System modeling. Budapest University of Technology and Economics Department of Measurement and Information Systems

Transcription

1 System modeling Business process modeling how to do it right Partially based on Process Anti-Patterns: How to Avoid the Common Traps of Business Process Modeling, J Koehler, J Vanhatalo, IBM Zürich, and Business Process Transformation: Componentization, A. Pataricza, University Relations IBM Academic Days Budapest University of Technology and Economics Department of Measurement and Information Systems

2 Contents Verification of process models (Anti)-pattern collection Outlook: Automatic verification

3 Correctness of process models How to measure the correctness of a model? o Functionality it does what we expect o Reliability it works reliably o Usability the process is understandable o Maintainability changes can be traced Correctness checking with formal methods o Eg. Petri-nets, data flow networks Defining patterns to be followed/avoided Built-in static analysis for design tools o Eg. BPEL 2.0 standard defines

4 Example model Fork Join Decision Merge IBM WebSphere Business Modeler

5 Example model Fork Join Decision Merge UML Activity Diagram

6 Example model Fork Join Decision Merge Business Process Modeling Notation

7 Example model Event-driven process chain

8 Which model is good for what? BPMN: high-level documentation, input for developers BPEL: execution built on web-services UML: modeling, documentation UML + ActionSemantics: code generation IBM Websphere Business Modeler: o Modeling, documentation o Simulation, scalability tasks o Monitoring o Input for given implementation tools IBM WebSphere Integration Developer

9 Describing conditions Explicit use of gateway objects Using data flow rules

10 Handling branches Fork No synchronization! Merge Decision Join Deadlock in the system!

11 Correct branch handling Decision Merge Fork Join

12 Handling loops Merge Fork May be executed infinitely! No outgoing branch from loop: livelock Merge Decision

13 Multiple connections Hard to understand, if data and control flow is not separated.

14 Exit from different branches Decision Merge Fork May cause deadlock at decision Join Allowed with parallelization

15 Handling events Eventhandling logic encoded as control. Incorrect, because every Start node is active at the same time! Good solution: define events

16 Termination Whole process terminates instead of just the parallel branches Exception handling and normal behavior separated, no hidden termination

17 Termination cont. Wrong interface definition! Nondeterminism/deadlock

18 Correct termination

19 Outlook: workflow verification Petri-net reduction o see business process abstraction/simplification o used for conformance checking o reduce state space Model-based workflow verification

20 Serial reduction fusion of serial places (FSP) fusion of serial transitions (FST)

21 Parallel reduction fusion of parallel places (FPP) fusion of parallel transitions (FPT)

22 Eliminate self-loops elminate self-looping place (ESP) eliminate self-looping transition (EST)

23 Example t 1 t 3 t 4 t 2 t 1 fires fusion of t 1 and t 2 (series transitions) t 12 fusion of t 3 and t 4 (series transitions) t 34

24 Example t 12 p 3 eliminate t 12 (self-looping transition) eliminate p 3 (self-looping place)

25 Example: result example is bounded, but not live (and not reversible)

26 Service composition (e.g. BPEL) o Widespread tool support Objectives o Design errors in choreography o Lack of formal verification Objectives: o Formal proof of compliance to the requirements on workflow o Derivation of mathematical analysis models by model transformations Formal analysis of workflows o Formal workflow semantics o Formal verification of properties E.g. variable access o Fault simulation: assessment of error propagation

27 A Workflow Example Basic activity Beginning of parallel execution Selection Policy Reject Recording Establish type Control flow Premium Pay End of parallel execution

28 Verification of Workflows Simulation Positive result Workflow (BPEL) Formal model (dataflow network) Analysis model (Promela) Model checker (SPIN ) Requirement (LTL expression) Negative result + counterexample

29 Verification of Workflows Simulation Positive result Workflow (BPEL) Formal model (dataflow network) IBM WebSphere Integration Developer Analysis model (Promela) SPIN modelchecker Requirement (LTL expression) Negative result + counterexample

30 Verification of Workflows Dataflow Network (generated) Abstract data Hierarchic modeling Model refinement Simulation Positive result Workflow (BPEL) Formal model (dataflow network) Analysis model (Promela) SPIN modelchecker Requirement Negative result Representation in the VIATRA2 (LTL + framework expression) counterexample Dataflow Network generated from parsed BPEL model

31 Verification of Workflows Target requirement Business level: no unauthorized business transaction Implementation level: each variable Positive Simulation should be initialized prior to a read access result Workflow (BPEL) Formal model (dataflow network) Analysis model (Promela) SPIN modelchecker Requirements LTL: linear temporal logical expression Requirement (LTL expression) Negative result + counterexample

32 Verification of Workflows Simulation Positive result Workflow (BPEL) Formal model (dataflow network) Analysis model (Promela) SPIN modelchecker Model checker Evaluation of LTL expressions Exhaustive state space traversal Requirement (LTL expression) Negative result + counterexample

33 Verification of Workflows Simulation Positive result Workflow (BPEL) Formal model (dataflow network) Analysis model (Promela) SPIN modelchecker Modelltranszformáció Model transformation VIATRA2 framework Requirement (LTL expression) Negative result + counterexample

34 Abstraction: qualitative modeling Formal methods have strict complexity limitations o Efficient, but still faithful abstractions are needed Qualitative abstraction: o A few of qualitative values out of an enumerated data type set o No detailed data representation o Drastic state space (analysis complexity) reduction Systematic methodology: predicate abstraction

35 Full model: Example IF credit_requested < THEN approval(director) ELSE approval(board) Deterministic abstraction: IF minor_credit_requested THEN approval(director) ELSE approval(board) o No representation is needed for value of credit_requested, o Only a single binary value (minor_credit_requested) representing the mode of operation o Invariant wrt. the limit of changes Nondeterministic abstraction: CHOOSE (approval(director), approval(board)) o No representation is needed for value of credit_requested, o Details -> random behavior

36 Estimation of the effects of a fault A resource/operation is good / faulty / missing (FAULT) System behavior? Analysis principle: o Assign faults to resources / operations o Trace the flow of errors (ERROR) o Check: is a service to the user affected (FAILURE)? Modeling and analysis: o Data items colored as good / faulty / suspicious o A component connected to another one in a potentially erroneous state is suspicious o Static worst case approximation: Damage Confinement Region

37 Dataflow Networks Node Port State Variable Uninitialized Written Read Written and read Fault written Fault written and read Token Activity Control Data D_F_Control Channel G(Variable.state!=Fault_written)

38 Mapping a Workflow to Dataflow Networks Policy Recording Establish type Premium Recording Establish type Policy Beginning of parallel execution Premium End of parallel Execution

39 Dynamics Qualitative Data Fault Simulation / Model Checking Variable 1 Uninitialized Written Read Written and read Fault written Fault written and read Activity A Read Control Data D_F_Control Variable 2 Uninitialized Written Read Written and read Fault written Fault written and read Activity A Write Control Data D_F_Control

40 Simulation of the Error Propagation Dynamics Variable Uninitialized Written Read Written and read Fault written Fault written and read If Control Data D_F_Control Activity Control Data D_F_Control Otherwise Control Activity Control Data D_F_Control