Performance and Availability Assessment for the Configuration of Distributed Workflow Management Systems

Transcription

1 Absrac Performance and Availabiliy Assessmen for he Configuraion of Disribued Workflow Managemen Sysems Michael Gillmann 1, Jeanine Weissenfels 1, Gerhard Weikum 1, Achim Kraiss 2 1 Universiy of he Saarland, Germany {gillmann,weissenfels,weikum}@csuni-sbde hp://www-dbscsuni-sbde/ Workflow managemen sysems (WFMSs) ha are geared for he orchesraion of enerprise-wide or even virual-enerprise -syle business processes across muliple organizaions are complex disribued sysems They consis of muliple workflow engines, applicaion servers, and ORB-syle communicaion servers Thus, deriving a suiable configuraion of an enire disribued WFMS for a given applicaion workload is a difficul ask This paper presens a mahemaically based mehod for configuring a disribued WFMS such ha he applicaion's demands regarding performance and availabiliy can be me while aiming o minimize he oal sysem coss The major degree of freedom ha he configuraion mehod considers is he replicaion of he underlying sofware componens, workflow engines and applicaion servers of differen ypes as well as he communicaion server, on muliple compuers for load pariioning and enhanced availabiliy The mahemaical core of he mehod consiss of Markov-chain models, derived from he applicaion's workflow specificaions, ha allow assessing he overall sysem's performance, availabiliy, and also is performabiliy in he degraded mode when some server replicas are offline, for given degrees of replicaion By ieraing over he space of feasible sysem configuraions and assessing he qualiy of candidae configuraions, he developed mehod deermines a configuraion wih near-minimum coss 1 Inroducion 2 Dresdner Bank AG, Germany achimkraiss@dresdner-bankcom hp://wwwdresdner-bankcom/ 11 Problem Saemen The main goal of workflow managemen sysems (WFMSs) is o suppor he efficien, largely auomaed execuion of business processes Large enerprises demand he reliable execuion of a wide variey of workflow ypes For some of hese workflow ypes, he availabiliy of he componens of he underlying, ofen disribued WFMS is crucial; for oher workflow ypes, high hroughpu and shor response imes are mandaory However, finding a configuraion of he WFMS (eg, wih replicaed componens) ha mees all requiremens is a difficul problem Moreover, i may be necessary o adap he configuraion over ime due o changes of he workflow load, eg, upon adding new workflow ypes Therefore, i is no sufficien o find an appropriae iniial configuraion; i should raher be possible o reconfigure he WFMS dynamically The firs sep owards a (dynamic) configuraion ool is he analysis of he WFMS o predic he performance and he availabiliy ha would be achievable under a new configuraion The goal of our research is o build a configuraion ool based on a sysem model ha is able o predic he bes configuraion for a given workflow load The configuraion ool should opimize he raio beween performance and cos, or availabiliy and cos, or even he combinaion of boh, he so-called performabiliy 12 Conribuion In his paper, we consider disribued WFMSs ha consis of componens like workflow engines, applicaion servers, and communicaion servers such as ORBs The WFMS can be This work was performed wihin he research projec Archiecure, Configuraion, and Adminisraion of Large Workflow Managemen Sysems funded by he German Science Foundaion (DFG)

2 configured such ha each of hese componens may be replicaed on differen compuers for availabiliy and/or load pariioning We presen an analyic approach ha considers boh he performance and he availabiliy of he enire WFMS in is assessmen of a given configuraion The approach is based on sochasic mehods [19, 20], specifically coninuous-ime Markov chains (CTMC), and shows he suiabiliy of hese models for a new applicaion field The developed analyic model allows us o rank he performance and availabiliy of differen configuraions ha use replicaed componens Moreover, we can predic he performance degradaion caused by ransien failures and repair or downime periods of servers (eg, for upgrading sofware ec) These consideraions lead o he noion of performabiliy [19], a combinaion of performance and availabiliy merics From he analyic model we can also derive he necessary number of WFMS componen replicaions o mee specified goals for performance and availabiliy So a crucial par of a configuraion ool for disribued WFMS becomes analyically racable, and no longer depends on expensive rial-and-error pracice or he subjecive inuiion of he sysem adminisraion saff 13 Relaed Work Alhough he lieraure includes much work on scalable WFMS archiecures [1, 4, 5, 6, 12, 15], here are only few research projecs ha have looked ino he quaniaive assessmen of WFMS configuraions wih regard o performance and availabiliy The work repored in [2, 3] presens several ypes of disribued WFMS archiecures and discusses he influence of differen load disribuion mehods on he nework and workflow-server load, mosly using simulaions [18] presens heurisics for he allocaion of workflow-ype and workflow-insance daa ono servers Mechanisms for enhanced WFMS availabiliy by replicaing sae daa on a sandby backup server have been sudied in [9, 14] None of his prior work has addressed he issue of how o configure a WFMS for given performance and availabiliy goals The use of CTMC models in he conex of workflow managemen has been pursued by [13] This work uses he seady-sae analysis of such models o analyze he efficiency of differen ousourcing sraegies in a virual-enerprise seing Our approach is more far-reaching in ha we use mehods for he ransien analysis of Markov chains o esimae he dynamic behavior of workflow insances and he resuling performance In addiion, we address also he availabiliy and performabiliy dimensions, which are beyond he scope of [13] 14 Ouline The res of he paper is organized as follows In Secion 2, we inroduce our model of a disribued WFMS In Secion 3, we describe how we can sochasically model he dynamic behavior of a workflow insance; we use a simplified e-commerce applicaion as an illusraing example In Secions 4 and 5, we develop he performance model and he availabiliy model, respecively In Secion 6, we combine boh models ino he performabiliy model ha allows us o predic he influence of ransien failures and downime periods on he overall performance Secion 7 discusses how he presened models are inegraed ino he core of an auomaed configuraion ool 2 Archiecural Model In his secion, we inroduce an archiecural model for disribued WFMSs We basically follow he framework of [23] Alhough he model is simple, i is powerful enough o capure he archiecure models of mos WFMS producs and research prooypes in a reasonable way Based on his model, we will inroduce he cenral noions of he sysem configuraion and he sysem sae of a disribued WFMS A workflow (insance) is a se of aciviies ha are spawned according o he conrol-flow specificaion of a given workflow ype An aciviy can eiher direcly invoke an applicaion, which is ypical of auomaed aciviies, or i can firs require he assignmen o an appropriae human acor or organizaional uni according o a specified worklis managemen policy

3 Workflow engine Communicaion server Applicaion server IniApp(AppName,WFID) CreaeIns(AppName,WFID) Clien Execuion of auomaed aciviy Execuion of ineracive aciviy including worklis managemen Reurn(ObjRef(AppName)) ObjRef->sar(Parameer) Done() Assign(Workiem) Ge(WorklisID) Reurn(ObjRef(WorklisID)) Done() Done() Done() Se(Condiion) Done() Ge(WFID) Reurn(ObjRef(WFID)) synchronous operaion invocaion asynchronous operaion invocaion sending a message ObjRef->inser(WorkiemID,Workiem) Done() sar(app,parameer) Se(Workiem->DONE) Done() Figure 1: Sequence diagram of he execuion of wo aciviies A disribued WFMS execues workflow insances in a decenralized manner: each workflow insance is pariioned ino several subworkflows which may run on differen workflow engines, for example, wih one workflow engine per subworkflow ype according o he organizaional srucure of he involved enerprises Invoked applicaions of specific ypes run on dedicaed applicaion servers, for example, under he conrol of a Web applicaion server and ofen wih a daabase sysem as a backend Finally, he communicaion wihin he underlying, ofen widely disribued and heerogeneous sysem environmen is assumed o be handled by a special kind of communicaion server, for example, an objec reques broker (ORB) or a similar piece of middleware These hree ypes of WFMS componens workflow engines, applicaion servers, and communicaion servers will henceforh be viewed as absrac servers of specific ypes wihin our archiecural model For simpliciy, we assume ha each such server resides on a dedicaed compuer, and ha all involved compuers are conneced by an inrane or he Inerne The siuaion where muliple servers run on he same compuer can be addressed wihin our model, oo, bu would enail some echnical exensions The ineracion of he various componens on behalf of a workflow insance is illusraed in he UML-syle sequence diagram of Figure 1 Noe ha each aciviy involves exacly one workflow engine of a specific ype, one applicaion server of a given ype, and he communicaion server Each aciviy incurs a cerain, aciviy-specific processing load on hese servers The firs par of Figure 1 shows he sequence of he requess for he asynchronous execuion of an auomaed aciviy The second par of Figure 1 shows he sequence of he requess for an ineracive aciviy As ha aciviy is execued on a clien machine, he applicaion server is no involved The specific deails of how many requess are sen a which imepoins beween he various servers is no relevan, however, as far as he performance assessmen and configuraion planning is concerned Raher we consider only he oal load induced by an aciviy insance on each of he involved server ypes So, in our example of Figure 1, he execuion of he auomaed aciviy induces 3 requess a he workflow engine, 2 requess a he communicaion server, and 3 requess a he applicaion server For scalabiliy and availabiliy reasons, many indusrial-srengh WFMSs suppor he replicaion of server ypes wihin he sysem For simpliciy, we will refer o he replicas of a server ype as servers For example, a workflow engine ha is capable o handle insances of specific subworkflow ypes can be insalled on muliple compuers, wih he oal load being pariioned across all such servers, eg, by assigning hem subworkflow insances in a roundrobin or hashed manner In addiion, each server provides capabiliies for backup and online failover in he case ha anoher server of he same ype fails or is aken down for mainenance

4 Applicaion server n Comm server (eg ORB) WF engine 1 Applicaion server 1 WF engine m Aciviy 1 Aciviy o generaes requess o Figure 2: Archiecural model of a disribued WFMS In ha case, he oal load would be disribued across one less server, leading o (emporarily) degraded performance Figure 2 illusraes he presened archiecural model: he WFMS consiss of one ype of communicaion server, m differen ypes of workflow engines, and n differen ypes of applicaion server The arcs denoe service requess of workflow aciviies o he several server ypes For example, he execuion of an aciviy of ype 1 requires work on he communicaion server, a workflow engine of ype 1 and an applicaion server of ype n Each server of ype x is assumed o have a failure rae λ x and a repair rae µ x These raes correspond o he reciprocals of he mean ime o failure and he mean ime o repair, respecively Here he noion of a failure includes downimes for mainenance, and he repair ime is he duraion of a resar (including all necessary recovery seps) afer a real failure or downime in general Noe ha our archiecural model could be easily exended o include more server ypes, for example, o incorporae direcory services or worklis managemen faciliies as separae servers if his were desired The hree server ypes made explici in our model appear o be he mos relevan ones for performance and availabiliy assessmen Also noe ha we do no include cliens as explici componens in he model, for he simple reason ha clien machines are usually no performance-criical Raher he shared, and heavily uilized resources of servers usually form he bolenecks in muli-user applicaions Finally, we disregard all effecs of human user behavior, eg, heir speed of reacion, inellecual decision making ec, for he assessmen of workflow urnaround imes, as hese aspecs are beyond he conrol of he compuer sysem configuraion We are now ready o define he cenral noion of he sysem configuraion of a disribued WFMS Wih k differen server ypes, he sysem configuraion of he WFMS is he vecor of replicaion degrees ( Y 1, K,Y k ) for each server ype; so Y x is he number of servers of server ype x ha we have configured he sysem wih Because of server failures and repairs, he number of available servers of a given ype varies over ime For a given poin of ime, we call he vecor ( X 1, K, X k ) (wih X x Yx for all 1 x k ) of he numbers of currenly available servers of each server ype he curren sysem sae of he WFMS 3 Sochasic Modeling of Workflow Behavior In his secion, we presen a model ha sochasically describes he behavior of a single workflow insance In Subsecion 31, we will firs inroduce a simplified elecronic-commerce scenario as an illusraing example In Subsecion 32, we develop he sochasic model ha allows us o esimae he (expeced) number of aciviy execuions for each aciviy ype wihin a workflow insance of a given ype For he sake of concreeness, we will use sae and aciviy chars as a workflow specificaion language, bu oher, comparable languages could be incorporaed in our approach as well

5 31 Example Scenario As an example of a workflow ype, we presen a simplified e-commerce scenario To underline he compleeness of our approach, we include he full specrum of conrol flow srucures, ie, branching splis, parallelism, joins, and loops The workflow is similar o he TPC-C benchmark for ransacion sysems [21], wih he key difference ha we combine muliple ransacion ypes ino a workflow and furher enhance he funcionaliy (see [7] for a full descripion of his workflow) The workflow specificaion is given in he form of a sae char [10, 11] This specificaion formalism has been adoped for he behavioral dimension of he UML indusry sandard [22], and i has been used for our own prooype sysem Menor-lie [16, 24] Sae chars specify he conrol flow beween aciviies A sae char is essenially a finie sae machine wih a disinguished iniial sae and ransiions driven by even-condiion-acion rules (ECA rules) Throughou his paper, we assume ha each workflow sae char has a single final sae (ie, one wihou ougoing edges) (If here were muliple final saes, hey could be easily conneced o an addiional erminaion sae) A ransiion from sae s i o sae s j, annoaed wih an ECA rule of he form E[C]/A, fires if even E occurs and condiion C holds The effec is ha sae s i is lef, sae s j is enered, and acion A is execued Condiions and acions are expressed in erms of variables ha are relevan for he conrol and daa flow among aciviies In addiion, an acion A can explicily sar an aciviy, expressed by s!(aciviy), and can generae an even E or modify a condiion variable C (eg, fs!(c) ses he condiion C o false) Each of he hree componens of an E[C]/A riple may be empy Imporan addiional feaures of sae chars are nesed saes and orhogonal componens Nesing of saes means ha a sae can iself conains an enire sae char The semanics is ha upon enering he higher-level sae, he iniial sae of he embedded lower-level sae char is auomaically enered, and upon leaving he higher-level sae all embedded lower-level sae chars are lef The capabiliy for nesing saes is especially useful for he refinemen of specificaions during he design process and for incorporaing subworkflows Orhogonal componens denoe he parallel execuion of wo sae chars ha are embedded in he same higherlevel sae (where he enire sae char can be viewed as a single op-level sae) Boh componens ener heir iniial saes simulaneously, and he ransiions in he wo componens proceed in parallel, subjec o he precondiions for a ransiion o fire Figure 3 shows he op-level sae char for our example workflow Each sae corresponds o an aciviy or one (or muliple, parallel) subworkflow(s), excep for iniial and final saes We assume ha for every aciviy ac he condiion ac_done is se o rue when ac is finished So, we are able o synchronize he conrol flow so ha a sae of he sae char is lef when he corresponding aciviy erminaes For parallel subworkflows, he final saes of he corresponding orhogonal componens serve o synchronize he erminaion (ie, join in he conrol flow) The workflow behaves as follows Iniially, he NewOrder aciviy is sared Afer he erminaion of NewOrder, he conrol flow is spli If he cusomer wans o pay by credi card, he condiion PayByCrediCard is se and he CrediCardCheck aciviy checks he validiy of he credi card If here are any problems wih he credi card, he workflow is erminaed Oherwise he shipmen, represened by he nesed op-level sae Shipmen_S, is iniiaed spawning wo orhogonal/parallel subworkflows, specified in he sae chars Noify_SC and Delivery_SC, respecively Afer he erminaion of boh subworkflows, he conrol flow is synchronized, and spli again depending on he mode of paymen The workflow erminaes in he finishing sae EP_EXIT_S 32 Sochasic modeling For predicing he expeced load induced by he execuion of a workflow insance, we have o be able o predic he conrol flow behavior of workflow insances As workflows include condiional branches and loops, he bes we can do here is o describe he execuion

6 EP_INIT_S /s!(neworder) NewOrder_S [PayByBill and NewOrder _DONE] EP_SC [PayByCrediCard and NewOrder _DONE] /s!(credicardcheck) Shipmen_S CrediCardCheck_S [CrediCardOK and CrediCardCheck_DONE] [CrediCardNoOK and CrediCardCheck_DONE] [in(noify_exit_s) and in(delivery_exit_s) and PayByBill] /s!(paymen) Paymen_S Noify_SC Delivery_SC [and PayByCrediCard] /s!(credicardpaymen) CrediCardPaymen_S [Paymen_DONE] EP_EXIT_S [CrediCardPaymen_DONE] Figure 3: Sae char of he elecronic purchase (EP) workflow example sochasically Our goal hus is o esimae he number of aciviy invocaions per workflow insance, for each aciviy ype; from his esimae we can hen derive he load induced by a workflow insance on he various server ypes In he following, we will concenrae on workflows wihou nesing, and will come back o he general case laer in Secion 4 when we show how o incorporae subworkflows in he overall model A suiable sochasic model for describing he conrol flow wihin a simple workflow insance wihou nesed subworkflows is he model of coninuous-ime, firs-order Markov chains (CTMC) [19, 20] A CTMC is a process ha proceeds hrough a se of saes in cerain ime periods Is basic propery is ha he probabiliy of enering he nex sae wihin a cerain ime depends only on he currenly enered sae, and no on he previous hisory of enered saes The mahemaical implicaion is ha he residence ime in a sae - ha is, he ime he process resides in he sae before i makes is nex ransiion - follows a (sae-specific) exponenial disribuion Consequenly, he behavior of a CTMC is uniquely described by a marix P = ( p ij ) of ransiion probabiliies beween saes and a vecor H = ( H i ) of he mean residence imes of he saes Le { s i i = 0 n 1 } be he se of n execuion saes of a workflow ype The conrol flow of an insance of will be modeled by a CTMC where he saes correspond o he workflow execuion saes s i The sae ransiion probabiliy p ij corresponds o he probabiliy ha a workflow insance of workflow ype eners sae s j when leaving sae s i The ransiion probabiliies have o be provided by he workflow designer based on he semanics of he condiions beween he workflow aciviies and he anicipaed frequencies of business cases If he enire workflow applicaion is already operaional and our goal is o reconfigure he WFMS (or invesigae if a reconfiguraion is worhwhile), hen he ransiion probabiliies can be derived from audi rails of previous workflow execuions The mean residence ime Hi of a sae i corresponds o he mean ime ha insances of workflow ype say in he execuion sae s i, ie, he urnaround ime of he corresponding aciviy (or he mean runime of he corresponding nesed subworkflow), and needs o be esimaed or observed analogously In accordance wih he workflow specificaion, we assume ha he CTMC has a single iniial sae s 0 In he iniial sae-probabiliy vecor of he CTMC, he probabiliy is se o 1 for he iniial sae s 0 and o 0 for all oher saes Moreover, we add a ransiion from he final execuion sae ino an arificial absorbing sae s A The ransiion probabiliy of his ransiion is se o 1, and he residence ime of he absorbing sae is se o infiniy

7 s0 (EP_INIT_S) 10 s1 (NewOrder_S) 02 s2 (CrediCardCheck_S ) 005 H 0=1min H 1=1min H 2=5sec s3 (Shipmen_S) H 3=6h H 5=50sec H 4=10days s4 (Paymen_S) s5 (CrediCardPaymen_S) 10 H 6=4sec s6 (EP_EXIT_S) sa Figure 4: CTMC represening he EP workflow ype For workflow ypes wih subworkflows, he subworkflows are represened by single saes wihin he CTMC of he paren workflow In he case of parallelism, he corresponding sae represens all parallel subworkflows ogeher For he mean residence ime of ha sae, we will use he maximum of he mean urnaround imes of he parallel subworkflows Figure 4 gives an example for he CTMC represening he e-commerce workflow ype of Figure 3 Besides he absorbing sae s A, he CTMC consiss of seven furher saes, each represening he seven saes of he workflow s op-level sae char The values for he ransiion probabiliies and he mean residence imes are ficiious for mere illusraion Wih his CTMC model, we are now able o predic he expeced number of invocaions for each aciviy ype, namely, he number of visis o he corresponding CTMC sae before evenually reaching he absorbing sae, using sandard analysis echniques for Markov chains We will provide more deails in he following secion, where we will also show how o derive he expeced oal load of a workflow insance 4 Performance Model In his secion, we discuss he server-performance model We proceed in four sages: 1 We analyze he mean urnaround ime R of a workflow of a given ype, based on he analysis of sae visi frequencies and he sae residence imes of he CTMC model This analysis makes use of sandard echniques for he ransien behavior of Markov chains (Noe ha he Markov chains in our approach are non-ergodic; so saionary sae probabiliies do no exis, and a seady-sae analysis is no feasible) 2 We deermine load induced on each server ype by a workflow insance of ype We will model his load as he expeced number of service requess o a server ype Technically, his is he mos difficul sep, and we will use a Markov reward model for his derivaion 3 We hen aggregae, for each server ype, he load over all workflow insances of all ypes (using he relaive fracions of he various workflow ypes as implici weighs) The oal load per server of a given server ype is hen obained by dividing he overall load by he number of such servers (ie, he server-ype-specific degree of replicaion) in he configuraion In his sage we also derive he maximum susainable hroughpu in erms of workflow insances per ime uni 4 Finally we derive, from he urnaround imes of workflows and he oal load per server, he mean waiing imes of service requess caused by queueing a a heavily loaded server This is a direc measure for he sysem s responsiveness as perceived by human users in ineracions for he aciviies wihin a workflow Overly high waiing imes are an indicaion of a poorly configured sysem, and we can hen idenify he server ype(s) ha forms he boleneck

8 41 Workflow Turnaround Time We derive he mean urnaround ime of a workflow insance of ype by he ransien analysis of he corresponding CTMC [20] The mean urnaround ime, R, is he mean ime ha he CTMC needs o ener he absorbing sae for he firs (and only) ime, he so-called firs-passage ime of he absorbing sae s A The firs-passage ime of a CTMC sae is generally compued by solving a se of linear equaions [20] as follows Assume ha for all saes s i of he CTMC he probabiliy ha he firs epoch a which he CTMC makes a ransiion ino he absorpion sae s A saring in sae s i is finie, is equal o one (which is he case for he specific CTMC models in our conex of workflow managemen) Then, he mean firs-passage ime m ia unil he firs ransiion of he CTMC ino s A saring in sae s i can be compued from he sysem of linear equaions ν imia + qijm ja = 1, i A j A, j i where ν i = 1 Hi is he rae of leaving sae s i, and qij = νi pij is he ransiion rae from sae s i o sae s j [20] This linear equaion sysem can be easily solved using sandard mehods such as he Gauss-Seidel algorihm 42 Load (Service Requess) per Workflow Insance The execuion of a workflow insance spawns a se of aciviies, which in urn generae service requess o differen server ypes For example, he invocaion of an aciviy incurs a cerain iniializaion and erminaion load, and a processing load is induced during he enire aciviy, on involved workflow engine and applicaion server ype, and also on he communicaion server ype Le he marix L = ( L xa ) denoe he number of service requess generaed on server ype x by execuing a single insance of he aciviy ype a wihin an insance of workflow ype Consider he EP workflow ype of our running e-commerce example The corresponding CTMC has eigh saes in oal, bu he absorbing sae s A does no invoke an aciviy and hus does no incur any load Wih hree server ypes, he sae-specific load vecors have hree componens each, and he enire load marix L EP is a 3 7 marix In pracice, he enries of he load marix have o be deermined by collecing appropriae runime saisics 421 Compuing he load of a op-level workflow insance wihou subworkflows To calculae he load ha one workflow insance of a given ype generaes on he various server ypes, we use mehods for he ransien analysis of CTMC models We will firs disregard he possible exisence of subworkflows, and will laer augmen our mehod o incorporae subworkflows The firs, preparaory sep is o eliminae he poenial difficuly ha he sae residence imes are non-uniform; here are sandard echniques for ransforming he CTMC ino a uniform CTMC where he mean residence ime is idenical for all saes and whose sochasic behavior is equivalen o ha of he original model [20] This is more of a echnicaliy and serves o simplify he formulas The acual analysis is based on a Markov reward model (MRM) which can be inerpreed as follows: each ime a sae is enered and we spend some ime here, we obain a reward, and we are ineresed in he oally accumulaed reward unil we ener he absorbing sae This meric is known as he expeced reward earned unil absorpion [20] Here he reward ha we obain in each sae is he number of service requess ha are

9 generaed upon each visi of a sae (The erm reward is somewha misleading in our problem conex, bu i is he sandard erm for such models) The expeced number of service requess ha an insance of he workflow ype generaes on server ype x can be compued by he formula r x, where = max { ν a = 1 Ha } 1 0 a q ab L xb, ν a A z= 0 b A, b a = L + p () z x 0 ν is he maximum of he deparure raes of he CTMC saes wih a A H a denoing he sae residence ime of sae s a, q ab = νa p ab is he ransiion rae from sae s a o sae s b, and p0 a ( z) is he aboo probabiliy ha he process will be in sae s a afer z seps wihou having visied he absorbing sae s A saring in he iniial sae s 0 The aboo probabiliies can be recursively compued from he Chapman-Kolmogorov equaions () p ab z = p cb pac( z 1 ), a, b A c A saring wih p 00 (0) = 1, and p 0 a (0) = 0 for a 0, and wih ν a p ab, b a, a A p = ν ab ν 1 a, b = a, a A ν denoing he one-sep ransiion probabiliies of he CTMC afer uniformizaion [20] For an efficien approximaion of r x,, he summaion over he number of seps, z, has o be erminaed when z exceeds a predefined upper bound z max The value of zmax is se o he number of sae ransiions ha will no be exceeded by he workflow wihin is expeced runime wih very high probabiliy, say 99 percen This value of z max can be easily deermined during he analysis of he CTMC 422 Incorporaion of subworkflows Once we add subworkflows, he expeced urnaround ime and he expeced number of service requess generaed by an insance of a workflow ype can be calculaed in a hierarchical manner For a CTMC sae ha represens a subworkflow or a se of parallel subworkflows, H s corresponds o he mean urnaround ime and he enries L xs of he load marix L correspond o he expeced number of service requess for he enire se of nesed subworkflows Thus, he mean residence ime H s is approximaely he maximum of he mean urnaround imes of he parallel subworkflows H s = max { Rb }, and he number of service requess L xs b S for server ype x equals he sum of he expeced number of service requess generaed by he parallel subworkflows L xs = r x, b b S Noe ha he maximum of he mean urnaround imes of he parallel subworkflows is acually a lower bound of he mean residence ime of he corresponding higher-level sae So he approximaion is conservaive wih regard o he induced load per ime uni

10 43 Toal Server Load and Maximum Susainable Throughpu We associae wih each workflow ype an arrival rae ξ which denoes he mean number of user-iniiaed workflows (of he given ype) per ime uni; he acual arrival process would ypically be described as a Poisson process for sysems wih a relaively large number of independen cliens (eg, wihin an insurance company) By Lile s law, he mean number of concurrenly execuing insances N acive of workflow ype is given by he produc of he arrival rae ξ of new insances and he mean urnaround ime R of a single insance of workflow ype : N acive = ξr The server-ype-specific reques arrival rae l x, of a single insance of workflow ype is given by dividing he expeced number of service requess o server ype x, r x,, by he mean runime R of an insance of Then he server-ype-specific oal load, ie, is reques arrival rae over all concurrenly acive insances of workflow ype is he produc of l x, wih he mean number, N acive, of acive workflow insances Finally, he reques arrival rae l x o server ype x over all workflow ypes is obained by rx, l x = Nacive = ξ rx, R Wih Y x servers of server ype x and uniform load disribuion across hese replicas, he oal load per server (of ype x) is l x = lx Yx Noe ha his is acually he service reques arrival rae If we assume ha each reques keeps he server busy for a service ime of lengh b x on average, hen he server s acual hroughpu is he maximum value lˆ x lx such ha l ˆ x b x 1; for arrival raes such ha l x b x > 1 he server could no susain he load So he maximum susainable hroughpu (in erms of processed workflow insances per ime uni) is given by he minimum of he lˆ x values over all server ypes x (ie, he server ype ha sauraes firs) 44 Waiing Time of Service Requess For analyzing he mean waiing ime of service requess, we model each server ype x as a se of Y x M/G/1 queueing sysems where Y x is he number of server replicas of he server ype So we assume ha service requess are, on average, uniformly disribued across all servers of he same ype This can be achieved by assigning work o servers in a round-robin or random (ypically hashing-based) manner In pracice hese assignmens would ypically be performed when a workflow insance sars, so ha all subworkflows, aciviies, or invoked applicaions of he same ype wihin ha workflow insance are assigned o he same server insance for localiy While his realisic load pariioning policy may creae emporary load burss, he long-erm (seady-sae) load would be spread uniformly Each server is modeled only very coarsely by considering only is mean service ime per service reques and he second momen of his meric Boh of hese server-ype-specific values can be easily esimaed by collecing and evaluaing online saisics We do no model he deails of a server s hardware configuraion such as CPU speed, memory size, or number of disks Raher we assume ha each server is a well-configured building block, and ha we scale up he sysem by adding such building blocks In paricular, he CPU and disk I/O power of a server are assumed o be in balance, so ha neiher of hese resources becomes a boleneck while he oher is way underuilized Commercially available commodiy servers for informa-

11 ion sysems in general are configured his way, and workflow managemen would fall ino his caegory Neverheless, even if i urns ou ha one resource ype always ends o be he boleneck, our coarse-grained model is applicable under he assumpion ha he absrac noion of service ime refers o he boleneck resource wihin a server Le l x be he arrival rae of service requess a server ype x as derived in he previous subsecion, b x he mean service ime of service requess a server ype x, and b (2) x he second momen of he service ime disribuion of service requess a server ype x The mean arrival rae of service requess a a single server of server ype x is given by l x = lx Yx where Y x is he number of servers of server ype x Then he mean waiing ime wx of service requess a an individual M/G/1 server of ype x is given by he sandard formula [17]: l (2) xb w x x = 2(1 ρx ) where ρx = lxbx is he uilizaion of he server This mean waiing ime is our main indicaor of he responsiveness of he WFMS whenever user ineracions ake place The generalized case for configuraions where muliple server ypes, say x and z, are assigned o he same compuer is handled as follows: he server-ype-specific arrival raes l x and l z are summed up, he server ypes common service ime disribuion is compued, and hese aggregae measures are fed ino he M/G/1 model o derive he mean waiing ime common o all server ypes on he same compuer Noe ha our approach is so far limied o a homogenous seing where all underlying compuers have he same performance capaciy, bu could be exended o he heerogeneous case by adjusing he service imes on a per compuer basis 5 Availabiliy Model In his secion we presen he availabiliy model for a disribued WFMS according o our archiecural model of Secion 2 We analyze he influence of ransien componen failures on he availabiliy of he enire sysem 51 CTMC for Sysem Saes Following he sandard approach, our availabiliy model is again based on coninuous-ime Markov chains (CTMC) The seady-sae analysis of he CTMC delivers informaion abou he probabiliy of he curren sysem sae of he WFMS Each sae of he CTMC represens a possible sysem sae of he WFMS So a sae of he CTMC is a k-uple wih k being he number of differen server ypes wihin he WFMS, and each enry of he uple represens he number X x of currenly available servers of server ype x a a given poin of ime For example, he sysem sae (2,1,1) means ha he WFMS consiss of hree differen server ypes and here are 2 servers of ype 1, 1 server of ype 2, and 1 server of ype 3 currenly running while he ohers have failed and are being resared or have been aken down for mainenance When a server of ype x fails, he CTMC performs a ransiion o he sysem sae wih he corresponding value for server ype x decreased by one For example, he sysem sae ( X 1,, X x,, X k ) is lef when a server of ype x fails, and he sysem sae ( X 1,, ( X x 1),, X k ) is enered Analogously, when a server of ype x complees is resar, he CTMC performs a ransiion ino he sae where he value for server ype x is increased by one The failure raes λ x and he repair raes µ x of he server ypes are he corresponding ransiion raes of he CTMC This basic model implicily assumes ha he ime spen in a sae is exponenially disribued, bu noe ha non-exponenial failure or repair raes (eg, anicipaed periodic downimes for sof-

12 ware mainenance) can be accommodaed as well, by refining he corresponding sae ino a (reasonably small) se of exponenial saes [20] This kind of expansion can be done auomaically once he disribuions of he non-exponenial saes are specified Wih such a CTMC a hand, which can be shown o be ergodic, we are able o compue he seady-sae probabiliy for each sae of he CTMC Then he probabiliy for he enire sysem being unavailable is simply he sum of he sae probabiliies over all hose saes where a leas one server ype is compleely unavailable (ie, has a zero enry in he X vecor) We nex presen he deails of he seady-sae analysis of he CTMC in he following subsecion 52 Seady-sae Analysis of he Availabiliy-Model CTMC Le k be he number of differen server ypes, Y = ( Y1, K, Y k ) he WFMS configuraion, and le X = { ( X1, K, Xk ) 0 X x Yx, 1 x k } be he finie se of he sysem saes of he WFMS We encode X ino a se X of ineger values ha denoe he saes of he CTMC of he previous subsecion as follows: k j 1 ( X1, K, Xk ) a X j ( Yl + 1) j= 1 l= 1 For example, for a CTMC wih hree server ypes, wo servers each we encode he saes (0,0,0), (1,0,0), (2,0,0), (0,1,0) ec as inegers 0, 1, 2, 3, and so on To derive he seady-sae probabiliies of he CTMC, we have o solve a sysem of linear equaions πq = 0 π i = 1 i where π i denoes he seady-sae probabiliy of sae i X, π is he vecor ( π i ), and Q is he infiniesimal generaor marix of he CTMC [19] The generaor marix Q = ( q ij ) wih i, j X is obained by seing q ij o he ransiion rae from he sae ( X 1, K, X k ) corresponding o i X ino he sae ( X 1, K, X k ) corresponding o j X The diagonal elemens of Q are se o q ii = q ij Noe ha qii is he rae a which he sysem depars from sae i X [19] j i The resuling linear equaion sysem can again be solved easily by using sandard mehods such as he Gauss-Seidel algorihm As an illusraing example consider a scenario wih hree server ypes Le server ype 1 be he communicaion server, server ype 2 be one ype of workflow engine, and server ype 3 be one ype of applicaion server The failure raes are assumed as follows (where failures would ypically be sofware-induced Heisenbugs [8] or downimes for mainenance): one failure per 1 monh (so λ 1 = (43200 min) ) for a communicaion server, one failure per week (so 1 1 λ 2 = (10080 min) ) for a workflow engine, and one failure per day (so λ 3 = (1440 min) ) for an applicaion server We furher assume ha he mean ime o repair of a failed server is 10 minues regardless 1 of he server ype, so he repair raes are µ 1 = µ 2 = µ 3 = (10 min) Noe ha hese absolue figures are arbirary, bu he ranking of server ypes wih respec o failure raes may reflec he mauriy of he underlying sofware echnologies The enire WFMS is available when a leas one server of each server ype is running, and he WFMS is down when all server replicaions of a leas one server ype are down

13 The CTMC analysis compues an expeced downime of 71 hours per year if here is only one server of each server ype, ie, no server is replicaed By 3-way replicaion of each server ype, he sysem downime can be brough down o 10 seconds per year However, replicaing he mos unreliable server ype, ie, he applicaion server ype in our example, hree imes and having wo replicas of each of he oher wo server ypes is already sufficien o bound he unavailabiliy by less hen a minue 6 Performabiliy Model Wih he performance model alone we are able o predic he performance of he WFMS for a single, given sysem sae So changes of he sysem sae over ime caused by failures and repairs are no capured In his secion, we presen a performabiliy model ha allows us o predic he performance of he WFMS wih he effecs of emporarily non-available servers (ie, he resuling performance degradaion) aken ino accoun Our performabiliy model is a hierarchical model consiued by a Markov reward model (MRM) for he availabiliy CTMC of Secion 5, where he sae-specific rewards are derived from he performance model of Secion 4 The probabiliy of being in a specific sysem sae of he WFMS is inferred from he availabiliy model As he reward for a given sae of he availabiliy CTMC, we use he mean waiing ime of service requess of he WFMS in ha sysem sae So we need o evaluae he performance model for each considered sysem sae, raher han only for he overall configuraion which now is merely he upper bound for he sysem saes of ineres Then he seady-sae analysis of he MRM [19] yields he expeced value for he waiing ime of service requess for a given WFMS configuraion wih emporary performance degradaion induced by failures Le Y be a given sysem configuraion and π i be he seady-sae probabiliy for he sysem sae i X as calculaed in Secion 5 Le w i = ( w i ) x be he vecor of he expeced waiing imes of service requess of all server ypes x for a given sysem sae i X as calculaed in Secion 4 Then he performabiliy vecor of he expeced values of he waiing imes of service requess W Y = ( W Y x ) for server ypes x under configuraion Y and wih failures aken ino accoun, is obained by condiioning he sysem-sae-specific waiing ime vecors w í wih he Y i sysem sae probabiliies π i, hus yielding W = w π i i X The value of W Y derived his way is he ulimae meric for assessing he performance of a WFMS, including he emporary degradaion caused by failures and downimes of server replicas The sysem s responsiveness is accepable if no enry of he waiing-ime vecor W Y is above a criical olerance hreshold 7 Configuraion Tool In his secion, we skech a configuraion ool ha we are currenly developing based on he presened analyic models We also discuss he inegraion of he ool ino a given workflow environmen 71 Funcionaliy and Archiecure of he Configuraion Tool The configuraion ool consiss of four componens: he mapping of workflow specificaions ono he ool s inernal models, he calibraion of he inernal models by means of saisics from monioring he sysem, he evaluaion of he models for given inpu parameers, and he compuaion of recommendaions o sysem adminisraors and archiecs, wih regard o specified performabiliy goals

14 For he mapping he ool ineracs wih a workflow reposiory where he specificaions of he various workflow ypes are sored In addiion, saisics from online monioring may be used as a second source (eg, o esimae ransiion probabiliies ec) The configuraion ool ranslaes he workflow specificaions ino he corresponding CTMC models For he evaluaion of he models, addiional parameers may have o be calibraed; for example, he firs wo momens of he server-ype-specific service imes have o be fed ino he models This calibraion is again based on appropriae online monioring So boh he mapping and calibraion componens require online saisics abou he running sysem Consequenly, when he ool is o be used for configuring a compleely new workflow environmen, many parameers have o be inellecually esimaed by a human exper Laer, afer he sysem has been operaional for a while, hese parameers can be auomaically adjused, and he ool can hen make appropriae recommendaions for reconfiguring he sysem The evaluaion of he ool s inernal CTMC models is driven by specified performabiliy goals Sysem adminisraors or archiecs can specify goals of he following wo kinds: 1) a olerance hreshold for he mean waiing ime of service requess ha would sill be accepable o he end-users, and 2) a olerance hreshold for he unavailabiliy of he enire WFMS, or in oher words, a minimum availabiliy level The firs goal requires evaluaing he performabiliy model, whereas he second one merely needs he availabiliy model The ool can invoke hese evaluaions eiher for a given sysem configuraion (or even a given sysem sae if failures are no a major concern), or i can search for he minimum-cos configuraion ha saisfies boh goals, which will be discussed in more deail in he nex subsecion The cos of a configuraion is assumed o be proporional o he oal number of servers ha consiue he enire WFMS, bu his could be furher refined wih respec o differen server ypes Also, boh kinds of goals can be refined ino workflowype-specific goals, by requiring, for example, differen maximum waiing imes or availabiliy levels for specific server ypes The ool uses he resuls of he model evaluaions o generae recommendaions o he sysem adminisraors or archiecs Such recommendaions may be asked for regarding specific aspecs only (eg, focusing on performance and disregarding availabiliy), and hey can ake ino accoun specific consrains such as limiing or fixing he degree of replicaion of paricular server ypes (eg, for cos reasons) So, o summarize, he funcionaliy of he configuraion ool comprises an enire specrum ranging from he mere analysis and assessmen of an operaional sysem all he way o providing assisance in designing a reasonable iniial sysem configuraion, and, as he ulimae sep, auomaically recommending a reconfiguraion of a running WFMS 72 Greedy Heurisics Towards a Minimum-cos Configuraion The mos far-reaching use of he configuraion ool is o ask i for he minimum-cos configuraion ha mees specified performabiliy and availabiliy goals Compuing his configuraion requires searching he space of possible configuraions, and evaluaing he ool s inernal models for each candidae configuraion While his may evenually enail full-fledged algorihms for mahemaical opimizaion such as branch-and-bound or simulaed annealing, our firs version of he ool uses a simple greedy heurisics The greedy algorihm ieraes over candidae configuraions by increasing he number of replicas of he mos criical server ype unil boh he performabiliy and he availabiliy goals are saisfied Since eiher of he wo crieria may be he criical one and because an addiional server replica improves boh merics a he same ime, he wo crieria are considered in an inerleaved manner Thus, each ieraion of he loop over candidae configuraions evaluaes he performabiliy and he availabiliy, bu adds servers o wo differen server ypes only afer reevaluaing wheher he goals are sill no me This way he algorihm avoids oversizing he sysem configuraion

15 8 Conclusion In his paper, we have developed models o derive quaniaive informaion abou he performance, availabiliy, and performabiliy of configuraions for a disribued WFMS These models form he core owards an assessmen and configuraion ool As an iniial sep owards evaluaing he viabiliy of our approach, we have defined a WFMS benchmark [7], and we are conducing measuremens of various producs and prooypes, including our own prooype coined Menor-lie, under differen configuraions These measuremens are a firs ouchsone for he accuracy of our models In addiion, we have sared implemening he configuraion ool skeched in Secion 7 This ool will be largely independen of a specific WFMS, using produc-specific subs for he ool s monioring, calibraion, and recommendaion componens We expec o have he ool ready for demonsraion by he middle of his year References [1] G Alonso, D Agrawal, A El Abbadi, C Mohan, Funcionaliy and Limiaions of Curren Workflow Managemen Sysems, IEEE Exper Vol12 No 5, 1997 [2] T Bauer, P Dadam, A Disribued Execuion Environmen for Large-Scale Workflow Managemen Sysems wih Subnes and Server Migraion, IFCIS Conf on Cooperaive Informaion Sysems (CoopIS), Charleson, Souh Carolina, 1997 [3] T Bauer, P Dadam, Disribuion Models for Workflow Managemen Sysems - Classificaion and Simulaion (in German), Technical Repor, Universiy of Ulm, Germany, 1999 [4] A Cichocki, A Helal, M Rusinkiewicz, D Woelk, Workflow and Process Auomaion, Kluwer Academic Publishers, 1998 [5] A Dogac, L Kalinichenko, M Tamer Ozsu, A Sheh (Eds), Workflow Managemen Sysems and Ineroperabiliy, NATO Advanced Sudy Insiue, Springer-Verlag, 1998 [6] D Georgakopoulos, M Hornick, A Sheh, An Overview of Workflow Managemen: From Process Modeling o Workflow Auomaion Infrasrucure, Disribued and Parallel Daabases Vol 3 No 2, 1995 [7] M Gillmann, P Muh, G Weikum, J Weissenfels, Benchmarking of Workflow Managemen Sysems (in German), German Conf on Daabase Sysems in Office, Engineering, and Scienific Applicaions, Freiburg, Germany, 1999 [8] J Gray, A Reuer, Transacion Processing Conceps and Techniques, Morgan Kaufmann, 1993 [9] C Hagen, G Alonso, Backup and Process Migraion Mechanisms in Process Suppor Sysems, Technical Repor, Swiss Federal Insiue of Technology (ETH), Zurich, Swizerland, 1998 [10] D Harel, Sae Chars: A Visual Formalism for Complex Sysems, Science of Compuer Programming Vol 8, 1987 [11] D Harel, E Gery, Execuable Objec Modeling wih Saechars, IEEE Compuer Vol30 No7, 1997 [12] S Jablonski, C Bussler, Workflow Managemen, Modeling Conceps, Archiecure, and Implemenaion, Inernaional Thomson Compuer Press, 1996 [13] J Klingemann, J Waesch, K Aberer, Deriving Service Models in Cross-Organizaional Workflows, In l Workshop on Reasearch Issues in Daa Engineering (RIDE), Sydney, Ausralia, 1999 [14] M Kamah, G Alonso, R Günhör, C Mohan, Providing High Availabiliy in Very Large Workflow Managemen Sysems, In'l Conf on Exending Daabase Technology (EDBT), Avignon, France, 1996 [15] C Mohan, Workflow Managemen in he Inerne Age, Tuorial, hp://www-rodininriafr/mohan [16] P Muh, D Wodke, J Weissenfels, G Weikum, A Koz Dirich, Enerprise-wide Workflow Managemen based on Sae and Aciviy Chars, in [5] [17] R Nelson, Probabiliy, Sochasic Processes, and Queueing Theory, Springer-Verlag, 1995 [18] H Schuser, J Neeb, R Schamburger, A Configuraion Managemen Approach for Large Workflow Managemen Sysems, In'l Join Conf on Work Aciviies Coordinaion and Collaboraion (WACC), San Francisco, California, 1999 [19] R A Sahner, K S Trivedi, A Puliafio, Performance and Reliabiliy Analysis of Compuer Sysems, Kluwer Academic Publishers, 1996 [20] HC Tijms, Sochasic Models, John Wiley and Sons, 1994 [21] Transacion Processing Performance Council, hp://wwwpcorg/ [22] Unified Modeling Language (UML) Version 11, hp://wwwraionalcom/uml/ [23] Workflow Managemen Coaliion, hp://wwwwfmcorg/ [24] D Wodke, G Weikum, A Formal Foundaion For Disribued Workflow Execuion Based on Sae Chars, In l Conf on Daabase Theory (ICDT), Delphi, Greece, 1997