## 2 Background
### Fault Injection Test Generation for Service-Oriented Architectures  
SOA is a set of loosely coupled, independent components called services that expose a well-defined interface and communicate exchanging messages [30; 31]. In an SOA, the computation and resource access are performed using network infrastructures and service communications standards such as Web Services Description Language (WSDL) or Simple Object Access Protocol (SOAP). Each invoked service may not be aware of the internal status of other services, and it only exposes its interface, completely encapsulating the implementation aspects of the service. A Web service is a specific embodiment of an SOA service that uses the HTTP protocol and Web-related standards as backbone technologies for its invocation.  
SOAs and Web services are already extensively used in e-commerce and e-banking applications and an even more pervasive adoption is envisioned in the future as a technological layer for the Internet of things [32; 33]. Correctness, availability, and reliability are desired characteristics of an SOA and many approaches have been developed to ensure that a given set of services satisfy those requirements even in presence of faults [31; 34]. Fault injection mechanisms are extensively exploited to ensure a safe composition of Web services even in the presence of failures. In [35], the authors proposed a fault injection method for testing Web services based on data perturbation of the XML messages exchanged by the services. The data of the message could be modified according to the XML schema syntax, such as a data value perturbation, the modified message was sent to the Web service, and the response was then validated by the test framework. Additionally, to support the designed method, a tool named GenAutoWS was developed and implemented. In [36], the authors described a fault injection framework for testing Web services' fault-tolerance based on the emulation of a WAN network and the injection of network and application faults. [PERSON] et al. [37] provided an overview of testing methods for Web services covering compile-time and run-time software fault injection mechanisms and tools and how to reuse the techniques in the context of the dependability assessment of Web services.  
Considering the wide application of model-based system engineering (MBSE), a model-based test generation is beneficial to support constituent systems and to embed verification into the SoS life cycle, especially for design verification. Therefore, among the different existing ATG methods, the model-based fault injection test case generation for systems was adopted as the foundation of this research, and it can be described as follows steps: (i) an input model of the system under test is provided as input; (ii) the input is processed either manually or automatically and an enriched model is produced, identifying for each component a list of failure modes that affect it; (iii) a set of system-level ATG constraints conditions are identified and formalized directly in the model or using a tool-specific language; and (iv) the enhanced input model and the ATG constraints are processed by the engine searching for test cases leading to the violation of system-level hazards by the injection of faults. A set of test cases is produced as a result of the ATG process. Each test case contains a sequence of input values and fault injections that leads to the occurrence of a hazard condition. The test cases can be used to exercise a fault-tolerant implementation of the model or to reason on the model since each test case may expose possible flaws in the system design or specification.  
The remainder of this paper is organized as follows. Section 3 presents the proposed ATG method. Section 4 provides the setup of the experiment, which is the modeling of a simplified emergency response SoS as the concept alignment example (CAE). Section 5 discusses the experimental results of our study. Section 6 summarizes our contributions.