Conversation-based specification and composition of agent services

Transcription

1 Conversation-based specification and composition of agent services Quoc Bao Vo Lin Padgham School of Computer Science and Information Technology RMIT University - Australia {vqbao linpa}@cs.rmit.edu.au Abstract. There is great promise in the idea of having agent or web services available on the internet, that can be flexibly composed to achieve more complex services, which can themselves then also be used as components in other contexts. However it is challenging to realise this idea, without essentially programming the composition using some process language such as BPEL4WS or OWL-S process descriptions. This paper presents a mechanism for specifying the external interface to composite and component services, and then deriving an appropriate internal model to realise a functioning composition. We present a conversation specification language for defining interaction protocols and investigate the issue of synchronous and asynchronous communication between the composite service and the component services. The algorithm presented computes a valid orchestration of components, given the interface specification of the desired composite service, interface specifications of available components, and some mapping rules between parameters to deal with ontological issues. 1 Introduction Web services have been growing enormously in popularity over the last few years, as people see the potential of the world wide web to provide a repository of program components, in much the same way as it currently provides a repository of information pages. Agent technology for open systems has also had significant activity, with a number of standards developed by FIPA [19] to support interoperability. As web services start to incorporate more semantics, and greater focus is put on aspects such as automated discovery and composition, the gap between agents and web services narrows. Many of the issues are identical. A vision of intelligent agents in an open Internet environment is that they would be able to locate services to assist them in achieving their goals and autonomously combine them in an appropriate manner forming composite services. In this paper we describe an approach to provide greater automated support for composition of services, whether they are seen as web or agent services. There have been a number of languages for modelling and describing web services developed as well as frameworks for web service composition. Process modelling languages such as BPEL4WS [6], BPML [7] or WSCI [22] provide concrete ways for composite services to be manually described. There has been significant work on using workflows to support automated composition (e.g. [21, 12] and references therein). One

2 common approach is to map workflows to Petri-nets as a formal model to allow reasoning. Using a similar idea, Narayanan and McIlraith [14] propose a framework for web service composition in which web service descriptions in OWL-S [15] are mapped to Petri-nets to allow formal verification and simulation and to Situation Calculus [16] to allow automatic composition. This approach requires that the services to be composed be atomic. As the process model description of the composite service must be given, such a mechanism should be more precisely described as service orchestration. On the other hand, the problem of synthesising the process model of a targeted composite service has been largely neglected with the notable exception of the work by Berardi et al [2, 1]. As such, two major goals of the work presented in the present paper are to introduce an expressive language for describing conversational services and to achieve a mechanism to synthesise the process models of the composite services. Several composition frameworks employ finite state machines or transition systems to formally describe either input/output messages or behaviours with environmental preconditions and effects. These include: the message-based approach (a.k.a. the Mealy model), (e.g. [5]) the activity-based approach (a.k.a. the Roman model) (e.g. [2]), and Traverso and Pistore s [20] approach which performs composition using an AI planner (based on a symbolic model checking approach). For a more thorough discussion of the various approaches, the reader is referred to [1]. Most of these approaches aim to describe web services using formal models such as process algebras, Petri-nets and finite state machines, to allow formal properties of the services to be verified. Our aim is rather to provide a simple language to allow the exported behaviours as well as the interface of a web service to be described in a way that will enable us to automatically produce an executable process model that realises a composite service. The description language proposed in our paper takes a major inspiration from a rich literature on component-based software engineering and communication protocols [23, 17]. The main contribution of this paper is a mechanism that allows for automated synthesis of the internal process of a composite service, given the interface description of both component services and the desired composite service. In order to achieve this we also (i) specify a conversation specification language that allows specification of interactions with other entities; (ii) provide a synchronous semantics for the conversations between services; and (iii) provide a framework of mediation to allow communications between services to be monitored by a mediator. The mediator synchronises the possibly asynchronous message flow between services to ensure they adhere to a given synchronous semantics of the entire system. 2 Modelling and describing services Agent or web services are software artefacts whose functionalities are made available over the Internet by the providing organisation. In order for them to be discovered and deployed by users or other applications, they must be described in a language interpretable by the users or client applications. Our model of services is an extension of the model of e-services introduced by Mecella and Pernici [13] as well as description of software components developed within the component-based software engineering community (see e.g. [23]). The key aspect of these representations of a software com-

3 ponent is that they specify not only the static interfaces of the component but also its behaviour and evolution over time. In our model a service is an event-driven component whose events are sending and receiving of messages. As such, the description of a service comprises an external interface, i.e. the input/output messages that can be exchanged between a service and its clients, and a system dynamics specification of the service. The system dynamics comprises an interaction protocol, i.e. the sequences of actions to be invoked, to allow the service to converse with its client applications or users. The interaction protocol describes a set of sequencing constraints, i.e. legal orderings of messages, by means of a finite-state grammar. The finite-state grammar consists of a set of named states and a set of transitions, one transition for each message that can be received or sent from a particular state. Formally, a transition is of the form: <S> : <dir><msg>-> <S> where <S> is the symbolic name of a state; <dir> is the direction of the message which can be either! (send) or? (receive); <msg> is the name of a message described in the external interface. The above description of a service comprises the external schema which is made available on the Internet to allow a user or a client application to discover the service and to correctly interact with it. Example 1 The following gives a Banking Service specification, describing how a client (of the bank) who has an account with the bank can interact with the service to carry out certain transactions. Service Banking { Interface { RECEIVE enterpin(account acc, EncryptedPIN PIN); RECEIVE requesttransfer(account toacc, float amount); RECEIVE requestbalance(); SEND invalidpin(); SEND authorised(); SEND overdrawn(); SEND transactionapproved(); SEND currentbalance(float balance); Protocol { States { 0(init,final), 1, 2, 3, 4, 5(final), 6(final) Transitions { 0 :?enterpin -> 1; 1 :!invalidpin -> 0; 1 :!authorised -> 2; 2 :?requesttransfer -> 4; 2 :?requestbalance -> 3; 3 :!currentbalance -> 0; 4 :!transferapproved -> 5; 4 :!overdrawn -> 6; Note that many transitions of a service also require some preconditions as well as have certain effects. For instance, the transition!authorised requires the precondition that the PIN entered is valid for the account. Or, the transition!transferapproved results in changes in the database including the balance of

4 !currentbalance 3!transferApproved 5 6!invalidPIN?requestBalance!overdrawn 0?enterPIN 1!authorised 2?requestTransfer 4 Fig. 1. The interaction protocol of a banking service. the current being deducted the amount entered and the balance of the account to which the money is transferred being increased by a corresponding amount. Besides the fact that not all transitions require a precondition or produce some effects, incorporating such conditions to the protocol description significantly increases the complexity of the framework and makes reasoning about the protocols and the composite service more difficult. Let S be the external schema of a service. We denote by States(S) the set of states of the interaction protocol of S, T ransitions(s) the set of transitions of the interaction protocol of S, and init S the initial state of the interaction protocol of S. As illustrated in Figure 1, the interaction protocol of a service defines a finite-sate machine (FSM), with edges between states being labelled by!<message> or?<message>. A protocol also has a (possibly empty) set of final states in which it is valid for no further transitions to be carried out with this service (instance). A mixed state is a state from which at least one outgoing transition is labelled by a receive message and at least one outgoing transition is labelled by a send message. 2.1 A model for composite services There are situations in which a client request can not be satisfied by any single available service, but a composite service obtained by combining some available services might fulfill such a request. The services used to form a composite service are referred to as component services. When an organisation wishes to introduce a composite service based on a collection of existing services, at least two basic tasks need to be accomplished. In the first task, the organisation must produce a specification of how to coordinate the component service to allow the client request to be fulfilled. It is normally required that the specification be executable, i.e. there is an execution engine to execute the specification. Secondly the composite service must be made available as a normal service, i.e. its external schema must be exported and made available on the Internet to allow potential clients to discover and deploy it. It is the former task which is the focus of our current work, though we will also briefly discuss how an external schema is extracted from a composite service at the end of the paper. Example 2 We now discuss a simple example of service composition involving the banking service discussed in Example 1 and the following Airline Service: Service Airline {

5 Interface { RECEIVE flightrequest(flight flightid); RECEIVE cancelbooking(flight flightid); RECEIVE bookflight(flight flightid ); SEND flightunavailable(); SEND pricinginfo(price price); SEND confirmticket(details); Protocol { States { A(init,final), B, C, D(final), E, F(final) Transitions { A :?flightrequest -> B; B :!flightunavailable -> A; B :!pricinginfo -> C; C :?cancelbooking -> D; C :?bookflight -> E; E :?confirmticket -> F; A client request to purchase a ticket to fly on one of the flights provided by the above airline involves both the Airline Service and the Banking Service to allow the following functionalities: request for availability on a specified flight, information about the ticket price (in case a seat on the specified flight is available), and purchasing the ticket by transferring an appropriate amount from the client bank account to the airline (or the service provider) bank account. The message flow behaviour of this composite service and its interaction protocol are depicted in Figure 2. requestflight(flightid) offer(price) notavailable() negativeack() payment(accountinfo, PIN) transactionnotapproved() ack(ticketdetails) AirTicket Sale Service (ATS) flightrequest(flightid) pricinginfo(price) flightunavailable() cancelbooking(flightid) bookflight(flightid) confirmticket(details) enterpin(account,pin) invalidpin() authorised() requesttransfer(toacc, amount) overdrawn() transferapproved() Airline Service (AL) Banking Service (BK)?negativeAck T U!notAvailable!ack!transactionNotApproved?requestFlight!offer?payment P Q R S Fig. 2. A simple composite service for online Air Ticketing. To realise the composite service AirTicket Sale Service, on the one hand an external schema consisting of an interface and an interaction protocol with messages such as

6 offer(), payment(), transactionnotapproved(), etc. must be exported and made available to the clients. On the other hand, a mechanism to coordinate the component services Airline Service and Banking Service must be introduced to allow the functionalities of the composite service to be correctly achieved. This is known as the problem of composition synthesis which is concerned with producing a specification of how to coordinate the existing services to realise the functionality of a desired composite service. 2.2 Problem formalisation Gerede et al [9] formalise the activity-based composition synthesis problem which was originally proposed by Berardi [1] based on finite state automata whose transitions between states are labelled by activities. The problem of message-based service composition has been discussed in the work of Hull et al [5, 10]. Given a set of available services whose external schemata are made available, we would like to construct a composite service that meets certain criteria. While there could be several way in which such criteria could be expressed, we will require that the external schema of the composite service be provided. This leads us to a similar starting point to that of Gerede et al s [9] formalisation of the activity-based composition synthesis problem, viz. the composition system. Definition 1 A composition system C is a pair (S T, S) where S T is the external schema of the target (or, desired) service to be composed and S = {S 1,...,S n } is a set of external schemata specifying the available component services to be used in the composition of the desired service. Essentially, in a composition system C, the set of component services is fixed with their external schemata required to be fully specified. We require that the target service to be composed also be clearly specified in terms of its input/output messages and its interaction protocol. It is the task of a composer to construct a mechanism to coordinate the component services so that the specification of the target services is satisfied. We henceforth refer to this mechanism as the internal model of the target composite service. For convenience, we introduce the following notations: Given the external schema S of a service, M essages(s) denotes the set of messages declared in the interface of S, and let τ Transitions(S), the function Dir(S, τ) will be? if τ is a receiving message in S and will be! otherwise. We will also write a transition as s : m s where s, s States(S) and m Messages(S). The internal model M of a composite service will have both message based transitions, with which it communicates with component services and the user, and also internal transitions to allow control of internal processing to capture the required business logic of the service. Definition 2 A realisation of the composite service S T, within a composition system C = (S T, S), is a finite state machine (FSM) M = (Q, Σ, δ, q 0, F) where Q is a finite set of states, Σ denotes the set of transitions, δ : Q Σ 2 Q is the transition function, q 0 Q is the initial state, and F Q is the set of final states. The realisation M of a composite service S T is required to satisfy the following conditions:

7 1. Σ = comm M trans M where comm M = {<?!>m : m msg M } is the set of communicative acts such that msg M Messages(S T ) S S Messages(S), and trans M consists of the set of transitions denoting the internal computations of the composite service. 2. There is an isomorphism ı : Q States(S T ) such that: (i) ı(q 0 ) = init S T, and (ii) for each transition (u : m v) Transitions(S T ), there exist two states q, r Q such that ı(q) = u and ı(r) = v, and q χ r, where χ is a sequence of transitions from Σ \ Messages(S T ) such that m occurs in χ. Moreover, in order for the composite service to behave correctly, certain properties need to be guaranteed. A composition state for a composition system C = (S T, {S 1,...,S n }) with a realisation M = (Q, Σ, δ, q 0, F) is a tuple s 1,...,s n, q where s i States(S i ) (i = 1,...,n) and q Q. An execution trace over (C, M) is a (possibly infinite) sequence σ 0 m1 σ 1 m2 σ 2..., where each σ i is a composition state for (C, M); σ 0 = init S 1,..., init S n, q 0, and σ i+1 = s 1 i+1,...,sn i+1, q i+1 iff σ i = s 1 i,...,sn i, q i, and there exists κ {1,...,n} such that (i) τ = (s κ i : m i s κ i+1 ) Transitions(Sκ ); (ii) q i+1 δ(q i,!m i ) if Dir(S κ, τ) =? and q i+1 δ(q i,?m i ) otherwise; and (iii) for each l {1,...,n} such that l κ, s l i+1 = sl i. By definition, Exec Tree(C, M) = {σ : σ is an execution trace over (C, M)}. Exec Tree(C, M) is a tree whose root is the initial composition state σ 0. Two desirable properties of a realisation of a composition system C are freedom of deadlock and freedom of unspecified receptions. 1 Definition 3 A realisation M = (Q, Σ, δ, q 0, F) of a composition system C is said to be free of unspecified receptions iff for all σ Exec Tree(C, M) such that σ = σ 0 m1... σ k, where σ k = s 1 k,..., sn k, q k, the following hold: for all l {1,...,n}, if (i) s = s l k is not a mixed state in the protocol of Sl, (ii) (s : m s ) Transitions(S l ), and (iii) Dir(S l, m) =!, then there exists σ = σ 0 m1...σ k m σ k+1 such that σ Exec Tree(C, M) and σ k+1 is the same as σ k at every position except from the l th position where s l k is replaced by s and the last position where q k is replaced by q for some q Q. let u = q k, for all m msg M, if q δ(q,!m) then there exists σ = σ 0 m1... σ k m σ k+1 such that σ Exec Tree(C, M) and there exists µ {1,...,n} and σ k+1 is the same as σ k at every position except from the µ th position where s µ k is replaced by s for some s States(S µ ) and the last position where q k is replaced by q. Essentially, a composition system C with a realisation M has no unspecified receptions if and only if (i) whenever an execution trace σ can reach a point where the 1 The notions of freedom of deadlock and freedom of unspecified receptions was first introduced by Brand and Zafiropulo [3]. Definition 3 is adapted from [23].

8 realisation M is in a state where it can send a message m then some service from the composition system C, be it a component service or the constructed composite service, will be in a state where it can receive that message, and (ii) whenever an execution trace σ can reach a point where a service from the composition system C is in a state where (ii.a) it can send a message m and (ii.b) it can not receive any message, then the realisation M will be in a state where it can receive that message. Definition 4 A realisation M = (Q, Σ, δ, q 0, F) of a composition system C is said to be free of deadlocks iff for all finite execution trace σ Exec Tree(C, M) such that σ = σ 0 m1... σ k, where σ k = s 1 k,...,sn k, q k, then either s 1 k,..., sn k are final states of S1,...,S n, respectively, or there exists σ Exec Tree(C, M) such that σ is a strict prefix of σ. Definition 5 A realisation M = (Q, Σ, δ, q 0, F) of a composition system C is an internal model of C if M is free of unspecified receptions and free of deadlocks. Example 3 The following is an internal model of the composition system involving the Banking Service, the Airline Service and the AirTicket Sale Service in our running example: 2!cB γ α σ δ!ua?na?fna?rf!fr!o?p!ep β χ?pi ε φ η!tna µ?ip!rt!ack?od ν ρ?ct!bf θ π?ta κ λ?au Fig. 3. An internal model for online Air Ticketing composite service. Theorem 1 There exists an algorithm to check whether a realisation M is an internal model of a given composition system C. 3 Asynchronous communication Under our formulation of the synchronous semantics, the finite-state machines describing the protocols of the component services and the composite service on the one side and the internal model of the composite service on the other side are required to advance atomically. That is, when a message m is sent, one side must be in a state that enables it to send m and the other side is in a state that enables it to receive m. Hence, 2 The following abbreviations for message names are used: rf (requestflight), fr (flightrequest), fna (flightunavailable), ua (notavailable), pi (priceinformation), o (offer), na (negativeack), cb (cancelbooking), p (payment), ep (enterpin), ip (invalidpin), au (authorised), rt (requesttransfer), od (overdrawn), ta (transferapproved), tna (transactionnotapproved), bf (bookflight), ct (confirmticket).

9 the finite-state machines describing one of the components and the internal model advance synchronously, so that the sending and receipt of a message are considered an atomic action under this abstraction. However, as discussed by Yellin and Strom [23], the synchronous semantics can be implemented without requiring the components to send and receive messages atomically. The only requirement is that the communicating components always agree on the execution trace, i.e. the order of messages sent and received. While the synchronous semantics significantly simplifies the reasoning about communicating systems, in particular, composite services and their internal models, this restriction may severely hamper the applicability of our model to most application domains in which services are required to be dynamically discovered and plugged in to obtain the composite services. The standard way to achieve asynchronism is to use unbounded memory to store the parameters sent from one component to another without requiring the sending component to halt its process to wait for its mate to receive the messages it sends. Although the asynchronous semantics are easier to implement in comparison to the synchronous semantics, it is hard to reason about systems of communicating components under these semantics. In general, properties of the system such as deadlock or existence of unspecified receptions are undecidable [3]. Given a composition system C = (S T, {S 1,..., S n }) and a realisation M = (Q, Σ, δ, q 0, F) for C, properties of the composite service embodied by M and C such as deadlock, unspecified receptions, etc. can be investigated by considering the product automaton constructed from S 1,..., S n, and S T and M. This is the approach taken by, e.g. Gerede et al. [9]. In our representation, we will have to take into account not only the interaction states the FSMs are in, but also the state of the FIFO channels containing the (asynchronous) messages exchanged between different components of the system. 3 A configuration is a pair I, M where I denotes the (global) interaction state, called i-state, of the production machine constructed from S 1,...,S n, and S T and M; M denotes the (communication) medium state, call m-state, of the composite service. There will be n duplex FIFO channels to allow messages between the components S 1,..., S n and the realisation M to be stored. We denote the content of the queue storing the messages from M to S i (resp. from S i to M) by ω i (resp. ω i ). The symbol ǫ denotes the empty sequence. Finally, an i-state is a tuple (s 1,...,s n, q) where s i S i (i = 1,...,n) and q Q. Without loss of generality we will assume that the sets of messages of S 1,...,S n and S T are disjoint. A transition from one configurationc = (s 1,..., s n, q), (ω i, ω i ) n i=1 to another configuration c is labelled by α which is either an activity from the set of activities Σ of the realisation M or a message from n i=1 Messages(Si ) satisfying the following conditions: 1. If α =!m and m Messages(S k ) for some k {1,..., n}, then 3 Another attribute of a configuration is the state of the world, e.g. the content of databases, ticketing and reservation systems, etc. This will be part of the future work to extend the framework introduced in this paper.

10 (a) If (s k : α w k ) Transitions(S k ), then (i) the i-state of c is the same as that of c except for s k being replaced by w k ; and (ii) the content of the FIFO queue from S k to M is updated by m.ω k (was ω k before the update). (b) If q δ(q, α), then (i) the i-state of c is the same as that of c except from q being replaced by q ; and (ii) the content of the FIFO queue from M to S k is updated by m.ω k. 2. If (i) α =?m and m Messages(S k ) for some k {1,...,n}, (ii) (s k : α w k ) Transitions(S k ), and (iii) the content of the FIFO queue from M to S k is m.ω for some sequence of messages ω, then (a) the i-state of c is the same as that of c except from s k being replaced by w k ; and (b) the updated content of the FIFO queue from M to S k becomes ω. 3. If (i) α =?m and m Messages(S k ) for some k {1,..., n}, (ii) q δ(q, α), and (iii) the content of the FIFO queue from S k to M is m.ω for some sequence of messages ω, then (a) the i-state of c is the same as that of c except from q being replaced by q ; and (b) the updated content of the FIFO queue from S k to M becomes ω. 4. Otherwise, the system reaches the special configuration error. The above definition of configurations constitutes the states of the production FSM of a composition system C and its realisation. Based on this FSM and its reachability graph, standard notions such as deadlocks and unspecified receptions can be defined. Definition 6 (Reachable configurations.) Let C = (S T, {S 1,...,S n }) be a composition system and M = (Q, Σ, q 0, δ, F) a realisation of C, a configuration c is reachable if either c 0 = (init S 1,..., init S n, q 0 ), (ǫ 2 ) n i=1, called the initial configuration of C and M, or for some r 1, c 1,...,c r, τ 1,..., τ r such that c = c r and τ i is the transition from c i 1 to c i as defined above, for i = 1,...,r. A deadlock is a reachable configuration where all channels are empty and no component is in a state to send a message or move to another state under a non-communicative act. Definition 7 (Deadlock.) Let C = (S T, {S 1,...,S n }) be a composition system and M = (Q, Σ, q 0, δ, F) a realisation of C, a configuration c = (s 1,...,s n, q), (ǫ 2 ) n i=1 is called deadlock if it is reachable and 1. i {1,...,n} s.t. m Messages(S i ) and s i :!m w, for some w States(S i ), and 2. σ Σ s.t. q Q and q δ(q, σ) unless σ =?m for some message m. An unspecified reception is a reachable configuration c where the head of an incoming channel cannot be consumed by the related component at c or any reachable configuration from c. Definition 8 (Unspecified reception.) Let C = (S T, {S 1,..., S n }) be a composition system and M = (Q, Σ, q 0, δ, F) a realisation of C, a configurationc = (s 1,..., s n, q), (ω i, ω i ) n i=1 is an unspecified reception if it is reachable and k {1,..., n} s.t. either 1. ω k = m.ω for some sequence of messages ω and s k :?m s / Transitions(S k ) for any s States(S k ); or

11 2. ω k = m.ω for some sequence of messages ω and there does not exist any reachable configuration from c that puts the realisation M into a state q where δ(q,?m) is defined. From the above definitions of deadlock configurations and unspecified receptions as well as the construction of the transition relation between configurations, the following theorem can be established: Theorem 2 Let C = (S T, {S 1,...,S n }) be a composition system and M = (Q, Σ, q 0, δ, F) a realisation of C, a configuration c is error if and only if c is either deadlock or an unspecified reception. 4 Synthesis approach to service composition We now wish to use the results of the semantic definition of asynchronous communication to define an algorithm which will build an internal model for a specified composite service, using a provided set of components. Most existing approaches to service composition are based on a programmer provided description of the process model for the composite service in a language such as OWL-S. This is typified, e.g., by Narayanan and McIlraith [14], Sirin et al [18], and Traverso and Pistore [20]. These approaches aim at producing a sequence of service instances that meet the provided description for the composite service. Our interest is in synthesising the process model itself, along similar lines to the work of Berardi et al [2, 1]. To aid in developing the internal model that interacts with component services as well as exporting the desired behaviour (i.e. the message interface and protocol of the target service), we introduce rules to allow interface mapping. 4 An interface mapping consists of a set of parameter mapping rules P which essentially express the relationships between the parameters of component services and the parameters of the target service, given by the following syntax: <par_mapping> ::= [when <msg0>] forward <msg1> as <msg2> [<Function>] <par_or_const>+ -> <par>; <msg> ::= <service_name>::<msg_name>; <par_or_const> ::= <constant> <par>; <par> ::= <service_name>::<msg_name>.<par_name>; Example 4 The parameter mapping rules for our running example include: 5 ATS :: requestflight.flightid AL :: flightrequest.flightid (1) AL :: pricinginfo.price ATS :: offer.price (2) forward AL :: flightunavailable as ATS :: notavailable (3) forward ATS :: ack as AL :: bookflight (4) ATS :: requestflight.flightid AL :: bookflight.flightid (5) 4 Such rules could potentially be derived using an ontology service, however that is outside the scope of the current work. 5 In this example and the following, we use the following abbreviation for the sake of presentation: ATS for AirTicket Sale Service, AL for Airline Service, and BK for Banking Service.

12 The idea behind our algorithm is fairly simple. By constructing the (asynchronous) 6 execution tree of the product FSM of a composition system we will be able to explore all possible execution traces as well as the error configurations. After deleting the branches of the execution trees that lead to error configurations, the remaining tree (if not empty) provides us with the possible process models for the target service. The algorithm of constructing the internal model M = (Q, Σ, q 0, δ, F) for a given composition system (S T, {S 1,..., S n }) proceeds as follows. First, as M must realise S T, let A be a set such that there is an isomorphism ı : Q States(S T ). Our algorithm begins with creating a unique name q 0 to denote the initial state of M and thus, ı(q 0 ) = init S T. To construct the execution tree for a composition system C and its internal model M, the common approach is to consider the set of all possible configurations (see Section 3) and construct all possible transitions between the configurations based on the messages that can be sent between components and the internal model. This is the approach taken, e.g. by Gerede et al [9]. The problem with this approach is the space explosion issue. As the execution of the whole system will either happen within the internal model or have an effect on the FIFO channels connecting the internal model with the component services, our approach will actually revolve around the internal model and the FIFO channels. Thus we will introduce the following set of (incomplete) configurations: Let {θ 1,..., θ k } {1,...,n}, then c = (s θ1,...,s θ k ), q, (ω i, ω i ) n i=1 is an i-configuration. Then initially the execution tree T contains only one single node labelled by the i-configuration c 0 = (), q 0, (ǫ 2 ) n i=1, i.e. no component service has been taken into account and all FIFO channels are empty. Definition 9 Let a composition system C = (S T, {S 1,..., S n }) be given. If the FSM M = (Q, Σ, q 0, δ, F) is an internal model of C, then the isomorphism ı can be constructed as follows: ı(q 0 ) = init S T ; let m Messages(S T ) and u T, v T States(S T ) such that u T!m v T (resp. u T?m v T ). If q, r Q such that r δ(q,!m) (resp. r δ(q,?m)) then ı(q) = u T and ı(r) = v T. It is straightforward to show that if M is an internal model of C then f F if and only if ı(f) is a final state of S T. An i-configuration c = (s θ1,..., s θ k ), q, (ω i, ω i ) n i=1 is final if for each i {1...k}, s θi is a final state of S θi and q F. Let B be an branch on an execution tree T whose leaf is labelled by the configuration c = (s θ1,...,s θ k ), q, (ω i, ω i ) n i=1 such that c is non-final, the following rules allow one to construct an execution tree: Extension rule on component services: Let S κ {S θ1,..., S θ k }, for each m Messages(S κ ): (i) if s κ :!m s for some s States(S κ ) then any transition 6 We note that we do not provide duplex FIFO channels for the communication between M and its client. Rather we simply assume that whenever M is in a state that enables it to receive a message from its client it will repeatedly come back to the same state until the expected message arrives. Whenever M is in a state that enables it to send a message to its client, it simply does so, assuming that its client is ready to accept it or that there is a queue where the message will be stored.

13 from c to another valid configuration c may contain an update by replacing s κ with s and enqueueing the message m to ω κ ; (ii) if s κ :?m s for some s States(S κ ) and the first element of the queue ω κ contains m then any transition from c to another valid configuration c may contain an update by replacing s κ with s and removing the message m from ω κ. Extension rule on the composite service: (i) if ı maps q to some state s States(S T ) then for each m Messages(S T ), if s :?m s for some s States(S T ) then any transition from c to another valid configuration c may contain an update by replacing q with a new state q and storing the message m to an array containing user s inputs for future uses; (ii) if the configuration c is such that the constructed model is required to send a message m then, based on the parameter mapping rules, a set of minimal requirements for m will be calculated. Each minimal requirement consists of a set of service parameters that are used to derive m (according to the parameter mapping rules). For each minimal requirement MR, we introduce a new branch on the execution tree indicating the set of services required for this branch of execution. For each service S κ MR, we add its initial state init S κ to the resulting configuration. Note that this mechanism allows several instances of a single service to be deployed on one execution trace. Closure rule: When the configuration c is an error configuration as described in the preceding section, the transaction leading from the parent node N (on the execution tree T ) to c is deleted and marked as inapplicable. Then, unless there is another transaction from N which is not marked inapplicable, the node N also becomes invalid and the transaction leading to N must also be marked as inapplicable. This process is recursively carried out further to the predecessors of N. Observe that the internal model M of the composite service can be straightforwardly derived from an execution tree as the set of states of M is made explicit in the configurations on the execution tree. In addition to the set of messages sent or received by M, the internal computation transitions such as require(s θ1,...,s θ k ) can also be easily extracted from the execution tree. Furthermore, in the extended version of the paper in which we take into account the preconditions and effects of transitions, each minimal requirement (leading to a new branch on the execution tree) is associated with a condition under which the requirement is applicable. Several minimal requirements may be applicable under one single condition. 5 Related work Our approach is similar to the one taken by Yellin and Strom [23] in which a language for protocol specification is introduced for software components. Yellin and Strom, however, only deal with synchronous communication between two processes whose communication protocols are given, and building an adaptor for collaborating components whose protocols may not be directly compatible. We on the other hand deal also with asynchronous communication between services as well as building an internal model to interact with the component services in a way that satisfies the specification of the composite service. Bultan et al. [5] also introduce a formal model for Web services (based on Mealy finite state machines) to allow conversations between services to be specified and rea-

14 soned about. Their framework employs a peer-to-peer orchestration mechanism rather than a mediated approach as pursued in our work. Furthermore, they require a composition architecture of the composite service to be given so that the execution of the composite service can be carried out on a peer-to-peer basis. Gerede et al s [9] framework is probably closest to the spirit of our approach. The delegator of a composition system plays the role of the execution tree presented in our paper. However, they assume that the messages sent and received by services are identical and, more importantly, that the communication between services is synchronous. There has been a vast literature on AI planning-based approaches to Web service composition (e.g. see [14, 18, 20]). One major requirement for these approaches to work is that the description of the process model of the composite service must be given (usually in OWL-S). These approaches then produce an instantiation for the given process model to meet the user s goal by looking for a sequence of applicable instances of available component services. It is this process model (or, more precisely, its unfolded execution tree) that we wish to synthesise in the work presented in the present paper. Berardi and her group [1, 2] appear to tackle a similar problem to the one we are trying to tackle in this paper. Their composition model, however, is based on a Roman model. It is not clear how the communication problem, especially in the presence of asynchronous communication, will be addressed in their framework. 6 Conclusion and future work The approach to the problem of Web service composition introduced in this paper is based on a rich literature in component-based software engineering. Our composition algorithm requires service specifications of the component services and the target composite service. We further require that a set of parameter mapping rules be provided to allow messages to be sent by the internal models of the composite service to be synthesised. We examine the conditions under which a configuration (i.e. the state of the production FSM) is an error configuration. The algorithm has then been constructed in such a way that error configurations and execution traces leading to error configurations are eliminated. There are several directions we could pursue to extend the framework presented in this paper: (i) so far we have not taken into account the preconditions and effects of a service. This requires our model to be augmented to be able to represent the state of the world and to reason about changes made by services; (ii) the problem of failure handling is a more challenging problem which requires careful investigation into different mechanisms to fix errors that occur during the execution or instantiation of the composite process model. References 1. D. Berardi. Automatic Service Composition: Models, Techniques and Tools. PhD thesis, Università di Roma, La Sapienza, D. Berardi, D. Calvanese, G. D. Giacomo, M. Lenzerini, and M. Mecella. Automatic Composition of E-services That Export Their Behavior. In Service-Oriented Computing - ICSOC 2003, First International Conference, Trento, Italy, December 15-18, 2003, Proceedings, pages Springer-Verlag, 2003.

15 3. D. Brand and P. Zafiropulo. On communicating finite-state machines. Journal of the ACM, 30(2): , R. Breite, P. Walden, and H. Vanharanta. C-commerce virtuality - will it work in the internet? In Proc. of International Conf. on Advances in Infrastructure for Electronic Business, Science, and Education on the Internet (SSGRR 2000), T. Bultan, X. Fu, R. Hull, and J. Su. Conversation specification: a new approach to design and analysis of e-service composition. In WWW 03: Proceedings of the 12th international conference on World Wide Web, pages , New York, NY, USA, ACM Press. 6. Business Process Execution Language for Web Services. Feb, Business Process Modeling Language. March, V. Christophides, R. Hull, G. Karvounarakis, A. Kumar, G. Tong, and M. Xiong. Beyond discrete e-services: Composing session-oriented services in telecommunications. In TES 01: Proceedings of the Second International Workshop on Technologies for E-Services, pages 58 73, London, UK, Springer-Verlag. 9. C. E. Gerede, R. Hull, O. H. Ibarra, and J. Su. Automated composition of e-services: lookaheads. In ICSOC 04: Proceedings of the 2nd international conference on Service oriented computing, pages , New York, NY, USA, ACM Press. 10. R. Hull, M. Benedikt, V. Christophides, and J. Su. E-services: a look behind the curtain. In PODS 03: Proceedings of the twenty-second ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems, pages 1 14, New York, NY, USA, ACM Press. 11. J. Klingemann, J. Wäsch, and K. Aberer. Adaptive outsourcing in cross-organizational workflows. In Proc. of 11th International Conference on Advanced Information Systems Engineering CAiSE 99, pages , S. Lu. The Semantic Correctness of Transactions and Workflows. PhD thesis, Computer Science Dept., State University of New York at Stony Brook, USA, M. Mecella and B. Pernici. Building flexible and cooperative applications based on e- services, S. Narayanan and S. A. McIlraith. Simulation, verification and automated composition of web services. In WWW 02: Proceedings of the 11th international conference on World Wide Web, pages ACM Press, OWL-S 1.1 Release. November, R. Reiter. Knowledge in Action: Logical Foundations for Specifying and Implementing Dynamical Systems. MIT Press, Cambridge, Massachussets, K. Saleh. Synthesis of communications protocols: an annotated bibliography. SIGCOMM Comput. Commun. Rev., 26(5):40 59, E. Sirin, B. Parsia, D. Wu, J. Hendler, and D. Nau. HTN planning for web service composition using SHOP2. Journal of Web Semantics, 1(4): , The Foundation for Intelligent Physical Agents P. Traverso and M. Pistore. Automated composition of semantic web services into executable processes. In Proceedings of International Semantic Web Conference 2004, pages Springer-Verlag, W. M. P. van der Aalst, T. Basten, H. M. W. Verbeek, P. A. C. Verkoulen, and M. Voorhoeve. Adaptive workflow-on the interplay between flexibility and support. In International Conference on Enterprise Information Systems, pages , Web Service Choreography Interface. August, D. M. Yellin and R. E. Strom. Protocol specifications and component adaptors. ACM Trans. Program. Lang. Syst., 19(2): , 1997.