A FORMULA DRIVEN INCREMENTAL CONSTRUCTION OF WEB

SERVICE COMPOSITIONS

Antonella Santone

∗

, Gigliola Vaglini

and Maria Luisa Villani

∗

Dipartimento di Ingegneria, University of Sannio, Benevento, Italy

Dipartimento di Ingegneria della Informazione, University of Pisa, Italy

Keywords:

Model checking, Temporal logic, Tableaux, Web services.

Abstract:

We present a modular approach to system speciﬁcation to support the realization of web services. In particular,

we solve the following problem: given the formal speciﬁcation of the (incomplete) system, say p, already built,

what is a characterization of the sub-systems that can collaborate with p, through a given communication

interface L , so that the complete system satisﬁes a given property ϕ? An automatic procedure is deﬁned to

identify the formula ψ such that, for each process q satisfying ψ, the parallel composition of p and q through

L satisﬁes ϕ. For applicability of the method to web service compositions the formula ψ should specify, as

much as possible, only the communication actions that allow p to correctly fulﬁll ϕ.

1 INTRODUCTION

The Service Oriented Architecture (SOA) model has

led to rethinking the way software systems are de-

veloped: systems are conceived as collaborations of

simpler services, whose concrete realizations will be

selected or even discovered at run-time. Also, these

systems can reconﬁgure themselves to recover from

problems that may occur during execution. Thus,

proper mechanisms to specify the behaviors of the

required services are essential, to enable automatic

search and compatibility checks of the services that

can be bound to the composition. Most importantly,

validity of the composition with respect to global ob-

jectives must be ensured not only at design time, but

also at execution time, when a binding with some ser-

vice might be changed with another one.

We present a modular approach to system speciﬁ-

cation to support the realization of such systems. In

particular we solve the following problem: given the

formal speciﬁcation of the (incomplete) system, say

p, already built, what is a characterization of the sub-

systems that can collaborate with p, through the given

communication interface L , so that the complete sys-

tem satisﬁes the property ϕ?

In this paper, properties are described by tempo-

ral logic formulae expressed, for the purpose of sim-

plicity, through the Selective Hennessy-Milner logic

(Barbuti et al., 1999), and systems by CCS processes

(Milner, 1989). If ϕ is the formula to be satisﬁed by

the complete system, an automatic procedure is de-

ﬁned to identify a formula ψ such that, for each pro-

cess q satisfying ψ, (p | q)\L satisﬁes ϕ. Moreover,

the description of the lacking component through a

logic formula guarantees correctness of the integra-

tion with p of any process that exhibits a behavior

compliant with the inferred formula. This behavior

consists in a skeleton of communications so that pro-

cesses having the same skeleton are all able to be suc-

cessfully integrated with p.

The synthesized formula could be generally ob-

tained with the partial model checking technique pre-

sented in (Andersen, 1995), aiming to reduce the

model checking problem of a complex process to that

of smaller size processes. Andersen’s method moves

the cause of the possible exponential complexity of

the model checking of the concurrent processes with

respect to ϕ from the number of states of the transi-

tion system of (p | x)\L to the number of operators of

a new formula ψ, which includes also the speciﬁca-

tion of all possible behaviors of p. Thus, the resulting

formula does not highlight the missing behavior in p

with respect to ϕ, and the method does not scale when

evolving the system with new components.

Our aim is, even at the price of non-completeness

of the method, to deﬁne a formula for q, whose com-

Santone A., Luisa Villani M. and Vaglini G. (2009).

A FORMULA DRIVEN INCREMENTAL CONSTRUCTION OF WEB SERVICE COMPOSITIONS.

In Proceedings of the 4th International Conference on Software and Data Technologies, pages 13-22

DOI: 10.5220/0002246800130022

 SciTePress

plexity depends mainly on the complexity of the orig-

inal formula ϕ and of the chosen communication in-

terface; moreover, the result of the model checking of

p is taken into account so that ψ includes only the part

of ϕ that is not satisﬁed by p. Finally, the efﬁciency of

the method is tackled by exploiting the Selective mu-

calculus logic and the local model checking method-

ology; logic and methodology that allow us to con-

sider (and build) only the part of the transition system

of p needed for the veriﬁcation.

In the following section, the basics of the speciﬁ-

cation language we refer to are recalled, together with

the temporal logic through which the system proper-

ties are deﬁned. Section 3 shows the core of the ap-

proach, while Section 4 presents an application of the

methodology through a known example in the ﬁeld

of Web Services. Finally, considerations and compar-

isons with some related work are given in Section 5.

2 PRELIMINARIES

In a web service composition, the implementation de-

tails are hidden, as web services are black box compo-

nents running on the provider servers, but their inter-

face speciﬁcations, described by standard languages

like WSDL (W3C Working Group, 2007) and ”ab-

stract” WS-BPEL (Andrews et al., 2003), could be

public and they are automatically accessible. These

descriptions include the incoming/outcoming mes-

sages for each service operation and the interaction

protocol for their usage. This work considers a set

of WS-BPEL processes, which can be translated into

CCS processes, and a global formula to be satisﬁed

by the integrated system: the presented approach can

be used to deduce the behavioural speciﬁcation of the

missing partner, i.e., a partner providing the opera-

tions required by the existing part of the system to cor-

rectly satisfy the global formula. Mappings of WS-

BPEL constructs to CCS are discussed in (Breugel

and Koshkina, 2006) and (Martinelli and Matteucci,

2007), while arguments sustaining CCS modelling of

web services compared to, for example, pi-calculus

are given in (Bao et al., 2006).

2.1 The Calculus of Communicating

Systems

The Calculus of Communicating Systems (CCS)

(Milner, 1989) is an algebra suitable for modelling

and analyzing processes. The syntax of processes is

the following:

p ::= nil | α.p | p + p | p|p | p\L | p[ f] | x

where α ranges over a ﬁnite set of visible actions

V = {a,a,b,b,...}. Input actions are labelled with

“non-barred” names, e.g. a, while output actions are

“barred”, e.g. a. The set L, in processes with the form

p\L ranges over sets of visible actions, f ranges over

functions from actions to actions, while x ranges over

a set of constant names: each constant x is deﬁned by

a constant deﬁnition x

def

= p.

The operational semantics is given in Appendix.

In the following, given a process p, the sort of p is

the subset of V containing the actions that p can per-

form. The reader can refer to (Milner, 1989) for the

precise deﬁnition of the syntactically based version of

the sort of p.

Let δ ∈ A

∗

: if δ = α

.. . α

,n ≥ 1, p

−→q means

−→·· ·

−→q; if δ = λ, where λ is the empty se-

quence, p

−→q iff p = q. A process q such that there

is a computation p

−→q is a δ-derivative of p with

−→ (or simply a derivative of p).

2.2 Model Checking and Selective

mu-calculus Logic

In the model checking framework (Clarke et al.,

2000), systems are modelled as automata (often called

transition systems) and requirements are expressed as

formulae of some temporal logic. The selective mu-

calculus is a branching temporal logic to express be-

havioral properties of systems (Barbuti et al., 1999).

It is equi-expressive to mu-calculus (Stirling, 1991),

but they differ in the deﬁnition of the modal opera-

tors. Given a set A of actions and a set Var of vari-

ables, selective mu-calculus formulae are deﬁned as

follows:

ϕ ::= tt | ff | Z | ϕ ∨ ϕ | ϕ∧ ϕ | [K]

ϕ |

hKi

ϕ | νZ.ϕ | µZ.ϕ

where Z ∈ Var and K,R ⊆ A . The operators µZ.ϕ and

νZ.ϕ are ﬁxed point operators: µZ.ϕ is the least ﬁxed

point of the recursive equation Z = ϕ, while νZ.ϕ is

the greatest one. In the formula µZ.ϕ (νZ.ϕ) µZ (νZ)

binds the occurrences of Z in ϕ. A variable that is not

bounded by any ﬁxed point operators is called free. A

formula without free variables is called closed. From

now on only closed formulae are considered. The pre-

cise deﬁnition of the satisfaction of the closed formula

ϕ by the process p is given in the Appendix.

An interesting property, which will be used in the

successive sections, is expressed by the formula be-

low, where S ⊆ A , γ = α

.. . α

and α

∈ A for all

1 ≤ i ≤ n:

ICSOFT 2009 - 4th International Conference on Software and Data Technologies

event seq(γ,S, ψ) = eventually(α

,S) ∧ [α

]

(eventually(α

,S) ∧ [α

]

(·· · ∧

[α

n−1

]

(eventually(α

,S)∧

[α

]

ψ)· · · ))

The property says: ”the actions of the sequence γ

eventually happen (each action is not interleaved with

actions in S) and then ψ holds”. The property uses the

formula eventually(α,S), i.e. ”α eventually happens,

not preceded by actions in S”, whose formal deﬁnition

is:

eventually(α,S) = µZ.h−i

tt∧

[S− {α}]

ff ∧ [−{{α} ∪ S}]

To the purpose of explaining the methodology with-

out too much technicality, system properties will be

deﬁned through the Selective Hennessy-Milner Logic

(SHML) instead of the full selective mu-calculus

(Barbuti et al., 1999). SHML is more expressive than

the Hennessy-Milner logic (Stirling, 1991) because of

the intrinsic recursion of the selective operators. The

syntax of such logic is:

ϕ ::=

| ϕ ∧ ϕ | ϕ ∨ ϕ | [K]

ϕ | hKi

ϕ.

3 THE METHOD

Given a process p and a formula ϕ, a formula ψ is

looked for such that the parallel composition of p and

q satisﬁes ϕ, for each process q satisfying ψ. In fact,

the aim of the present work is the integration of the

functionality of an existing process p with new ones:

such integration has to maintain certain guarantees,

expressed by the formula ϕ, together with the require-

ments of the new functionalities. Thus, the logic for-

mula ψ supplies the formal speciﬁcation of the pro-

cess q and it is thought to force q to support p to meet

ϕ; obviously, the behavior of p might be such that no

formula ψ can be deduced to guarantee a solution to

the satisﬁability problem of ϕ . Such a case is detected

as unsuccessful by the tableau-based algorithm. In

particular, we consider a process p offering a commu-

nication interface to cooperate with another process q:

if such interface is not sufﬁcient to guarantee, for the

part involving p, the satisfaction of the formula (i.e. a

required communication is not in the interface of p or

it exists, but is not correctly performed) then the algo-

rithm stops with failure. Thus the method hypotheses

can be recalled: given a CCS process p,

• all actions of p are either communication ac-

tions, τ

, performed inside p or visible actions

that are proposed for communicating with q; only

the communication actions with q, together with

the corresponding dual actions, constitute the set

L ⊆ sort(p);

• in the global formulae, only actions τ

will occur,

both performed inside p or between p and q.

We need also the deﬁnition of the following set con-

taining the corresponding actions through which a

communication occurs, beyond the internal commu-

nication actions performed by p.

Deﬁnition 3.1. Given the set of communication ac-

tions L and R ⊆ {τ

| τ

∈ A },

= {l,l | (τ

∈ R)∧(l, l ∈ L )}∪{τ

| (τ

∈ R)∧(l, l 6∈ L )}.

When clear from the context we use R

instead of R

We propose a tableau-based method since such

method permits the exploration (and then requires the

construction) of only the part of the transition sys-

tem of the process involved in the veriﬁcation of a

given formula. In our tableau two parts are distin-

guished: the goal and the environment. Intuitively, at

each intermediate stage while producing the solution,

the goal says what remains to be done and the envi-

ronment records the solution produced so far along a

branch of the tableau itself. The tableau works on se-

quents on which a set of rules can be applied; sequents

are deﬁned as follows.

Deﬁnition 3.2. A sequent is an expression of the

form: hp, L ,x

,B i ⊢

ϕ, s.t.:

• ϕ is a SHML formula;

• p is a CCS process (the existing process or one of

its derivatives);

• L is the communication interface offered by p;

• E is the environment (i.e. a set of incomplete se-

lective mu-calculus formulae representing the un-

til now performed path on the tree);

• x

represents the unknown formula that will be

possibly built through the tableau branches as the

search will go onward;

• B is a boolean value yes or no: B is yes when

the last selective operator, being examined when

producing ψ, is a box operator; otherwise B is

no.

Each rule is of the form:

hp, L ,x

,B i ⊢

,L ,x

,B i ⊢

′

·· · hp

,L ,x

,B i ⊢

′

where n > 0 and side conditions may exist. The

premise sequent is the goal to be achieved, the conse-

quents are the sub-goals which are determined by the

structure of the formula and by the possible deriva-

tives of p.

A FORMULA DRIVEN INCREMENTAL CONSTRUCTION OF WEB SERVICE COMPOSITIONS

Table 1: The Rules.

dia

hp, L ,x

,noi ⊢

hτ

′

,L ,x

j+1

,noi ⊢

i+1







γα

=⇒

∪L

′

, α ∈ {l, l}, α ∈ L , γ ∈ (L − R

)

∗

i+1

= E

∪ {ψ

= hγi

∪L

hαi

∪L

j+1

}







dia

hp, L ,x

,noi ⊢

hτ

′

,L ,x

j+1

,noi ⊢

i+1







γα

=⇒

{τ

}∪R

∪L

′

, α = τ

, l 6∈ L , γ ∈ (L − R

)

∗

i+1

= E

∪ {ψ

= hγi

∪L

j+1

}







dia

hp, L ,x

,yesi ⊢

hτ

′

,L ,x

j+1

,noi ⊢

i+1







γα

=⇒

∪L

′

, α ∈ {l,l}, α ∈ L , γ ∈ (L − R

)

∗

i+1

= E

∪ {ψ

= event seq(γ,R

∪ L ,hαi

∪L

j+1

)}







dia

hp, L ,x

,yesi ⊢

hτ

′

,L ,x

j+1

,noi ⊢

i+1







γα

=⇒

{τ

}∪R

∪L

′

, α = τ

, l 6∈ L , γ ∈ (L − R

)

∗

i+1

= E

∪ {ψ

= event seq(γ,R

∪ L ,ψ

j+1

)}







box

hp, L ,x

,B i ⊢

[τ

]

,L ,x

,yesi ⊢

i+1

ϕ· · · hp

,L ,x

,yesi ⊢

i+1

condition

condition =











| p

=⇒

∪L

, 1 ≤ i ≤ n, α ∈ {l,l} , α ∈ L }

i+1

= E

∪ {ψ

= [α]

(

k=1...n

)}











box

hp, L ,x

,B i ⊢

[τ

]

,L ,x

,yesi ⊢

i+1

ϕ· · · hp

,L ,x

,yesi ⊢

i+1

condition

condition =











| p

=⇒

{τ

}∪R

∪L

, 1 ≤ i ≤ n, α = τ

, l 6∈ L }

i+1

= E

∪ {ψ

= (

k=1...n

)}











and

hp, L ,x

,B i ⊢

∧ ϕ

hp, L ,x

,B i ⊢

i+1

hp, L ,x

,B i ⊢

i+1



i+1

= E

∪ {ψ

= ψ

∧ ψ

}



hp, L ,x

,B i ⊢

∨ ϕ

hp, L ,x

,B i ⊢

hp, L ,x

,B i ⊢

∨ ϕ

hp, L ,x

,B i ⊢

3.1 Tableau Rules

A tableau, i.e., a proof tree, is built starting from a

root labelled with the following initial goal

hp, L ,x

i ⊢

ϕ.

where, for any tableau, B

= no, E

0 and ψ

is the

formula to be obtained through the tableau search.

Then, the construction proceeds by applying spe-

ciﬁc rules to successively simplify the goal and extend

the environment until terminal sequents are reached.

Namely, the sequents labelling the immediate succes-

sors of a node are determined by the rules in Table 1,

while terminal sequents (successful and unsuccessful)

are identiﬁed in Table 2.

The rules take into account the structure of the

formula present in the premise of each sequent (the

ﬁrst modal operator), and some ”context” informa-

tion: speciﬁcally, context information regard the last

examined logical operator. The rules and and or

specify recursion on one or both the component for-

mulae.

In Table 1 the shorthand hγi

ϕ is used to repre-

sent the sequence hδ

·· · hδ

ϕ when γ = δ

·· · δ

and n ≥ 1. If γ = λ, then hγi

ϕ is equal to ϕ. The

rules dia and box have a case regarding the actions

in the interface L and one regarding communications

inside p; in the case in which p does not perform ei-

ther the required action in the interface or the internal

communication, instead of forcing q to substitute p,

ICSOFT 2009 - 4th International Conference on Software and Data Technologies

Table 2: Successful/unsuccessful terminal sequents.

success

hp, L ,x

,B i ⊢

i+1

= E

∪ {ψ

= tt}

succes

hp, L ,x

,B i ⊢

[τ

]



′

| p

=⇒

{α}∪R

∪L

′

, α ∈ {l,l,τ

}} =

i+1

= E

∪ {ψ

= tt}



unsucces

hp, L ,x

,B i ⊢

unsucces

hp, L ,x

,B i ⊢

hτ

p 6

γα

=⇒

{α}∪R

∪L

′

, α ∈ {l,l,τ

},γ ∈ (L − R

)

∗

we have chosen to produce a failure of the algorithm

to represent, in some sense, a failure of the formula

veriﬁcation. Now the rules are explained by case anal-

ysis:

• dia

, dia

. These rules are applicable when the

previously examined logical operator is not a box

one. The rule dia

considers the action α be an of-

fered communication, while dia

considers α as a

communication inside p. If α is preceded by a

sequence γ of actions not in R

, q must perform

an equal sequence of corresponding dual actions;

obviously, if α = τ

no corresponding action is re-

quired of q. Note that when more than one move

exists for p, each one produces the speciﬁcation

of a different set of candidate processes q. It is

out of the scope of this paper the deﬁnition of a

possible strategy for choosing the ”most suitable”

set of candidate processes.

• dia

, dia

. When the last examined formula oper-

ator is a box one, the sequence γ of actions must be

performed in all paths of q before performing α, if

different from τ

. Otherwise only the sequence γ

must be performed in all paths. In such a way the

connected behaviors of p and q are synchronized.

• box

, box

. These rules take account of the abil-

ity of p of performing k actions α: for each one a

branch of the tableau is opened to verify the for-

mula ϕ.

• and. The rule says that the constructions of the

two sub-formulae are carried on separately, and

the results are composed.

• or

and or

: straightforward.

A sequent S = hp, L ,x

,B i ⊢

ϕ, S can be ei-

ther a successful or an unsuccessful terminal. The

successful/unsuccessful terminals are clearly deﬁned

in Table 2. A tableau is successful if it is ﬁ-

nite and all of its leaves are successful terminals.

If hp

,L ,x

,B i ⊢

·· · hp

,L ,x

,B i ⊢

are all the leaves of the tableau for the goal

hp, L ,x

,noi ⊢

ϕ, and they are also successful

terminals, then the solution is the formula ψ

, con-

tained in all the environments of the leaves and re-

cursively obtained by substituting the right hand side

of each equation ψ

= ψ

′

(taken from any terminal

environment) each time ψ

exists in some environ-

ment. When ψ

′

is a SHML formula the procedure

terminates. It is worth noting that, while the name ψ

can appear more than once in the terminal environ-

ments, its deﬁnition is unique, i.e., in only one leaf

environment we have ψ

= ψ

′

The following theorem states the soundness of our

approach.

Theorem 3.1. Consider a CCS process p and

a SHML formula ϕ. Any tableau for the goal

hp, L ,x

i ⊢

ϕ, deﬁnes the formula ψ

such

that: q |= ψ

=⇒ (p | q)\L |= ϕ.

Proof. The proof can be done by induction on the

length of the formula ϕ.

4 AN APPLICATION OF THE

METHODOLOGY

In the design of a web service composition, the imple-

mentation details of the candidate component services

are hidden, but, attached to their WSDL interface de-

scriptions, one may luckily have their ”abstract” WS-

BPEL processes (Andrews et al., 2003), represent-

ing the interaction protocol for their usage. Indeed,

this assumption is in line with the facet-based publi-

cation process supported by the SeCSE platform, an

outcome of the European project SeCSE (Di Penta et

al., 2008). In this context, given a set of processes,

described, for example in WS-BPEL, which we can

translate into CCS processes, and a global formula to

be satisﬁed by the integrated system (that one can ﬁ-

nally realize as a choreographyin the WS-CDL (W3C

Working Group, 2005) speciﬁcation language), the

approach can be used to deduce the behavioral spec-

iﬁcation of the missing partner, i.e., a partner provid-

ing the operations required by the existing part of the

A FORMULA DRIVEN INCREMENTAL CONSTRUCTION OF WEB SERVICE COMPOSITIONS

system, to correctly satisfy the global formula.

As an example, let us consider the following sce-

nario, described in (Bertoli et al., 2007), which we

have slightly modiﬁed to realize it as a choreography:

The employee of a ﬁrm is organizing a work trip. He

presents a ticket request to the employer’s adminis-

tration, complete with ticket details. He has gathered

these data by ﬁrst interacting with on-line informa-

tion service. The administration will either accept

or refuse such a proposal, and in the former case, it

will try to pay for the ticket of the employee, either by

credit card, or by cheque, through some payment ser-

vice. The employee will eventually get the ticket, or a

cancel message by the administration due to payment

problems, or else a refusal. The aim is to provide the

ﬁrm with a service-centric system that automates this

process. The authors had identiﬁed ﬁve services that

could be used:

• the Administration service: implementing the ﬁrm

internal process of employees’ work trip manage-

ment;

• the InfoTrains and InfoFlights services: providing

tickets information over train/ﬂight routes, and

ticket booking/buying services; and

• the BuyCheque and BuyCard services: enabling

payment by cheque or card respectively.

We added the Travel service as the interface with the

user. The main requirement for this composition is

ﬂexibility with respect to the services that will be ac-

tually used at run-time, that is, possibility to seam-

lessly replace a service with another one (e.g., the

transport or payment services). Examples of CCS de-

scriptions of ”skeleton” services for this scenario are

given in Table 3.

Supposing ﬁxed the Travel and Administration

services interfaces, any compatible transport service

must provide: (i) an operation to search for available

seats with respect to the data provided in the query;

(ii) an operation for booking a selected travel, with-

out further data (e.g., payment information); (iii) an

operation to be notiﬁed of the payment. Instead, a

payment service consists of an operation to accept

the data for the speciﬁc payment mean (either card

or cheque), and it is required to notify the interested

service of the payment in case of success, or to send

an error message back to the requestor.

We show how the presented approach can be ap-

plied to automatically derive properties to be satisﬁed

by any transport and payment services, given some

global objectives to be ensured by the composition.

Let us ﬁrst consider the following formula:

= hτ

fSearch

tt ∧ [τ

fSearch

]

hτ

book

(hτ

buy

tt ∨ [−]

{τ

fSearch

}

ff)

which says: it is possible to search for ﬂights and

whenever this operation is required, it is possible to

ﬁrst book a travel and then either buying the ticket or

to start another search.

Suppose that we want this formula to hold for the

composition: S

def

=(TS|AD|TInfo|X|BC|BCH)\L

where X is the missing service interface to be speci-

ﬁed, providing the ﬂights information, and L contains

all the actions of the CCS process components.

The application of the approach leads to the fol-

lowing (sub)formula providing a characterization of

the ﬂights service:

= h fSearchi

tt ∧ [ fSearch]

= event seq( fSearchStarted.

flights,L,hbooki

)

= hbuyi

tt ∨ [−]

{ fSearch}∪L

The formula, other than requiring the booking and

buying operations from the service to add, ensures

that the communication with that service is correct,

that is, the booking operation is actually reachable.

We note that the FInfo process in Table 3 satisﬁes ψ

and so it is a solution for X, whereas the following

process does not:

FInfoBad

def

= fSearch. fsearchStarted.

flights.(FInfoBad + BOOKBad)

BOOKBad

def

= book.(buy.ticket.FIn foBad+

cancel.FIn f oBad)

as it requires to explicitly cancel the booking. Now

suppose that we want to replace the service BC with

another one, without affecting the composition. Thus,

we consider the system:

′

def

=(TS|AD|TInfo|FInfo|X|BCH)\L

where X is the missing card payment service, and the

global formula:

= hτ

ticket

tt ∧ hτ

cancel

which says: either the user will ﬁnally get the ticket or

the selected trip is cancelled, that is, both results must

be possible. We note that none of the actions of the

formula are required from the missing service, that

only needs to provide a correct interaction protocol in

′

to the satisfaction of ϕ

. In this case, the following

formulais derived, satisﬁed by the service BC in Table

= hcardPayi

hreceipti

hbuyi

∧hcardPayi

hinvalidi

tt.

ICSOFT 2009 - 4th International Conference on Software and Data Technologies

Table 3: Travel management choreography.

Travel Service

def

= FClient + TClient

FClient

def

= f Search. fsearchStarted. flights.(BOOK + TS)

TClient

def

= tSearch.tsearchStarted.trains.(BOOK+ TS)

BOOK

def

= book.(bookOK.ADClient + bookKO.TS)

ADClient

def

= request.(accepted.(ticket.TS+ cancel.TS) + rejected.TS)

Administration Service

def

= request.(accepted.(CPClient +CHPClient) + rejected.AD)

CPClient

def

= cardPay.(receipt.AD+ invalid.cancel.AD)

CHPClient

def

= chequePay.(receipt.AD+ invalid.cancel.AD)

Payment Services

def

= cardPay.(receipt.buy.BC + invalid.BC)

BCH

def

= chequePay.(receipt.buy.BCH + invalid.BCH)

Transport Services

FIn fo

def

= f Search. fsearchStarted. flights.(FInfo+ book.(bookOK.FBUY + bookKO.FIn f o))

FBUY

def

= buy.ticket.FIn fo+ FInfo

TInfo

def

= tSearch.tsearchStarted.trains.(TInfo+ book.(bookOK.TBUY + bookKO.TInfo))

TBUY

def

= buy.ticket.TIn fo + TIn fo

5 CONCLUSIONS AND RELATED

WORK

In this paper, given an incomplete system (say p) and

a requirement described by the logic formula ϕ, an

automatic procedure is deﬁned to identify a formula

ψ such that, for each q satisfying ψ, we have that

the parallel composition between p and q satisﬁes ϕ.

For the sake of clarity, only requirements expressed

in the Selective Hennessy-Milner Logic (SHML) are

used. The extension to full selective mu-calculus can

be easily deﬁned. The procedure can be incorporated

in an implementation of a model checker for the Con-

currency Workbench of the New Century (CWB-NC)

(Cleaveland and Sims, 1996), a tool for the automated

analysis of concurrent systems.

In (Andersen, 1995), an automatic method is pro-

posed, sound and complete for the full mu-calculus,

able to determine the formula ψ; such method al-

ways includes in ψ all the possible behaviors of p,

so producing a formula whose complexity depends

on the number of states of p. Our aim is, even at

the price of non-completeness of the method, to de-

ﬁne a more efﬁcient formula ψ for q, that is a formula

containing only the corresponding actions of the in-

complete communications of p. Indeed, simplicity of

the derived property ψ and scalability of the veriﬁca-

tion process, are necessary for applying the method to

both incremental design and system evolution scenar-

ios where p is already in place, realizing some func-

tionality, and one needs to understand the speciﬁca-

tion of the functionality of the new component that

would behave correctly with p. Scalability problems

are also tackled, in our work, by using a local model

checking methodology combined with the SHML that

provides an abstraction technique as shown in (Bar-

buti et al., 1999).

The formal problem we face in this paper could

A FORMULA DRIVEN INCREMENTAL CONSTRUCTION OF WEB SERVICE COMPOSITIONS

be alternatively solved under the well known assume-

guarantee theoretical framework. This provides infer-

ence rules that permit to deduce the global validity of

a formula for a system, by verifying correctness of a

given component under a set of assumptions on the

environment (a report on this technique is contained

in (Furia, 2005)). The most difﬁcult part here is the

generation of the assumptions, a job that for long has

been left (at least partially) to the developer ((Pasare-

anu et al., 1999), (Inverardi et al., 2000)). Starting

from the paper (Giannakopoulou et al., 2002), a num-

ber of works use a learning algorithm for regular lan-

guages (Angluin, 1987) to automatically derive the

weakest assumptions for the component at hand to

satisfy a safety property. This approach requires both

the component and the formula be modelled as deter-

ministic ﬁnite state machines and model checking is

used iteratively (until convergence of the algorithm)

to identify states and transitions of the environment.

In this respect, our approach, that works for all prop-

erties expressible in SHML (both safety and liveness)

and includes non-determinism, is more efﬁcient as it

is based on local model checking and does not even

require to construct the state transition system of the

component.

In the service-oriented computing area, formal

methods have been used to deﬁne unambiguous se-

mantics for the languages WS-BPEL and WS-CDL,

to describe service compositions and interaction pro-

tocols (called choreography). An overview of the

various formalisms proposed, including process alge-

bras, is contained in (Breugel and Koshkina, 2006).

Once a formal model of the system is available, one

can check properties such as deadlock-freeness and

correctness of conversationswith the services (see (Fu

et al., 2005) and (Kazhamiakin et al., 2006)). Con-

versely, given a set of service interfaces and a chore-

ography to be realized, one may ask whether service

behaviors may be deduced generating conversations

that, at global level, are all admissible by the chore-

ography. In (Fu et al., 2005), sufﬁcient conditions for

realizability of a choreography are given, and the ser-

vice behaviors are deduced through projection of the

global conversations (i.e., removing messages that do

not involve the speciﬁc service). In our work, we are

given a partial choreography already ”realized” that

needs to be extended with an additional service, so

to satisfy a global requirement expressed by a SHML

formula. Our method allows us to eventually deduce

another formula that is used to discover a class of ser-

vice implementations all able to complete the realiza-

tion of the extended choreography. In (Lohmann et

al., 2007) the authors propose to attach an operational

description to a service P, automatically computed,

characterizing services whose composition with P

is deadlock-free or satisﬁes speciﬁc behavioral con-

straints. Finally, the Open Workﬂow Nets formalism,

a special class of Petri Nets, is used both to describe

the processes and the constraints. As we consider all

properties that can be expressed in SHML, our ap-

proach is more general, and we can check constraints

satisfaction by model checking. Finally, the paper

(Martinelli and Matteucci, 2007) presents a simpli-

ﬁed version of Andersen’s partial model checking al-

gorithm with the aim of applying it to the deﬁnition of

web service orchestrations: given a parallel composi-

tion of processes, all known, the speciﬁcation of the

orchestrator is deduced. They may avoid the formula

explosion of the original Andersen’s method as they

just need to generate a process, containing only com-

munication actions, to make sure that these happen in

the right order. Indeed, differently from Andersen’s

and ours, their method only works if the construc-

tion of the transition system of the parallel processes

is feasible. As a future work, we intend to develop

a service discovery tool integrating the approach and

analyze its efﬁciency and usefulness compared to the

existing methods.

REFERENCES

Andersen, H. R. (1995). Partial Model Checking (Extended

Abstract). In LICS’95, Proc. 10th Annual IEEE Sym-

posium on Logic in Computer Science, San Diego,

California, USA, 26-29 June. IEEE. 398–407.

Andrews, T. and Curbera, F. and Dholakiam, H. and

Goland, Y. and Klein, J. and Leymann, F. and

Liu, K. and Roller, D. and Smith, D. and Thatte,

S. and Trickovic, I. and Weerawarana, S. Busi-

ness Process Execution Language for Web Services.

(http://www.ibm.com/developerworks/library/

speciﬁcation/ws-bpel/).

Angluin, D. (1987). Learning regular sets from queries

and counterexamples. Information and Computation

75(2). 87–106.

Bao, L. and Zhang, W. and Zhang, X. (2006). Describ-

ing and Verifying Web Service Using CCS. In PD-

CAT06, Seventh Int. Conf. on Parallel and Distributed

Computing, Applications and Technologies, Washing-

ton, DC, USA. IEEE. 421–426.

Barbuti, R. and De Francesco, N. and Santone, A. and

Vaglini, G. (1999). Selective mu-calculus and

Formula-Based Abstractions of Transition Systems.

Journal of Computer and System Sciences 59(3).

537–556.

Bertoli, P. and Hoffmann, J. and Freddy, L. and Pistore, M.

(2007). Integrating Discovery and Automated Com-

position: from Semantic Requirements to Executable

Code. In ICWS 2007, International Conference on

ICSOFT 2009 - 4th International Conference on Software and Data Technologies

Web Services, Salt Lake City, Utah, USA, July 9-13

2007. IEEE. 815–822.

Breugel, F. and Koshkina, M. (2006). Models and veriﬁca-

tion of BPEL.

(http://www.cse. yorku.ca/ franck/research/drafts/

tutorial.pdf)

Clarke, E.M. and Grumberg, O. and Peled, D. (2000).

Model Checking. MIT press.

Cleaveland, R. (1989). Tableau-Based Model Checking

in the Propositional Mu-Calculus. Acta Informatica

27(8). 725–747.

Cleaveland, R. and Sims, S. (1996). The NCSU Concur-

rency Workbench. In CAV’96, Eighth International

Conference on Computer-Aided Veriﬁcation. Lecture

Notes in Computer Science 1102. 394–397.

Di Penta, M. and Bastida, L. and Sillitti, A. and Baresi,

L. and Ripa, G. and Melideo, M. and Tilly, M. and

Spanoudakis, G. and Maiden, N. and Gorroogoitia

Cruz, J. and Hutchinson, J. (2008). SeCSE - Service

Centric System Engineering: an overview. In At your

service: Service Engineering in the Information Soci-

ety Technologies Program. MIT Press. ISBN: 978-0-

262-04253-6.

Fu, X. and Bultan, T. and Su J. (2005). Synchronizability

of Conversations among Web Services. IEEE Trans.

Software Eng., 31(12). 1042–1055.

Furia, C.A. (2005). A compositional world: a survey of

recent works on compositionality in formal methods.

Technical Report 2005.22, Dipartimento di Elettron-

ica e Informazione, Politecnico di Milano.

Giannakopoulou, D. and Pasareanu, C. and Barringer, H.

(2002). Assumption Generation for Software Com-

ponent Veriﬁcation. In ASE 2002, 17th International

Conference on Automated Software Engineering, 23-

27 September 2002, Edinburgh, Scotland, UK. 3–12.

Inverardi, P. and Yankelevich, D. and Wolf, A. L. (2000).

Static Checking of Systems Behaviors Using Derived

Component Assumptions. ACM Transactions on Soft-

ware Engineering and Methodology 9(3). 239–272.

Kazhamiakin, R. and Pistore, M. and Santuari, L. (2006).

Analysis of communication models in web service

compositions. In WWW’06, 15th international con-

ference on World Wide Web. 267–276.

Lohmann, N. and Massuthe, P. and Wolf, K. (2007). Behav-

ioral Constraints for Services. In BPM 2007, 5th In-

ternational Conference on Business Process Manage-

ment, Brisbane, Australia, Sept. 24-28. Lecture Notes

in Computer Science 4714. Springer. 271–287.

Martinelli, F. and Matteucci, I. (2007). Synthesis of Web

Services Orchestrators in a Timed Setting. In WS-FM

2007, 4th International Workshop on Web Services

and Formal Methods, Sept. 28-29. Lecture Notes in

Computer Science 4937. Springer. 124–138.

Milner, R. (1989). Communication and Concurrency.

Prentice-Hall.

Pasareanu, C. and Dwyer, M. and Huth, M. (1999).

Assume-guarantee model checking of software: A

comparative case study. In 6th SPIN Workshop. Lec-

ture Notes in Computer Science 1680. 168–183.

Stirling, C. (1991). An Introduction to Modal and Temporal

Logics for CCS. In UK/Japan workshop on Concur-

rency : theory, language, and architecture, Oxford,

UK. Springer-Verlag. 2–20.

W3C Working Group (2005). Web Services Chore-

ography Description Language Version 1.0.

(http://www.w3.org/TR/ws-cdl-10/).

W3C Working Group (2007). Web Services De-

scription Language (WSDL) Version 2.0.

(http://www.w3.org/TR/wsdl20-primer/).

APPENDIX

Operational semantics of CCS.

The operational semantics (see for the standard ver-

sion (Milner, 1989)) is given by the relation −→ ⊆

P × A × P , where A is the set {a,a,τ

,b,b,τ

,...};

this relation is the least one deﬁned by the rules in Ta-

ble 4 (we omit the symmetric rule of Sum and Par).

Since we consider abstract WS-BPEL process, where

all actions are communications, we modify the stan-

dard CCS semantic rule for the operator ” | ” so that

the produced action be τ

, different for each visible

action l. These new visible actions can be used in the

global formulae. Each relabelling function f has the

property that f(τ

) = τ

for each visible action l.

Satisfaction of a Selective mu-calculus Logic

Formula.

The precise deﬁnition of the satisfaction of the closed

formula ϕ by the process p is given in Table 5 where

the transition relation =⇒

, parametric with respect

to I ⊆ A , is used. By p

=⇒

q we express the fact

that it is possible to pass from p to q by performing

a (possibly empty) sequence of actions not belonging

to I (i.e., non-interesting actions belonging to A − I)

and then the action α in I. Note that =⇒

= −→.

Deﬁnition 5.1. Let p be a CCS pro-

cess and I ⊆ A , for each α ∈ I,

=⇒

q iff p

γα

−→q, for some γ ∈ (A − I)

∗

From now on, the following abbreviations will be

used:

[α

,. . . ,α

]

ϕ = [{α

,. . . ,α

}]

[−]

ϕ = [A ]

[−K]

ϕ = [A − K]

Example 5.1. Some examples of selective mu-

calculus formulae are given.

= hbi

{c}

tt: “it is possible to perform b without

performing c before”;

= νZ.[a]

(Z∧[a]

{c}

ff): ”it always holds that two

successive occurrence of a are not possible if not in-

terleaved by an occurrence of c”.

A FORMULA DRIVEN INCREMENTAL CONSTRUCTION OF WEB SERVICE COMPOSITIONS

Table 4: Operational semantics of CCS.

Act

α.p

−→ p

Sum

−→ p

′

p+ q

−→ p

′

Con

−→ p

′

−→ p

′

def

= p

Par

−→ p

′

p|q

−→ p

′

Com

−→ p

′

, q

−→q

′

p|q

−→ p

′

Rel

−→ p

′

p[ f]

f(α)

−→ p

′

[ f]

Res

−→ p

′

p\L

−→ p

′

α,α 6∈ L

Table 5: Satisfaction of a closed formula by a process.

p 6|=

p |=

p |= ϕ∧ ψ iff p |= ϕ and p |= ψ

p |= ϕ∨ ψ iff p |= ϕ or p |= ψ

p |= [K]

ϕ iff ∀p

′

∀α ∈ K p

=⇒

K∪R

′

implies p

′

|= ϕ

p |= hKi

ϕ iff ∃p

′

∃α ∈ K.p

=⇒

K∪R

′

and p

′

|= ϕ

p |= νZ.ϕ iff p |= νZ

.ϕ for all n

p |= µZ.ϕ iff p |= µZ

.ϕ for some n

where, for each n, νZ

.ϕ and µZ

.ϕ are deﬁned as:

νZ

.ϕ = tt µZ

.ϕ = ff

νZ

n+1

.ϕ = ϕ[νZ

.ϕ/Z] µZ

n+1

.ϕ = ϕ[µZ

.ϕ/Z]

and ϕ[ψ/Z] indicates the substitution of ψ for each free occurrence of Z in ϕ.

ICSOFT 2009 - 4th International Conference on Software and Data Technologies