H Rik Eshuis

Symbolic model checking of UML activity diagrams

Two translations from activity diagrams to the input language of NuSMV, a symbolic model verifier, are presented. Both translations map an activity diagram into a finite state machine and are inspired by existing statechart semantics. The requirements-level translation defines state machines that can be efficiently verified, but are a bit unrealistic since they assume the perfect synchrony hypothesis. The implementation-level translation defines state machines that cannot be verified so efficiently, but that are more realistic since they do not use the perfect synchrony hypothesis. To justify the use of the requirements-level translation, we show that for a large class of activity diagrams and certain properties, both translations are equivalent: regardless of which translation is used, the outcome of model checking is the same. Moreover, for linear stuttering-closed properties, the implementation-level translation is equivalent to a slightly modified version of the requirements-level translation. We use the two translations to model check data integrity constraints for an activity diagram and a set of class diagrams that specify the data manipulated in the activities. Both translations have been implemented in two tools. We discuss our experiences in applying both translations to model check some large example activity diagrams.

Constructing customized process views

To enable effective cross-organizational collaborations, process providers have to offer external views on their internal processes to their partners. A process view hides details of an internal process that are secret to or irrelevant for the partners. This paper describes a formal two-step approach for constructing customized process views on structured process models. First, a non-customized process view is constructed from an internal structured process model by aggregating internal activities the provider wishes to hide. Second, a customized process view is constructed by hiding and omitting activities from the non-customized view that are not requested by the process consumer. The feasibility of the approach is shown by means of a case study.

Tool support for verifying UML activity diagrams

We describe a tool that supports verification of workflow models specified in UML activity diagrams. The tool translates an activity diagram into an input format for a model checker according to a mathematical semantics. With the model checker, arbitrary propositional requirements can be checked against the input model. If a requirement fails to hold, an error trace is returned by the model checker, which our tool presents by highlighting a corresponding path in the activity diagram. We summarize our formal semantics, discuss the techniques used to reduce an infinite state space to a finite one, and motivate the need for strong fairness constraints to obtain realistic results. We define requirement-preserving rules for state space reduction. Finally, we illustrate the whole approach with a few example verifications.

Reconciling statechart semantics

Statecharts are a visual technique for modelling reactive behaviour. Over the years, a plethora of statechart semantics have been proposed. The three most widely used are the fixpoint, Statemate, and UML semantics. These three semantics differ considerably from each other. In general, they interpret the same statechart differently, which impedes the communication of statechart designs among both designers and tools. In this paper, we identify a set of constraints on statecharts that ensure that the fixpoint, Statemate and UML semantics coincide, if observations are restricted to linear, stuttering-closed, separable properties. Moreover, we show that for a subset of these constraints, a slight variation of the Statemate semantics coincides for linear stuttering-closed properties with the UML semantics.

Specification and verification of harmonized business-process collaborations

In the area of business-to-business (B2B) collaboration, original equipment manufacturers (OEMs) are confronted with the problem of spending a considerable time and effort on coordinating suppliers across multiple tiers of their supply chains. By supporting inter-organizational business-process collaborations with service-oriented technology, a scope for more efficient and effective supply-chain coordination is anticipated. This paper defines a formal framework, called eSourcing, for specifying structurally harmonized inter-organizational business-process collaborations. The framework permits verification of harmonized processes before their enactment. Moreover, the framework uses private and public layers to protect competitive knowledge of the individual partners. In the research project CrossWork, the eSourcing framework has been integral for harmonizing on an external level the intra-organizational business processes of a service-consuming and one or many service-providing organizations.

Structured service composition

Composition languages like BPEL and many enactment tools only support structured process models, while most composition approaches only consider unstructured models. In this paper, we outline a semi-automatic approach for composing a set of services with data flow dependencies into a structured process model. These data flow dependencies can be automatically derived from the input and output messages of each service, but some additional user input is needed to annotate dependencies with specific branching types. Heart of the approach is a fully automatic composition algorithm that given an annotated dependency graph constructs a structured composition. We illustrate the approach by applying it to an example case study from the CrossWork project, which studies the dynamic formation of cross-organisational workflows.

Service Outsourcing with Process Views

Service outsourcing is a business paradigm in which an organization has a part of its business process performed by a service provider. Process views are pivotal to support this way of working. A process view shields secret or irrelevant details from a private business process, thus allowing an organization to reveal only public, relevant parts of its private business process to partner organizations. This paper introduces a specification framework to support service outsourcing using process views. To enable the construction of process views at various levels of detail, the framework defines several projection relations between process views and the underlying internal processes. To allow consumers and providers of process views to establish an outsourcing relation, the framework defines several matching relations between the respective views that are comprehensive and flexible for service outsourcing. A proof-of-concept prototype tool implements the framework, which is applied in a case study.

An integer programming based approach for verification and diagnosis of workflows

Workflow analysis is indispensable to capture modeling errors in workflow designs. While several workflow analysis approaches have been defined previously, these approaches do not give precise feedback, thus making it hard for a designer to pinpoint the exact cause of modeling errors. In this paper we introduce a novel approach for analyzing and diagnosing workflows based on integer programming (IP). Each workflow model is translated into a set of IP constraints. Faulty control flow connectors can be easily detected using the approach by relaxing the corresponding constraints. We have implemented this diagnosis approach in a tool called DiagFlow which reads and diagnoses XPDL models using an existing open source IP solver as a backend. We show that the diagnosis approach is correct and illustrate it with realistic examples. Moreover, the approach is flexible and can be extended to handle a variety of new constraints, as well as to support new workflow patterns. Results of testing on large process models show that DiagFlow outperforms a state of the art tool like Woflan in terms of the solution time.

Synthesizing object life cycles from business process models

Unified modeling language (UML) activity diagrams can model the flow of stateful business objects among activities, implicitly specifying the life cycles of those objects. The actual object life cycles are typically expressed in UML state machines. The implicit life cycles in UML activity diagrams need to be discovered in order to derive the actual object life cycles or to check the consistency with an existing life cycle. This paper presents an automated approach for synthesizing a UML state machine modeling the life cycle of an object that occurs in different states in a UML activity diagram. The generated state machines can contain parallelism, loops, and cross-synchronization. The approach makes life cycles that have been modeled implicitly in activity diagrams explicit. The synthesis approach has been implemented using a graph transformation tool and has been applied in several case studies.

Transforming process models: executable rewrite rules versus a formalized java program

In the business process management community, transformations for process models are usually programmed using imperative languages (such as Java). The underlying mapping rules tend to be documented using informal visual rules whereas they tend to be formalized using mathematical set constructs. In the Graph and Model Transformation communities, special purpose languages and tools (such as GrGen) are being developed to support the direct execution of such mapping rules. As part of our ongoing effort to bridge these two communities, we have implemented a transformation from petri-nets to statecharts (PN2SC) using both approaches. By relying on technical comparison criteria and by making the solutions available for online replay, we illustrate that rule-based approaches require less specification effort due to their more declarative specification style and automatic performance optimizations. From a tool perspective, GrGen has better visualization and debugging support whereas Java tools support evolution better.