Verifying Interaction Protocol Compliance of Service Orchestrations

Transcription

1 Verifying Interation Protool Compliane of Servie Orhestrations Andreas Shroeder and Philip Mayer Ludwig-Maximilians-Universität Münhen, Germany {shroeda, Abstrat. An important aspet of servie-oriented omputing is the ability to invoke servies without knowledge of the atual implementation. This requires at least a desription of the servie interfae; better yet is a speifiation of the omplete interation protool. This applies to atomi servies as well as servie ompositions. In both ases, however, guaranteeing that a servie omplies with the promised interation protool is ruial for deadlok-free ommuniation. In this paper, we present an analysis method and tool for verifying ompliane of servie orhestrations with servie interation protools given as UML models. Our method is part of a larger suite of methods and tools for model driven development of servie oriented arhitetures overing ode generation for the Web servie stak and other servie platforms: MDD4SOA. 1 Introdution A ore aspet of Servie-Oriented Computing (SOC) is enabling (semi-) automati disovery and omposition of servies. To ahieve this aim, servies are aompanied with a desription of their interfae, onsisting of a desription of aepted and sent messages and its interation protool detailing whih interations with the servie are legal at a ertain point in a onversation. Interation protools greatly help in assembling servies and enable more thorough mehanial hekings of whether servies fit together. However, for this heking to be helpful, it is ruial that servie orhestrations onform to their interation protools; otherwise, servies may be proven inompatible although fitting, or even worse, servies may be onsidered ompatible when they are not. Therefore, tools for heking the onformane of servie implementation (in our ase, the orhestration) and servie desription (i.e., the interation protool) are urgently needed. In this paper, we present an approah for heking the onformane of servie orhestrations given as UML ativity diagrams and interation protools given as UML protool state mahines. We use the UML as it onstitutes the lingua frana of software engineers, and furthermore allows to follow a model driven approah: to reate platform independent software models that an be transformed into platform speifi realizations. The remainder of this paper is strutured as follows. First, we give a brief overview over our UML profile for servies in Se. 2. In Se. 3, we detail the basi ideas of This work has been partially supported by the EC projet SENSORIA, IST

2 Fig. 1. Thesis Management: Servie Orhestration. our refinement analysis, and desribe an aompanying tool. Finally, we present related work in Se. 4, and onlude in Se. 5. The work presented in this paper has been developed in the EU projet S ENSO RIA, whih aims at developing a novel omprehensive approah to the engineering of servie-oriented software systems. More about S ENSORIA may be found in [14]. 2 Modelling Servies with UML4SOA Our UML profile UML4SOA [9] enables onvenient modelling of servie-oriented systems on a platform independent level. So far, UML4SOA inluded stereotypes for modelling (a) servie orhestrations only, and was extended for the purpose of onformane heking to address (b) servie arhiteture modelling with UML omposite struture diagrams, and () servie interfae desriptions using lass diagrams (for the stati part) and protool state mahines (for the dynami part). Servie Orhestration. UML4SOA inludes a profile for modelling servie orhestrations with UML ativity diagrams. The profile employs native UML2 elements where possible, e.g. for modelling branhes, loops, and parallel ontrol flow, and extends the UML2 with servie-speifi onepts like servie alls as well as event- and ompensation handling. For details on the extension for servie orhestration, see [9]. Fig. 1 shows the orhestration of the student thesis management example taken from [9]. It models the proess of handling a student thesis from the initial topi provided by a tutor, through managing the ongoing thesis writing proess, to the final assessment and notifiation. Servie Composition Struture. The servie omposition struture desribes the partiipants in a servie oriented arhiteture and how servies may be used by partiipants. For this, we use UML2 omposite struture diagrams. To speify the servies of a SOA, UML4SOA follows the UML2 omponent-based design approah: servie stereotyped Ports represent servies, and servie provider - stereotyped Components

3 represent servie providers, that is to say, software entities that expose and offer servies to other software entities. Servie Interfaes. While the servie omposition struture gives an overview over the SOA infrastruture, it does not desribe the interfaes of the involved servies. For this task, we use UML2 lass diagrams to model servie providers, their servies, provided operations, and required allbaks. Going beyond stati servie desriptions, we use UML2 protool state mahines to desribe behavioural aspets of servie interfaes. In this way, the intended usage an be speified more preisely than by relying on operation names and message types as done e.g. in WSDL. UML protool state mahines (PrSM) are used to desribe valid interation sequenes of a port with finite state mahines onsisting of protool states and protool transitions between them. Transitions of PrSMs may ontain a preondition, event, and postondition. In UML4SOA, we use events to model inoming and outgoing messages. Pre- and postonditions are not onsidered yet, but may be in the future. Fig. 2(a) shows the protool offered to a thesis tutor by the thesis management servie provider. It speifies that the provider first requires to reeive a newtopi message, and only allowing status queries (performed by reeive getstatus and send / reply getstatus from the servie) from a tutor one the topi was piked up by a student, whih is invisible to the tutor an hene internal. In addition to the orret protool, we introdued a reeive transition from and to topiposted with the reeption of a posttopi message, hene requiring that the topi for a thesis may be posted arbitrarily often; obviously, the orhestration does not satisfy this requirement, whih is disovered by the onformane verifiation tool, as disussed in Se Analysing Servie Orhestrations One a servie orhestration and its servie interfae is modelled, the question arises whether the orhestration onforms to the defined protool whih is part of the published servie desription. In more formal terms, the question is whether the orhestration onstitutes a valid refinement of the protool. For this, we implemented an approah that (1) allows to selet servie providers and servies for heking, (2) analyses the assoiated servie orhestrations and interation protools for syntati onsisteny, (3) allows to selet failure onfigurations, (4) generates modal input/output labelled transition systems (modal I/O LTS, see [8] for the omplete formal framework) from both servie orhestrations and interation protools, (5) performs the onformane analysis and (6) outputs the results graphially. Seleting servie providers and servies. The MDD4SOA onformane heker aepts UML XMI files and allows users to selet, from the model, the servies and servie providers they would like to validate. Cheking Syntati Consisteny. Sine not all UML ativity diagrams may be translated into a modal I/O LTS, the MDD4SOA analysis tool heks the syntati onsisteny of a given servie orhestration before performing any refinement analysis, and informs the servie engineer about syntati inonsistenies found in the model. We over general onsisteny onstraints suh as forbidding non-exeutable ativities and MDD4SOA speifi onstraints restriting the branhing and forking struture.

4 Seleting Failure Configurations. Before performing the onformane analysis, the tool allows the user to hoose possible erroneous servie interations, i.e. servie interations that may fail due to unavailability of the ommuniation partner or transmission errors. By this, the user is able to adjust the generated LTS and hene analyse the servie orhestration onformane with varying fault assumptions. This feature emerged from pratie, as onformane to reasonable servie protools is only ahievable if some servie interations are assumed as being reliable. Generating Modal I/O LTS. In order to reah an answer to the question of protool onformane, a ommon semanti basis for servie orhestrations and interation protools must be found. We hose as this ommon basis modal I/O LTS. Sine the simple UML protool state mahines we use in our approah an be easily translated to modal I/O LTS, one half of the transformation is very straightforward. Servie orhestration models on the other hand use a subset of UML ativity diagram onstruts as well as the stereotypes introdued by UML4SOA. We defined a translation of servie orhestration models to modal I/O LTS by following the widespread interpretation of ativity diagrams as Petri nets in the sense that a state is a set of markers, and markers an be roughly interpreted as Petri net tokens (f. Fig. 2(b) for an extrat of the LTS generated for the thesis management orhestration). The modal I/O LTS that is onstruted from a servie orhestration S roughly onsists of states representing possible exeution states of S, and transitions from one exeution state to its suessor for eah servie interation or event that may our. An exeution state of S onsists of the orhestration S with markers of different kinds (e.g. program ounter markers, ative markers on urrently proessed sopes, or ompleted markers attahed to ativity nodes). Performing Conformane Analysis. Now that both servie orhestration and interation protool are represented as modal I/O LTS, we an verify whether a refinement exists using observational modal refinement as defined in [8]. Observational modal refinement is omputed in the MDD4SOA onformane analysis tool by starting from the pair of initial orhestration and protool states enumerating all alternative suessor pairs using and-or trees. If a pair of states is found during proess whih violates the observational modal refinement onditions in one step (by not providing a required ation or performing an illegal ation), this fat is memorized within the and-or tree, and propagated to its predeessor nodes in a final step. All propagated paths that lead (together with others or alone) to a falsifiation of the initial pair represent exeution traes that must be reported to the user, as they onstitute violation traes of the refinement between interation protool and servie orhestration. Graphial Output. Considering the thesis management example, Fig. 2() shows how an error trae is displayed: the servie orhestration does not support the reeption of posttopi after it was one reeived. The analysis result states that the servie orhestration fails to support the reeption of a posttopi message one it ompleted the first posttopi reeive ativity. The MDD4SOA onformane analysis tool is an open soure Elipse plugin available at mdd4soa.eu. The MDD4SOA tool suite also features ode generation tools that allow the generation of e.g. BPEL/WSDL ode from UML4SOA models.

5 newtopi <<reeive>> <<reeive>> newtopi() / <<r eei ve>> newtopi newtopi() / Mi ssi ngi nt opi Post ed: newtopi topiposted <<internal>> <<exept i on>> <<internal>> topiaepted <<send>> post Topi <<internal>> <<send>> <<reply>> <<reeive>> getstatus() / getstatus() / <<send&r v>> get Assessment retrievingstatus (a) Wrong Tutor Protool <<ompens.al l >> f r eetopi (b) Orhestration LTS () Resulting Analysis Output Fig. 2. Analysing with UML4SOA 4 Related Work Several proposals exists for modelling servie-oriented systems defining own UML profiles for SOA or proposing a proprietary approah. For a omparison of these approahes to our UML4SOA profile, see [9]. Several other approahes to ativity diagram semantis exist, of whih a omprehensive overview an be found in [12]. Other tools for refinement analysis based on bisimulation exist, e.g. Ti [1] and Chi [4], where the latter is also appliable to Web servies [3]. Both tools however define their own textual notations for modelling. Other approahes to analyzing servies often fous on BPEL [5,7,6], XLANG [15] or own notations (based on petri nets, e.g. [13], finite state mahines, e.g. [2], or proessaluli, e.g. [11]), entailing platform lok-in or a steeper learning urve for software engineers ompared to our UML-based approah, respetively. Furthermore, most approahes fous the analysis of single servies (e.g. verifying internal onsisteny of single BPEL proesses) or on omposability of servies (e.g. heking whether a omposition of BPEL proesses is deadlok-free or satisfies other properties). However, onformane of servies to behavioural desriptions will onstitute a vital part in servie engineering and deployment [11,10]. This may be related to the fat that the Web servie stak does not yet offer means for behavioural desription of Web servies. A partiular lose approah to ours is [15], whih generates behavioural desriptions of orhestrations instead of heking their onformane. This is an interesting approah that however does not support top-down servie engineering (first reating the desription, then the realization) as a onformane verifiation approah does. 5 Conlusion In this paper, we have addressed the problem of heking ompliane of servie orhestrations with their interations protools. We employ modal observational refinement based on a modal I/O LTS semantis of servie orhestrations and servie protools,

6 whih allows to display informative error traes to the servie engineer. Our work is built on an extension for UML2, the UML4SOA profile, whih inludes stereotypes for speifying both stati and dynami aspets of servie ompositions. As onformane between servie orhestration and interation protool is of ruial importane for (semi-) automati servie omposition, we believe that the provided ability to mehanially verify and onfirm that an orhestration follows its promised interation protool signifiantly eases ahieving error-free ommuniation between servies. With the UML4SOA profile and the MDD4SOA tool suite, our approah offers straightforward modelling, heking, and generation of SOA artefats. Referenes 1. B. T. Adler, L. de Alfaro, L. D. da Silva, M. Faella, A. Legay, V. Raman, and P. Roy. Ti: A Tool for Interfae Compatibility and Composition. In 18th Int. Conf. Computer Aided Verifiation, volume 4144 of LNCS, pages Springer, D. Berardi, D. Calvanese, G. De Giaomo, M. Lenzerini, and M. Meella. Automati Composition of E-Servies that Export Their Behavior. In 1st Int. Conf. Servie-Oriented Computing, volume 2910 of LNCS, pages Springer, D. Beyer, A. Chakrabarti, and T. A. Henzinger. Web servie interfaes. In 14th Int. Conf. on World Wide Web, pages ACM, D. Beyer, K. Chatterjee, T. A. Henzinger, and F. Y. C. Mang. Chi: Cheker for Interfae Compatibility. arindam/hi. 5. H. Foster, S. Uhitel, J. Magee, and J. Kramer. Compatibility Verifiation for Web Servie Choreography. In 3rd Int. Conf. on Web Servies, pages IEEE, X. Fu, T. Bultan, and J. Su. Analysis of Interating BPEL Web Servies. In 3rd Int. Conf. on Web Servies, pages IEEE, M. Kovás and L. Gönzy. Simulation and Formal Analysis of Workflow Models. In 5th Int. Wshp. on Graph Transformation and Visual Modeling Tehniques, Eletroni Notes in Theoretial Computer Siene, pages Elsevier, K. Larsen, U. Nyman, and A. Wasowski. Modal I/O Automata for Interfae and Produt Line Theories. In 16th Eur. Symp. on Programming, volume 4421 of LNCS, pages Springer, P. Mayer, A. Shroeder, and N. Koh. UML4SOA: Model-Driven Servie Orhestration. In 12th Int. Enterprise Computing Conf. IEEE, Meredith, L.G. and Bjorg, S. Contrats and Types. Comm. ACM, 46(10):41 47, G. Salan, L. Bordeaux, and M. Shaerf. Desribing and Reasoning on Web Servies Using Proess Algebra. In 3rd Int. Conf. on Web Servies, pages IEEE, H. Störrle. Strutured Nodes in UML 2.0 Ativities. Nord. J. of Comput., 11(3): , W. van der Aalst and M. Weske. The P2P approah to interorganizational workflows. In 13th Int. Conf. on Advaned Information Systems Engineering, volume 2068 of LNCS, pages Springer, M. Wirsing, A. Clark, S. Gilmore, M. Hölzl, A. Knapp, N. Koh, and A. Shroeder. Semanti-Based Development of Servie-Oriented Systems. In 26th Int. Conf. on Formal Methods for Networked and Distributed Systems, volume 4229 of LNCS, pages Springer, A. Wombaher and B. Mahleko. Finding trading partners to establish ad-ho business proesses. In Int. Conf. on Cooperative Information Systems, volume 2519 of LNCS, pages Springer, 2002.