The PROV Ontology: Model and Formal Semantics