BPEL Processes and Human Workflow

Business Process Execution Language (BPEL), one of the key technologies for Service Oriented Architecture (SOA), has become the accepted mechanism for defining and executing business processes in a common vendor-neutral way. Companies ranging from Oracle, IBM, Microsoft, SAP, and BEA to smaller organizations such as Fuego and Lombardi have committed to BPEL as a building block for SOA. BPEL, which has been designed specifically for defining business processes, supports typical interactions such as synchronous and asynchronous operation invocation, sequential and parallel flows, message correlations, fault and compensation handlers and activities triggered by events. Business processes often require human interactions as well.

Since the BPEL specification doesn't address them, you might think BPEL isn't suitable for business processes that involve people. But that's not the case. In this article, we'll look at different choices for human workflow support - including future possible extensions to the BPEL specification and current vendor solutions - and analyze their relevance in practical scenarios. We'll also discuss real-world scenarios in which BPEL and human workflow services are used and show how one company is using BPEL to integrate people with processes - and the benefits achieved through this approach.

User Interaction in Business Processes
BPEL business processes are defined as collections of activities that invoke services. BPEL doesn't make a distinction between services provided by applications and other interactions, such as human interactions. And that's important since real-world business processes often integrate not only systems and services but also users. User interactions in business processes can be simple, such as approving certain tasks or decisions, or complex, such as delegation, renewal, escalation, nomination, or chained execution.

Task approval is the simplest and probably the most common user interaction. In a business process for opening a new account, a user interaction might be required to decide whether the user is allowed to open the account. If the situation is more complex, a business process might require several users to make approvals, either in sequence or in parallel. In sequential scenarios, the next user often wants to see the decision made by the previous user. Sometimes, particularly in parallel user interactions, users aren't allowed to see the other users' decisions. This improves the decision potential. Sometimes one user doesn't even know which other users are involved - or whether any other users are involved at all.

A common scenario for involving more than one user is workflow with escalation. Escalation is typically used in situations where an activity doesn't fulfill a time constraint. In such a case, a notification is sent to one or more users. Escalations can be chained, going first to the first-line employees and advancing to senior staff if the activity isn't fulfilled.

Sometimes it's difficult or impossible to define in advance which user should perform an interaction. In this case, a supervisor might manually nominate the task to other employees; the nomination can also be made by a group of users or by a decision-support system.

In other scenarios, a business process may require a single user to perform several steps that can be defined in advance or during the execution of the process instance. Even more complex processes might require that one workflow is continued with another workflow.

User interactions aren't limited to approvals; they can also include data entries or process management issues, such as process initiation, suspension, and exception management. This is particularly true in long-running business processes, where, for example, user exception handling can prevent costly process termination and related compensation for those activities that have already been successfully completed.

As a best practice for human workflows, it's usually not wise to associate human interactions directly with specific users; it's better to connect tasks to roles and then associate those roles with individual users. This gives business processes greater flexibility, letting any user with a certain role interact with the process and enabling changes to users and roles to be made dynamically.

BPEL and User Interaction
So far we've seen that user interaction in business processes can get quite complex. Although BPEL specification 1.1 (and the upcoming BPEL 2.0) doesn't specifically cover user interactions, BPEL is appropriate for human workflows. Several vendors today have created workflow services that leverage the rich BPEL support for asynchronous services. In this fashion, people and manual tasks become just another asynchronous service from the perspective of the orchestrating process and the BPEL processes stay 100% standard.

We now see the next generation of workflow specifications emerging around BPEL with the objective of standardizing the explicit inclusion of human tasks in BPEL processes. This proposal is called BPEL4People and was originally put forth by IBM and SAP in July 2005. Other companies, such as Oracle, have also indicated that they intend to participate in and support this effort.

The most important extensions introduced in BPEL4People are people activities and people links. People activity is a new BPEL activity used to define user interactions; in other words, tasks that a user has to perform. For each people activity, the BPEL server must create work items and distribute them to users eligible to execute them. People activities can have input and output variables and can specify deadlines.

To specify the implementation of people activities, BPEL4People introduced tasks. Tasks specify actions that users must perform. Tasks can have descriptions, priorities, deadlines, and other properties. To represent tasks to users, we need a client application that provides a user interface and interacts with tasks: it can query available tasks, claim and revoke them, and complete or fail them.

To associate people activities and the related tasks with users or groups of users, BPEL4People introduced people links. People links are somewhat similar to partner links; they associate users with one or more people activities. People links are usually associated with generic human roles, such as process initiator, process stakeholders, owners, and administrators.

The actual users who are associated with people activities can be determined at design time, deployment time, or runtime. BPEL4People anticipates the use of directories such as LDAP to select users; however, it doesn't define the query language used to select users. Rather, it foresees the use of LDAP filters, SQL, XQuery, or other methods.

BPEL4People proposes complex extensions to the BPEL specification, however so far it's still quite high level and doesn't yet specify the exact syntax of the new activities mentioned above. Until the specification becomes more concrete, we don't expect vendors to implement the proposed extensions. But while BPEL4People is early in the standardization process, it shows a great deal of promise.

Finally, as it stands today, the BPEL4People proposal raises an important question: Is it necessary to introduce such complex extensions to BPEL to cover user interactions? As described previously, some vendor solutions model user interactions as just another Web Service with well-defined interfaces for both BPEL processes and client applications. This approach doesn't require any changes to BPEL; to become portable, it would only need an industry-wide agreement on the two interfaces. And of course, both interfaces can be specified with WSDL, which gives developers great flexibility and lets them use practically any environment, language, or platform that supports Web Services. An example of such an approach is the Workflow Service in the Oracle BPEL Process Manager, which we'll describe later.

First, we should complete the discussion of standards efforts by pointing out that there are several older workflow specifications, most notably Wf-XML from the Workflow Management Coalition (WfMC). Wf-XML is an XML-based proposal for consistent data transfer between workflow engines. As far as we know, it hasn't been used in any major BPEL engine, probably because WfMC and the Business Process Management Initiative jointly released the XML Process Definition Language. XPDL focuses on the design-time interoperability of different workflow products and is therefore only of very limited relevance to the BPEL community.

Clearly, a single standard approach hasn't yet been adopted for extending BPEL to include human tasks and workflow services. However, this doesn't mean that developers can't use BPEL to develop business processes with user interactions. In the rest of this article, we're pragmatic and describe one approach that works today for integrating user interactions in standard BPEL processes.

Workflow Integration with BPEL
To interleave user interactions with service invocations in BPEL processes we can use a workflow service, which interacts with BPEL using standard WSDL interfaces. This way, the BPEL process can assign user tasks and wait for responses by invoking the workflow service using the same syntax as for any other service. The BPEL process can also perform more complex operations such as updating, completing, renewing, routing, and escalating tasks.

After the BPEL process has assigned tasks to users, users can act on the tasks by using the appropriate applications. The applications communicate with the workflow service by using WSDL interfaces or another API (such as Java) to acquire the list of tasks for selected users, render appropriate user interfaces, and return results to the workflow service, which forwards them to the BPEL process. User applications can also do other tasks such as reassign, escalate, route, suspend, resume, and withdraw. Finally, a workflow service may allow other communication channels, such as e-mail and SMS, as shown in Figure 1.

Oracle BPEL Process Manager uses such an architectural abstraction to integrate standard BPEL functionality with workflow. Loose coupling lets workflow services be deployed on any supported application server. It also allows evolving the workflow service, as specifications such as BPEL4People emerge, without having to change the existing BPEL processes. The workflow service includes a simple yet powerful set of Java APIs and WSDL interfaces for building UI workflow interfaces; these offer maximum interoperability for UI approaches, including JSF, AJAX, .NET, and Adobe Flex.

Case Study
Let's look at a case study that shows how you can incorporate human interactions with BPEL. Consider a business process for opening a new bank account; we'll call this process "New Account." The customer provides the necessary details (such as name, address, social security number, and initial deposit) to open the account. Once the process is initiated, the customer may want to track the status of the request and respond to any additional queries from the bank. This process requires a workflow to enable customer participation and process monitoring so that the customer can track the request status.

This example is based on a multi-organizational process that creates accounts for a financial service intermediary, its financial partners (insurance companies and their financial advisors), mutual fund companies, and clearinghouses. This value chain of partners collaborates to make the "New Account" business process more efficient and compliant. Each partner has compliance requirements that must be satisfied during the instantiation of the process. Regulations such as the U.S. Patriot Act, the Bank Secrecy Act, and other federal and state regulations apply and add requirements to the process for both automated system and human workflow interactions.

The example combines business process management through BPEL to orchestrate business processes in a B2B context, managing compliance in a secure environment, while greatly enhancing the efficiency of the overall process. This approach was selected because it makes the organization resilient to ongoing threats from a regulatory and competitive standpoint. These requirements were incorporated into the "New Account" business process, including the following key requirements:

• Common interfaces for maximum interoperability
• Comprehensive security, as each environment has firewall and other security requirements
• Audit trails and monitoring for compliance, security, and performance reasons

As with most business processes that require automation, human interactions play a large role in this business process. Workflow requirements for the process include:

• Electronic data routing (intra-organization as well as inter-organization)
• Data verification and approval of provided information
• Workflow routing to other departments with notification
• Escalation as a result of exceptions and/or alerts
• Approval of the entire heterogeneous transaction
• The need for workflow requirements to interact seamlessly with automated business process steps and existing enterprise information

BPEL fit these requirements perfectly and can also address security concerns due to its foundation of Web Services and integration with specifications such as WS-Security and SAML. Enterra, the company that developed this process, first evaluated how a BPEL server could function as both a process automation and workflow tool. Since workflow specifications for BPEL are evolving, as described above, the decision was based on the following criteria:

• Maturity of the BPEL product
• Support for workflow from BPEL
• Native support for relevant standards
• Ease of development, maintenance, and deployment
• Satisfying the process monitoring and audit capabilities
• Using a single security model supported by BPEL
• Taking advantage of BPEL's built-in transaction semantics

Oracle BPEL Process Manager was the selected product based on these criteria.

Workflow Interface Architecture and Benefits
Enterra used Oracle's BPEL Process Manager engine and its Java API to build an enterprise-ready resilient workflow architecture. Figure 2 shows that architecture.

The following describes the workflow:

1. The Rich Internet Interface (RIA) workflow portal instantiates the business process via the BPELService API
2. The instance ID of the process is captured to maintain state
3. When a task is initiated in the process, a correlation ID is captured
4. The payload data is sent to the task and is available via the worklist interface
5. The API pulls the worklist data and uses the correlation ID to gather the XML metadata to return to the RIA. The RIA uses the metadata to dynamically determine which panel to display next and to update the context of the visual navigation mechanisms used in the workflow portal. This data is returned to the portal and all the update events are processed.

To implement the workflow scenario shown here, Enterra developed the Rich Internet Interface and used Java APIs to interact with the Oracle BPEL Process Manager Workflow Service. The RIA user interface is the face of the application; it runs and manages the "New Account" business process. The presentation layer is built using Macromedia's Flex technology and ActionScript scripting language. It accepts the user input and passes it to the BPEL process and also displays the current status of the process. Figure 3 shows the RIA front-end for the New Account business process.

Let's review its four main components and their key capabilities:

1)  Workflow Bar: This lets users view the workflow steps in the New Account process at the business level. Every step in the Workflow Bar is displayed in a detail view in the BPEL Panel.

2)  BPEL Panel: The BPEL Panel offers an exploded view of every step of the New Account process. The panel dynamically loads the process model and the audit trail of a given process instance to combine the process paths available with the paths actually taken by the current instance. The panel also uses the audit trail to determine what action is pending, visually delineating where the current process is at that time. Previously executed nodes of the process can be clicked on to view their respective payload. This functionality gives operations and compliance managers real-time visibility into the past, current, and potentially future states of the current process. This panel is dynamically populated at runtime using the BPEL Process Manager API.

3)  Workflow Forms: These correspond to the workflow steps in the New Account BPEL process. This view stack (developed in Macromedia Flex) communicates with the audit trail of the business process, changing the view stack form to match the context of the BPEL process. When considering different architectural approaches, we found that the RIA application would have been much more difficult to build if the data had come from two different applications (workflow and BPM). A single platform made it much easier to build a unified interface for the business user.

4)  Zone Panels: Zone Panels provide alerts and feedback to help workflow and process activity users perform their respective tasks. These panels offer a superior usability experience and interact with the BPEL API. As the context of the business process changes, the Zone Panels are updated. The events that manage these changes are propagated through the Oracle BPEL Process Manager API.

5)  BPEL Process Manager: The BPELService class facilitates interaction between the RIA front-end and the process activity monitoring capabilities in Oracle BPEL Process Manager.

The RIA interface also provides detailed audit trails views and other business process and workflow alerts in real-time. The combination of BPEL, workflow, and RIA provides a compelling architecture for addressing compliance, security, and performance metrics.

The benefits of the New Account business process implementation are:

• Maximum interoperability without compromising security
• Real-time monitoring and auditing of the entire environment
• Robust workflow capabilities integrated cleanly in the BPEL environment
• An enterprise-ready infrastructure that supports transactions, availability, and advanced exception handling

Conclusion
When automating business processes, it's critical to include the element of human interaction in the design. Standards play a key role in business process automation, and BPEL is clearly the de facto standard for process execution, but human workflow doesn't have such a single widely adopted standard. In this article, we've highlighted the options related to human workflow support in BPEL, discussed the emergence of BPEL workflow extensions, shown how to incorporate workflow into BPEL servers today, and presented a real-world BPEL process that includes human workflow.

Acknowledgments
We would like to thank Harish Gaur and Dave Shaffer for their helpful comments.