The document discusses approaches for modeling processes and data, focusing on ensuring state-boundedness. It describes the concept of data-centric dynamic systems (DCDSs) and how subclasses with decidable state-boundedness correspond to variants of Petri nets. While checking state-boundedness is undecidable in general, the document outlines strategies like identifying syntactic conditions or designing methods that guarantee it. It also discusses how modeling languages can combine unboundedly many cases while retaining verification decidability through data isolation and relative boundedness.

1. Integrated Modeling and Verification of
Processes and Data
Exploiting DCDSs: models, methods, concrete systems
Diego Calvanese, Marco Montali
Research Centre for Knowledge and Data (KRDB)
Free University of Bozen-Bolzano, Italy
KRDB
1
15th International Conference on Business Process Management
Barcelona, Spain – 12 September 2017

2. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
The story so far, with main references
The need of combining (business) processes and data.
[Calvanese, De Giacomo, and Montali 2013]
A pristine formalism for data-aware business processes: DCDS.
[Bagheri Hariri, Calvanese, De Giacomo, et al. 2013; Montali and Calvanese 2016]
Suitable verification logics for data-aware processes.
[Bagheri Hariri, Calvanese, De Giacomo, et al. 2013; Calvanese, De Giacomo,
Montali, and Patrizi 2017]
Corresponding characterization theorems.
[Calvanese, De Giacomo, Montali, and Patrizi 2017]
A decidability map, with an unexpected dichotomy between
µLA and LTL-FOA.
[Bagheri Hariri, Calvanese, De Giacomo, et al. 2013; Calvanese, De Giacomo,
Montali, and Patrizi 2017]
Note: Incorrect results in [Bagheri Hariri, Calvanese, De Giacomo, et al. 2013;
Okamoto 2010] fixed in [Calvanese, De Giacomo, Montali, and Patrizi 2017].
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (1/16)

3. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
How to check/ensure state boundedness?
Theorem
Checking whether a DCDS is state-/run-bounded is:
Decidable for a given bound.
Undecidable for an unknown bound.
Three possible strategies:
Single out classes of DCDSs for which checking state-/run-boundedness
is decidable.
Identify sufficient syntactic conditions that are decidable to check, and
that guarantee state-/run-boundedness
cf. syntactic conditions for chase termination in data exchange.
Devise modeling methodologies that guarantee state boundedness.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (2/16)

4. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
How to check/ensure state boundedness?
Theorem
Checking whether a DCDS is state-/run-bounded is:
Decidable for a given bound.
Undecidable for an unknown bound.
Three possible strategies:
Single out classes of DCDSs for which checking state-/run-boundedness
is decidable.
Identify sufficient syntactic conditions that are decidable to check, and
that guarantee state-/run-boundedness
cf. syntactic conditions for chase termination in data exchange.
Devise modeling methodologies that guarantee state boundedness.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (2/16)

5. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
DCDSs with decidable state-boundedness
Fact
DCDSs using only unary relations correspond to variants of Petri nets.
The specific variant depends on the features used in the DCDS.
Note: State-boundedness relate to boundedness in Petri nets.
Petri nets with name management
Decidable boundedness.
[Rosa-Velardo and Frutos-Escrig 2011]
t
p2 c e
p1
a
a c
p4
p3
p5
y
xxy xxν1
ν1ν2
[Montali and Rivkin 2016]
Translation to DCDSs and µLP verification.
Reset-Transfer Nets
Undecidable boundedness.
[Dufourd, Jancar, and Schnoebelen 1999]
p0
t1
p1
p2
t2
p3
t3
p4
p2
p2
p2
[Bagheri Hariri, Calvanese, Deutsch, et al. 2014]
“Lossy” correspondence with DCDSs.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (3/16)

6. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
DCDSs with decidable state-boundedness
Fact
DCDSs using only unary relations correspond to variants of Petri nets.
The specific variant depends on the features used in the DCDS.
Note: State-boundedness relate to boundedness in Petri nets.
Petri nets with name management
Decidable boundedness.
[Rosa-Velardo and Frutos-Escrig 2011]
t
p2 c e
p1
a
a c
p4
p3
p5
y
xxy xxν1
ν1ν2
[Montali and Rivkin 2016]
Translation to DCDSs and µLP verification.
Reset-Transfer Nets
Undecidable boundedness.
[Dufourd, Jancar, and Schnoebelen 1999]
p0
t1
p1
p2
t2
p3
t3
p4
p2
p2
p2
[Bagheri Hariri, Calvanese, Deutsch, et al. 2014]
“Lossy” correspondence with DCDSs.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (3/16)

7. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
DCDSs with decidable state-boundedness
Fact
DCDSs using only unary relations correspond to variants of Petri nets.
The specific variant depends on the features used in the DCDS.
Note: State-boundedness relate to boundedness in Petri nets.
Petri nets with name management
Decidable boundedness.
[Rosa-Velardo and Frutos-Escrig 2011]
t
p2 c e
p1
a
a c
p4
p3
p5
y
xxy xxν1
ν1ν2
[Montali and Rivkin 2016]
Translation to DCDSs and µLP verification.
Reset-Transfer Nets
Undecidable boundedness.
[Dufourd, Jancar, and Schnoebelen 1999]
p0
t1
p1
p2
t2
p3
t3
p4
p2
p2
p2
[Bagheri Hariri, Calvanese, Deutsch, et al. 2014]
“Lossy” correspondence with DCDSs.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (3/16)

8. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
Attacking state-boundedness
The class of DCDSs with decidable state-boundedness very restrictive
These variants of Petri nets corresponds to DCDSs with only unary relations,
limited use of negation, no or limited joins, . . .
How to check/guarantee that a DCDS is state-bounded?
Sufficient, syntactic conditions:
Extract a data flow graph from
the DCDS.
Check sources of unboundedness
through this graph.
See [Bagheri Hariri, Calvanese, De Giacomo,
et al. 2013] and [Bagheri Hariri, Calvanese,
Deutsch, et al. 2014].
State-boundedness by design:
Design methods for state-bounded
DCDSs. In [Solomakhin et al. 2013]:
Processes are bound to evolving
business objects (artifacts).
Each business object manipulate
boundedly many data.
(New) business objects pick their
names from a fixed pool of ids.
More sophisticated techniques in
[Montali and Calvanese 2016; Calvanese,
Montali, et al. 2014].
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (4/16)

9. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
Attacking state-boundedness
The class of DCDSs with decidable state-boundedness very restrictive
These variants of Petri nets corresponds to DCDSs with only unary relations,
limited use of negation, no or limited joins, . . .
How to check/guarantee that a DCDS is state-bounded?
Sufficient, syntactic conditions:
Extract a data flow graph from
the DCDS.
Check sources of unboundedness
through this graph.
See [Bagheri Hariri, Calvanese, De Giacomo,
et al. 2013] and [Bagheri Hariri, Calvanese,
Deutsch, et al. 2014].
State-boundedness by design:
Design methods for state-bounded
DCDSs. In [Solomakhin et al. 2013]:
Processes are bound to evolving
business objects (artifacts).
Each business object manipulate
boundedly many data.
(New) business objects pick their
names from a fixed pool of ids.
More sophisticated techniques in
[Montali and Calvanese 2016; Calvanese,
Montali, et al. 2014].
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (4/16)

10. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
Attacking state-boundedness
The class of DCDSs with decidable state-boundedness very restrictive
These variants of Petri nets corresponds to DCDSs with only unary relations,
limited use of negation, no or limited joins, . . .
How to check/guarantee that a DCDS is state-bounded?
Sufficient, syntactic conditions:
Extract a data flow graph from
the DCDS.
Check sources of unboundedness
through this graph.
See [Bagheri Hariri, Calvanese, De Giacomo,
et al. 2013] and [Bagheri Hariri, Calvanese,
Deutsch, et al. 2014].
State-boundedness by design:
Design methods for state-bounded
DCDSs. In [Solomakhin et al. 2013]:
Processes are bound to evolving
business objects (artifacts).
Each business object manipulate
boundedly many data.
(New) business objects pick their
names from a fixed pool of ids.
More sophisticated techniques in
[Montali and Calvanese 2016; Calvanese,
Montali, et al. 2014].
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (4/16)

11. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
State-boundedness in concrete process modeling languages
Classical BPM languages/suites
Central notion of case representing a process instance.
Each case carries its own case data, in isolation to the other cases (e.g.,
order details, customer address, . . . ).
Cases interact by accessing a central, persistent data storage.
Artifact-centric approaches:
Central notion of business object gluing data and behaviour together.
All data relevant to a business object are attached to it.
Processes may query multiple business objects at once, to determine the
possible next steps.
External and internal stakeholders. . .
New cases/business objects are created upon events issued by external
stakeholders (e.g., new order request).
But then they are bound to internal resources, responsible for progressing
the corresponding process instances.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (5/16)

12. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
State-boundedness in concrete process modeling languages
Classical BPM languages/suites
Central notion of case representing a process instance.
Each case carries its own case data, in isolation to the other cases (e.g.,
order details, customer address, . . . ).
Cases interact by accessing a central, persistent data storage.
Artifact-centric approaches:
Central notion of business object gluing data and behaviour together.
All data relevant to a business object are attached to it.
Processes may query multiple business objects at once, to determine the
possible next steps.
External and internal stakeholders. . .
New cases/business objects are created upon events issued by external
stakeholders (e.g., new order request).
But then they are bound to internal resources, responsible for progressing
the corresponding process instances.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (5/16)

13. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
RIAW-nets [Montali and Rivkin 2016]
tg
i
check
in-house repair
do repair
write summary
external repair
start
shipping
write report
prepare package
assemble
print receipt
o tr
ν x x
x
x
x x x x
x
x x
x
x
x
x
x
x
x
x
x
x x
x x x
HW expert
shipping clerk secretary
RIAW-nets = ν-PNs + workflow nets
Emitter transition generating a new process id when fired.
Control-flow name matching to selectively spawn/synch tokens using their id.
Resource places to bound the number of simultaneously coexisting active
process instances! (but unboundedly many over time).
Decidability of model checking via translation to state-bounded DCDSs.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (6/16)

14. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
Data isolation and case unboundedness
What if the number of simultaneously active cases cannot be bounded?
In [Montali and Calvanese 2016; Calvanese, Montali, et al. 2014], we show that
decidability of model checking can be retained, if the system obeys to:
relative boundedness (each case manipulates boundedly many data);
data isolation (cases interact very weakly).
State Group MarryM
group state id id combatLevel group
12 out • • 12 76 pro null
4 in • • 4 • • 19 basic 4
431 running • • 431 • • 56 ok 431
. . . • 3 basic 431
• 98 ok 431
Modeling guidelines to guarantee data isolation and relative boundedness:
1 Queries must be navigational (no arbitrary access to relations).
2 1-to-many relations require a number restriction on the “many” side.
3 Each case cannot create a chain of tuples of unbounded lenght.
4 Cases can share tuples only in a controlled way (no construction of chains).
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (7/16)

15. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
Data isolation and case unboundedness
What if the number of simultaneously active cases cannot be bounded?
In [Montali and Calvanese 2016; Calvanese, Montali, et al. 2014], we show that
decidability of model checking can be retained, if the system obeys to:
relative boundedness (each case manipulates boundedly many data);
data isolation (cases interact very weakly).
State Group MarryM
group state id id combatLevel group
12 out • • 12 76 pro null
4 in • • 4 • • 19 basic 4
431 running • • 431 • • 56 ok 431
. . . • 3 basic 431
• 98 ok 431
Modeling guidelines to guarantee data isolation and relative boundedness:
1 Queries must be navigational (no arbitrary access to relations).
2 1-to-many relations require a number restriction on the “many” side.
3 Each case cannot create a chain of tuples of unbounded lenght.
4 Cases can share tuples only in a controlled way (no construction of chains).
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (7/16)

16. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
Data isolation and case unboundedness
What if the number of simultaneously active cases cannot be bounded?
In [Montali and Calvanese 2016; Calvanese, Montali, et al. 2014], we show that
decidability of model checking can be retained, if the system obeys to:
relative boundedness (each case manipulates boundedly many data);
data isolation (cases interact very weakly).
State Group MarryM
group state id id combatLevel group
12 out • • 12 76 pro null
4 in • • 4 • • 19 basic 4
431 running • • 431 • • 56 ok 431
. . . • 3 basic 431
• 98 ok 431
Modeling guidelines to guarantee data isolation and relative boundedness:
1 Queries must be navigational (no arbitrary access to relations).
2 1-to-many relations require a number restriction on the “many” side.
3 Each case cannot create a chain of tuples of unbounded lenght.
4 Cases can share tuples only in a controlled way (no construction of chains).
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (7/16)

17. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
Data isolation and case unboundedness
What if the number of simultaneously active cases cannot be bounded?
In [Montali and Calvanese 2016; Calvanese, Montali, et al. 2014], we show that
decidability of model checking can be retained, if the system obeys to:
relative boundedness (each case manipulates boundedly many data);
data isolation (cases interact very weakly).
State Group MarryM
group state id id combatLevel group
12 out • • 12 76 pro null
4 in • • 4 • • 19 basic 4
431 running • • 431 • • 56 ok 431
. . . • 3 basic 431
• 98 ok 431
Modeling guidelines to guarantee data isolation and relative boundedness:
1 Queries must be navigational (no arbitrary access to relations).
2 1-to-many relations require a number restriction on the “many” side.
3 Each case cannot create a chain of tuples of unbounded lenght.
4 Cases can share tuples only in a controlled way (no construction of chains).
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (7/16)

18. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
Beyond State-Boundedness
Question
Are there classes of DCDSs that are unbounded, but still amenable to
verification?
Key result in [Abdulla et al. 2016].
Recency-bounded data-aware processes
Unbounded DB, but only the latest inserted/accessed values can bound to
parameters.
Verification via under-approximation
Decidability by focusing only on runs that are k-recency-bounded for an
explicitly given key.
Open problem
Investigate the relationships between all such results and those where the initial
DB is not fixed, and verification is studied for every possible initial DB.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (8/16)

19. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
Beyond State-Boundedness
Question
Are there classes of DCDSs that are unbounded, but still amenable to
verification?
Key result in [Abdulla et al. 2016].
Recency-bounded data-aware processes
Unbounded DB, but only the latest inserted/accessed values can bound to
parameters.
Verification via under-approximation
Decidability by focusing only on runs that are k-recency-bounded for an
explicitly given key.
Open problem
Investigate the relationships between all such results and those where the initial
DB is not fixed, and verification is studied for every possible initial DB.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (8/16)

20. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
Beyond State-Boundedness
Question
Are there classes of DCDSs that are unbounded, but still amenable to
verification?
Key result in [Abdulla et al. 2016].
Recency-bounded data-aware processes
Unbounded DB, but only the latest inserted/accessed values can bound to
parameters.
Verification via under-approximation
Decidability by focusing only on runs that are k-recency-bounded for an
explicitly given key.
Open problem
Investigate the relationships between all such results and those where the initial
DB is not fixed, and verification is studied for every possible initial DB.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (8/16)

21. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
Incorporation of datatypes
Databases have datatypes
Numeric domains, domain-specific predicates, arithmetic.
Many coordination algorithms and auctions require dense orders.
Processes with costs and payment policies require integers and arithmetic.
Dense orders combine well with state-boundedness
Data-aware, state-bounded distributed systems with reals [Calvanese, Delzanno,
and Montali 2015]:
OK to include dense linear orders: minor extension to the standard
DCDS abstraction technique. Intuition. . .
Rigid > relation Non-rigid GreaterThan relation
over the entire domain −→ over active domain elements.
No hope to include the successor relation (or integers):
2 data slots are sufficient to encode two counters.
Discrete orders and arithmetic combine well with run-boundedness
Ongoing work. . .
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (9/16)

22. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
Relational multiagent systems and commitments
Relational MAS [Montali, Calvanese, and De Giacomo 2014]
Agents have names and hold/manipulate local, state-bounded DBs.
Agents exchange data using their names for addressing.
An institutional agent manages agent creation and deletion.
Due to state-boundedness: unboundedly many agents can dynamically enter
into the system, but at each moment only boundedly many are active.
Seller John
Customer Alice
Name
MyCust
Alice
Bob
ID
Item
i1
i2
Item
Paid
Cust
Institutional agent D.
DeliveryCC
C.
DeliveryC
Item
ACCEPT-REG
JohnAlice
Item
Owns
PAY-CC(i1)
Item
Paid
Cust
i1 Alice
D. C. State
D.
DeliveryCC
C.
DeliveryC
Item
JohnAlice
D. C. State
i1JohnAlice active
PAY-BT(Alice, i2)
Item
Paid
Cust
i1 Alice
D.
DeliveryCC
C.
DeliveryC
Item
JohnAlice
D. C. State
i1JohnAlice active
Alice's Bank
i2JohnAlice active
i2 Alice
deliver(i1,...)
Item
Paid
Cust
i1 Alice
D.
DeliveryCC
C.
DeliveryC
Item
JohnAlice
D. C. State
i1JohnAlice sat
Carrier
i2JohnAlice active
i2 Alice
Item
Owns
i1
Item
Owns
Item
Owns
Relational commitments
In the same work: first
proposal for modeling and
verifying interaction
protocols based on
relational commitments,
i.e., commitments with
data payload and multiple
instances.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (10/16)

23. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
daphne: implementing DCDSs with relational technology
DB
Engine
Flow
Engine
Service Manager
Persistent Storage
daphne
DCDS
state
DCDS Spec.
RDBMS
Native modeling and execution of DCDSs using relational DBMSs:
SQL-like syntax for DCDSs with datatypes.
Automated translation into relational DBMSs, as (temporal) tables,
constraints, and stored procedures.
Java APIs to support enactment and integration with concrete services.
Native explicit model checking of DCDSs using relational DBMSs:
Same model for execution and verification!
Special tables for storing the RTS induced by a DCDSs.
Factoring of tables into temporal and atemporal parts.
Computation of isomorphic type and value recycling in services.
Java APIs for RTS construction and search.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (11/16)

24. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
Can we cook with all ingredients?
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (12/16)

25. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
BAUML: artifact-centric processes with UML
IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING, VOL. XXX, NO. YYY, [MONTH-YEAR]
id : Natural
title : String
Submission
id : String
name : String
affiliation : String
Author name : String
beginning : Date
end : Date
country : String
Conference
id : String
date : Date
time : Time
room : String
Session
submissionDate : Date
PendingReviewSub
reviewDate : Date
comments : String
evaluation : Integer
ReviewedSub
withdrawalDate : Date
WithdrawnSub
AcceptedSubmission
reason : String
RejectedSubmission
email : String
UserNonUser
status
result
*1..*
writes
1
0..*
1*
*
1
*
1
1*
registered by
sends
{disjoint, complete}registered
is presented in
is divided into
{disjoint,complete}
{disjoint, complete}
is sent to
Fig. 1. Class diagram showing the artifacts and objects involved in the submission of articles to conferences.
WithdrawnSubmission
RejectedSubmission
AcceptedSubmission
PendingReviewSubmission
Withdraw Submission
Review Submission [failure]
Review Submission [success]
Submit Paper
Visual Paradigm for UML Community Edition [not for commercial use]
Fig. 2. State machine diagram showing the evolution of artifact Submis-
sion.
NonUser
User
Promote to User
Create New Author as NonUser
Create New Author as User
Fig. 3. State machine diagram showing the evolution of artifac
Fig. 4. Activity diagram of Submit Paper.
reason : String
0..* is presented in
Fig. 1. Class diagram showing the artifacts and objects involved in the submission of articles to conferences.
NonUser
User
WithdrawnSubmission
RejectedSubmission
AcceptedSubmission
PendingReviewSubmission
Promote to User
Create New Author as NonUser
Create New Author as User
Withdraw Submission
Review Submission [failure]
Review Submission [success]
Submit Paper
Visual Paradigm for UML Community Edition [not for commercial use]
Fig. 2. State machine diagram showing the evolution of artifact Submis-
sion.
have its own. Figure 2 shows the lifecycle for Submission.
When a paper is submitted to a conference, the correspond-
ing Submission is created in state PendingReviewSubmission.
When it is reviewed, it changes to state AcceptedSubmission,
if the reviewers consider it is appropriate to be presented
at the conference (event-dependent condition success), or
RejectedSubmission, if they decide it is not (event-dependent
condition failure). Before the submission is accepted or re-
jected, one of its authors may decide to withdraw it: then it
changes its state to WithdrawnSubmission. Notice that all of
the transitions in the state machine diagram correspond to
external events.
Similarly, as shown in Figure 3, authors can be created as
a User or a NonUser. A NonUser will become a User when the
system receives additional information by means of external
event Promote to User.
Each external event in the state machine diagram(s) will
be refined by means of an activity diagram. In particular, we
will show the details of Submit Paper and Review Submission
in the state machine diagram of Submission.
Figure 4 shows the activity diagram of event Submit
Paper. The first task registers a new submission in the
system (Register New Submission), and afterwards an author
NonUser
User
Promote to User
Create New Author as NonUser
Create New Author as User
Fig. 3. State machine diagram showing the evolution of artifact Author.
Fig. 4. Activity diagram of Submit Paper.
Submit Paper
Register New
Submission
Add Author to
Submission
[no more authors to add}
[add more authors]
is added to it. If more authors need to be added (see decision
node at the end), this process is repeated. Otherwise, the
activity diagram ends.
Figure 5 shows the activity diagram for event Review
Submission. To begin with, the reviewers evaluate the sub-
mission and decide whether it is good enough to be pre-
sented at the conference. If it is not, the reviewers add a
comment and the activity diagram finishes in failure. This
corresponds to the transition that leads to state RejectedSub-
mission in the state machine diagram. On the other hand, if
the paper is accepted, it is assigned to a certain session and
the activity diagram finishes in success. It corresponds to the
transition that leads to state AcceptedSubmission in the state
machine diagram.
Notice that all the activities in the activity diagram
correspond to tasks: atomic units of work within the process.
IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING, VOL. XXX, NO. YYY, [MONTH-YEAR] 5
Fig. 5. Activity diagram of Review Submission.
Each of them, therefore, will have an operation contract with
pre and a postcondition. The contracts corresponding to the
tasks in activity diagram SubmitPaper are shown below, in
Listings 1 and 2.
Listing 1. Code for service RegisterNewSubmission
operation RegisterNewSubmission(subId: Natural, title:
String, conf: String)
pre: Conference.allInstances()->exists(c | c.name=conf)
and not Submission.allInstances()->exists(s |
s.id=subId and s.conference.name=conf)
post: PendingReviewSubmission.allInstances()->exists(s |
s.oclIsNew() and s.id=subId and s.title=title and
s.submissionDate=today() and s.conference.name=conf
and result=s)
those combinations of artifact instances where
all the picked instances are in a proper state
(i.e., a state where the same type of transition
is enabled).
iii) If there is at least one executable transition, non-
deterministically pick one.
iv) Fire the transition, depending on the correspond-
ing label.
A)
4 REASONING ON BAUML MODELS THROUGH
DCDSS
5 RELATED WORK
6 CONCLUSIONS
ACKNOWLEDGMENTS
This work has been partially supported by the Ministerio
de Ciencia e Innovaci´on under project TIN2011-24747 and
by UPC
REFERENCES
BAUML approach
Business objects, states, associations and attributes: UML class diagrams.
Business object lifecycle: UML statechart diagram.
Complex event triggering a lifecycle transition: UML activity diagram.
Tasks modeled as OCL operation contracts.
In [Calvanese, Montali, et al. 2014]: methodology to guarantee decidability of
model checking (see before). Estanol PhD thesis: BAUML to DCDS!
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (13/16)

26. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
raw-sys: marrying workflow nets and databases
Task
i
o
local
Case
Task
i
o
local
Case
globalread
write
Task
i
o
local
Case
raw-sys model [De Masellis et al. 2017]:
Data-aware processes using well-known formalisms:
Data: global and local relational databases.
Process control-flow: workflow nets, enriched with:
Guards (queries over the DBs).
STRIPS-like actions with external inputs from an infinite domain, invoked
upon firing net transitions.
raw-sys verification [De Masellis et al. 2017]:
Map of (un)decidability, exploiting translation to DCDSs.
Encoding into planning systems to handle reachability problems.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (14/16)

27. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
db-nets: marrying colored Petri nets and databases
...
Proceed
To Booking
Reserve
(tid, pn)
Create
Booking
FreeDrivers
Reserved
Taxi
Leave
Pickup Data
Leave
Phone Number
Pickup
Data
Pnone
Number
AddBooking
(sid, tid, νpdid, n, a, t)
Finalize
Booking
...
sid sid
sid, tid
sid
sid
sid
sid
sid, νa, νt
sid, νn
sid,a,t
sid, tid
sid, n
tid, pn
TAXI
TID: int PlateNum : string IsFree : bool
BOOKING
BID : int TaxiID : int PickupID : int PhoneID : int
PHONE
PID : int Phone : string
PICKUP DATA
PDID : int Address : string Time : date
db-net model [Montali and Rivkin 2017], three layers:
1 Persistence: relational database with constraints.
2 Data logic: queries and actions over the persistence layer.
3 Control: colored Petri net with ν-variables, enriched with view places and
transition-action bindings to inspect/update the persistence layer.
Note: Natural formalization of contemporary process modeling suites!
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (15/16)

28. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
db-nets: marrying colored Petri nets and databases
...
Proceed
To Booking
Reserve
(tid, pn)
Create
Booking
FreeDrivers
Reserved
Taxi
Leave
Pickup Data
Leave
Phone Number
Pickup
Data
Pnone
Number
AddBooking
(sid, tid, νpdid, n, a, t)
Finalize
Booking
...
sid sid
sid, tid
sid
sid
sid
sid
sid, νa, νt
sid, νn
sid,a,t
sid, tid
sid, n
tid, pn
TAXI
TID: int PlateNum : string IsFree : bool
BOOKING
BID : int TaxiID : int PickupID : int PhoneID : int
PHONE
PID : int Phone : string
PICKUP DATA
PDID : int Address : string Time : date
db-nets execution, simulation, verification [Montali and Rivkin 2017]:
Foundational results thanks to translation to DCDSs.
Ongoing implementation effort inside www.cpntools.org.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (15/16)

29. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
OCBC: declarative data+process integrated model
Create
Order
Pick
Item
Wrap
Item
Deliver
Items
Order
Order
Line
Delivery
Product
Customer
contains1 * results in1..* 0..1
is for
*
1
belongs to
*
1
receives
1
*
creates
1
1
fills
1
1
prepares
1
0..1
refers to
1
1
OCBC model [Artale et al. 2017], three components:
1 Data model: UML class diagram.
2 Tasks: units of work, referencing classes in the data model. Each task
instance comes with objects belonging to such classes.
3 Behavioral constraints: declarative patterns equipped with coreference
relations pointing to the data model. They constrain when tasks can be
executed, and which data objects they should carry.
Naturally captures many-to-many processes with no single notion of case!
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (16/16)

30. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
Acknowledgements
Thanks to the many people who contributed interesting ideas, suggestions,
discussions, and collaborated to the presented results.
Giuseppe De Giacomo
Fabio Patrizi
Babak Bagheri Hariri
Riccardo De Masellis
Alin Deutsch
Marlon Dumas
Paolo Felli
Rick Hull
Maurizio Lenzerini
Alessio Lomuscio
Andy Rivkin
Ario Santoso
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (17/16)

31. The story so far State-boundedness Boundedness and resources Unbounded systems Concrete systems
Thank you for your attention!
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (18/16)

32. References
References I
[1] Diego Calvanese, Giuseppe De Giacomo, and Marco Montali.
“Foundations of Data-Aware Process Analysis: A Database Theory
Perspective”. In: Proc. of the 32nd ACM SIGACT SIGMOD SIGAI Symp.
on Principles of Database Systems (PODS). ACM Press, 2013, pp. 1–12.
[2] Babak Bagheri Hariri, Diego Calvanese, Giuseppe De Giacomo, et al.
“Verification of Relational Data-Centric Dynamic Systems with External
Services”. In: Proc. of the 32nd ACM SIGACT SIGMOD SIGAI Symp. on
Principles of Database Systems (PODS). Extended version available at
http://arxiv.org/abs/1203.0024. 2013, pp. 163–174.
[3] Marco Montali and Diego Calvanese. “Soundness of Data-Aware,
Case-Centric Processes”. In: Int. J. on Software Tools for Technology
Transfer (2016). doi: 10.1007/s10009-016-0417-2.
[4] Diego Calvanese, Giuseppe De Giacomo, Marco Montali, and
Fabio Patrizi. “First-Order mu-Calculus over Generic Transition Systems
and Applications to the Situation Calculus”. In: Information and
Computation (2017). To appear.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (19/16)

33. References
References II
[5] Keishi Okamoto. “Comparing Expressiveness of First-Order Modal
µ-calculus and First-Order CTL*”. In: RIMS Kokyuroku 1708 (2010),
pp. 1–14.
[6] Fernando Rosa-Velardo and David de Frutos-Escrig. “Decidability and
Complexity of Petri Nets with Unordered Data”. In: Theoretical
Computer Science 412.34 (2011), pp. 4439–4451.
[7] Marco Montali and Andrey Rivkin. “Model Checking Petri Nets with
Names Using Data-Centric Dynamic Systems”. In: Formal Aspects of
Computing (2016), pp. 1–27.
[8] Catherine Dufourd, Petr Jancar, and Ph. Schnoebelen. “Boundedness of
Reset P/T Nets”. In: Proc. of the 26th Int. Coll. on Automata,
Languages and Programming (ICALP). Vol. 1644. Lecture Notes in
Computer Science. Springer, 1999, pp. 301–310.
[9] Babak Bagheri Hariri, Diego Calvanese, Alin Deutsch, et al.
“State-Boundedness in Data-Aware Dynamic Systems”. In: Proc. of the
14th Int. Conf. on the Principles of Knowledge Representation and
Reasoning (KR). AAAI Press, 2014.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (20/16)

34. References
References III
[10] Dmitry Solomakhin et al. “Verification of Artifact-Centric Systems:
Decidability and Modeling Issues”. In: vol. 8274. Lecture Notes in
Computer Science. Springer, 2013, pp. 252–266.
[11] Diego Calvanese, Marco Montali, et al. “Verifiable UML Artifact-Centric
Business Process Models”. In: Proc. of the 23rd Int. Conf. on
Information and Knowledge Management (CIKM). 2014, pp. 1289–1298.
doi: 10.1145/2661829.2662050.
[12] Parosh Aziz Abdulla et al. “Recency-Bounded Verification of Dynamic
Database-Driven Systems”. In: Proc. of the 35th ACM SIGACT
SIGMOD SIGAI Symp. on Principles of Database Systems (PODS). ACM
Press, 2016.
[13] Diego Calvanese, Giorgio Delzanno, and Marco Montali. “Verification of
Relational Multiagent Systems with Data Types”. In: Proc. of the 29th
AAAI Conf. on Artificial Intelligence (AAAI). AAAI Press, 2015,
pp. 2031–2037.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (21/16)

35. References
References IV
[14] Marco Montali, Diego Calvanese, and Giuseppe De Giacomo.
“Verification of Data-Aware Commitment-Based Multiagent System”. In:
Proc. of the 13th Int. Conf. on Autonomous Agents and Multiagent
Systems (AAMAS). IFAAMAS, 2014, pp. 157–164.
[15] Riccardo De Masellis et al. “Add Data into Business Process Verification:
Bridging the Gap between Theory and Practice”. In: Proc. of the 31st
AAAI Conf. on Artificial Intelligence (AAAI). AAAI Press, 2017,
pp. 1091–1099. url:
http://aaai.org/ocs/index.php/AAAI/AAAI17/paper/view/14627.
[16] Marco Montali and Andrey Rivkin. “DB-Nets: on The Marriage of
Colored Petri Nets and Relational Databases”. In: LNCS Transactions on
Petri Nets and Other Models of Concurrency (2017). To appear.
[17] Alessandro Artale et al. “Object-Centric Behavioral Constraints:
Integrating Data and Declarative Process Modelling”. In: Proc. of the
30th Int. Workshop on Description Logics (DL). Ed. by
Alessandro Artale, Birte Glimm, and Roman Kontchakov. CEUR
Workshop Proceedings, http://ceur-ws.org/, 2017.
Calvanese, Montali (FUB) Processes and Data BPM 2017 – 12/9/2017 (22/16)