Inf Syst Front (2010) 12:457–479DOI 10.1007/s10796-009-9164-1

Specification and verification of harmonizedbusiness-process collaborations

Alex Norta · Rik Eshuis

Published online: 1 April 2009© Springer Science + Business Media, LLC 2009

Abstract In the area of business-to-business (B2B) col-laboration, original equipment manufacturers (OEMs)are confronted with the problem of spending a conside-rable time and effort on coordinating suppliers acrossmultiple tiers of their supply chains. By supportinginter-organizational business-process collaborationswith service-oriented technology, a scope for moreefficient and effective supply-chain coordination isanticipated. This paper defines a formal framework,called eSourcing, for specifying structurally harmonizedinter-organizational business-process collaborations.The framework permits verification of harmonizedprocesses before their enactment. Moreover, theframework uses private and public layers to protectcompetitive knowledge of the individual partners.In the research project CrossWork, the eSourcingframework has been integral for harmonizing onan external level the intra-organizational businessprocesses of a service-consuming and one or manyservice-providing organizations.

A. Norta (B)Department of Computer Science, University of Helsinki,P.O. Box 68 (Gustaf Hällströmin katu 2b),00014, Helsinki, Finlande-mail: alexander.norta@cs.helsinki.fi

R. EshuisFaculty of Technology and Management,Department of Information Systems,Eindhoven University of Technology, P.O. Box 513,5600 MB, Eindhoven, The Netherlandse-mail: h.eshuis@tue.nl

Keywords e-business · b2b · Collaboration ·Service orientation · Supply chain ·Inter-organizational · Business process · Visibilities ·eSourcing

1 Introduction

Having explored and successfully applied workflowconcepts for intra-organizational applications (van derAalst and van Hee 2002; Leymann and Roller 1999),enterprises in the B2B domain are currently faced withthe next challenge: achieving increased efficiency andeffectiveness in the area of B2B collaborations. In theresearch project CrossWork (CrossWork 2009; Grefenet al. 2009; Mehandjiev and Grefen 2009), the problemwas studied of how to establish inter-organizationalB2B collaborations within the automotive industry, inwhich only essential business-process details are dis-closed to other partners to enable collaboration, whilethe other details can remain hidden to safeguard com-petitive advantages. Establishing B2B collaborations isfeasible by harmonizing the partner business processes.In this context, it is important to ensure that inter-organizational business-process harmonizing does notimpose fixed standardized routing in the domain of acollaborating party. The harmonizing must allow a con-sumer, for CrossWork an automotive OEM, to ensurethe presence of desired service content and behaviourin different degrees from a supplier.

As pointed out by Bussler (2002b), B2B collabora-tion is hampered if the parties involved share one com-mon business-process definition or instance state thatis split and shared for internal refinements, as thisconstitutes a violation of their competitive knowledge

458 Inf Syst Front (2010) 12:457–479

protection, i.e., the business internals may be uninten-tionally revealed to collaborating counterparts. Fur-thermore, if process definitions are shared, correctmessage-exchange and message-transformation imple-mentation, and the enactment of shared business rulesbecomes problematic, since adding a collaboratingparty quickly results in an explosion of the business-process definition.

To overcome these difficulties pointed out in Bussler(2002b), several authors have advocated the use ofseparate modelling levels (Chiu et al. 2004; Grefen et al.2003). For this paper, we consider a simplified versionof a specification framework for business process out-sourcing proposed by Grefen et al. (2003) (see Fig. 1).An organisation, called the consumer, can outsourcepart of its business process to another organization,called the provider. The provider process interacts withthe in-house consumer process. To specify such B2Bcollaborations, multiple modelling levels are needed.At the conceptual level, private business processes arespecified independently from infrastructure and col-laboration specifics. Conceptual processes are mappedto their respective technology-dependent internal levelfor enactment.

The internal level is not the focus of this paper,so we do not consider it in the sequel. External-levelprocesses specify the public collaboration process be-tween the two parties. Therefore, the external levelstretches across the domains of the consumer andprovider. Parts of the private conceptual processes areprojected to the external level and compared by thecollaborating parties to achieve a consensus. However,it is not a requirement to project the entire conceptual-level process to the external level, so an organizationcan choose to hide secret or competitive business inter-nals at the conceptual level from its collaborating party.

While such specification frameworks (Chiu et al.2004; Grefen et al. 2003) allow collaborating orga-

Fig. 1 A three-level specification framework for business processoutsourcing

nizations to manage their process specifications atmultiple levels, the frameworks do not define anyconcrete projection relations that can exist betweenconceptual and external-level business processes. Also,these frameworks do not address the question whenthe business processes of a consumer and a providerare harmonized, i.e., when the provider process real-izes the requested consumer process and the providerprocess interacts correctly with the in-house consumerprocess, so no deadlock state is reached. For this pa-per, correctness refers to control-flow properties of thebusiness processes; other perspectives such as data-flowor resources are not the focus of this paper. Note thatbusiness processes that perform correctly in isolationmay, for example, contain a deadlock or livelock whenlinked together (van der Aalst 2002; Gomez et al. 2005).In B2B, if an inter-organizational business-process col-laboration fails, the consequence is penalty payments,unsatisfied customers, lost time and money, and so on.

This paper defines a framework, called eSourcing,for specifying and verifying harmonized B2B processcollaborations. Based on the three-level specificationframework by Grefen et al. (2003), the frameworkdistinguishes between conceptual and external-levelprocesses. However, unlike the three-level framework,eSourcing uses a concrete formal language for mod-elling and analyzing business process, workflow (WF)nets. WF-nets have been used for modelling and ana-lyzing business processes for correctness (van der Aalst1998; Verbeek et al. 2001a). Based on WF-nets, theeSourcing framework formally defines different typesof projections that can exist between conceptual andexternal level business processes. The availability ofdifferent types of projection gives flexibility to the col-laborating parties with respect to how much businessinternals they want to disclose. One special type, greybox projection, allows the incorporation of a new pri-vate task in a conceptual provider process without vio-lating the runtime behaviour at the external level. Thisgives providers flexibility in defining their own busi-ness processes while still realizing the external processagreed upon.

Next, the framework formally defines the notionof an eSourcing configuration, which is a set of con-ceptual-level and external-level models of consumerand provider with projection relations between them.We show that not every combination of projectiontypes for consumer and provider-side is meaningful foreSourcing configurations. Certain types of eSourcingconfigurations are guaranteed to be harmonized, i.e.,they are correct and realize the consumer’s requestedprocess, while others require any additional correctnesscheck by a third party service.

Inf Syst Front (2010) 12:457–479 459

The structure of this paper is as follows. Based oncase studies from CrossWork, the business context ofeSourcing is informally introduced in Section 2 to-gether with an example from CrossWork that showshow the processes of a consumer and a provider areinter-organizationally represented. As preliminaries,Section 3 presents existing theory on WF-nets that isused in the subsequent sections. Section 4 formalizesthe eSourcing processes that are located on the concep-tual and external levels of the three-level framework.Section 5 formally defines projection variations fromthe conceptual level to the inter-organizational leveland describes different types of consensus constella-tions between collaborating parties. In Section 6, aneSourcing configuration is formally defined as a setof conceptual-level and external-level models of con-sumer and provider with consensus relations betweenthem. In Section 7, a method is described to checkthe behaviour of an eSourcing configuration for cor-rectness. Section 7 also shows that with certain typesof inter-organizational process harmonizations, an es-tablished eSourcing configuration is guaranteed to besound and to realize the consumer’s process withoutrequiring any additional check by a third party ser-vice. The architecture of a trusted third-party service isspecified in Section 8. This trusted third-party service isneeded for supporting the soundness-checking methodof the previous section. Section 9 discusses related workfrom the domains of business-process formalizationsand from B2B-collaboration research projects. Finally,Section 10 concludes the paper.

2 A motivating eSourcing example

To clarify the business context for eSourcing, we ex-plain how it has been applied in the CrossWork project.The industrial partners in this project come from theautomobile industry. In this industry, OEMs have sev-eral tiers of suppliers that agree to deliver systemscollaboratively. For example, the OEM assembles carswith systems like a cockpit, or an engine, etc. Thesesystems are manufactured by the second tier that re-ceives components for those systems from their third-tier supplier.

The supply chain relationship between an OEM andsuppliers resembles a pyramid where the OEM at thetop spends considerable time and effort on aligningfirst- and second-tier suppliers for achieving the desiredservice provision. Additionally, the overall number ofproduced cars and also the number of variants is in-creasing while the lifetime of car-types is shortening,which means the number of cars per type is decreasing.

To deal with the resulting complexity in manufactur-ing as well as in design and development, OEMs areshifting parts of their activities down the organizationalhierarchy. By applying eSourcing, specifying the inter-organizational process collaboration, this coordinationeffort between collaborating parties is relieved.

Based on a real-world scenario developed in theCrossWork project (CrossWork 2009) with industrypartners from the automobile industry, the exampleis about an OEM sourcing a car water tank from asupplier. In Fig. 2, a corresponding eSourcing configu-ration is depicted, consisting of multiple processes. AneSourcing configuration comprises intra-organizationalbusiness processes of service-consuming and service-providing organizations that are harmonized dynam-ically on an external level into a B2B supply-chaincollaboration. Here dynamically means that dur-ing process enactment collaborator organizations arefound by searching business process market placesand the subprocesses are integrated with the runningprocess. Hence, a dynamic inter-organizational busi-ness process is formed dynamically by the (automatic)integration of the subprocesses of the involved organi-zations. Important elements of eSourcing are the sup-port of different visibility levels of corporate processdetails for the collaborating counterpart and mecha-nisms for service monitoring and information exchange.

The processes in Fig. 2 are modelled in the WF-net formalism (van der Aalst 1998). Circles representplaces and boxes represent transitions. Blacks dots rep-resent the current active places. A process can changestate by firing a transition that has all input places filledwith a token; the transition then produces tokens onall output places (see Section 3 for formal details).In the center of Fig. 2 the external level is stretch-ing across the respective domains of eSourcing partieswhere process harmonization takes place. Parts of therespective conceptual-level processes are projected tothe external level for performing a harmonization torealize an automated and dynamically forged collabo-ration between partners.

Starting from the in-house process, the consumerorders a waterpump, which enables a consumer spherethat is sourced from a supplier. As we will explain inSection 4, a sphere is part of a conceptual-level processthat is projected to the external-level. In a parallelbranch the specification documentation and paymentof the watertank are prepared. The consumer spherein Fig. 2 is a subnet of the in-house process and it isentirely projected to the external level into a consumercontractual sphere. The projected contractual sphere ofthe service provider comprises matching content withequal transition labels. That way a consensus about the

460 Inf Syst Front (2010) 12:457–479

Fig. 2 An eSourcing-configuration exampledepicting the externaland conceptual level

service content is established between the collaboratingparties. On the conceptual level, a provider sphere isdepicted that consists of the elements in the providercontractual sphere and additionally inserted refinementnodes, i.e., check tank, check engine, check valve, as-semble pump. Note that the external level containsa process specification, not just a specification of theinterface. The specification indicates what process theprovider has to supply to the consumer.

The provider receives the watertank specificationbased on which an internal resource configuration takesplace. In parallel branches the body of the water tankand the watertank pump are produced. These steps arefollowed by internally inserted quality checks that arenot disclosed externally to the consumer. In Fig. 2, these

additional transitions are depicted with bolder lines.The watertank pump consists of separate parts thatneed to be assembled and finally the parallel branchesare joined by a transition for assembling the overall wa-tertank. During the assembly, a bill is retransmitted tothe consumer where an output transition prepares thepayment. While the enactment of the provider sphere iscompleted, the consumer’s in-house process must stillprocess the payment for completing the enactment ofthe overall eSourcing configuration.

The processes in Fig. 2 are not depicted withmodelling constructs that indicate how the serviceconsumer may monitor the enactment progress of theservice provider and such monitoring is not the focusof this paper. However, in Norta (2007, b) so-called

Inf Syst Front (2010) 12:457–479 461

monitorability constructs are described that bindprocess nodes from the external level and the respectiveconceptual levels with each other. This way, the con-sumer can monitor public tasks done by the provider.

The example assumes an out-sourcing scenariowhere during the setup time the consumer externalizesparts of the in-house process so that another party stepsin as a provider. However, other interaction patternsare possible between a service consumer and providerduring setup time (see Norta 2008 for more details).For example, internal-to-external sourcing means thatthe collaborating parties have internal processes thatare only harmonized externally at the end of their setupinteraction. In-sourcing means a service provider has aservice that is subsequently integrated into the processof a service consumer. Thus, external harmonizationis only performed at a later stage. Finally, external-to-internal means that externally harmonized processesare the starting point of interaction and the collaborat-ing parties set up internal processes at a later stage justbefore enactment starts.

3 Preliminaries

We recall some preliminaries from Petri-net and work-flow net theory that are used in the sequel.

3.1 Petri nets

Workflow (WF) nets are defined as a subclass of a vari-ant of Petri nets, labelled Place/Transition nets (Reisigand Rozenberg 1998). The definition we use here istaken from (Basten and van der Aalst 2001). Let U bea universe of identifiers; let AL be some set of actionlabels with τ ∈ AL the silent action, whose role will beexplained later. Let ALv = AL\{τ } be the set of visiblelabels.

Definition 1 (labelled P/T-net) A labelled Place/Tran-sition net, or simply P/T-net, is a tuple (P, T, L, F, �)

where

1. P ⊆ U is a finite set of places;2. T ⊆ U is a finite set of transitions such that

P ∩ T = ∅;3. L ⊆ ALv is a finite set of labels such that L ∩

(P ∪ T) = ∅;4. F ⊆ (P × T) ∪ (T × P) is a set of directed arcs,

called the flow relation;5. �:T → L ∪ {τ } is a labelling function.

A place p is called an input place of a transition t iffthere exists a directed arc from p to t. Place p is called

an output place of transition t iff there exists a directedarc from t to p. Likewise, a transition t is called an inputtransition of a place p iff there exists a directed arc fromt to p. Place t is called an output transition of place p iffthere exists a directed arc from p to t. All places of aparticular transition constitute the preset and all outputplaces of a particular transition are called postset.

For the pre- and postsets an additional notationis relevant. Two auxiliary functions •−,−•: (P ∪ T) →P(P ∪ T) are defined that assign to each node its presetand postset, respectively. For any node x ∈ P ∪ T,•x = {y | yFx}. To avoid confusion about which neta node belongs to, the preset and postset notation isaugmented with the name of the net: Given a net N,N•x is the preset of node x in N and x•N is the postsetof node x in N.

Definition 2 (Marked, labelled P/T-net) A marked,labelled P/T-net is a pair (N, s), where N = (P, T,

L, F, �) is a labelled P/T-net and where s is a bag overP denoting the marking (also called state) of the net.

At any time a place contains zero or more tokens,drawn as black dots. The state, often referred to asmarking, is the distribution of tokens over places, i.e.,a function s ∈ P → N. A Petri net PN and its initialmarking s: P → N where for each p ∈ P there are n ∈ N

tokens, are denoted by (PN, s). If confusion is possible,brackets are used to denote markings, e.g., [p] is themarking with just a token in place p.

The number of tokens may change during the execu-tion of the net. Transitions are the active componentsin a Petri net: they change the state of the net accordingto the following firing rule:

(1) A transition t is said to be enabled iff each inputplace p of t contains at least one token.

(2) An enabled transition may f ire. If transition tfires, then t consumes one token from each inputplace p of t and produces one token for eachoutput place p of t.

In Fig. 2, examples of Petri nets are depicted. Thecircles are places, the boxes are transitions, and theblack dot in the i-labelled place of the in-house processis a token. Marking s′ is reachable from s if there is asequence of transitions such that, starting in s, firing thetransitions results in state s′. For a formal definition, seeReisig and Rozenberg (1998). The following definitionsrepresent a non-exhaustive selection of Petri-net prop-erties that are sufficient for later sections. Let F∗ be thereflexive-transitive closure of F.

462 Inf Syst Front (2010) 12:457–479

Definition 3 (Connectedness) A labelled P/T-net N =(P, T, L, F, �) is strongly connected iff for every twonodes x and y in P ∪ T, x F∗y.

The in-house process of Fig. 2 is not strongly con-nected because there is no directed path from o placeto the i place. However, the in-house process wouldbe strongly connected with an additional transition thatconnects the places with the i and o label.

Definition 4 (Live) A marked, labelled P/T-net (N, s)is live iff, for every reachable state s′ and everytransition t there is a state s′′ reachable from s′ whichenables t.

The in-house process in Fig. 2 is live as no stateis reachable where a transition would not be enabledto fire.

Definition 5 (Bounded, safe) A marked, labelled P/T-net (N, s) is bounded iff for each place p there is anatural number n such that for every reachable statethe number of tokens in p is less than n. The net is saf eiff for each place the maximum number of tokens doesnot exceed 1.

Finally, it is possible that so-called dead transitionsare contained in a P/T-net. A definition for dead transi-tions is given below.

Definition 6 (Dead transition) Let (N, s) be a marked,labelled P/T-net. A transition t ∈ T is dead in (N, s) ifand only if there is no marking s′ reachable from s, suchthat s enables t.

The β operator (van der Aalst 2002) removes alldead transitions and corresponding places from the net.

Definition 7 (Removing dead transitions: β) Let (N, s)be a marked, labelled P/T net, with N = (P, T, L, F, �)

and a set of dead transitions D ⊆ T such that T \D does not contain dead transitions. β is a func-tion such that it maps marked P/T-nets onto P/Tnets: β(N, s) = (P′, T ′, L′, F ′, �′) with T ′ = T\D,P′ = {p ∈ P|(•p ∪ p•) � D}, F ′ = F ∩ ((P′ × T ′) ∪(T ′ × P′)), dom(�′) = T ′, for t ∈ T ′ : �′(t) = �(t), andL′ = ran(�′) \ {τ }. If N is a WF-net with source place i,then β can also be applied without explicitly stating theinitial marking, i.e., β(N) = β(N, [i]).

The definition uses functions dom and ran, whichreturn the domain and range of a function, respectively.So given a function f : X → Y, dom( f ) = X whileran(X) = Y.

Petri-net formalisms are suitable for specifying thecontrol-flow of tasks in a process. However, for thedomain of business processes, simple Petri-nets are notsufficient; therefore, a subclass of Petri-nets has beendeveloped.

Workflow nets Workflow is the operational aspect ofa work procedure: how tasks are structured, who per-forms them, what their relative order is, how they aresynchronized, how information flows to support thetasks and how tasks are tracked. A WorkFlow net(WF-net) (van der Aalst 1997, 1998; Ellis and Nutt1993) models the control-flow dimension of a workflow.It should be noted that a WF-net specifies the dynamicbehaviour of a single case in isolation. This means thatevery piece of work is executed for a specific case,which is also called a workflow instance. Examples ofcases are handling an insurance claim, an order, a taxdeclaration, and so on. Different definitions of work-flow nets exist, the one used here comes from van derAalst (2002).

Definition 8 (WF-net) van der Aalst (2002) LetN = (P, T, L, F, �) be a labelled P/T-net. N is a WF-net iff the following conditions are satisfied:

1. Instance creation: P contains an input (source)place i ∈ P such that •i = ∅;

2. Instance completion: P contains an output (sink)place o ∈ P such that o• = ∅;

3. Strongly connected: N̄ = (P, T ∪ {t̄}, L, F ∪{(o, t̄), (t̄, i)}, � ∪ {(t̄, τ )}) is strongly connected (t̄ ∈T);

4. Label use: L = ran(�)\{τ };5. Visible start: for any t ∈ T such that t ∈ i•: �(t) ∈

ALv , i.e. �(t) = τ ;6. Visible end: for any t ∈ T such that t ∈ •o: �(t) ∈

ALv , i.e. �(t) = τ .

A WF-net has one input place (i) and one outputplace (o) because any case handled by the procedurerepresented by the WF-net is created when a tokenenters place i and ends when a token enters place o,i.e., the WF-net specifies the life-cycle of a case. Thethird requirement in Definition 8 has been added toavoid ‘dangling tasks and/or conditions’, i.e., tasks andconditions which do not contribute to the processingof cases. Note that transitions model tasks and placesmodel conditions.

Inf Syst Front (2010) 12:457–479 463

The in-house process of Fig. 2 fits the requirementsof a WF-net as stated in Definition 8. To the left, theinput place (i) and to the right, the output place (o) aredepicted. Furthermore, the third condition is satisfiedas all other nodes contribute to the processing of theWF-net.

The three requirements stated in Definition 8 can beverified statically, i.e., they only relate to the structureof the Petri net. However, there is another requirementwhich should be satisfied, namely, that the process willterminate eventually and the moment the procedureterminates there is a token in place o and all the otherplaces are empty. Looking at the in-house process ofFig. 2, this requirement is fulfilled. This requirement iscalled the soundness property. Different definitions ofsoundness exist; the one used here is defined in van derAalst (2002).

Definition 9 (Soundness) A WF-net N is weakly soundiff the following conditions are satisfied:

(i) (N, [i]) is safe;(ii) for any marking s reachable from [i], o ∈ s implies

s = [o];(iii) for any marking s reachable from [i], [o] is reach-

able from s.

N is said to be strongly sound, or simply sound, if andonly if, in addition there are no dead transitions, i.e.,(N, [i]) contains no dead transitions.

The first condition of Definition 9 states that a soundWF-net is safe. The second condition focuses on theproper completion of a WF-net. If a marking in o isreached, all places are empty with the exception ofplace o that must contain one token. Finally, the thirdcondition refers to a completion option that states thatfrom the initial marking i that activates a case, it isalways possible to reach the marking with one tokenin place o that results in a successful termination. Thefourth condition about dead transitions that definesstrong soundness, states that for each transition thereis an execution sequence activating this transition. Re-moving all dead transitions and places connected tothem from a weakly sound net results in a stronglysound net (van der Aalst 2002).

Note that the soundness property relates tothe dynamics of a WF-net. Given a WF-netN = (P, T, L, F, �), one wants to decide whetherN is sound. In van der Aalst (1997) it is shown thatsoundness corresponds to liveness and boundedness.To link soundness to liveness and boundedness, anextended net N = (P, T, L, F, �) is defined that is theP/T-net obtained by adding an extra transition t̄ (see

Definition 8) which connects o and i. Such an extendednet is called the short-circuited net of N that allows forthe formulation of the following theorem.

Theorem 1 van der Aalst (2002) A WF-net N is soundiff (N, [i]) is live and safe.

This theorem shows that standard Petri-net-basedanalysis techniques can be used to verify soundness,which is of significant value for the area of intra-organizational business processes as a manual detectionof control-flow problems such as deadlocks is difficultand time consuming. Hence, for the verification of com-plex WF-nets, tool support is available, e.g., Verbeeket al. (2001a, b).

When business processes need to be related inter-organizationally, it is desirable to establish a relation-ship that can be analyzed and checked for correctness.The following subsection presents such a relationship.

3.2 A notion of business-process inheritance

To express a client-server relationship between anoriginal equipment manufacturer and suppliers, a spe-cial notion of business-process inheritance is used foreSourcing, namely the notion of projection inheri-tance (van der Aalst and Basten 2002; Basten and vander Aalst 2001) that can informally be described asfollows:

For two workflow process definitions A and B,where B contains all transitions in A and someadditional ones, if it is not possible to distinguishbetween the behaviour of A and B, when the effectsof the transitions that are in B but not in A arehidden (ignored), then B is a subclass of A underprojection inheritance.

Before projection inheritance can be defined for-mally, first an equivalence relation needs to be spec-ified. This equivalence is based on the idea that asuperprocess and a refined subprocess have the same(observable) behaviour. Concretely, branching bisim-ilarity (van Glabbeek and Weijland 1996) is such anequivalence.

The notion of a silent action is pivotal for branch-ing bisimilarity and can be used to hide labels. Silentactions result from an abstraction that is defined asfollows:

Definition 10 (Abstraction) Let N = (P, T, L, F, �0)

be a labelled P/T-net. For any I ⊆ ALv , the ab-straction operator τI is a function that renames all

464 Inf Syst Front (2010) 12:457–479

transition labels in I to the silent action τ . FormallyτI(N) = (P, T, L, F, �1) such that, for any t ∈ T,�0(t) ∈ I implies �1(t) = τ and �0(t) /∈ I implies�1(t) = �0(t).

Silent actions can not be observed and are denotedwith the label τ , i.e., only transitions in a Petri net witha label different than τ are observable. Such a singlelabel suffices as all internal actions are equal in thesense that they can not be observed by the collaboratingcounterpart.

Two marked, labelled P/T-nets are called branchingbisimilar, denoted ∼b , iff their observable behaviourscoincide, i.e., abstracting from silent actions. For aformal definition, it is referred to van der Aalst (2002).Branching bisimilarity is an equivalence relation, i.e.,∼b is reflexive, symmetric, and transitive (see Basten1998). Branching bisimilarity is used in the followingdefinitions.

Definition 11 (Behavioral equivalence of WF-nets)For any two sound WF-nets N0 and N1, N0

∼= N1 iff(N0, [i]) ∼b (N1, [i]).

After clarifying the notion of behavioural equiva-lence the initially presented notion of projection inher-itance above can be defined formally. For that purposethe abstraction operator τI of Definition 10 is useful forhiding labels. The definition of projection inheritance ispresented as follows.

Definition 12 (Projection inheritance) For any twoweakly sound WF-nets N0 and N1, N1 is a subclassof N0 under projection inheritance, denoted N1 ≤pj

N0, iff there is an I ⊆ ALv such that (τI(N1), [i]) ∼b

(N0, [i]).

In Basten and van der Aalst (2001) details arecontained about three projection-inheritance preserv-ing refinement patterns, namely an inserted task, aloop, and a parallel branch. Examples of these refine-ment patterns are contained in following sections ofthis paper that explain formal properties of eSourcingconfigurations. After presenting the preliminaries, thesubsequent sections explain properties of eSourcingcollaboration.

4 Processes and spheres

This section formally defines the models used at theconceptual and external level of an eSourcing con-figuration. That way it is clarified how the respec-

tive processes and spheres relate to each other. Thestructure of this section is as follows. In Section 4.1,the conceptual-level process of the consumer and theprovider are defined, followed by the definition of anoperator that is instrumental for checking the correcttermination of an in-house process. In order to de-termine the nature of correct termination, Section 4.1gives a variation definition of the soundness property.Finally, Section 4.2 defines external-level models, calledspheres.

4.1 Conceptual level

To specify conceptual-level processes, we use soundWF-nets as defined in the previous section. We usethe term ‘sphere’ to denote a conceptual-level processthat is mapped to the external-level. In Fig. 2 bothconceptual levels contain spheres for the consumer andthe provider.

Definition 13 (Consumer sphere, provider sphere) Asphere N is a sound WF-net that is located at theconceptual level. If N is part of the consumer, it is calleda consumer sphere CS. If N is part of the provider, it iscalled a provider sphere PS.

While the external level depicted in the abstracteSourcing example of Fig. 3 is explained in Section 5where contractual spheres are investigated, this sub-section focusses on the properties of the consumer’sconceptual level. The consumer sphere in Fig. 2 is con-tained in the in-house process of the consumer. When aconsumer sphere is demarcated in an in-house process,gaps may occur, as illustrated by the in-house processof Fig. 3. The bottom conceptual level depicts that aconsumer sphere is demarcated in the in-house process.Since this results in an unconnected remainder of thein-house process, it is considered invalid.

To resolve this issue, an extra place with the la-bel im is introduced in the middle process of Fig. 3.Adding implicit place im results in a valid partitioningof the in-house process that results in a sound WF-net.Implicit places and their properties have been studiedin Berthelot (1987), Colom and Silva (1990). Furtherdetails about implicit places and their use are containedin van der Aalst (2002). Adding the im-labelled placein Fig. 3 yields a P/T-net which is branching bisimilar tothe original net.

The interface places depicted in Fig. 3 are locatedon the borders of the respective spheres and enable asystematic exchange of business-relevant informationbetween the consumer sphere and the rest of the in-house process. To denote that the interface places and

Inf Syst Front (2010) 12:457–479 465

Fig. 3 The conceptualdomain of the consumer

their connected arcs are separated from the consumersphere in a valid bilateral WF-net, they are depictedwith dotted lines. Furthermore, to support the clarityof the formalism in this paper, the interface places andconnected arcs are also lined in a dotted way in depictedcontractual spheres and provider spheres.

To formally model in-house processes, consumerspheres and their interaction, we introduce the notionof a bilateral WF-net, which consists of two interactingWF-nets. A bilateral WF-net is a simplification of aninter-organizational workflow net (IOWF-net) (van derAalst 2002); Section 9 explains the differences betweenthe two models. The definitions introduced in this sub-section for bilateral WF-nets, such as activation safe-ness, are also adapted from IOWF-nets.

Definition 14 (Bilateral WF-net) A bilateral WF-netBW is a tuple (I, M, S, L, G) where:

1. I is a set of interface places;2. M = (PM, TM, LM, FM, �M), the main process, is a

sound WF-net, such that (PM ∪ TM ∪ LM) ∩ I = ∅;3. S = (PS, TS, LS, FS, �S), the subprocess, is a

sound WF-net, such that (PS ∪ TS ∪ LS) ∩ I = ∅and (PS ∪ TS ∪ LS) ∩ (PM ∪ TM ∪ LM) = ∅;

4. L = LM ∪ LS is the set of transition labels;5. G ⊆ (I × L) ∪ (L × I) is a set of directed arcs,

called the interface flow relation.

Subprocess S corresponds to a sphere CS while Mcorresponds to an in-house process that activates and

466 Inf Syst Front (2010) 12:457–479

deactives S. The sphere can belong to either provider orconsumer. The definition of the interface flow relationG connects interface places and transition labels. Thisfacilitates the replacement of S by another process S′without changing G; the binding of M to S′ is achievedthen by G, since S offers the same labels as S′. If Gwould connect interface places and transitions, S couldnot be replaced without changing G as well.

The definition of bilateral WF-net considers one sub-process only. However, this definition can be extendedto multiple subprocesses by repeatedly partitioning themain process M. This way, collaborations between oneconsumer and several providers can be expressed. Todefine when a partitioning is valid, it is necessary tointroduce a flattening operator that turns a bilateralWF-net into a P/T-net.

Definition 15 ( f lat(BW)) Let BW = (I, M, S, L, G)

be a bilateral WF-net. The flattened P/T netf lat(BW) = (P, T, L, F, �) where:

1. P = I ∪ PM ∪ PS \ {iS, oS};2. T = TM ∪ TS;3. L = LM ∪ LS;4. � = �M ∪ �S;5. F = FM ∪ FS ∪ {(p, t) ∈ P × T | (p, �(t)) ∈ G} ∪

{(t, p) ∈ T × P | (�(t), p) ∈ G}.

Hence, the f lat operator removes the i and o-labelled places from the sphere S that is contained inthe main process M and creates a P/T-net.

A sphere S that is contained in a main process ofa bilateral WF-net is activated if at least one of theplaces in the subflow S is marked (except the sourceand sink place). Since multiple activations of CS maylead to anomalies in an in-house process, the notion ofactivation safeness (van der Aalst 2002) is used.

Definition 16 (Activation safeness) Let (N, s) be amarked, labelled P/T-net, where N = (P, T, L, F, �). Asubset of places P′ ⊆ P is activation safe in (N, s) ifand only if for any reachable state s’ any transitiont ∈ •P′\P′•, and any place p ∈ P′: if s′ enables t, thens′(p) = 0.

A set of places P′ is activation safe if all transitionsproducing tokens for P′ but not consuming tokens fromP′ are not enabled as long as there are tokens in P′. Asphere S that is a subflow of a bilateral WF-net is notactivated multiple times if and only if the places of Sare activation safe.

Definition 17 (Soundness of bilateral WF-nets) LetBW = (I, M, S, L, G) be a bilateral WF-net and letN = (P, T, L, F, �) be the corresponding flattened netwithout dead transitions, i.e., N = β( f lat(BW)). BWis sound if and only if:

1. the flattened net N is a sound WF-net, and2. PS\{iS, oS} is activation safe in (N, [i])).

Note that a flattened bilateral WF-net does not havedead transitions, i.e., the dead transitions are removedusing β. The sphere contained in the main process of abilateral WF-net must be activation safe.

The following definition states when a process N isvalidly partitioned by a bilateral WF-net BW.

Definition 18 (Valid partitioning) Let N be a soundWF-net and let BW be a bilateral WF-net. BW is avalid partitioning of N if and only if BW is sound andN = β( f lat(BW)).

The operator β removes dead transitions and placesconnected to them from a WF-net. For N to be validlypartitioned by BW, BW needs to be sound and theflattened net without dead transitions must equal N.

4.2 External level

Both the consumer and the provider have their owncontractual spheres that belong to the external level ofan eSourcing configuration.

Definition 19 (Contractual sphere) A contractualsphere CS is a labelled P/T-net (P, T, L, F, �) such thatτ /∈ ran(�).

A contractual sphere does not use τ -labels, since itdoes not make sense from a business point of view tooutsource invisible actions. In an eSourcing configu-ration there are two contractual spheres, one for theconsumer and one for the provider that are located onthe external level. Having separate contractual spheresfor the respective collaborating parties facilitates nego-tiations until a consensus is reached.

Examples of contractual spheres are depicted inFigs. 3 and 4. Note that a contractual sphere does notneed to be a WF-net, which enables empty projectionsto the external level in the case of black-box projec-tions, as is explained in the next section.

Inf Syst Front (2010) 12:457–479 467

Fig. 4 The provider contractual sphere and two providerspheres. The bottom one is illegal

5 Projections

The external level of an eSourcing configuration deter-mines how much internal process details are exposed.The collaborating parties have the option of projectingdifferent amounts of conceptual-level process contentinto their respective contractual spheres. To achievea consensus about the nature of service provision, therespective contractual spheres must match in content.This subsection formally defines three projection op-tions: white-box, grey-box, and black-box projectionthat differ in their level of projection abstraction.

5.1 White-box projection

In the case of a white-box projection, the consumeror provider sphere is fully projected into the con-tractual sphere on the external level. This means thetwo spheres at the conceptual and external level mustbe identical. Figure 3 gives an example of white-boxprojection.

Mathematically, two nets are identical iff all their ob-jects are pairwise identical. For P/T-nets the notion ofan isomorphism is instrumental to express equality. Thefollowing definition is based on Reisig and Rozenberg(1998).

Definition 20 (Isomorphism) Two nets N0 = (P0, T0,

L0, F0, �0) and N1 = (P1, T1, L1, F1, �1) are isomor-phic, denoted by N0 ≡ N1 if there exist two bijectionsα: P0 → P1 and β: T0 → T1 such that for every p ∈ P0

and t ∈ T0,

1. (p, t) ∈ F0 iff (α(p),β(t)) ∈ F1;2. (t, p) ∈ F0 iff (β(t),α(p)) ∈ F1;3. �(t) = �(β(t));4. L0 = L1.

Using the notion of isomorpism, white-box projec-tion is defined as follows:

Definition 21 (ω-projection) Let N0 = (P0, T0, L0,

F0, �0) be a consumer or provider sphere and letN1 = (P1, T1, L1, F1, �1) be a contractual sphere.There is an ω-projection from N0 to N1, written N0ωN1,if and only if N0 ≡ N1, so N0 and N1 are isomorphic.

Theoretically, other equivalences like strong bisim-ulation (Milner 1989) are applicable as well. However,such equivalences allow syntactic modifications to thesphere, like creating duplicate branches. For example,strong bisimulation would allow to add another taskProduce pump that is alternative to the existing taskProduce pump. From a business point of view, suchmodifications do not make much sense.

5.2 Grey-box projection

An example of grey-box projection is depicted inFig. 4, for which a specific refinement relationship existsbetween the provider sphere and the correspondingcontractual sphere. The provider sphere contains addi-tional labels compared to the contractual sphere. How-ever, during enactment the consumer only perceivesprocess behaviour that is part of the external level andnot what constitutes the provider’s refinement.

To realize such a refinement scenario as depicted inFig. 4, projection inheritance (van der Aalst and Basten2002; Basten and van der Aalst 2001) is employed. InSection 3.2, projection inheritance (see Definition 12) isexplained together with the related notions of branch-ing bisimilarity (van Glabbeek and Weijland 1996) andbehavioural equivalence (see Definition 11). Details

468 Inf Syst Front (2010) 12:457–479

about the external level follow in the sequel wherecontractual spheres are investigated.

The provider sphere PS1 of Fig. 4 is a subclass of theprovider contractual sphere PCS according to projec-tion inheritance. Hiding the inserted transitions doesnot violate the behaviour equivalence the consumerexpects. Firstly, neither hiding the parallel branch withw nor hiding the execution of the inserted x violates theoriginal behaviour of PCS. Secondly, the same holdsfor hiding the execution of y that merely postpones theexecution of e. Figure 4 contains projection-inheritancepreserving refinement patterns in PS1, namely a paral-lel branch, inserted transition, and a loop. The parallelbranch starts from the a-labelled transition and endswith the a-labelled transition containing a w-labelledtransition. The inserted transition in Fig. 4 carries anx label and the loop example a y label.

The sphere PS2 at the bottom of Fig. 4 shows a vi-olation of projection inheritance in correlation to PCSbecause hiding the inserted newly labelled transitionsresults in a potential trace where a is followed byd without executing c. Hence, grey-box projection isdefined as follows.

Definition 22 (γ -projection) Let PS=(PPS, TPS, LPS,

FPS, �PS) be a provider sphere and PCS = (PPCS,

TPCS, LPCS, FPCS, �PCS) a provider contractual sphere.There is a γ -projection from PS to PCS, writtenPSγ PCS, if and only if:

– PCS is a sound WF-net;– PS ≤pj PCS;– {�(t) | t∈TPS∧iPS ∈•t}={�(t) | t∈TPCS∧iPCS ∈•t};– {�(t) | t∈TPS∧oPS ∈ t•}={�(t) | t∈TPCS∧oPCS ∈ t•}.

For NPS to be a projection-inheritance subclass ofNPCS, the latter must be a WF-net and both nets mustbe sound. Additionally, the labels of the starting transi-tions must be equal, and the labels of the ending transi-tions must be equal to support projection inheritance.

Note that γ -projection is limited to provider spheresand must not be performed with consumer spheres.The reason for this limitation is the non-adherenceto projection inheritance that may occur during theenactment of an eSourcing configuration. In that casea consumer sphere and a provider sphere can havepartly deviating control-flow constructs, leading to aviolation of projection inheritance and therefore to alack of contractual adherence. To see why, in Fig. 5an example is depicted where both parties use grey-box projection. At the top of Fig. 5, the bold linedparallel branch is not projected to the external level.The provider sphere at the bottom of the figure depicts

Fig. 5 An example of both collaborating parties using grey-boxprojection

the bold lined refinement compared to the providercontractual sphere.

5.3 Black-box projection

The black-box projection does not project any contentof the sphere to the external level. In Fig. 6, an example

Fig. 6 A black-box projection to the external level

Inf Syst Front (2010) 12:457–479 469

of β-projection is depicted. The notion of β-projectionis defined as follows.

Definition 23 (β-projection) Let N0 =(P0, T0, L0, F0,

�0) be a consumer or a provider sphere, and letN1 = (P1, T1, L1, F1, �1) be a contractual sphere.There is a β-projection from N0 to N1, written N0βN1 ,if and only if N1 = (∅, ∅, ∅, ∅, ∅).

If the contractual spheres results from β-projection,nothing from the conceptual level is exposed. Still,the collaborating parties have to conjoin their spheresthrough the interface places. This can be solved in anarchitectural way, by allowing the consumer to informthe provider of interface specifics.

With β-projection it is not ensured that an eSourcingconfiguration is deadlock free. Instead the collaborat-ing parties need to rely on a collapsing method forwhich an example is depicted in Fig. 8. Informally, thecollapsing method replaces the consumer sphere of anin-house process with the provider sphere and the re-sulting net must be sound. For such a soundness checkthe tool Wolflan (Verbeek et al. 2001b) is instrumental.

For black-box projection the issue arises how aproper conjoinment of the contractual spheres of aconsumer and a provider is achievable. The problemoccurs because for the formalization of eSourcing thelabelling of interface places is omitted. To solve thisproblem, during the setup phase of an eSourcing con-figuration, the collaborating parties must inform eachother about the conjoinment labels of the channel flowsin the consumer contractual sphere.

Black-box projection offers increased flexibility forexternal-level business process harmonization with thetrade-off that harmonization is difficult to achieve asthe business-process internals remain opaque. To al-leviate this situation, it is necessary that collaboratingparties have a mechanism available to support thechecking of an eSourcing configuration realized withblack-box projection. In Section 7.1 such a method ispresented for checking the correctness of eSourcingconfigurations, which are formally defined in the fol-lowing section.

6 eSourcing configurations

To realize a method for checking eSourcing configu-rations, it is relevant to first give a definition of aneSourcing configuration. This section presents a def-inition together with the accompanying properties ofan eSourcing configuration. Figure 7 depicts a high-

Fig. 7 A high-level overview of an eSourcing configuration

level overview of the different parts of an eSourcingconfiguration and how they relate to each other.

Shown at the left bottom of Fig. 7, a valid par-titioned bilateral WF-net BW that is located on theconceptual level. The interface places I connect theconsumer sphere CS as a subflow to the bilateral WF-net BW. On the right side of Fig. 7, the provider spherePS is located on the conceptual level. The consumercan choose between an ω-projection and β-projectionfrom the consumer sphere to the consumer contractualsphere CCS on the external level. On the other hand,the provider can choose between an ω-projection, γ -projection, and β-projection.

At the top of Fig. 7, the external level is depictedwere the contractual spheres CCS and PCS are lo-cated. To have a contractual consensus between CCSand PCS, the respective contractual spheres need tobe isomorphic, so CCS ≡ PCS. In the middle, thethree projection tuples are depicted that are availablefor the collaborating parties to establish a contractualconsensus between CCS and PCS. Either the consumerperforms a white-box projection which the providercomplements either with a white-box projection or agrey-box projection, or both parties use a black-boxprojection. At the left bottom of Fig. 7, the depictedconceptual level expresses that the consumer sphereCS is a subnet of the bilateral WF-net BW and theinterface places I serve as connections. Based on theseexplanations, an eSourcing configuration is defined asfollows:

Definition 24 (eSourcing configuration) An eSourc-ing configuration is a tuple eSC = (I H P, BW, PS,

CCS, PCS) such that:

1. I H P, the in-house process, is a sound WF-net;2. BW = (I, M, CS, L, G) is a bilateral WF-net that

is a valid partitioning of I H P, where CS is theconsumer sphere (the subflow of BW);

3. PS is the provider sphere;4. CCS is a consumer contractual sphere;

470 Inf Syst Front (2010) 12:457–479

5. PCS is a provider contractual sphere;6. there is a projection relation between CS and CCS

on the one hand, and between PS and PCS on theother hand, such that either:

– CSωCCS and PSωPCS, or– CSωCCS and PSγ PCS, or– CSβCCS and PSβ PCS;

7. there is contractual consensus: CCS ≡ PCS.

The last requirement states that for contractual con-sensus, the contractual spheres of the collaboratingparties must be isomorphic. An example of contractualconsensus is given by Figs. 3 and 4. The consumercontractual sphere CCS of Fig. 3 and the provider con-tractual sphere PCS of Fig. 4 are isomorphic, althoughin the first case ω-projection and in the latter case γ -projection results in the respective contractual sphere.

The definition states in which cases the bilateral WF-net, provider sphere, and the corresponding contractualspheres of the consumer and provider are properlyrelated to each other. However, the eSourcing config-uration can still be incorrect. For an eSourcing con-figuration, we define correctness as soundness of thebilateral WF-net containing the consumer main processand the provider sphere. The next section defines anoperator that yields such a bilateral WF-net from aneSourcing configuration. The next section also intro-duces two methods that are instrumental for checkingthe correct termination and adherence of the providerto an agreed-upon service provision. In particular, weshow that only for black-box eSourcing configurationsan additional correctness check is needed. All othertypes of eSourcing configuration are guaranteed to becorrect and the consumer main process together withthe provider process are guaranteed to realize the orig-inal consumer in-house process.

7 Checking eSourcing configurations

An eSourcing configuration may contain errors, forexample the collaboration of an in-house process anda provider sphere can result in a deadlock. To checkeSourcing configurations for correctness, a verificationmethod is used that takes advantage of the supportingtheorems and their proofs from the domain of inter-organizational WF-nets (van der Aalst 2002). Firstly,it is shown how a collapsing method for eSourcingconfigurations can be specified by using the flatteningfunction defined for bilateral WF-nets. Such a flatteningis useful for checking soundness; however, it requiresthat a consumer and a provider expose their local

processes to a trusted third party. The architecture forthis third party is painted in Section 8. Secondly, it isshown that grey-box and white-box eSourcing configu-rations are guaranteed to be correct (sound). Thus, forsuch eSourcing configurations, the collapsing method isnot needed to check soundness, and the consumer andprovider do not need to expose their processes to sometrusted third party. Furthermore, for such eSourcingconfigurations it is ensured that the resulting inter-organizational business process realizes the in-houseprocess.

Below, Section 7.1 presents a method that is neces-sary to ensure correct termination when the col-laborating parties use black-box projections. Whenwhite-box or grey-box projections are used, the methodof Section 7.1 is not applicable. Instead local ter-mination checking of business processes inside thedomains of collaborating parties suffices to ensureinter-organizational termination correctness, as Sec-tion 7.2 shows.

7.1 Checking correct termination using collapsing

The practical method with which an eSourcing con-figuration is checked for control-flow problems andcorrect service provision is the collapsing method that isillustrated by means of an example in Fig. 8. Basically,the collapsing method replaces the consumer sphere ofthe in-house process with the provider sphere.

Fig. 8 A collapsed net

Inf Syst Front (2010) 12:457–479 471

At the bottom of Fig. 8, the collapsed net for therunning example is depicted, which can be verifiedfor soundness with the tool Woflan (Verbeek and vander Aalst 2009). Moreover, Woflan checks whetherthe collapsed net is a subclass according to projectioninheritance compared to the bilateral WF-net BW thatis depicted in Fig. 3. If β-projection is used, the flattenednet need not be a WF-net. In that case Woflan may stillbe used, although the tool then signals that the input isnot a WF-net.

By applying the collapsing method, a bilateral WF-net BW ′ is yielded, i.e., a bilateral WF-net that speci-fies the enactment of inter-organizational collaborationbetween a consumer and a provider. To obtain BW ′,an operator is defined for replacing a consumer spherethat is contained in the valid bilateral WF-net BWwith a provider sphere. The resulting bilateral WF-netconnects the internal process to the provider sphere sothat BW ′ is linking the domains of a consumer and aprovider for collaborative enactment.

Definition 25 (CSreplacePS) Let eSC = (I H P, BW,

PS, CCS, PCS) be an eSourcing configuration withBW = (I, M, CS, L, G), then CSreplacePS(eSC) is de-fined as the bilateral WF-net BW ′ = (I, M, PS, L, G).

Hence, CSreplacePS(eSC) is a bilateral WF-net in which the provider sphere replaces the consu-mer sphere, i.e., the provider sphere cooperates withthe consumer’s internal process. Figure 8 illustrates theCSreplacePS function. The process at the top is thebilateral WF-net BW and the bottom is the net BW ′where the provider sphere PS replaces the consumersphere contained in BW. Both processes are connectedthrough interface places. Using CSreplacePS, weformally define the collapsing method. For thecollapsing method the operator f lat is used (seeDefinition 15).

Definition 26 (Collapsed net) Let eSC = (I H P, BW,

CS, PS, CCS, PCS) be an eSourcing configuration.The collapsed net is f lat(CSreplacePS(eSC)).

The following section shows that for eSourcing con-figurations that do not use black-box projection, an es-tablished inter-organizational workflow is guaranteedto be sound.

7.2 Checking correct termination using projectioninheritance

In this section, a theorem is introduced for white-boxand grey-box eSourcing configurations. The theorem

states that for such eSourcing configurations, the run-time bilateral WF-net is sound and the collapsed net is asubclass of the in-house process under projection inher-itance. The main advantage of this result is that withoutthe need for coordination among the collaborating par-ties, the resulting bilateral WF-net is guaranteed to besound. Additionally, it is guaranteed that the eSourcingconfiguration realizes the in-house process, i.e., all thetasks specified in the in-house process are executed inthe proper order. The proof is not difficult but relies onIOWF-nets (van der Aalst 2002); the proof is containedin Norta (2008).

Theorem 2 (Compositionality of eSourcing configura-tions) Let eSC = (I H P, BW, PS, CCS, PCS) be aneSourcing configuration with BW = (I, M, CS, L, G)

the bilateral WF-net, CS the consumer sphere, PS theprovider sphere, and M the main process, with a projec-tion relation between CS and CCS on the one hand, andbetween PS and PCS on the other hand, such that eitherCSωCCS and PSωPCS, or CSωCCS and PSγ PCS.

1. CSreplacePS(eSC) is sound, and2. β( f lat(CSreplacePS(eSC))) is a subclass of I H P

under projection inheritance, i.e., β( f lat(CSreplacePS(eSC))) ≤pj I H P.

The essence of the theorem about compositionalityof projection inheritance is depicted in Fig. 9. It showsthat the flattened net without dead transitions BW ′ isguaranteed to be a subclass of the in-house processI H P if the provider sphere PS is a subclass of theconsumer sphere CS under projection inheritance. SoBW ′ and I H P do not have to be checked explicitlyfor deciding whether BW ′ is a subclass of I H P underprojection inheritance.

As a consequence of this theorem, it is possible tocheck the overall soundness of an eSourcing configura-

Fig. 9 The essence of the compositionality of projection inheri-tance (van der Aalst 2002)

472 Inf Syst Front (2010) 12:457–479

tion and the adherence of internal service provision towhat is publicly agreed while maintaining independentand mutually opaque process domains of a consumerand a provider. The soundness of the eSourcing con-figuration is guaranteed without the need for any co-ordination among the provider and consumer. Hence,the employment of a trusted third party by the con-sumer and the provider is only required for checkingcontractual consensus. It is ensured that the tasks of theconsumer sphere are executed in the proper order bythe refined service provision.

For ensuring the overall correctness of an eSour-cing configuration when β-projection is used, the archi-tectural solution presented in the following section isinstrumental.

8 Evaluation

In the previous section it is demonstrated how aneSourcing configuration is mapped to a bilateral WF-net which can be verified for correctness. First, thearchitecture of a corresponding verifier component ispresented, followed by an introduction of XRL (eX-changable Routing Language) (Norta 2009) that showshow this language can be used to model the in-houseprocess and provider process of an eSourcing config-

uration. As an enactment engine for XRL-formulatedprocesses, the tool XRL/flower exists.

8.1 A verifier component

Since neither consumer nor provider are willing toshare its process definitions with each other, a trustedthird-party service is needed to check the actual termi-nation correctness. It needs to be stressed that Theo-rem 2 implies the verifier component in Fig. 10 is onlyneeded for black-box eSourcing configurations, but notwhen a provider and a consumer agree on performingω-projection and/or γ -projection. Then the eSourcingconfiguration is either white-box or grey-box. In bothcases, the third party only needs to check contractualconsensus. All other checks are performed locally bythe collaborating parties themselves. As a core partof the verifier component, the analysis tool Woflan(Verbeek and van der Aalst 2000, 2009; Verbeek et al.2001a) checks control-flow abnormalities of submittedprocesses, e.g., deadlocks. Collaborating parties inde-pendently submit their conceptual processes for veri-fication to this component without disclosing internalbusiness details to each other.

Figure 10 shows the architecture of the trusted third-party verifier. A process-communicator component re-ceives a request from the contracting client belonging

Fig. 10 The trustedthird-party verifier servicein detail

Inf Syst Front (2010) 12:457–479 473

to the domain of a collaborating party to perform averification of a created eSourcing configuration. Theprocess communicator requests the conceptual-levelprocesses of all collaborating parties and the contrac-tual spheres from the eSourcing middleware. Next,the collected processes from conceptual and externallevels are delivered to a translator that converts theprocesses into a format the eSCtoBW-mapper com-ponent and Woflan can process. The first componentdelivers the resulting BW-net to a collapser componentthat creates a net, which Woflan verifies for soundnessand projection inheritance. For the latter verificationtype, the BW-net is compared with the collapsed P/T-net. All processes delivered by the Translator compo-nent are separately verified by Woflan for control-flowproblems.

8.2 XRL: An XML-based routing language

In CrossWork, the external- and conceptual-levelbusiness processes of an eSourcing configuration areformulated in XRL, which is an instance-based work-flow language that uses XML for the representationof process definitions and WF-nets for its semantics. Acatalogue of control-flow patterns (van der Aalst et al.2000, 2007; Kiepuszewski 2002; Kiepuszewski et al.2003) is contained in the definition of XRL (van derAalst and Kumar 2003; Norta 2009) as routing elementsthat results in strong control-flow expressive power ofXRL. These routing elements are equipped with WF-net semantics (van der Aalst et al. 2001), namely, everyrouting element stands for an equivalent WF-net snip-pet that can be connected with other routing elementsinto a bigger WF-net. Figure 11 shows extracts of anXRL code that are inspired by the provider process ofFig. 2, which depicts the watertank example.

The syntax of XRL is completely specified in a DTDand schema definition (Norta 2009). An XRL routeis a consistent XML document, that is, a well-formedand valid XML file with top element route. The struc-ture of any XML document forms a tree. In case ofXRL, the root element of that tree is the route. Thisroute contains exactly one so-called routing element. Arouting element is an important building block of XRLas it can either be simple (no child routing elements)or complex (one or more child routing elements). Acomplex routing element specifies whether, when andin which order the child routing elements are carriedout. In van der Aalst and Kumar (2003), Norta (2009)more details about the control-flow elements of XRLare conatined.

Figure 12 shows the WF-net semantics of an XRL-task construct. Hence, since the semantics of XRL isexpressed in terms of WF-nets (see Section 3.1), itpermits the use of theoretical results and standard toolssuch as van der Aalst (1998); Verbeek et al. (2001a)for checking the notion of soundness and projectioninheritance. The WF-net semantics of XRL is realizedby mapping to PNML (Kindler et al. 2003a,b; Weberand Kindler 2003), an XML-based interchange formatthat permits the definition of Petri-net types. For thatpurpose a stylesheet translator is employed that con-tains mapping rules (van der Aalst et al. 2001) to PNMLfor every XRL control-flow construct.

For an evaluation and enactment application, thetool XRL/flower (Verbeek et al. 2002) is instrumentalfor XRL-modeled business processes. Figure 13 showsthe enactment application of XRL/flower with a visualrepresentation of enactment code resulting from XRLto PLMN mapping. Since XRL is based on both XMLfor syntax and WF-nets for semantics, standard XMLtools can be deployed to parse, check, and handleXRL documents. The Petri-net representation allows

Fig. 11 Extract of XRL-codeexample

474 Inf Syst Front (2010) 12:457–479

Fig. 12 The WF-netsemantics of an XRL-taskconstruct (van der Aalst et al.2001)

for a straightforward implementation of the workflowenactment engine. XRL constructs are automaticallytransformed to Petri-net constructs. This allows foran efficient implementation and the system is easy toextend by employing an XSL translator for mappingrouting elements to PNML. Thus, for supporting a newcontrol flow primitive, only a transformation to thePetri-net format needs to be added and the engine itselfdoes not need to change.

To model the contractual spheres of the externallevel, the XML-based markup language eSML (Norta2005, 2008) was developed during the CrossWorkproject. eSML is instrumental as an external choreogra-phy language of the conceptual-level business processesand differs compared to other choreography languagessuch as AbstractBPEL (Alves et al. 2007) or WS-CDL (Jordan 2007). Firstly, in accordance with thehigh-level overview of an eSourcing configuration inFig. 7, every service consumer and service providerspecifies separate contractual spheres in one eSML

instantiation that are linked with additional languageconstructs to specify the degree of enactment observ-ability for a service consumer. Secondly, the expressive-ness of eSML permits its use as an electronic contractbetween collaborating parties that also specifies the col-laborating parties, the service-reward, business-processrolebacks for a failed enactment, and so on.

9 Related work

We first review existing formalizations for businessprocess collaborations followed by a discussion of re-lated research projects about inter-organizational busi-ness collaboration.

9.1 Formalizations for business process collaborations

Bilateral WF-nets are a simplified version of IOWF-nets (van der Aalst 2002). First, an IOWF-net can

Fig. 13 Enactmentapplication of the Petri-netenactment module

Inf Syst Front (2010) 12:457–479 475

reference an arbitrary number of WF-nets, while abilateral WF-net only references two. More important,however, IOWF-nets are intended for modelling peer-to-peer collaborations, while a bilateral WF-net modelsa client/server collaboration. This difference is exem-plified by the P2P (Public-To-Private) approach (vander Aalst 2002) in which IOWF-nets are used. In thefirst step of the approach, a publicly agreed WF-netis created. Secondly, the public WF-net is partitionedinto domains for the collaborating parties. Finally, aprivate workflow is created for each domain such thatthe private workflow is a subclass of the correspondingpart of the public workflow. Thus, by starting with apublicly agreed WF-net, the P2P approach implies anequal power constellation between collaborating busi-ness parties.

The above mentioned approach of IOWF-nets suitsthe current way of technically composing web services.However, from a business point of view, observingOEMs and their suppliers in CrossWork (CrossWork2009) industry case studies shows that the businessneeds of B2B collaboration must be harmonized in adifferent way. Typically OEMs play a dominant role inB2B settings and try to exert tight control over theirsuppliers. Thus, OEMs impose a dominating client-server relationship on their suppliers that are usuallytightly integrated into the OEM’s in-house process.That way the OEM achieves fast production cycles,which is a competitive advantage. To support B2B col-laboration in an electronic way, the client-server natureof inter-organizational business process managementneeds to be explicitly modeled. That is why we usebilateral WF-nets rather than IOWF-nets. Problemsthat occur in a technical realization of the IOWF-netapproach are pointed out in Bussler (2002b) and dis-cussed in Section 1 of this paper.

There are several other Petri net-based approachesin the literature that support service-based businessprocess collaborations (Martens 2003a, b; Bonchi et al.2007; Reisig et al. 2005; van der Aalst et al. 2008).In all these approaches, a service is represented bya net. Different services interact with each other byexchanging tokens through shared interface places,which models the asynchronous exchange of messagesbetween the services. Given a service A, any otherservice B that can interact with A through the sharedinterface places without reaching a deadlock state isconsidered correct. These approaches resemble black-box projection. However, we use a collapsing method tocheck absence of deadlock, while the approaches focuson defining criteria or rules on the services that guar-antee absence of deadlock, rendering an explicit checksuperfluous.

Regarding white-box and grey-box projection, theserelated approaches are completely different from ours.For these projection types, an interface of a service notonly consists of places, but also of transitions and theirlabels (actions), and a service that replaces anotherservice must not only agree on the interface places butalso have similar behaviour. van der Aalst et al. (2008)claim this is too restrictive and give an example wherea service with the same actions but different behaviourcan still replace another service without leading todeadlock. However, the criterion they propose doesnot take transitions and their labelling into account.Consequently, using their criterion, a provider couldperform actions that are different from the ones spec-ified by the consumer. Clearly, this is not appropriatefor outsourcing. Therefore, for grey-box and white-boxprojection, we have chosen interfaces that contain bothtransitions and their labels.

Next, there is other related work on process-basedservices. Some approaches focus on service contractsbased on process algebra (Bravetti and Zavattaro 2007;Carbone et al. 2007). None of these approaches usesprojection inheritance. Bravetti and Zavattaro (2007)use a testing preorder to check replacability, whileCarbone et al. (2007) use a (bi)simulation approach.These process-algebraic approaches do not considerblack-box projection. Finally, Benatallah et al. (2006)focus on service protocols, and analyse their behav-iour to check their compatibility and replacability.However, service protocols are sequential. This makestheir analysis considerably more simple than Petri nets,which are parallel. Also, Benatallah et al. (2006) do notconsider different projection types, since these are notapplicable to service protocols.

9.2 Research projects

The WISE project (Alonso 1999; Lazcano et al. 2001)resulted in a software platform for process-based B2Belectronic commerce that focuses on support for anetwork of small and medium-sized enterprises. WISErelies on a central workflow engine to control inter-organizational processes that are termed virtual busi-ness processes. In WISE a virtual business processconsists of a number of black-box services that arelinked in a workflow process (Alonso 1999). A serviceis offered by an involved organization and can be abusiness process that is controlled by a local workflowmanagement system. WISE does not support multiplelevels of visibility, so there is no distinction betweenconceptual and external-level processes.

In the CrossFlow project (IBM Research 1999),inter-organizational business process collaboration was

476 Inf Syst Front (2010) 12:457–479

investigated. In the context of this project, the for-mation of virtual enterprises is realized by dynamicallyout-sourcing a part of the consumer’s process to a pro-vider. A service matchmaker matches a service offer-ing and a service request. The provider has adjustmentflexibility as nodes of the assigned process can be in-ternally refined on a lower process level. Based onthe electronic contract, a service enactment infra-structure (Hoffner et al. 2005) is established dynami-cally, employing workflow technology. CrossFlow hasan external level that spans across organizational do-mains where the process specification is part of a con-tract specification. The workflow specification languageof the workflow management system IBM MQSeriesWorkflow (IBM 2009) forms the internal process level.

The integrated research project ATHENA (2009)investigates enterprise inter-operability in a holisticway with a technology-based approach that is guidedby user requirements. It is the strategic objective ofthe project to enable networked businesses and gov-ernments. The expected results are of a technical-,business-, content-, and community-building naturewhere the topics of inter-organizational enterpriseand process modelling, correspondingly required on-tologies, service-composition frameworks, and enact-ment infrastructures are investigated. In the areaof inter-organizational business process modelling, abusiness-level framework is proposed with a B2Bprocess spanning across organizations, which is comple-mented by a public process and a private process in thedomains of a collaborating organization. This businesslevel is complemented with a technical and executionlevel that is responsible for enactment. For business-process modelling, an extension of event-process chain(EPC) formalism with so-called process-modules is pro-posed to achieve process abstraction. However, optingfor EPC poses the difficulty that a verification of correcttermination before enactment is not achieved. Further-more, it is not possible to verify the extent to whichcollaborating parties adhere to their internal processesto what is externally promised.

Compared to these other research projects, theeSourcing framework offers a formal approach forspecifying and verifying B2B process collaboration withmultiple levels of visibility. Since CrossWork was a suc-cessor of CrossFlow, our work is naturally most closelyrelated to CrossFlow. The main improvement over theCrossFlow approach is that eSourcing supports black-box and grey-box projections, whereas CrossFlow onlyconsidered white-box projections. However, CrossFlowdid consider an alternative projection between concep-tual and external-level processes: an external-level taskcan be decomposed into a set of conceptual-level tasks.

Elsewhere (Eshuis and Grefen 2008) we formalizedaggregation in the context of process views. Addingaggregation to the eSourcing framework is straight-forward, since it is a variant of transition refinement(replacing a transition by a subnet) which is well knownfrom hierarchical Petri nets.

Additional approaches to inter-organizationalprocess collaboration exist. In Bussler (2002a) the topicof B2B integration is dealt with in detail, ranging fromdiffering integration concepts via required integrationtechnology and their deployment to a discussion aboutintegration standards, products, and ongoing researchin the domain. These integration approaches dealpredominantly with the technicalities involved anddo not propose a collaboration model that is suitablefor the way B2B collaboration between an OEM andsuppliers unfolds. An advanced approach for enablinginter-organizational business collaboration (Bussler2002b) investigates the use of public and privateprocesses that solves the problems of message-exchange implementation, message transformation,and business rule handling between opposing parties.Open issues of Bussler (2002b) are how collaboratingparties can regulate the degree of exposing theirbusiness internals to each other during setup andenactment time, which detailed options exist forbinding the nodes of collaborating business processes,what issues arise for message exchanges betweencollaborating domains, which process properties mustbe adhered to for ensuring a smooth enactment phase,how can those properties be independently verifiedand evaluated during the setup phase without forcingthe collaborating parties into exposing their businessinternals, and so on.

10 Conclusion

This paper focuses on control-flow issues that occur ininter-organizationally harmonized business processeswhere the collaborating parties disclose only as manybusiness details as necessary. The presented formaleSourcing framework addresses the problem of over-all termination correctness such as deadlocks or live-locks that may occur when business processes thatcorrectly terminate on their own are linked together.To support the conceptual and external collaborationseparation levels, the eSourcing framework caters fordifferent projection methods of business-process detailsto the external level that result in variations of externalbusiness-process visibility, namely a white-box, grey-box and black-box visibility. Based on the adopted

Inf Syst Front (2010) 12:457–479 477

pre-existing Petri-net theory, we define the control-flow properties for the processes of the conceptualand external levels of an eSourcing configuration. Thepaper also defines which conditions must hold in orderto achieve contractual consensus between collaboratingparties.

Based on a practical collapsing method the correcttermination of a collapsed eSourcing configuration maybe determined. The collapsing method is also suit-able for verifying if the provider adheres to an agreedupon service request. Alternatively, we show that aneSourcing configuration that does not use black-boxprojection is guaranteed to be sound and moreover, thecollaboration of the internal process with the providerprocess is guaranteed to realize the in-house process.The latter approach relies on a theorem about thecompositionality of projection inheritance.

For the practical collapsing method, we propose areference architecture of a trusted-third party to sup-port the checking of an eSourcing configuration withoutforcing collaborating parties to reveal internal busi-ness secrets to each other. This reference architecturecomprises the tool Woflan for checking the sound-ness of an eSourcing configuration before enactment.The trusted third party supports the collapsing methodwhen the contractual parties use black-box projection.In this case, a check of the eSourcing configuration bya trusted-third-party service prevents the collaboratingparties from revealing business internals to each other.For eSourcing configurations that use white-box pro-jection and grey-box projection, a trusted third-partyservice may check contractual consensus. Instead, alocal checking by the collaborating parties suffices forcorrect termination detection.

We mention several areas of future work. Firstly,it needs to be explored how the black-box projectioncan be supported in a better way. Hence a formaliza-tion extension should indicate the features of interfaceplaces without requiring the collaborating parties toexchange such information in an architectural solution.Despite using a black-box projection, the automatedblack-box projection should ensure that an eSourcingconfiguration still terminates correctly without forc-ing the collaborating parties into disclosing business-critical internals.

Future research must investigate the data-flow per-spective in eSourcing configurations. For now we as-sume that data flows along a correctly terminatingcontrol flow. However, that does not solve all possibleproblems with respect to data flow, e.g., data mapping,data transformation, data consistency as part of long-lasting business transactions, and so on. Such data-flowissues particularly matter as eSourcing configurations

integrate heterogeneous legacy-system infrastructuresof collaborating parties.

Further scope for future research results from ex-periences in evaluation studies of constructed appli-cation prototypes with CrossWork industry partnersshow that the expressiveness of available languagesand applications for service-oriented computingdo not sufficiently support eSourcing configurations.Hence, to enable eSourcing, future research needsto demarcate the existing gaps of support in service-oriented-computing languages and applications andexplore extension options to fill them.

Acknowledgements We would like to thank the reviewers fortheir very valuable and helpful feedback. This research was partlyconducted in the EU-FP6 research project CrossWork and partlyin SOAMeS (Service Oriented Architecture in Multichannel e-Services). The latter project was financed by the Finnish FundingAgency for Technology and Innovation, VTT, Elisa Oyj, KeskoOyj, Metsäteho Oy, and TietoEnator Processing & Network Oy.

References

Alonso, G., Fiedler, SU., Hagen, C., Lazcano, A., Schuldt, H. &Weiler, N. (1999). WISE: business to business e-commerce.In Proc. of the 9th international workshop on research issueson data engineering (pp. 132–139). Sydney, Australia.

Alves, A., Arkin, A., Askary, S., Barreto, C., Bloch, B., Curbera,F., et al. (2007). Web services business process execution lan-guage version 2.0 (OASIS standard). WS-BPEL TC OASIS,http://docs.oasis-open.org/wsbpel/2.0/wsbpel-v2.0.html.

ATHENA (2009) Advanced technologies for interoperabilityof heterogenous enterprise networks and their application.http://www.athena-ip.org/index.php.

Basten, T. (1998). In terms of nets: System design with Petri netsand process algebra. PhD thesis, Eindhoven University ofTechnology, Eindhoven, The Netherlands.

Basten, T., & van der Aalst, W. M. P. (2001). Inheritance of be-havior. Journal of Logic and Algebraic Programming, 47(2),47–145.

Benatallah, B., Casati, F., & Toumani, F. (2006) Represent-ing, analysing and managing web service protocols. Data &Knowledge Engineering, 58(3), 327–357.

Berthelot, G. (1987). Transformations and decompositions ofnets. In W. Brauer, W. Reisig, & G. Rozenberg (Eds.), Ad-vances in Petri nets 1986 part I: Petri nets, central models andtheir properties. Lecture notes in computer science (Vol. 254,pp. 360–376). Berlin: Springer.

Bonchi, F., Brogi, A., Corfini, S., & Gadducci, F. (2007). A behav-ioural congruence for web services. In F. Arbab, & M. Sirjani(Eds.), Proc. int. symposium on fundamentals of softwareengineering (FSEN 2007). Lecture notes in computer science(Vol. 4767, pp. 240–256). Berlin: Springer.

Bravetti, M., & Zavattaro, G. (2007). Contract based multi-party service composition. In F. Arbab, & M. Sirjani (Eds.),Proc. int. symposium on fundamentals of software engineer-ing (FSEN 2007) (Vol 4767, pp. 207–222). Berlin: Springer.

Bussler, C. (Ed.) (2002a). B2B integration: Concepts and architec-ture. Berlin: Springer.

478 Inf Syst Front (2010) 12:457–479

Bussler, C. (2002b). The application of workflow technology insemantic B2B integration. Distributed and Parallel Data-bases, 12, 163–191.

Carbone, M., Honda, K., & Yoshida, N. (2007). Structuredcommunication-centred programming for web services. InR. De Nicola (Ed.) Proc. 16th European symposium on pro-gramming (ESOP 2007). Lecture notes in computer science(Vol. 4421, pp. 2–17). Berlin: Springer.

Chiu, D. K. W., Cheung, S. C., Till, S., Karlapalem, K.,Li, Q., & Kafeza, E. (2004). Workflow view drivencross-organizational interoperability in a web service en-vironment. Information Technology Management, 5(3–4),221–250.

Colom, J. M. & Silva, M. (1990). Improving the linearly basedcharacterization of P/T nets. In G. Rozenberg (Ed.), Ad-vances in Petri nets 1990. Lecture notes in computer science(Vol. 483, pp. 113–146). Berlin: Springer.

CrossWork (2009) Cross-organisational workflow formation andenactment, IST no. 507590. http://www.crosswork.info/.

IBM (2009) IBM MQSeries workflow. http://www-4.ibm.com/software/mqseries/workflow.

IBM Research (1999). CrossFlow architecture description, Tech-nical report, ESPRIT CrossFlow EP 28653.

Ellis, C. A., & Nutt, G. J. (1993) Modelling and enactment ofworkflow systems. In M. A. Marsan (Ed.), Application andtheory of Petri nets 1993. Lecture notes in computer science(Vol. 691, pp. 1–16). Berlin: Springer-Verlag.

Eshuis, R., & Grefen, P. (2008). Constructing customized processviews. Data and Knowledge Engineering, 64(2), 419–438.

Gomez, J. M., Haller, A., & Bussler, C. (2005). A conversa-tion oriented language for B2B integration based on se-mantic web services. web service semantics. In Towardsdynamic business integration workshop. In conjunction withthe 14th international world wide web conference (WWW2005), Chiba, Japan, May 2005.

Grefen, P., Ludwig, H., & Angelov, S. (2003). A three-levelframework for process and data management of complexe-services. International Journal of Cooperative InformationSystems, 12(4), 487–531.

Grefen, P., Mehandjiev, N., Kouvas, G., Weichhart, G., &Eshuis, R. (2009). Dynamic business network process man-agement in instant virtual enterprise. Computers in Industry,60, 86–103.

Hoffner, Y., Ludwig, H., C. Gülcü, & Grefen, P. (2005).Architecture for cross-organizational business processes. InProcs. 2nd int. workshop on advanced issues of e-commerceand web-based Information systems (pp. 2–11). Milpitas, CA,USA.

Jordan, D., Evdemon, J., Alves, A., & Arkin, A. (2007).Web services choreography description language 1.0.http://www.w3.org/TR/2004/WD-ws-cdl-10-20041217/.

Kiepuszewski, B. (2002). Expressiveness and suitability oflanguages for control flow modelling in workflows. PhD the-sis, Queensland University of Technology, Queensland Uni-versity of Technology, Brisbane, Australia.

Kiepuszewski, B., ter Hofstede, A. H. M., & van der Aalst,W. M. P. (2003). Fundamentals of control flow in workflows.Acta Informatica, 39(3), 143–209.

Kindler, E., Billington, J., & Christensen, S., et al. (2003a). ThePetri net markup language: Concepts, technology, and tools.In W. M. P., van der Aalst, E. Best (Eds.), Proc. of the24th international conference, ICATPN 2003. Lecture notesin computer science (Vol. 2679, pp. 483–505). Eindhoven:Springer.

Kindler, E., et al. (2003b). Petri net markup language (PNML)home page. http://www.informatik.hu-berlin.de/top/pnml/.

Lazcano, A., Schuldt, H., Alonso, G., & Schek, H. (2001).WISE: Process based e-commerce. IEEE Data EngineeringBulletin, 24(1), 46–51.

Leymann, F., & Roller, D. (1999) Production workflow: Con-cepts and techniques. Upper Saddle River: Prentice-HallPTR.

Martens, A. (2003a). On compatibility of web services. Petri NetNewsletter, 65, 12–20.

Martens, A. (2003b). On usability of web services. In C. Calero,O. Díaz, & M. Piattini (Eds.) Proc. of 1st web services qualityworkshop (WQW 2003). Rome, Italy.

Mehandjiev, N., & Grefen, P. (Eds.) (2009). Dynamic busi-ness process formation for instant virtual enterprises. Berlin:Springer (in press).

Milner, R. (1989). Communication and concurrency. EnglewoodCliffs: Prentice-Hall.

Norta, A. (2005). eSML (electronic Sourcing Markup Language).In R. Eshuis, & I. Stalker (Eds.) CrossWork: Requirementsand concepts for agent-based workflowconfiguration, workpackage 2: Workflow modelling, task 2.2: Agent-based work-flow configuration.

Norta, A. (2007). eSourcing: Electronic sourcing for businessto business. http://www.cs.helsinki.fi/u/anorta/research/eSourcing/.

Norta, A. (2008). Exploring dynamic inter-organizationalbusiness process collaboration: Privacy protecting conceptsfor choreographing eSourcing in B2B with service-orientedcomputing. VDM.

Norta, A. (2009). XRL home page. http://www.cs.helsinki.fi/u/anorta/research/XRL/xrlHome.html.

Reisig, W., & Rozenberg, G. (Eds.) (1998). Lectures on Petri netsI: Advances in Petri nets. Lecture notes in computer science(Vol. 1491). Berlin: Springer.

Reisig, W., Schmidt, K., & Stahl, C. (2005). KommunizierendeWorkflow-Services modellieren und analysieren. In Infor-matik - Forschung und Entwicklung (pp. 90–101).

van der Aalst, W. M. P. (1997). Verification of workflow nets.In P. Azéma, & G. Balbo (Eds.), Application and theory ofPetri nets 1997. Lecture notes in computer science (Vol. 1248,pp. 407–426). Berlin: Springer.

van der Aalst, W. M. P. (1998). The application of Petri netsto workflow management. Journal of Circuits, Systems andComputers, 8(1), 21–66.

van der Aalst, W. M. P. (2002). Inheritance of interorganizationalworkflows: How to agree to disagree without loosing con-trol? Information Technology and Management, 2(3).

van der Aalst, W. M. P., & Basten, T. (2002). Inheritance of work-flows: An approach to tackling problems related to change.Theoretical Computer Science, 270(1–2), 125–203.

van der Aalst, W. M. P., & Kumar, A. (2003). XML based schemadefinition for support of inter-organizational workflow. In-formation Systems Research, 14(1), 23–47.

van der Aalst, W. M. P., & van Hee, K. M. (2002). Workflow man-agement: Models, methods, and systems. Cambridge: MIT.

van der Aalst, W. M. P., ter Hofstede, A. H. M., Kiepuszewski, B.,& Barros, A. P. (2000). Advanced workflow patterns. In O.Etzion & P. Scheuermann (Eds.) 7th international conferenceon cooperative information systems (CoopIS 2000). Lecturenotes in computer science (Vol. 1901, pp. 18–29). Berlin:Springer.

van der Aalst, W. M. P., Verbeek, H. M. W., & Kumar, A. (2001).XRL/Woflan: Verification of an XML/Petri-net based lan-guage for inter-organizational workflows (best paper award).In K. Altinkemer & K. Chari (Eds.) Proceedings of the 6thinforms conference on information systems and technology(CIST-2001) (pp. 30–45). Linthicum: Informs.

Inf Syst Front (2010) 12:457–479 479

van der Aalst, W. M. P., ter Hofstede, A. H. M., Kiepuszewski,B., & Barros, A. P. (2007). Workflow patterns home page.http://www.workflowpatterns.com.

van der Aalst, W. M. P., Lohmann, N., Massuthe, P., Stahl,C., & Wolf, K. (2008). From public views to privateviews – Correctness-by-design for services. In M. Dumas &R. Heckel (Eds.) Proc. WS-FM 2007. Lecture notes in com-puter science (Vol. 4937, pp. 139–153). Berlin: Springer.

van Glabbeek, R. J., & Weijland, W. P. (1996). Branching timeand abstraction in bisimulation semantics. Journal of theACM, 43(3), 555–600.

Verbeek, H. M. W., & van der Aalst, W. M. P. (2000). Woflan 2.0:A Petri-net-based workflow diagnosis tool. In M. Nielsen &D. Simpson (Eds.) Application and theory of Petri nets 2000.Lecture notes in computer science (Vol. 1825, pp. 475–484).Berlin: Springer.

Verbeek, H. M. W., & van der Aalst, W. M. P. (2009). Woflanhome page. Eindhoven, The Netherlands: Eindhoven Uni-versity of Technology. http://www.tm.tue.nl/it/woflan.

Verbeek, H. M. W., Basten, T., & van der Aalst, W. M. P. (2001a).Diagnosing workflow processes using Woflan. The ComputerJournal, British Computer Society, 44(4), 246–279.

Verbeek, H. M. W., Basten, T., & van der Aalst, W. M. P. (2001b).Diagnosing workflow processes using Woflan. The ComputerJournal, 44(4), 246–279.

Verbeek, H. M. W., Hirnschall, A., & van der Aalst, W. M. P.(2002). XRL/Flower: Supporting inter-organizational work-flows using XML/Petri-net technology. In C. Bussler, R.Hull, S. McIlraith, M. E. Orlowska, B. Pernici, & J. Yang(Eds.) Web services, e-business, and the semantic web. CAiSE2002 international workshop, WES 2002, Toronto, Canada(pp. 93–109). LNCS Springer, May 2002.

Weber, M., & Kindler, E. (2003). The Petri net markup language.In H. Ehrig, W. Reisig, G. Rozenberg, & H. Weber (Eds.)Petri net technology for communication-based systems ad-vances in Petri nets, Lecture notes in computer science (Vol.2472, 455 p.). Berlin: Springer.

Alex Norta is a post-doctoral researcher at the Universityof Helsinki, Finland. He received his MSc degree (2001) fromthe Johannes Kepler University of Linz, Austria and his PhDdegree (2007) from the Eindhoven University of Technology,The Netherlands. His PhD thesis was partly financed by the ISTproject CrossWork, in which he focused on developing the eSour-cing concept for dynamic inter-organizational business processcollaboration. His research interests include business process col-laboration, e-business transactions, service-oriented computing,software architectures.

Rik Eshuis is an assistant professor at Eindhoven Universityof Technology, The Netherlands. He received an MSc degree(1998) and a PhD degree (2002) in Computer Science from theUniversity of Twente. Afterwards, he spent one year as a visitingpostdoctoral researcher at the CRP Henri Tudor and LIASITin Luxembourg. He was involved in the IST project CrossWork,which focused on developing advanced process support for theautomotive industry. He is on the editorial board of the OpenSoftware Engineering Journal. His main research interest is inprocess-oriented information systems and service-oriented com-puting. This includes areas like process composition, processviews, process integration, process modeling, process analysis,service composition, and service adaptation. He is member ofACM, IEEE, and IEEE Computer Society.