Synchronizability of Conversations Among Web Services

Transcription

1 1 Synchronizbility of Converstions Among Web Services Xing Fu, Tevfik Bultn, Jinwen Su Abstrct We present frmework for nlyzing interctions mong web services tht communicte with synchronous messges. We model the interctions mong the peers prticipting to composite web service s converstions, the globl sequences of messges exchnged mong the peers. This nturlly leds to the following model checking problem: given n LTL property nd composite web service, do the converstions generted by the composite web service stisfy the property? We show tht synchronous messging leds to stte spce explosion for bounded messge queues nd undecidbility of the model checking problem for unbounded messge queues. We propose technique clled synchronizbility nlysis to tckle this problem. If composite web service is synchronizble, its converstion set remins the sme when synchronous communiction is replced with synchronous communiction. We give set of sufficient conditions tht gurntee synchronizbility nd tht cn be checked stticlly. Bsed on our synchronizbility results, we show tht lrge clss of composite web services with unbounded messge queues cn be verified completely using finite stte model checker such s Spin. We lso show tht synchronizbility nlysis cn be used to check relizbility of top-down converstion specifictions nd we contrst the converstion model with the messge sequence chrts. We integrted synchronizbility nlysis to tool we developed for nlyzing composite web services. Index Terms web services, synchronous communiction, converstions, model checking, verifiction, synchronizbility, relizbility I. INTRODUCTION Browser-bsed web ccessible softwre systems hve been extremely successful in electronic commerce, especilly for business-to-consumer pplictions. However, the difficulty of integrting business processes cross heterogeneous pltforms hs been mjor hurdle in extending this success to business-to-business pplictions. Web services ddress this problem by providing frmework for integrtion nd interoperbility of web ccessible softwre pplictions regrdless of implementtion pltforms nd cross boundries of business entities [3], [13], [27], [33]. Since communicting web services cn be deployed on different loctions using different implementtion pltforms, greeing on set of stndrds for dt trnsmission nd service descriptions is clerly very importnt. Fig. 1 displys collection of most frequently used stndrds for web services where Extensible Mrkup Lnguge (XML) [12] forms the foundtion. Web services interct with ech other by exchnging messges in the XML formt. XML Schem [44] provides the type system for XML messges nd Simple Object Access Protocol (SOAP) [38] is stndrd communiction protocol for trnsmitting XML messges. Ech web service hs to publish its invoction interfce, e.g., network ddress, ports, functions provided, nd the expected XML messge formt to invoke the service, using the Web Services Description Lnguge (WSDL) [43]. Although WSDL specifiction defines the public interfce of web service, it does not provide ny informtion bout its behvior. Behviorl descriptions of web services re defined using higher level stndrds such s Business Process Execution Lnguge for Web Services (BPEL) [7]. BPEL specifictions cn be used to define behviorl interfces of web services. The Web Service Choreogrphy Description Lnguge (WS-CDL) [42] is used to specify the interctions mong multiple web services. The specifictions of web services re registered in Universl Description, Discovery nd Integrtion (UDDI) [40] registry, which llows registered web services to be discovered by other services. Web service development bsed on these stndrds is supported by different implementtion pltforms such s.net [29] This work is supported in prt by NSF grnts CCR , IIS , nd IIS X. Fu is with the Georgi Southwestern Stte University. T. Bultn nd J. Su re with the University of Cliforni, Snt Brbr. Emil: xfu@cnes.gsw.edu, {bultn,su}@cs.ucsb.edu

2 2 Web Service Stndrds Registrtion Interction Behvior Interfce Messge Type Dt UDDI WS-CDL BPEL WSDL SOAP XML Schem XML Microsoft.Net, Sun J2EE Implementtion Pltforms Fig. 1. Web Service Stndrds nd J2EE [41]. The use of stndrdized protocols llows utomtic discovery, invoction nd composition of web services regrdless of the implementtion pltforms nd progrmming lnguges used during their development. Web services re essentilly loosely coupled distributed systems. The loose coupling is prtly chieved by the use of stndrdized interfces nd dt formts mentioned bove. Another fctor in chieving loose coupling is synchronous communiction during messge exchnge, the sender nd the receiver do not hve to synchronize the send nd receive ctions. In synchronous communiction messge is stored in the messge buffer (usully FIFO queue) of its receiver until it is consumed nd processed. Asynchronous communiction is necessry for building robust web services [6]. It prevents the sending service getting stuck during send opertion due to puses in vilbility of the receiving service or slow dt trnsmission through the Internet. Asynchronous messging is supported by messge delivery pltforms such s Jv Messge Service (JMS) [25] nd Microsoft Messge Queuing Service (MSMQ) [32]. The future success of web services frmework will prtly depend on the fesibility of constructing highly dependble services. For criticl business pplictions, ny design error during web service development cn cuse potentilly gret finncil losses, nd d-hoc repirs fter filures re not cceptble. It is desirble to stticlly ensure the correctness of web services before they re deployed. In this pper we investigte modeling nd verifiction of interctions mong web services. Our gol is to utomticlly verify properties of interctions mong web services bsed on their behviorl descriptions. There re severl chllenges tht need to be ddressed to chieve this gol. First, we hve to decide on how to chrcterize the interctions of web service compositions. For exmple, should both send nd receive events be modeled? We need to resolve such questions in order to construct forml model for interctions of web services. Another chllenge is the hndling of synchronous messges. As we mentioned bove, synchronous communiction is one of the dvntges of the web service technology over trditionl tightly coupled systems. However, synchronous communiction mkes most verifiction nd nlysis problems bout web services undecidble. In this pper we tckle these chllenges s follows: (1) We model the interctions mong web services s converstions. A converstion is sequence of send events recorded in the order they re sent. Liner Temporl Logic (LTL) cn be nturlly extended to specify desired properties on converstions. (2) We present set of synchronizbility conditions. When these conditions re stisfied by set of web services, i.e., when set of web services re synchronizble, they generte the sme set of converstions under both synchronous nd synchronous communiction semntics. Assuming tht the behviorl descriptions of web services re specified s finite stte mchines, we show tht verifiction of LTL properties of converstions of synchronizble web services cn be performed using existing finite stte model checkers. We show tht the synchronizbility nlysis is relted to relizbility nlysis of converstion protocols [16]. A converstion protocol is top-down specifiction which specifies the desired converstion set for set of web services without describing the behviors of individul services. We show tht the synchronizbility conditions cn be used to show the relizbility of converstion protocols when they re combined with one dditionl condition. We built tool clled Web Service Anlysis Tool (WSAT) which implements the nlysis techniques presented in this pper. WSAT supports both bottom-up nd top-down specifictions. The front-end of WSAT trnsltes web service specifictions written in BPEL nd WSDL to n internl stte mchine representtion. The synchronizbility nd relizbility nlyses re performed on this stte mchine representtion. The bck-end of WSAT trnsltes its internl stte mchine representtion to Promel, the input lnguge of the Spin model checker [22], [23]. We use

3 3 Converstion Schem msg1 msg4 Peer A Peer B Peer C msg2, msg3, msg6 msg5 Converstion Protocol A B:msg1 B A:msg2 B C:msg3 B C:msg5 C B:msg4 B A:msg6 LTL property? G(msg1 F(msg5)) Peer A!msg1?msg2?msg6 Peer B!msg3?msg4?msg1!msg2!msg5!msg6 Peer C?msg3!msg4?msg5 Input Queue Converstion...? G(msg1 F(msg5)) LTL property Fig. 2. A Simple Exmple Demonstrting Our Model Spin s bck-end model checker to verify LTL properties of converstions. The rest of the pper is orgnized s follows. Section II introduces model for web service compositions nd their interctions. Section III presents the synchronizbility nlysis for bottom-up specifictions. Section IV presents the relizbility nlysis for top-down specifictions, nd discusses the reltionship between the synchronizbility nd relizbility nlyses. Section V presents the WSAT tool nd some experimentl results. Section VI discusses the relted work, nd presents the comprison with Messge Sequence Chrts. Section VII concludes the pper. II. MODELING INTERACTIONS OF ASYNCHRONOUSLY COMMUNICATING WEB SERVICES In this section we present forml model for intercting web services [9], [15], [16]. A web service composition is closed system where finite set of intercting (individul) web services, clled peers, communicte with ech other vi synchronous messging. We consider the problem of how to chrcterize the interctions mong peers prticipting in web service composition, s well s how to reson bout the correctness of these interctions. We will first introduce the notion of composition schem, which specifies the sttic interconnection pttern of web service composition. Then we discuss the specifiction of ech peer, i.e., ech prticipnt of web service composition. Next we discuss how to chrcterize the interctions mong the peers, nd introduce the notion of converstion. We present some theoreticl observtions on converstion sets, which motivtes the synchronizbility nlysis presented in the next section. A. Composition Architecture Fig. 2 shows simple exmple demonstrting our model. The top prt of Fig. 2 shows composition schem. A composition schem specifies the set of peers nd the set of messges exchnged mong the peers. The middle prt of Fig. 2 (lbeled converstion protocol) shows top-down specifiction for the interctions mong the peers. We will discuss the top-down specifiction pproch lter in section IV. In this section we will focus on the bottom-up specifiction model shown t the bottom of Fig. 2. In the bottom-up model we re interested in nlyzing the interctions of set of peer implementtions. Ech peer implementtion describes the control flow of peer. Since peers communicte with synchronous messges, ech peer is equipped with FIFO queue to store incoming messges. A converstion is the sequence of messges exchnged mong the peers during n execution, recorded in the order they re sent. A converstion cn be regrded s lineriztion of the messge events, similr to the pproch used in defining the semntics of Messge Sequence Chrts [31] in [5]. We now formlize the bove descriptions with the definitions below.

4 4 Definition 2.1: A composition schem is tuple (P, M) where P = {p 1,..., p n } is the set of peer prototypes, nd M is the set of messges. Ech peer prototype p i = (Mi in, Mi out ) is pir of disjoint sets of messges (Mi in Mi out = ), where Mi in is the set of incoming messges (the input lphbet), Mi out is the set of outgoing messges (the output lphbet), nd M i = Mi in Mi out is the lphbet of p i. If i j then Mi in Mj in = Mi out Mj out =. M stisfies the following: i [1..n] M in i = i [1..n] The bove definition implies tht ech messge hs unique sender nd unique receiver, nd peer cnnot send messge bck to itself. Now, using the composition schem, we cn define web service compositions s follows. Definition 2.2: A web service composition is tuple W = (P, M), A 1,..., A n, where (P, M) is composition schem, n = P, nd ech A i is the peer implementtion (or simply peer) for the corresponding peer prototype p i = (Mi in, Mi out ) P. The lphbet of A i is M i = Mi in Mi out. The bove definition is generl in the sense tht it does not restrict the expressive power of peer implementtions. However, in this pper, we focus on the web service compositions whose peers re specified using Finite Stte Automt (FSA). B. Peers The bottom prt of Fig. 2 presents the peer implementtions for the peer prototypes shown t the top. Note tht, in order to model synchronous communiction, ech peer is equipped with FIFO queue to store incoming messges. Formlly, peer implementtion is defined s follows. Definition 2.3: Let S = (P, M) be composition schem nd p i = (Mi in, Mi out ) P be peer prototype. A peer A i which implements p i is nondeterministic FSA A i = (M i, T i, s i, F i, δ i ) where M i = Mi in Mi out, T i is the finite set of sttes, s i T is the initil stte, F i T is the set of finl sttes, nd δ i T i (M i {ɛ}) T i is the trnsition reltion. A trnsition τ δ i cn be one of the following three types: (1) send-trnsition of the form (t 1,!m 1, t 2 ) which sends out messge m 1 Mi out, (2) receive-trnsition of the form (t 1,?m 2, t 2 ) which consumes messge m 2 Mi in from its input queue, nd (3) n ɛ-trnsition of the form (t 1, ɛ, t 2 ). C. Converstions Below we will formlize the notion of converstions to model the interctions mong peers in web service composition [9], [16]. Let W = (P, M), A 1,..., A n be web service composition. A globl configurtion (or simply configurtion) is (2n)-tuple of the form (Q 1, t 1,..., Q n, t n ) where for ech j [1..n], Q j (Mj in), t j T j. Here t i, Q i denote the locl stte nd the queue contents of peer A i respectively. Let the set of sttes, trnsition reltion, etc. of peer A i be ll lbeled with subscript i, e.g., δ i is the trnsition reltion of peer A i. For two configurtions c = (Q 1, t 1,..., Q n, t n ) nd c = (Q 1, t 1,..., Q n, t n ), we sy tht c derives c, written s c c, if one of the following three conditions hold: M out i One peer executes send ction (denoted s c!m c ), i.e., there exist 1 i, j n nd m Mi out tht: 1) (t i,!m, t i ) δ i, 2) Q j = Q jm, 3) Q k = Q k for ech k j, nd 4) t k = t k for ech k i. One peer executes receive ction (denoted s c?m c ), i.e., there exists 1 i n nd m Mi in 1) (t i,?m, t i ) δ i, 2) Q i = mq i, 3) Q k = Q k for ech k i, nd 4) t k = t k for ech k i. One peer executes n ɛ-ction (denoted s c ɛ c ), i.e., there exists 1 i n such tht: 1) (t i, ɛ, t i ) δ i, 2) Q k = Q k for ech k [1..n], nd = M M in j such such tht:

5 5 3) t k = t k for ech k i. Consider the definition of the receive ction. Intuitively, the bove definition sys tht the peer A i executes receive ction if there is messge t the hed of its queue nd corresponding receive trnsition in its trnsition reltion from its current stte. After the receive is executed, the received messge is removed from the queue of A i, the queues nd locl sttes of other peers remin the sme, nd the locl stte of A i is updted ccordingly. The ɛ-ction (where peer tkes n ɛ-trnsition) nd the send ction (where peer tkes send trnsition) re defined similrly. Now we cn define the runs of web service composition s follows: Definition 2.4: Let W = (P, M), A 1,..., A n be web service composition, sequence of configurtions γ = c 0 c 1... c k is prtil run of W if it stisfies the first two of the following three conditions, nd γ is (complete) run if it stisfies ll the three conditions: 1) The configurtion c 0 = (ɛ, s 1,..., ɛ, s n ) is the initil configurtion where s i is the initil stte of A i for ech i [1..n], nd ɛ is the empty word. 2) For ech j [0..k 1], c j c j+1. 3) The configurtion c k = (ɛ, t 1,..., ɛ, t n ) is finl configurtion where t i is finl stte of A i for ech i [1..n]. Now we define the send sequences nd the converstions s follows: Definition 2.5: Given prtil or complete run γ the send sequence generted by γ, denoted by ss(γ), is defined recursively s follows: If γ 1, then ss(γ) is the empty sequence. If γ = γ cc, then ss(γ) = ss(γ c)m if c!m c, ss(γ) = ss(γ c) otherwise. A word w over M (w M ) is converstion of web service composition W if there exists complete run γ such tht w = ss(γ), i.e., converstion is the send sequence generted by complete run. The converstion set of the web service composition W, written s C(W), is the set of ll converstions for W. For exmple, the converstion set of the web service composition in Fig. 2 cn be cptured by the regulr expression: msg1 msg2 (msg3 msg4) msg5 msg6 Given web service composition, one interesting problem is to check if its converstions stisfy n LTL property. The semntics of LTL formuls cn be nturlly dpted to converstions by defining the set of tomic propositions s the power set of messges, i.e., 2 M. Stndrd LTL semntics is defined on infinite sequences [11] wheres we focus on finite converstions. We cn dopt the stndrd LTL semntics to converstions by extending ech converstion to n infinite string by dding n infinite suffix which is the repetition of specil termintion symbol. For exmple, the composition in Fig. 2 stisfies the LTL property: G(msg1 F(msg5)), where G nd F re temporl opertors which men globlly nd eventully, respectively. Notice tht, due to the queue effects, not ll web service compositions produce regulr converstion sets like the exmple in Fig 2. In fct, converstions of web service composition could be very difficult to nlyze s demonstrted by the following negtive result bout the LTL verifiction of converstions of web service compositions [16]: Theorem 2.1: Given web service composition W nd n LTL property φ, determining if ll the converstions of W stisfy the LTL property φ is undecidble. The web service composition model we described bove is essentilly system of Communicting Finite Stte Mchines (CFSM) nd it is known tht CFSMs cn simulte Turing Mchines [8]. Similrly, one cn show tht, given Turing Mchine T M it is possible to construct web service composition W tht simultes T M nd exchnges specil messge (sy m t ) once T M termintes. Thus T M termintes if nd only if the converstions of W stisfy the LTL formul F(m t ), which mens tht eventully messge m t will be sent. Hence, undecidbility of the hlting problem implies tht verifiction of LTL properties of converstions of web service composition is n undecidble problem. III. BOTTOM-UP APPROACH AND SYNCHRONIZABILITY The undecidbility of LTL verifiction for web service compositions is cused by the synchronous communiction. Notice tht if synchronous communiction is used insted, the set of configurtions of web service

6 6 requester!e? 1? 2!r 1!r 2!e? 1? 2!r 1!r 2!r 1!e?!r!r 2 r 1,r 2,e 1, 2 r 1,r 2,e 1, 2 r,r 1,r 2,e server! 1! 2?r 1?r 2?e! 1! 2?r 1?r 2?e?r!?r 1?e?r 2 Composition 1 Composition 2 Composition 3 Fig. 3. Three Motivting Exmples composition would be finite set, nd it is well-known tht LTL model checking is decidble for finite stte systems. In this section we present technique clled synchronizbility nlysis which identifies web service compositions tht generte the sme converstion set with synchronous nd synchronous communiction semntics. We cll such web service compositions synchronizble. We cn verify synchronizble web service compositions using the synchronous communiction semntics, nd the verifiction results we obtin will hold for the synchronous communiction semntics. We strt with three motivting exmples, nd then we introduce the technicl results for the synchronizbility nlysis. A. Motivting Exmples Consider the three web service compositions shown in Fig. 3. Ech composition consists of two peers: requester nd server. For ech request messge (r i ) the server will respond with corresponding cknowledgment messge ( i ). However the consumption of the cknowledgments t the requester my not be immedite (e.g. in Composition 1). Finlly the end messge (e) concludes the interction between the requester nd the server. Assume tht we wnt to use the finite stte model checker Spin to verify the properties of the exmples shown in Fig. 3. In order to trnslte these exmples to Promel (the input lnguge of the Spin model checker) we need to bound the sizes of the input queues (communiction chnnels in Promel), since Spin is finite stte model checker. In fct, bsed on the undecidbility of LTL verifiction we discussed bove, it is impossible to verify the behviors of web service compositions with unbounded queues utomticlly. In generl, best we cn do is prtil verifiction, i.e., to verify the behviors of web service composition using queues with fixed length. Note tht the bsence of errors using such n pproch does not gurntee tht the web service composition is correct. Interestingly, in this section we will show tht, Compositions 2 nd 3 shown in Fig. 3 re different thn Composition 1, in tht the properties of Compositions 2 nd 3 cn in fct be verified for unbounded messge queues, wheres for Composition 1 we cn only chieve prtil verifiction. First, note tht in Composition 1 the requester cn send n rbitrry number of messges before the server strts consuming them. Due to this queuing effect, the converstion set of Composition 1 is not regulr set [9]. Actully it is subset of (r 1 r ) e where the number of r i nd i messges re equl nd in ny prefix the number of r i messges is greter thn or equl to the number of i messges. Hence, it is not surprising tht we cnnot mp the behvior of Composition 1 to finite stte process. Another problem with Composition 1 is the fct tht its stte spce (i.e., rechble configurtions) increses exponentilly with the sizes of the input queues. Hence, even prtil verifiction for lrge queue sizes becomes intrctble. In Composition 2 the requester nd server processes move in lock-step fshion, nd it is esy to see tht the converstions generted by Composition 2 is (r 1 1 r 2 2 ) e, i.e., regulr set. In fct, the web service composition described in Composition 2 hs finite set of rechble sttes. During ny execution of Composition 2, t ny stte, there is t most one messge in ech queue. Bsed on the results we will present in this section, we cn

7 7 stticlly conclude tht properties of Composition 2 cn be verified using synchronous communiction (in other words, using input queues of size 0). Unlike Composition 2, Composition 3 hs n infinite stte spce s Composition 1. In other words, the number of messges in the input queues for Composition 3 is not bounded. Similr to Composition 1, the stte spce of Composition 3 lso increses exponentilly with the sizes of the queues. However, unlike Composition 1, the converstion set of Composition 3 is regulr. Although Composition 3 hs n infinite stte spce, we will show tht the properties of Composition 3 cn lso be verified for rbitrry queue sizes using finite stte verifiction techniques. Sttes 3.5e+06 3e e+06 2e e+06 1e Exmple 1 Exmple 2 Exmple Queue Size Fig. 4. Increse in the Stte Spce with respect to the Queue Size We cn experimentlly demonstrte how stte spces of the exmples in Fig. 3 chnge with the incresing queue sizes. In Fig. 4 we show the sizes of the rechble stte spces of the exmples in Fig. 3 computed using the Spin model checker for different input queue sizes. The x-xis of the figure shows the size of the input queues, nd y-xis shows the number of rechble sttes computed by Spin. As shown in the figure, the stte spce of Composition 2 is fixed (lwys 43 sttes), however the stte spces of Compositions 1 nd 3 increse exponentilly with the queue size. Below we will show tht we cn verify properties of Compositions 2 nd 3 for rbitrry queue sizes, lthough best we cn do for Composition 1 is prtil verifiction. In prticulr, we will show tht the communiction mong peers for Compositions 2 nd 3 re synchronizble nd we cn verify their properties using synchronous communiction nd gurntee tht the verified properties hold for synchronous communiction with unbounded queues. B. Synchronous Communiction To further explore the differences of Compositions 2 nd 3 from Composition 1, we define n lterntive synchronous semntics for web service compositions different thn the one given in Section II. Intuitively, the synchronous semntics dicttes tht the sending nd receiving peers tke the send nd receive ctions concurrently. Therefore, there is no need to hve the input messge queues. Recll tht web service composition W is tuple W = (P, M), A 1,..., A n where ech utomton A i describes the behvior of peer. The configurtion of web service composition with respect to the synchronous semntics, clled the syn-configurtion, is tuple (t 1,..., t n ), where for ech j [1..n], t j T j is the locl stte of peer A j. For two syn-configurtions c = (t 1,..., t n ) nd c = (t 1,..., t n), we sy tht c derives c, written s c syn c, if one of the following two conditions hold: Two peers execute send ction (denoted s c m syn c ), i.e., there exist 1 i, j n nd m Mi out such tht: 1) (t i,!m, t i ) δ i, 2) (t j,?m, t j ) δ j, 3) t k = t k for ech k i nd k j. One peer executes n ɛ-ction (denoted s c ɛ syn c ), i.e., there exists 1 i n such tht: 1) (t i, ɛ, t i ) δ i, M in j

8 8 2) t k = t k for ech k i. The definition of the derivtion reltion between two syn-configurtions is different thn the synchronous cse so tht send ction cn only be executed concurrently with mtching receive ction, i.e., sending nd receiving of messge occur synchronously. We cll this semntics the synchronous semntics for web service composition nd the semntics defined in Section II is clled the synchronous semntics. The definitions of run, prtil run, send sequence nd converstion for synchronous semntics is similr to those of the synchronous semntics given in Section II (we will use syn s prefix to distinguish between the synchronous nd synchronous versions of these definitions when it is not cler from the context). Given web service composition W, let C syn (W) denote the converstion set under the synchronous semntics. Then synchronizbility is defined s follows: Definition 3.1: A web service composition W is synchronizble if its converstion set remins the sme when the synchronous semntics is used insted of the synchronous semntics, i.e., C(W) = C syn (W). Clerly, if web service composition is synchronizble, then we cn verify its interction behvior using synchronous semntics (without ny input queues) nd the results of the verifiction will hold for the behviors of the web service composition in the presence of synchronous communiction with unbounded queues. Below we will give sufficient conditions for synchronizbility. Bsed on these conditions, we cn show tht Compositions 2 nd 3 in Fig. 3 re indeed synchronizble. However, before giving the sufficient conditions for synchronizbility, we would like to show the following property: Theorem 3.1: Given web service composition W its converstion set with respect to synchronous semntics is subset of its converstion set with respect to synchronous semntics, i.e., C syn (W) C(W). Proof: We will show tht for ech syn-send-sequence generted by web service composition with synchronous semntics, there exists run with synchronous semntics which genertes the sme send-sequence. The ide is to simulte the execution of web service composition with synchronous semntics using synchronous semntics. Given syn-send-sequence, consider syn-run tht genertes tht sequence. Now, we cn construct run for the synchronous semntics where ech send ction in the syn-run is replced with the sme send ction immeditely followed by the corresponding receive ction for tht messge nd ɛ-ctions re left s they re. It is esy to show tht such run exists bsed on the derivtion reltions of the synchronous nd synchronous semntics. In this constructed run ech messge is received immeditely fter it is sent, i.e., t ny given time during the execution there is t most one messge queue tht is not empty nd there is t most one messge in it. We cll such run, run with immedite receives. Note tht, the send-sequence generted by the constructed run is sme s the syn-send-sequence. Hence, every converstion generted by the synchronous semntics is lso generted by the synchronous semntics. It is esy to show tht the converse of the bove property does not hold. For exmple, consider web service composition of two peers A nd B, which cn exchnge two messges m 1 (from A to B) nd m 2 (from B to A). The implementtion of A ccepts one word!m 1?m 2 nd the implementtion of B ccepts one word!m 2?m 1. Obviously, if synchronous semntics is used there exists run which genertes the converstion m 1 m 2. However, note tht, when synchronous semntics is used there is no run which genertes the sme converstion. In fct, there is no run with immedite receives for the synchronous semntics which genertes the converstion m 1 m 2. Note tht in ny run which genertes the converstion m 1 m 2, when B sends out m 2, the messge m 1 is in B s input queue nd is not received immeditely. In the following we will give conditions which, when they hold, gurntee tht for ny converstion generted with the synchronous semntics there exists run with immedite receives which genertes the sme converstion. C. Synchronizbility Anlysis We propose two sufficient conditions for synchronizbility which cn be used in identifying synchronizble web service compositions. Synchronous comptible condition: This condition requires tht in ech syn-configurtion of the web service composition tht is rechble from the initil stte bsed on the synchronous semntics, if there is peer which hs send trnsition for messge m from its locl stte in tht configurtion, then the receiver for tht messge should hve receive trnsition for tht messge either from its locl stte in tht configurtion or from configurtion rechble from tht configurtion vi ɛ-ctions. Below we give n lgorithm for checking the synchronous comptible condition:

9 9 Procedure issynchronouscomptible(w = (P, M), A 1,..., A n ) 1. Let CS = {c} where c is the initil syn-configurtion of W which is tuple c = (t 1,..., t n ) where for ech i [1, n] t i is initil stte of A i. 2. Until there re no more configurtions to dd to CS, do the following: 3. If there re syn-configurtions c, c s.t. c CS, c CS nd c syn c, 4. then dd c to CS. 5. For every syn-configurtion c CS where c = (t 1,..., t n ), do the following: 6. Let ɛ-closure(c) be the set of configurtions tht re rechble from c vi ɛ-ctions. 7. If there re two peers p i nd p j nd messge m Mi out Mj in s.t. there is send trnsition of p i which origintes from t i nd sends m, however, for ech c in ɛ-closure(c) there is no c in CS s.t. c m syn c. 8. c is illegl, return flse. 9. Return true if no illegl stte is found in CS. The bsic ide of the bove lgorithm is to construct the product (i.e., the synchronous composition) of ll peers. Ech stte (i.e., syn-configurtion) of the product is vector of locl sttes of ll peers. During the construction, if we find peer redy to send messge but the corresponding receiver is not redy to receive it (either immeditely or fter executing severl ɛ-ctions), the composition is identified s not synchronous comptible. When ll sttes of the product hve been exmined, the lgorithm returns true. The complexity of the lgorithm is qudrtic on the size of the product nd the size of the product is exponentil in the number of peers. Using the bove lgorithm we cn show tht Compositions 2 nd 3 in Fig. 3 stisfy the synchronous comptible condition, however, Composition 1 does not. Strting from the initil syn-configurtion of Composition 1, we cn go to nother syn-configurtion fter the requester sends nd the server receives r 1 (concurrently). Now in this new configurtion the requester hs trnsition to send out nother r 1, however, the server is in locl stte where it cn send 1 but does not hve trnsition to receive r 1. Hence Composition 1 in Fig. 3 does not stisfy the synchronous comptible condition. Autonomous condition: A web service composition is utonomous if ech peer, t ny moment, cn do only one of the following 1) terminte, 2) send messge, or 3) receive messge. Notice tht the utonomous condition llows peer the choice of sending one of mny messges. However, utonomous condition does not permit choice between send nd receive ctions. The following lgorithm checks the utonomous condition: Procedure isautonomous( (P, M), A 1,..., A n ) 1. For ech A i do the following: 2. Determinize A i nd remove ll the ɛ-trnsitions. 3. For ech stte t in A i do the following: 4. Return flse if there re both send nd receive trnsitions originting from t. 5. Return flse if there is trnsition originting from t nd t is finl stte. 6. Return true if ech stte of ech peer psses the bove check. To check the utonomous condition we determinize ech peer implementtion nd check tht out-going trnsitions for ech non-finl stte re either ll send trnsitions or ll receive trnsitions. We lso check tht finl sttes hve no out-going trnsitions. The complexity of the lgorithm cn be exponentil in the size of the peers due to the determiniztion. Using the bove lgorithm we cn show tht Composition 2 nd 3 in Fig. 3 re utonomous. However, Composition 1 is not utonomous becuse in the initil stte requester cn either send r 1 or r 2 or receive 1 or 2. We now present the key result concerning the synchronizbility nlysis. Note tht the property nd the discussion below is with respect to synchronous semntics. Theorem 3.2: Let W = (P, M), A 1,..., A n be web service composition. If W is synchronous comptible nd utonomous, then for ny converstion generted by W there exists run with immedite receives which genertes the sme converstion. Proof: We will prove this property by induction on the number of sends in converstion. We will ctully prove the following property which implies the property bove: Let w = m 0 m 1... m w 1 be converstion generted by synchronous comptible nd utonomous web service composition, then, for ll n such tht 0 n w, there exists run which genertes the sme converstion in which the first n sends re immeditely received (i.e., between the send nd receive ctions of the first n messges there re no other ctions). Bse Cse: For n = 0 the property holds vcuously.

10 10 Inductive Step: Now we will ssume tht for n, 0 n < w there exists run γ which genertes the converstion w in which the first n sends re immeditely received. Assume tht the n + 1st messge in the send sequence is m n+1 Mi out Mj in. Let c be the configurtion in γ right before m n+1 is sent, we now prove tht during γ, the first non-ɛ ction tht p j tkes fter c is to receive m n+1. Since, ccording to the inductive ssumption, the first n messges in γ re immeditely received, we cn generte prtil syn-run from γ which reches the configurtion c by collpsing the consecutive send nd receive ctions for the first n messges. Let t j be the stte of p j in configurtion c. Since p i is redy to send m n+1 t c, ccording to the synchronous comptible condition, peer p j cn execute receive trnsition for the messge m n+1 from t j, or from stte rechble from t j vi ɛ-trnsitions. Since W is utonomous, from the bove sttement, we lso know tht the first non-ɛ ction tht p j cn perform fter configurtion c hs to be receive ction. Combined with the fct tht ech queue is FIFO, we cn infer tht the first ction tht p j cn execute fter configurtion c in γ is to receive m n+1. Bsed on the fcts estblished bove, we cn lter γ by 1) shifting the ɛ-ctions by peer p j tht re between the send ction for messge m n+1 nd the receive ction for messge m n+1 right before the send ction for m n+1 nd, 2) moving the receive ction for messge m n+1 right fter the send ction for m n+1, hed of ll the ctions by peers other thn p j tht re between the send ction for m n+1 nd the receive ction for m n+1. This ltered run is run of W which genertes the sme send sequence nd the first n + 1 sends in the ltered run re immeditely received. Note tht, for ech send sequence generted with run with immedite receives bsed on synchronous semntics, there exists syn-run which genertes the sme send-sequence with synchronous semntics. Such syn-run cn be obtined from the run with immedite receives by merging the consecutive send nd receive ctions. Then bsed on Theorem 3.2 we get the following result: Theorem 3.3: Let W = (P, M), A 1,..., A n be web service composition. If W is synchronous comptible nd utonomous, then W is synchronizble. Note tht if synchronous semntics is used the set of configurtions generted by collection of finite stte peers is finite. Hence, LTL verifiction with respect to synchronous semntics is finite stte model checking problem nd therefore it is decidble. For exmple, both Compositions 2 nd 3 in Fig. 3 re synchronizble wheres Composition 1 is not (it violtes the utonomous condition). Hence, we cn verify the properties of Compositions 2 nd 3 using synchronous communiction semntics (which cn be chieved in Spin by restricting the communiction chnnel lengths to 0) nd the results we obtin will hold for behviors generted using synchronous communiction with unbounded queues. Notice tht, synchronizbility does not imply dedlock freedom. Think bout the following composition of two peers A nd B, which exchnge messges m 1 (from A to B) nd m 2 (from B to A). If A ccepts one word?m 2, nd B ccepts one word?m 1, it is not hrd to verify tht the composition of A nd B is synchronizble, however, they re involved in dedlock right t the initil stte since both peers re witing for ech other. Hence, before the LTL verifiction of web service composition, designers my hve to check the composition for dedlocks. However, for synchronizble web service compositions the dedlock check cn be done using the synchronous semntics (insted of the synchronous semntics), since it is possible to show tht [20] synchronizble web service composition hs run (with synchronous semntics) tht leds to dedlock if n only if it hs syn-run (with synchronous semntics) tht leds to dedlock. IV. TOP-DOWN APPROACH AND REALIZABILITY In this section we discuss the reltionship between the top-down nd bottom-up specifiction pproches of web service compositions. In our erlier work [9], we investigted using top-down pproch in which the desired interction ptterns mong the peers re specified directly s finite stte converstion protocols nd the specifiction of the locl behviors of the individul peers re left blnk. The middle prt of Fig. 2 shows the converstion protocol for the simple web service composition we discussed in Section II. This pproch enbles the verifiction of the interction properties on finite stte converstion protocols using stndrd model checking techniques. However this top-down pproch introduces relizbility problem since converstion protocol my not be relizble by set of synchronously communicting finite stte peers [16]. Below we will formlize these concepts. Definition 4.1: Let S = (P, M) be composition schem. A converstion protocol over S is tuple R = (P, M), A where A is finite stte utomton on lphbet M. We let L(R) = L(A), i.e., the lnguge recognized

11 11 Converstion Protocol A b c b b C B c Projection to Peers?b!!b?!?b?!b!c?c peer A peer B peer C Fig. 5. Ambiguous Execution of Converstion Protocol which Genertes n Unspecified Converstion by A. The top-down specifiction pproch bsed on converstion protocols cuses the relizbility problem which is defined s follows. Definition 4.2: Let S = (P, M) be composition schem, nd let the converstion protocol R nd the web service composition W both shre the sme schem S. We sy tht W relizes R if C(W) = L(R). A converstion protocol R is relizble if there exists web service composition tht relizes R. First we look into the following question: given converstion protocol R, is it lwys possible to construct web service composition tht relizes R, i.e., re ll converstion protocols relizble? In the following we show tht the nswer is negtive. Exmple 4.1: Let (P, M) be composition schem which consists of four peers p 1, p 2, p 3 nd p 4. Its lphbet M consists of two messges, which is from p 1 to p 2, nd b, which is from p 3 to p 4. Suppose R is converstion protocol over (P, M) where L(R) = {b}. It is cler tht ny peer implementtion which genertes converstion b cn lso generte b s well, becuse there is no wy to let p 3 nd p 1 synchronize their send opertions. Hence the converstion protocol R is not relizble. A more involved exmple (dpted from the Büchi protocol exmple in [16]) is shown in Fig. 5. On the left side of the figure is the converstion protocol, nd on the right side we show its projection to ech peer. Think bout one possible execution of the web service composition shown on the right side of Fig. 5 with dshed rrows. At the beginning, peer B sends messge b to peer A, nd b is stored in the input queue of peer A. Then peer A sends messge to peer B, nd b is the current prtil converstion. Now peer B continues to execute the left pth of the protocol, consumes the in the queue; nd peer A executes the right pth of the protocol, consumes the b, nd sends out c. Eventully, non-specified converstion bc is generted, without ny of the peers noticing it. This bnorml converstion is the result of mbiguous understnding of the protocol by peers, nd the rcing between A nd B t the initil stte is the min cuse. Below we will show tht relizbility of converstion protocols cn be shown using the synchronizbility nlysis nd n extr condition. First we need to introduce notions of projections nd join which relte converstions with locl views of the peers. For composition schem (P, M) the projection of word w to the lphbet M i of the peer prototype p i, denoted by π i (w), is subsequence of w obtined by removing ll the messges which re not in M i. When the projection opertion is pplied to set of words the result is the set of words generted by ppliction of the projection opertor to ech word in the set. For composition schem (P, M) let n = P nd let L 1 M1,..., L n Mn, the join opertor is defined s follows: JOIN(L 1,..., L n ) = {w w M, i [1..n] : π i (w) L i }. Note tht, L = JOIN(L 1,..., L n ) i [1..n] : π i (L) L i. Now we cn define the lossless join condition for converstion protocols s follows: Lossless join condition: A converstion protocol R is lossless join if L(R) = JOIN(π 1 (L(R)),..., π n (L(R))), where n is the number of peers involved in the protocol. The lossless join condition requires tht converstion protocol should include ll words in the join of its projections to ll peers. The lossless join property cn be checked s follows:

12 12 Web Services BPEL (bottom-up) Front End BPEL to GA Intermedite Representtion Gurded utomt Anlysis Synchronizbility Anlysis skip success filure Bck End GA to Promel (synchronous communiction) GA to Promel (bounded queue) Verifiction Lnguges Promel Converstion Protocol (top-down) GA prser Gurded utomton Relizbility Anlysis filure success GA to Promel (single process, no communiction) Fig. 6. WSAT rchitecture Procedure islosslessjoin(r = (P, M), A ) 1. For ech peer p i : 2. Let A i be the projection of A to peer p i constructed by replcing ech trnsition tht is lbeled with messge tht is not in M i with n ɛ-trnsition. 3. Let A be the product utomton constructed by tking the product of the projections A 1,..., A n. 4. If the product utomton A is equivlent to A then return true otherwise return flse. Intuitively, the lossless join property requires tht the protocol should be relizble under synchronous communiction semntics. The bove lgorithm simply projects the converstion protocol to ech peer, nd then constructs the product of ll projections. If the resulting product is equivlent to the protocol, then the lgorithm reports tht the lossless join property is stisfied. The lgorithm cn be exponentil in the size of the converstion protocol due to the equivlence check on two nondeterministic finite stte mchines. Now we hve the following result which connects the synchronizbility nlysis nd the relizbility nlysis: Theorem 4.1: Given converstion protocol R = (P, M), A where n = P, let web service composition W = (P, M), A 1,..., A n include the determinized projections of A to ech peer, s.t. for ech i [1..n], L(A i ) = π i (L(R)), nd A i is determinized FSA. If W is synchronizble, nd R is lossless join, then R is relized by W. The proof of this property follows directly from Theorem 3.3 nd the fct tht the synchronous composition of set of peers ccepts the join of their lnguges. Theorem 4.1 shows the interesting reltionship between the synchronizbility nlysis discussed in this pper nd the relizbility nlysis introduced in [16]. In [16] three relizbility conditions were given to gurntee the relizbility of converstion protocol. Here Theorem 4.1 shows tht the relizbility of converstion protocol comes from the synchronizbility of its projections to ech peer. Therefore Theorem 4.1 is stronger result thn the relizbility results in [16]. In the lst three sections, we presented two forml models which chrcterize the top-down nd bottom-up specifiction pproches for web service compositions. These two specifiction pproches reflect the chrcteristics of different web service lnguges nd stndrds. For exmple, WSDL nd BPEL essentilly tke the bottom-up pproch. These two stndrds re used to describe the invoction signtures nd control flows of individul web services where ech individul web service cn be composed of set of tomic web services. On the other hnd, WS-CDL is bsed on top-down specifiction pproch nd is used to specify the public interction contrcts tht should be followed by ll prticipnts involved in web service composition. Our reserch presents formliztion of these two different pproches nd revel severl semntics nd nlysis issues tht should be known by the web service designers. In the bottom-up pproch the use of synchronous communiction cn cuse unexpected behviors nd leds to undecidbility of verifiction. In the top-down pproch some globl behvior specifictions my not be relizble by set of distributed peers. Our results on synchronizbility nd relizbility cn be used to ddress these problems. For bottom-up specifictions, if the peers stisfy the two synchronizbility conditions, the composition is gurnteed to be finite stte system nd hence cn be nlyzed utomticlly. For top-down specifiction, if the three relizbility conditions re stisfied, the specifiction is gurnteed to be relized by its projections to ech peer. V. WEB SERVICE ANALYSIS TOOL In this section we briefly discuss the Web Service Anlysis Tool (WSAT) [19] which implements the synchronizbility nd relizbility nlyses discussed bove. We lso present experimentl results bout the synchronizbility nd relizbility nlyses of 12 web service composition exmples. Fig. 6 shows the rchitecture of WSAT. WSAT uses n intermedite representtion clled Gurded Automt (GA) for web services. A GA is finite stte mchine which sends nd receives XML messges nd hs finite

13 13 number of XML vribles. The types of XML messges nd vribles re defined using XML Schem. In the GA representtion used by WSAT ll the vrible nd messge types re bounded. Ech send trnsition cn hve gurd, which is essentilly n ssignment tht determines the contents of the messge being sent. Ech receive trnsition cn lso hve gurd if the messge being received does not stisfy the gurd, the receive ction is blocked. The GA representtion is cpble of cpturing both the control flow nd dt mnipultion semntics of web services. WSAT includes trnsltor from BPEL to GA tht supports bottom-up specifiction of web service compositions. It lso includes trnsltor from top-down converstion protocol specifictions to GA. Support for other lnguges cn be dded to WSAT by integrting new trnsltors to its front end without chnging the nlysis nd the verifiction modules. We implemented the synchronizbility nd relizbility nlyses in WSAT. When the nlysis succeeds, LTL verifiction cn be performed using the synchronous communiction semntics insted of synchronous communiction semntics. WSAT lso implements extensions to the synchronizbility nd relizbility nlyses to hndle the gurds of the trnsitions in the GA model [18]. We developed nd implemented lgorithms for trnslting XPth expressions to Promel code [17], nd we use the model checker Spin [22], [23] t the bck-end of WSAT to check LTL properties. A. Experimentl Results We pplied WSAT to rnge of exmples, including six converstion protocols converted from the IBM Converstion Support Project [24], five BPEL services from BPEL stndrd nd Collx.com, nd the SAS exmple from [17]. We pplied either the synchronizbility nlysis or the relizbility nlysis to ech exmple, depending on whether the specifiction is bottom-up or top-down. Our intent ws to exmine the pplicbility of the sufficient conditions for synchronizbility nd relizbility nlyses to relistic exmples. We believe tht the set of web service specifictions we collected represent diverse set of relistic pplictions. The informtion nd the synchronizbility/relizbility nlyses results for these exmples re shown in Fig. 7. Other issues relting to LTL verifiction of web service compositions (e.g., trnsltion of input specifictions to intermedite gurded utomt representtions, hndling of XML dt nd XPth semntics, using SPIN s bck-end model checker) re out of the scope of this rticle nd re discussed in [15], [17], [19]. Source ISSTA 04 IBM Conv. Support Project Collx. com Problem Set BPEL spec Nme SAS CvSetup MetConv Cht Buy Hggle AMAB shipping Lon Auction StrLon Auction #msg Size #sttes #trns Pss no no S-Anlysis/ R-Anlysis R R R R R R R S S S S S Fig. 7. WSAT experimentl results The size columns in Fig. 7 indicte the sizes of the exmples. The #sttes is either the size of the product utomt (i.e., synchronous composition) of ll peers, or the size of the converstion protocol. The lst column indictes which nlysis is pplied, e.g., R nd S denote the relizbility nd synchronizbility nlysis, respectively. We did not list the nlysis cost in Fig. 7 becuse the cost is trivil for these exmples. Generlly, we believe tht the synchronizbility nlyses will be sclble s long s ll peers re deterministic, nd the cost of determiniztion cn be voided. As reported in the tble, only 2 of the 12 exmples violte the conditions for relizbility (both violte the utonomous condition). For exmple, the Met Converstion exmple in [24] llows two peers to rce t the beginning nd decide the inititor of the converstion. Unfortuntely, our utonomous condition forbids such rcing. However, the fct tht 10 out of 12 exmples stisfy the presented sufficient conditions implies tht they re not restrictive nd they re ble to cpture significnt portion of prcticl web service pplictions.