showed in Leslie Lamport[8]): ( P ( ' ) ( P P[ P P '] )) I ( [ N] [ N I I'] ) ( I [ N] I') (( I [ N] ) I) (12) (13) (14) To the rules above, P is a predicate, I is an invariant, N is a TLA action, is a state unction. According to the expression Spec init '), the low' [ low'] state SFpc ( low goal is to proo the implementation relation Spec=>P, and the main idea is to ind out an invariant I to satisy the ollowing: Init I (15) I P (16)

5 JOURNAL OF COMPUTERS, VOL. 4, NO. 1, JANUARY I [ low] I ' (17) state P[ low] state P' (18) I premise (15) ~ (17) hold, then solution (18) holds. According to the deinition o Spec and ormula (1), we have the implementation relation: Spec init [ low] state and then have Spec I [ low] state, by the ormulas (18) and (14), we could have the result. The key Spec P. idea o this prooing is to ind out the invariant I. A state predicate I is an invariant o a speciication S, i S implies However, sometimes predicate P could be treated as I. Dierent with the proo o invariance properties, the proo o eventuality properties relies on the airness predicates. Common rules or its proo are listed as ollowing: P [ N] ( P' Q') PN A Q' (20) P EnableA (19) (21) N SF A P Q (22) [ ] ( ) ( ~ ) I premise ormula (19) ~ (21) hold, then ormula (22) holds. According to the rules above, let P and Q be two dierent predicates, the key idea o prooing Spec ( P ~ Q) is to ind out a sub control low low which is enabled by predicate P and the execution o low make predicate Q holds, then let action A be substituted with low, action N be substituted with low, then we would have the ormula: ( Spec ' [ low] ) holds. As we have SF ( low')) ( P ~ Q Spec Spec ', then we would have the implementation relation: Spec=>(P~>Q). We have discussed about control properties and data properties above and separately. However, when in practice, data properties are always associate with control constraints, which means a data properties should only necessary to be hold at the assumption o some certain selected control path. A simple example would demonstrate this: only when a customer chooses to buy a Book-A, would its stock amount decreases. This simple property contains two elements: one is o a control assumption that, a customer chooses to buy a Book-A, the other is o a data property that the stock amount o Book- A should decrease. However, this data property only needs to be hold under the assumption o the control selection, otherwise, need not to be hold. Thus a uniied ramework or speciying both control and database state o worklow would take the advantage in reasoning the properties o such condition. C. Case Study The ollowing case shows a worklow or a trip planning. We irst give a short description or this case, and then we demonstrate how to model the worklow and how the properties are veriied. As we could see in Figure 3 which shows the control graph o this case, the control starts rom a start activity and demand or customer s eedback. When customer agree with the trip scheduling, they could choose to purchase trip canceling insurance, accident insurance or purchase nothing. When decision was made, they wait or the traveling day to come. This may come to a contretemps that the trip may be canceled, or had accident during the trip or ortunately, started and inished normally. I the customer had purchased cancel insurance or accident insurance, they would have the corresponding compensation. As we could see in this example, the low is consisted o a set o activities as well as its guard and several predicates. Under the control low, lays the un-observational data base and when activities are executed during a running lie cycle, data base state might be changed each. Time related events may be concerned in the way that, when time arrivals the corresponding activity should be executed. Table I demonstrates the description o every activities and predicates that appear in the control graph. By the descriptions, we irst give the P-TLA model as ollowing: low( pc) Start; Soleedback; con1; Travelreg; ( con2; Pur c ins) ( con3; Purains) ; 4 con Pretravel; con5; Starttravel; con6; Accoccur;(( con8; Compcus) 9) ; con End 7 con con10; Canceltravel;(( con11; Compcus) ; con12) End According to requirement, our properties could be described as i customer has purchased accident insurance, then i accident occurs, the customer would eventually be compensated. According to this properties, we could see that it has a control property accident occurs, and under this control constraint, a data constraint should hold. Let pconstrs be control constraint, and sconstrs be data constraint, the T-TLA ormula and proo goal could be represented as: Spec pc, hidden : initial( hidden) AT ( spec( pconstrs, low( pc))) [ spec( pconstrs, low( pc))] pc, hidden, state SF ( spec( pconstrs, low( pc))) pc

6 32 JOURNAL OF COMPUTERS, VOL. 4, NO. 1, JANUARY 2009 Figure 3. Control Graph or Worklow. TABLE I. DESCRIPTIONS OF ACTIVITIES AND PREDICATES Start Start to execute the low Sol_eedback Soliciting customer s eedback Travel_reg Registering traveling Pur_c_ins Purchase cancel insurance Pur_a_ins Purchase accident insurance Pre_travel Prepare or traveling Start_travel Start traveling Cancel_travel Cancel traveling Acc_occur Accident occurs Comp_cus Compensate customers End End executing Con1 I customer agree to travel Con2 I customer agrees to purchase cancel insurance Con3 I customer agrees to purchase accident insurance Con4 I customer does not agree to purchase Con5 I time reaches and travel starts any insurance Con6 I accident occurs Con7 I accident does not occur Con8 I customer has accident insurance Con9 I customer does not have accident insurance Con10 I time reaches and travel canceled Con11 I customer has cancel insurance Con12 I customer does not have cancel insurance Spec sconstrs As we have introduced in section part A, a single activity o a worklow is deined as: a( pc) l : acta( x, x.. x ). a 1 2 n state { x1, x2.. xn } According to this, we give deinitions or primary activities as ollowing: First deine database state that would be used in our activity deinition: state time : INT, cancelinsu : BOOL, accinsu : BOOL, hascancel : BOOL, hasaccident : BOOL, paycus : BOOL, agreeaccinssu : BOOL... The state deined above donates the data base o our example: time, a integer type simply donates the time progress, and relects the time based event in the way that when an activity is executed, the variable time would increase, and when the time satisies the guard o a time based event, the corresponding activity would be activated. Variable cancelinsu represents whether a customer choose to purchase a cancel insurance, while accinsu represents whether a customer choose to purchase an accident insurance. Variable hascancel represents whether a trip has been canceled and hasaccident represents whether accidents has occurred during the trip. Variable paycus donates whether the customer has had compensation and agreeaccinssu represents whether a customer already got an accident insurance. Notice that, when in practice, a time constraints would be much more complex, thus more deinitions should be made on time such as time progression, clock or timer, however, this is not what our paper ocus, thus we only give a raw deinition in the way to increase variable time in every execution o a activity. Based on the data state given above, the primary activities are given as below:

7 JOURNAL OF COMPUTERS, VOL. 4, NO. 1, JANUARY // action Purchase cancel insurance actpurcins cancelinsu alse cancelinsu ' true time' time 1 // action Purchase accident insurance actpurins accinsu alse accinsu ' true time' time 1 // action Start_travelling actstarttravel time deadline time' time 1 // action Cancel_travelling actcanceltravel hascancel alse hascancel ' true time' time 1 // action Accident_occurs actaccoccur hasaccident alse hasaccident ' true time' time 1 // action Compensating actcompcus paycus alse paycus ' true time' time 1 // predicate con3 con3 agreeaccinsu ture // predicate con5 con5 time deadline hascancel alse // predicate con6 con6 hasaccident ture // predicate con8 con8 accinsu ture Thus property i accident occurs, the customer would eventually be compensated, could be represented as: pconstrs Acc _ occur sconstrs ( accinsu true) ~ ( paycus true) The validation o this property is equivalence to the proo o implementation relation: Spec sconstrs. Let low (pc) = spec(pconstrs, low(pc)), by the rules o spec given in previously, the expression o low (pc) is showed as ollowing: low'( pc) Start; Soleedback; con1; Travelreg; ( con2; Pur c ins) ( con3; Pur _ a _ ins) ; Pre _ travel; 4 con con5; Starttravel; con6; Accoccur;(( con8; Compcus) con9) ; End con7 Spec ' pc, hidden : initial( hidden) AT ( low'( pc)) [ low'( pc)] SF ( low'( pc) ) pc, hidden, state pc By the deinition o Spec, it is clearly that we have Spec Spec '. Let P personassu ture, and Q paycus ture, the proo is equivalence to Spec ' P ~ Q, by the proo rules given previously, we have the ollowing ormulas: P[ low'( pc)] ( P' Q') (23) P low'( pc) low''( pc) Q ' (24) P Enablelow''( pc) (25) [ low'( pc)] SF ( low''( pc)) ( P ~ Q) (26) I (23),(24) and (25) hold, then (26) holds. According to (28) and the deinition o predicate P, we could see that in low (pc), ater activity Pur_a_ins was executed, then would have predicate P true. According to (24) and the deinition o predicate Q, we see that ater activity Comp_cus was executed, then would have predicate Q true. Thus i a sub-low low (pc) in which Pur_a_ins and Comp_cus eventually executed: low''( pc) spec( Compcus, spec( Purains, low'( pc))) and low''( pc) Start; Soleedback; con1; Travelreg; con3; Purains; Pretravel; con5; Starttravel; con6; Accoccur; con8; Compcus; End Then according to ormula (26) and ormula Spec ' [ low'( pc)], we could have the SF ( low''( pc)) implementation relation: Spec ' P ~ Q holds, and the eventually property P ~ Q holds. Which means, under the control constraint pconstrs, the data constraint sconstrs holds. From this example, we see that the modeling and validate o properties o a worklow are done in an uniied ramework and data properties are always related with control constraints. When in practice, situation would be much more complex, however, special operator spec would help us to minimize the control path and eicient algorithm could be designed.. CONCLUSION AND FURTHER WORKS In this paper, we used TLA or the modeling and analysis o worklow, and established an uniied ramework or the reasoning and validation o control and data properties. Compared with other modeling approaches, TLA has its advantages in providing a simpler and uniorm way to describing both control and database actors, as well as or their properties reasoning and veriication. We demonstrate several comparisons showed in Table II. In our approach, control graph will be constructed by TLA concurrent operators, and represented by a P-TLA ormula in which each activity is represented by a label and action pair, and relect the database update in every execution. Properties are represented by a T-TLA

8 34 JOURNAL OF COMPUTERS, VOL. 4, NO. 1, JANUARY 2009 TABLE II. COMPARISON OF DIFFERENT WORKFLOW MODELING APPROACHES Modeling Formalization Has data Has control Features approach description description Notation General no yes Easy to use UML activity General No yes Easy to use Petri net Strict No yes Good at analysis in control properties TLA logic Strict no yes Good at analysis in control and data properties ormula, and introduced operator spec to TLA to iltrate the model that satisies the corresponding control constraints. By the rules o the speciic operator, eicient algorithm could be designed or the property veriication. The reasoning o properties is simple like the proo o normal TLA ormulas. As we can see, the validation o data property may base on the control properties. Thus, a uniied ramework would be better or properties reasoning. Besides, automated TLA prove method and the corresponding tools are existed, so it is possible or us to automatically reason the worklow properties. On the base o this approach, the composition o worklow model would be listed in our urther works. Task reinement as well as its soundness validation is one kind o worklow composition approaches. More over, the way o describing the semantics o time constraints, resource and other actors o worklow would be concerned into our urther study. REFERENCES [1] D.Georgakopoulos, M. Hornick, A. Sheth, An overview o worklow management: From process modeling to worklow automation inrastructure. Distributed and Parallel Databases, 1995, 3 (3): [2] Salimiard K, Wright M. Petri net based modeling o worklow systems: An overview. European Journal o Operational Research, 2001, 134 (3): [3] W.M.P van der Aalst. The application o Petri nets to work low management. The Journal o Circuits, Systems and Computers, 1998, 8 (1): [4] Marlon Dumas and Arthur H.M. ter Hostede. UML Activity Diagrams as a Worklow Speciication Language. In Proceedings o the UML' 2001 Conerence, Cooperative Inormation Systems Research Centre, Queensland University o Technology. [5] R.Eshuis, R.Wieringa. Veriication support or worklow design with UML activity graphs. The 24th Int l Con on Sotware Engineering, Orlando, USA, [6] Salomie, Ioan Cioara, A Layered Worklow Model Enhanced with Process Algebra Veriication or Industrial Processes. Intelligent Computer Communication and Processing, 2007 IEEE. [7] Davulcu H, Kier M, Ramakrishnan C, Ramakrishnan I. Logic based modeling and analysis o worklows. In : Proceedings o the ACM Symposium in PODS 98, Seattle, USA, [8] Leslie Lamport. The Temporal Logic o Actions[J]. ACM Transactions, [9] Leslie Lamport. veriication and speciication o concurrent programs. proceedings o a REX Workshop, Netherlands, June, [10] Leslie Lamport. Adding Process Algebra to TLA. First A. Author Chen Shu, 01/30/1981 Bachelor degree in computer science WuHan university computer science department WuHan P.R.China, Master degree in sotware engineering WuHan university sotware department WuHan P.R.China, PHD candidate in sotware engineering WuHan university sotware department WuHan P.R.China. Majored in sotware engineering, sotware ormalization and automation. Second B. Author Wu Guo Qing, 10/1954 Proessor, doctoral tutor in WuHan university computer science department. Majored in sotware engineering, sotware ormalization and automation.