Verification of Web Services Modeled as Finite State Machines

Deepak ChenthatiTeradata(R&D) India Pvt Ltd

Hyderabad, Indiachvcdeepak@yahoo.com

Supriya Vaddi, Hrushikesha MohantyDepartment of CIS

University of HyderabadHyderabad, India

hmcs hcu@yahoo.com,supriya vaddi@yahoo.com

Avula DamodaramDepartment of CSE & Director

UGC Academic Staff College, JNTUHHyderabad, India

damodarama@gmail.com

Abstract—Currently, model based development of web ser-vices is being actively researched for its usefulness in de-veloping a system. Various techniques like EPC, petrinet,process algebra, CPN and UML have been proposed for webservice modeling. FSM is found appropriate to model Businessrequirements because a business process on execution movesforward from one state to other. We have shown uses of FSM(Finite State Machine) based models in development of webservices [1]; also have developed a tool HUMSAT to modelservice specification in FSM and to generate executable codesin BPEL and WSDL. However, automated code generationdepends on correct specification of models as an improperlyspecified model leads to errors and bugs in resultant code.Hence model checking plays an important role in eliminatingthe flaws at design phase itself. In this paper, we propose atechnique for model verification that identifies structural flawse.g. unreachability, deadlock and temporal inconsistencies.Further, HUMSAT is augmented with the model verificationfeatures.

Keywords-Modeling, Web Services, FSM, BPEL, WSDL,Orchestration, Cheoreography, HUMSAT

I. INTRODUCTION

Increasing availability of Internet and globalizationbrought different enterprises together on common platformi.e. Web. Web service is an upcoming technology to performbusiness on Internet. The availability of services on web,ease to access them and the reduction in time and moneyinvolved to utilize these services have changed the waybusiness is done today. Making a service available on webwould initially involve modeling a service i.e. specifyingwhat the service is intended to do and how it is done.Business modeling involves specifying business logic andcommunication with the other services. Business logic isdepicted in service orchestration and a service protocol isdepicted in choreography. Later executable code is extractedfrom a model. Thus for automation of model based webservices generation, the study of correctness of a model hasa lot of significance.

Various techniques based on EPC [13][14], petrinet[3], processalgebra [5], CPN [7] and UML [15][16][17] havebeen proposed for web services modeling. EPC introducedby scheer[13] provides comprehensive means for modelingseveral aspects of a business process. EPC is a graph thatconsist of events and functions and control flow among them.

[14] describes transformation of EPC process models to atechnical language like BPEL. This mapping provides thefoundation for a transformation program from EPML(Event-Driven Process Chain Markup Language) to BPEL. In [3]the formal approach maps WS-BPEL constructs to PeriNetstructures and proposes methods to explore unreachableactivities, deadlock, conflicting messages. Automated toolslike BPEL2PNML and WofBPEL are used for analysis andverification of business logic. [5] proposes a process algebraBPE- calculus for specifying control flow of BPEL process,then properties of process like deadlock freedom, reacha-bility etc..are checked. In [9] a frame work VERBUS forverification of BPEL process has been proposed. VERBUSintegrates BPEL4WS definition language and the SPIN andSMV verification tool. [2] proposes a method to check cor-rectness of choreography for compatibility among partners.In [12] authors presented an approach, which specificallyaddresses adding semantic representation to the BPEL4WSnotation, and developed a plugin module for LTSA tool forverification of implementations against abstract functionalspecifications. [7] proposes approach for translation of WS-BPEL to CPN model and verification of Web servicescomposition with CPN tools. CPN tools [10] provide anumber of formal analysis methods to check reachability,boundness, dead marking, dead transition, liveness, home,fairness and conversation. The verification of Web servicescomposition in context of these properties can be seen in[18]. In [11] a formal method TLA (Temporal Logic Action)is used to compose and verify Web services, involvingdescription, composition, selection and verification.

Recently, we have proposed FSM-based modelingscheme for web service specifications. While all otherproposed schemes model service choreography mainly forservice composition, our proposed modeling scheme [4]enables to model both service choreography and orches-tration. By doing this, it is shown that a web service canbe obtained in complete from given FSM-based model. Inorder to support our claim we have also developed a toolHUMSAT ( Hyderabd University Mandi Seva AutomatingTool) [1] that allows a modeler to specify a web servicechoreography i.e. business protocol and orchestration i.e.business logic and generate corresponding BPEL and WSDL

2010 Fourth Asia International Conference on Mathematical/Analytical Modelling and Computer Simulation

978-0-7695-4062-7/10 $26.00 © 2010 IEEE

DOI 10.1109/AMS.2010.107

526

codes. As stated earlier for automation of generation of cor-rect system, verification of a model is essential. In this paperwe propose a technique for correction of FSM-based webservice model. The proposed correction technique followsa standard graph theoretic approach to identify structuralflaws like deadlock and unreachability. First we introducesome serious structural flaws that may make web servicesdefunct. And then proposes solutions to these problems. Wehighlight the impact of the proposed verification with a casestudy.

This paper is composed of five sections while in thesecond section we briefly describe how one can specify aweb service using FSM. In section 3 we described each flawin detail and proposed methods for checking correctness.Section 4 describes a case study of travel booking and howthe structural flaws are identified; finally, Section 5 presentsa conclusion and discussion of future work.

II. FSM FOR SPECIFYING WEBSERVICE

Finite state machines, FSMs, are used as a formalismfor modeling behavior of Web services. Conceptually abusiness process can be viewed as an FSM since a businessprocess on execution proceeds forward from one state toanother. A larger, complex process can be understood as aset of simpler, discrete steps i.e states of an FSM. Whilecreating a design, for each step (state) in the process, thedesigner can ask: What should the process do next? And,given this input what should it do, at this point of theprocess. Thus FSM describes a process. Each node in FSMhas a name stating a state. An edge describes a transitionfrom one node or state to another. Since more than oneedge can lead from the same node, each edge may includea selection criteria or condition which is used to determinewhich transition to use. There is an action associated with

search flight boking

agent

to receivereply

ser#uddi#fba_sersend req

to fba

ser#fba#flight_reqto receivefba reply

uddi#ser#fba_ser_res

sf1

fba#ser#flight_res

assignnot confirm

onfault := no fba flight_confir :=

no

x :=0 x<20 min.

onfault :=timeout

checkconfirmation

flight_confir =yes

flight_confir =no

Figure 1: FSM for "Flight Booking"

each transition. When a transition is selected, the action forthe selected transition is performed. We specify a FSM asa tuple 〈 S, A, δ, s, F〉where S : set of states

A : set of activitiesδ : set of transitionss : Start stateF : set of final states

State transition occurs on performing an activity. Activitiesare the business process activities like messaging,assignment etc., A messaging activity is specified assender�receiver�message.Execution of business process atproviders end would be specified with same transitionbut the sender and receiver identities would be same.HUMSAT provides a integrated development environmentthat can be used for web service generation. Figure 1 showsFSM specifying a flight booking service. The proposedspecification can be used to model not only basic activitieslike messaging, assignment etc., complex and structuredactivities like parallel execution, synchronization but alsotemporal specifications. To specify temporal constraints weextended the definition of basic FSM to Timed FSM. ATimed FSM is defined as a tuple 〈 S, T, A, δ, s, F〉where S : set of states

T : set of time constraintsTemporal constraints defined over transitions(activities) canbe one of the following(x is a temporal variable)constraint 1: {x:=0} at the activity, clock is initialized.constraint 2: {x=�time} activity waits to execute till systemclock reads a given time.constraint 3: {x< �time} activity execution should be overbefore system clock reads a given time. To model parallelexecution(flow) and synchronization, we introduced twonew modeling constructs [4] as shown in Figure 1. ThisFSM is part of specification of a service ”Travel BookingAgent”, it takes request from an user and based on therequest it books flight and hotel. Both bookings are done inparallel but it confirms hotel booking only after the flightbooking is confirmed. There exists three kinds of pathsin our proposed FSM viz. Mutually exclusive, serial andparallel paths. Two paths are said to be mutually exclusive

if either one of the paths are executed at a time. Apath is said to be serial, if the execution takes place inserial order. Two paths are said to be parallel, if executionof activities in each path takes place in parallel. Due tolack of space we are not defining modeling in detail, fordetail [1], [4] can be refereed.

527

III. VERIFICATION ISSUES

We have proposed usaged Timed FSM with newly definedconstructs choice, flow and synchronization for modelingwebservices. However improper use of modeling constructsresults in both structural as well as behavioural errors. Herewe are interested in identifying structural errors as these arethe main causes for behavioral errors. The possible errorsthat may be modeled in proposed modeling scheme are

• Unreachable Activities• Deadlock• Improper temporal constraints• Missing choice paths

A. Unreachable Activities

A state cannot be reached due to incorrect use of synchro-nization construct. Consider the situation given in Figure3. In the example two set of activities are in flow, activitya6 in second set can occur only after the completion ofthe set of activities a1 and a2. But from the FSM we canobserve that the activities a1 and a2 are in choice i.e atany point of time depending on the condition only one ofthe paths will be selected and executed. Hence it is notpossible to complete a1 and a2 together, as the activitiesare in synchronization activities a6, a8 are unreachable. To

a 1

a 2

h a p p e n - b e f o r e

h a p p e n - b e f o r e

a 0

a 3

a 4

a 5

a 6

a 7

a 8

F i g u r e 2 : A n E x a m p l e o f U n r e a c h a b l e A c t i v i t i e s

F l o w

C h o i c e

check unreachable activities checking details of underlyingactivities and processing entities of the model are not re-quired we just have to make sure ”The Mutually exclusivepaths do not join”. As in Figure 2 their are two mutualexclusive paths are a0, a1, a4, a7 and a0, a2, a5, a7 and bothare in flow with a3, a6, a8 but both paths join before a6.The proposed algorithm traverses through FSM and detectsthe unreachable nodes.

1: List of all SyncNodes L{ SyncNode - node where the synchronization is present}

2: choice ref node = null; { To Track choice node}3: For each SyncNode in the List L4: for every node preceding SyncNode5: Traverse in forward direction till end of choice node

(curr node)is encountered

6: if choice ref node = = null then7: choice ref node = curr node8: else if choice ref node == curr node then9: ”SyncNode is not reachable”

10: end if

B. Deadlock

Deadlock occurs due to incorrect use of synchronizationconstruct. Consider the scenario given in Figure 3. In theabove scenario three set of activities are in flow, activity a6of second set can occur only after a4 of first set completes,a8 of third set can occur only after a6 of second setcompletes and a4 of first set can occur only after a8 of thirdset completes. From the model we observe that a dependencycycle is formed and after code generation it might iterateover the loop infinitely resulting in a deadlock state.

a 1

a 2

h a p p e n - b e f o r e

a 0

a 3 a 4

a 5

a 7

a 9

a 6 a 1 0

a 1 1

a 8

h a p p e n - b e f o r e

h a p p e n - b e f o r e

F i g u r e 3 : A n E x a m p l e o f D e a d l o c k

For deadlock avoidance loops in the model especiallyamong the synchronized nodes needs to be checked. Thefollowing algorithm traverses the FSM and verifies foroccurrence of loops.

1: List all the SyncNodes to an array2: A graph G is constructed from SyncNodes3: Identify the loops in graph G4: if Loop Exists then5: Dead Lock occurs6: else7: Verify graph for other issues8: end if

C. Improper temporal constraints

Business processes execute in temporal context and haveTiming constraints. During modeling timing is an importantinformation that is added to the model. Different processeshave different timing constraints and while executing, busi-ness process is forced to meet the timings. Hence verificationof temporal constraints is essential. In our modeling schemethe temporal constraints are labeled down the transition.Temporal constraints defined across a path should togeather

528

make a meaningful i.e executable specification. On a path atemporal constraint is inconsistent when it is not consistentto contstraints that exist on the path. We illustrate this withan example below. Consider the scenario as shown in Figure

a 1

x : = 0

a 0 x = 2 0a 2

x = 2 0

a 5

x < 1 0

a 3

a 4

F i g u r e 4 : E x a m p l e o f U n r e a c h a b l e A c t i v i t i e s

4. In this case temporal constraints for activity a1 and a2are x=20, but for activity a5 it is x<10 and it is to beperformed after a1 and a2. So the activity a5 is unreachableas it can occur only if x<10 but previous activities a1and a2 will occur only if x=20. The proposed algorithm

can be used to detect errors that may arise due to conflictin timing specification. It is based on the assumption that”Time constraints should be in incremental order from startstate”

1: Identify different paths P from initial node2: For Each path p in P3: check the temporal value of each variable4: if variable value is decreased then5: ”Temporal Error”6: end if

D. Missing choice paths

Modeling of a service involves several conditions thatneed to be incorporated. In the process one may miss tomodel a conditional path i.e . a condition in choice. Considerthe scenario, a service provider while specifying his service,wants to model the condition in which service will receiverequest for high, medium and low bandwidth. Based on therequest service will perform certain activities. But whilemodeling he forgets to model condition for medium, whenthe service runs, and on receiving a request for mediumbandwidth it will throw an error.

IV. CASE STUDY : TRAVEL BOOKING AGENT

This section shows how a specification model can beverified to identify structural errors. Travel Booking serviceprovides users with online travel booking for holiday. Acustomer requests service provider to plan his travel,

In order to provide service the travel booking agentneeds to book flight, accommodation and local travel.

These days as all services are readily available on web,provider searches for agents that meet his service require-ments. Initially search is performed on UDDI for flightbooking agent, then a request for flight is sent with requiredinformation as shown in Figure 1. Once the agent confirmswith availability of tickets only then can the service providerprocess go ahead booking a hotel. Since hotel booking hassynchronization dependency on flight this is represented

529

as double headed arrow pointing to state ”check flightconfirmation” shown in Figure 5. Once the hotel booking isconfirmed synchronization dependency exists for booking ataxi. This can be noted in part of FSM for taxi booking at thestate ”check flight and hotel confirmation” here the user hasmodeled synchronization wrongly by placing control depen-dency on two mutually exclusive paths viz.”pay by credit”and ”Pay by debit” with ”happens-before” dependency. Ascontrol takes up only one paths at a time the synchronizationrequirement of all the three activities taking place is nevermet. Hence state ”check flight and hotel confirmation” isunreachable and execution would always fail. This is shownas message unreachability in Figure 5. Once these errors aredetected in model at specification stage this would reducethe time and money involved in code modification.

From the FSM shown for the case study we observe thatthere is a dependency cycle-hotel booking depends on flightbooking, taxi booking depends on hotel & flight bookingand finally flight booking again depends on payment madeduring taxi booking this is modeled as a double endedarrow pointing to Flight booking FSM. The deadlock occursdue to the target link from ”taxi-to-flight” shown in theframe. Similarly the missing choice path code that shouldbe generated is shown in frame. Due to space constraintsonly part of FSM for Travel Booking Agent is shown. Thisdependency cycle leads to deadlock. After code generationBPEL code would have improper and unwanted linksshown below.Part of BPEL code for Travel Booking Agent

<flow><links>

<link name=”flight-to-hotel”/ ><link name=”flight-to-taxi” / ><link name=”hotel-to-taxi1”/ ><link name=”hotel-to-taxi2”/ ><link name=”taxi-to-flight” / >

< /links><!– Flight booking –><sequence>

<invoke partnerLink=”fba”portType=”lns:fbaPT”operation=”flightBooking”inputVariable=”flightBookingRequest”outputVariable=”flightBookingInfo”>

<sources><source linkName=”flight-to-hotel”/ >

< /sources><targets>

<target linkName=”taxi-to-flight”/ >< /targets>

<!– The above target link leads todead lock and not permissible –>

</invoke>

</sequence><!– Hotel Booking –><sequence><!– code to find hotel –>

<invoke partnerLink=”hotel”portType=”lns:hotelPT”operation=”hotelBooking”inputVariable=”hotelBookingRequest”outputVariable=”hotelBookingInfo”/>

<targets><target linkName=”flight-to-hotel”/>

</targets><if>

<condition>bpel:getVariableProperty(’hotelBookingInfo’,’hotelConfirmation’) = ’yes’</condition>

<!– payment process –><!–This part of code is not generated due tomissing choice path–>

<elseif><condition>bpel:getVariableProperty(’hotelBookingInfo’,’hotelConfirmation’) = ’no’</condition>

<!– searching uddi for new fba–><targets>

<target linkName=”hotel-to-taxi”/></targets></if>

</sequence><!– Taxi Booking –><sequence><!– searching uddi for taxi provider–>

<targets><target linkName=”flight-to-taxi”/><target linkName=”hotel-to-taxi1”/><target linkName=”hotel-to-taxi2”/>

</targets><invoke partnerLink=”taxi”

portType=”lns:taxiPT”operation=”taxiBooking”inputVariable=”taxiBookingRequest”outputVariable=”taxiBookingInfo”/>

<if><condition>

bpel:getVariableProperty(’taxiBookingInfo’,’taxiConfirmation’) = ’yes’

</condition><!– payment process –>

<sources>

530

<source linkName=”taxi-to-flight”/></sources></if>

</sequence></flow>In the FSM related to taxi booking the improper assignmentof temporal constraints x=10, x=20, x<10 leads to temporalerror. Which is detected upon running the algorithm statedin the earlier section. Hence the modeled diagram ischecked for correctness and then the code is generated forbetter service deployment.

V. CONCLUSION

In this paper we have discussed different patterns thatlead to errors, that occur when modeling a business process.Proposed approaches for verification of model automaticallyto detect the errors. As business process executes in temporalcontext. We have also considered temporal constraints thatare very important in any business process. The businessspecification is modeled using HUMSAT [4], [1] and themodel is verified for various errors before code generation.In our future work we would like to simulate FSM to detectvarious other dynamic and communication errors. Dynamicerrors that cannot be verified in the model like deadlock,variable parameters that lead to infinite loop etc.

REFERENCES

[1] Hrushikesha Mohanty, Deepak Chenthati, Supriya Vaddi,R.K.Shyamasundar, R.K.Ghosh, “Automatic Generation ofBPEL and WSDL from FSM models of Web Services”,In Proceedings of the 14th International Conference onAdvanced Computing & Communications, NIT Surathkal,INDIA, Dec 2006.

[2] Melliti Tarek, Celine Boutrous-Saab, Sylvain Rampacek “Ver-ifying correctness of Web services choreography”, In Pro-ceedings of the Fourth IEEE European Conference on WebServices (ECOWS 2006), Switzerland, pages 306-318, Dec2006.

[3] Chun Ouyang, Eric Verbeek, Wil M.P. van der Aalst, StephanBreutel, Marlon Dumas, Arthur H.M. ter Hofstede “Formalsemantics and analysis of control flow in WS-BPEL. InScience of Computer Programming, 67, 2-3 (Jul. 2007), 162-198.

[4] Hrushikesha Mohanty, Jitesh Mulchandani, Deepak Chen-thati, R.K. Shyamasundar, “Modeling of Web Services withFSM Modules”, In Proceedings of the First Asia Interna-tional Conference on Modeling & Simulation(AMS 2007),Phuket,Thailand, pages 100-105, March 2007.

[5] Mariya Koshkina and Franck van Breugel “Verification ofBusiness Process for Web Services”, Technical Report, De-partment of Computers Science, York University,Canada, Oct2003.

[6] Pengcheng Zhang, Bixin Li, Henry Muccini, Yu Zhou,Mingjie Sun, “Data-Enriched Modeling and Verification ofWS-CDL Based on UML Models,”icws, pp.752-753, 2008IEEE International Conference on Web Services, 2008

[7] Hui Kang, Xiuli Yang, Sinmiao Yuan,“Modeling and Ver-ification of Web Services Composition based on CPN,”,Network and Parallel Computing Workshops, 2007. NPCWorkshops. IFIP International Conference on Network andParallel Computing Workshops2007 , pages 613 - 617

[8] Yanping Yang, Qingping Tan, Yong Xiao, Feng Liu, andJinshan Yu. “Transform BPEL Workflow into HierarchicalCP-Nets to Make Tool Support for Verification,”APWeb 2006:275-284.

[9] Chun Ouyang, Eric Verbeek, Wil M.P. van der Aalst, StephanBreutel, Marlon Dumas, Arthur H.M. ter Hofstede “Applyingmodel checking to BPEL4WS business collaborations”, InACM Symposium on Applied Computing, pages 826-830,2005.

[10] CPN tools. http://www.daimi.au.dk/CPNtools/

[11] Hongbing Wang, Chen Wang, Yan Liu, “A Logic-Based Approach to Web Services Composition andVerification,”services-2, pp.103-110, 2009 World Conferenceon Services - II, 2009

[12] Howard Foster, Sebastian Uchitel, Jeff Magee, Jeff Kramer,“Model-based Verification of Web Service Compositions,”ase,pp.152, 18th IEEE International Conference on AutomatedSoftware Engineering (ASE 03), 2003

[13] August-Wilhelm W. Scheer “Aris-Business Process Frame-works”. Springer-Verlag New York, Inc., 2 edition, 1998

[14] J. Ziemann and J. Mendling. “Epc-based modelling of bpelprocesses: a pragmatic transformation approach.”, In Proceed-ings of the 7th International Conference Modern InformationTechnology in the Innovation Processes of the IndustrialEnterprises (MITIP 2005), Genova, Italy, 2005.

[15] Juan M. vara, Valeria De Castro, and Esperanza Marcos.“WSDL automatic generation from uml models in a mdaframework.”In International Journal of Webservices Practices,pages 112.Web Services Research Foundation, Seoul, Korea,2005.

[16] David Skogan, Roy Grnmo, and Ida Solheim. “Web servicecomposition in UML”. In Proceedings of 8th InternationalEnterprise Distributed Object Computing Conference (EDOC2004), pages 4757, Monterey,California, USA, 20-24 Septem-ber 2004.

[17] Keith Mantell. “From UML to BPEL, model driven ar-chitecture in a web services world.”IBM developer works,September 9 2003.

[18] XiaochuanYi and Krys J. Kochut. “A CP-net-based designand verification framework for web services composition.”InProceedings of the IEEE InternationalConference on WebServices (ICWS04), pages 756760. IEEE, 2004.

531