2013 IEEE Seventh International Symposium on Service-Oriented System Engineering

Dependability prediction of WS-BPEL service compositions using Petri net and time series models
Yunni Xia , Jian Ding, Xin Luo, Qingsheng Zhu Software Theory and Technology Chongqing Key Lab, Chongqing University, China, 400030

Abstract
Web services are emerging as a major technology for deploying automated interactions between distributed and heterogeneous applications. To predict dependability of composite service processes allows service users to decide whether service process meets quantitative trustworthiness requirement. Existing contributions for dependability prediction simply trust QoS information published in ServiceLevel-Agreement (SLA) or assume QoS of service activities to follow certain assumed distributions. These information and distributions are used as static model inputs into stochastic process models to obtain analytical results. Instead, we consider QoS of service activities to be uctuating and introduce a dynamic framework to predict runtime dependability of service compositions built on WS-BPEL, employing the Autoregressive-Moving-Average Model (ARMA) time series model and general stochastic Petri net model. In the case study of a real-world service composition sample, a comparison between existing approaches and our one is presented and results suggest that our approach achieves higher prediction accuracy and a better curve-tting.

Introduction

Web Services are interfaces that describe a collection of operations that are network-accessible through standardized protocols, and whose features are described using a standard XML-based language. The development of new services through composition of existing ones has gained considerable acceptance as a major means to integrate heterogeneous industrial applications and to realize B2B ecommerce collaborations. Service Composition involves the development of customized services often by discovering, integrating, and executing existing services. One of the most used and de facto composition standard is WS-BPEL
Supported by the NSCF Research Program of China under grant No. 61103036 xiayunni@yahoo.com.cn

(Business Process Execution Language for Web Services) [1]. WS-BPEL employs the orchestration-based pattern that species an executable process that involves message exchanges with other systems, such that the message exchange sequences are controlled by the orchestration designer. WSBPEL denes an interoperable integration model that facilitates the expansion of automated process integration both within and between businesses. When deploying composite services, service providers often commit service-level agreements (SLAs) with their customers, which include performance and dependability related metrics. For example, mean response time and service dependability for each incoming request are guaranteed. It is therefore natural to directly trust and use SLA parameters specied or QoS published by service providers as model inputs to predict dependability of service compositions. However, SLA only provides a promised level that QoS of services are supposed to achieve. This promised level is unsuitable to be used as a direct barometer of actual run-time QoS , which constantly uctuates due to the dynamicness of environment (internet congestion, unexpected connection latency, resource contention, etc.) Some other contributions simply adopt the averagebased strategy in building architecture-based dependability models. These studies share a common idea that they all try to t historical QoS data of activities into assumed distributions (deterministic, exponential, geometrical, or general distributions) and employ these obtained distributions as the model input into the static stochastic models (continuous Markovian model, discrete Markovian model, or PERT (Program Evaluation and Review Technique, [5]) mode, etc.) to obtain the predicted dependability. In general, both SLA-based and the architecture-based models employ a static-model-input assumption. This assumption ignores the run-time uctuation of service dependability and dynamicness of runtime environment. Thus, one may nd innegligible errors between the results derived from these models and the actual runtime dependability. Our aim in this paper is therefore the development of a dynamic dependability prediction approach for WS-BPEL processes, with special attention to the modeling of compo192

978-0-7695-4944-6/12 $26.00 2012 IEEE DOI 10.1109/SOSE.2013.8

sitional patterns and dynamicness of service dependability in runtime environment. The main innovation includes a translation from WS-BPEL to the general stochastic Petri net (GSPN for short) and an analytical dependability prediction method based on the ARMA time-series model. In the case study, we obtain experimental dependability data of actual WS-BPEL processes and conduct a comparative study. The comparison suggests that our dynamic prediction model achieves higher prediction accuracy than existing approaches.

Similar studies can be found in [15] and [16]. Recently, some architecture-based approaches dedicated for WS-BPEL are also introduced. [13] proposes a method to interpret BPEL descriptions into stochastic Petri net and derives dependability estimates. However, its interpretation method is coarse-grained and only considers sequential and parallel patterns. Similar studies based on stochastic colored Petri net can be found in [14]. [17] and [18] propose a translation method to map BPEL-based service composition into CTMC chain and derives closed form estimates of service completion durations. However, the translation only considers < switch >, < while > and < f low > activities. A similar but better approach is proposed in [19], where all structural activities are modeled and analyzed. Our earlier studies in [20][21] introduce translationbased approaches to evaluating QoS of WS-BPEL and WSCDL processes. They are based on a series of translation rules to map compositional patterns into QoS-equivalent Petri nets. [22] presents a translation from BPEL into SPN and analyzes its dependability. Its translation covers all process level elements of WS-BPEL. Its results are obtained in a approximate way using WEBSPN tool (WEBSPN is based on a discrete time approximation where continuous distributional functions are simplied through a discrete sampling technique). Although the assumption of probabilistic distribution provides a more rened characterization of real dependability of services than that of deterministic variables and exponential variables, it still has limitations. In deriving the probability-distributional-functions (PDF) of QoS of service activities, above studies simply employ the historical empirical distribution as the actual PDF and assume such PDF is capable of characterize even the future changes of service dependability. In doing so, the cumulative ratio or density of equaling a certain value is considered to be the future rate of equaling such value, while ignoring the trend and seasonality by which the historical dependability values increase or decrease. For example, the empirical PDF of dependability of a service task may suggest a normal distribution. However, the empirical PDF may fails in capturing the fact that the density of dependability value being low increases, probably caused by the deteriorating connectivity of network. By contrast, a time series analysis may reveal the up-going trend and suggest a tailed distribution. In this case, only a time-series-based prediction of future dependability guarantees the correctness and accuracy.
193

Related work

During the last decade, the QoS of web services and service compositions has received a lot of attention in the research community. Various studies discussed how to specify and estimate the QoS of composite web services effectively based on the aggregations of the QoS of its constituent service activities or tasks. Various contributions ([6][7][8][9]) assume that each service activity has a deterministic dependability and these deterministic value can be easily derived from corresponding SLA documents. This assumption simplies the calculation of QoS. In this case, a composite service can be modeled as a static PERT (Program Evaluation and Review Technique, [5]) network with deterministic edges and the service completion time can be easily calculated as the longest execution path of the PERT network. However, the assumption of deterministic dependability is rarely satised in practice. This is because qualitative measures of web services are intrinsically probabilistic. For instance, the response time for invoking a remote service is usually probabilistic and depends on various uncertain factors as the connection bandwidth, the stability of remote connection, the load level of such service, the possibility of SOAP message loss, the existence of extra-long delay, etc. Instead of deterministic dependability, probabilistic and stochastic models for dependability analysis are also introduced. These approaches are based on the architecturebased-software-reliability theories [23] and interpret control ow of service execution as stochastic processes. From the architectural view, system dependability is decided by the compositional pattern of activities, probabilistic distributions of dependability of service activities, and branching probabilities of nondeterministic constructs. [10] is the seminal work in the literature of this kind. This work extends the Structural-Workow-Reduction (SWR) models in [27] into the stochastic case. The calculation repeatedly applies a reduction on various constructs (i.e., sequence, parallelism, selection, loop, and fault-tolerance) until only one atomic task remains. This study is for a general model of service compositions and is not intended for any specic service composition standard.

3
3.1

Preliminaries
WS-BPEL

to Box and Jenkins. ARMA models of order (p, q ) can be viewed as linear lters from the point of view of digital signal processing. The time structure of these lters is the following models: Zt = c + 1 Zt1 + ... + p Ztp 1 t1 ... q tq + t (1) where c is a constant, p is the number of autoregressive orders, q is the number of moving average orders, Z1 , Z2 ,....Zt1 is observation at time t, Zt is the variable to be predicted using previous samples of the time series, and t , t1 ,...,tq is a discrete white noise with zero mean and variance. Four iterative steps must be followed in order to construct ARM A(p, q ) models as below: a) Series stationarity; b) Model identication; c) Optimization and selection; d) Model diagnostic checking.

WS-BPEL [1] is an XML-based language that is standardized by OASIS to orchestrate multiple Web services for building complex business processes. A WS-BPEL process is composed of various activities including basic activities and structured activities. The basic activities describe the elemental steps of business process behavior, such as receive, reply, invoke, and assign. On the other hand, the structured activities, such as sequence, ow, if, and while, encode the control logic of a process and contain other basic and/or structured activities recursively. The structured activities are similar to the control constructs in the programming languages. For example, the activities contained within a sequence structure will be executed sequentially. The activities contained within a ow structure will be executed concurrently. In particular, the synchronization among the concurrent activities within a ow structure is provided using links. Each link connects a source activity to a target activity and has an associated transition condition (a Boolean XPath expression). The transition condition determines whether a link is followed during runtime. If the transition condition is not specied, the value of the link is dened to be true and the link will be followed.

Model translation of WS-BPEL

In this section, we provide translation rules to map BPEL into GSPN. Since the syntax of BPEL is too vast, we restrict it to a subset, only considering the elements directly related with the ow of activity execution and the main aspects of service composition. This translation captures the visible behavior of the participants of a service composition and their interactions.

3.2

General Stochastic Petri net

4.1

Translation of basic activities

The General Stochastic Petri net (GSPN) is an extension of Petri net, which is a graphical and mathematical tool used for modeling and analyzing of the concurrent, parallel, synchronous and asynchronous systems. The formal denitions of Petri nets and GSPN are given as follows. A Petri net (PN) is a quadruple (P, T, F, M0 ), where P = {p1 , p2 ..pk } is a nite set of places,T = {t1 , t2 ..tm } is a nite set of transitions, F (P T ) (T P ) is a set of directed arcs and M0 = {m01 , m02 , ..m0k } is an initial marking. The sets of input and output places for transition t are denoted by t and t, respectively. The input and output transitions for place p are denoted by p and p. In a GSPN [2], we distinguish two different kinds of transitions, the timed (in blank) and immediate transitions (in black color). The immediate transitions are combined with ring probabilities and the timed transitions are combined with an exponential ring rate.

3.3

The ARMA model

ARMA [3] model is a class of stochastic processes used to analyze time series. The application of the ARMA methodology for the study of time series analysis is due
194

We start the translation with the basic activity. A basic activity (like, for example, < invoke >, < assign >, < validate >, < empty >, and wait) is atomic and does not contain any other activity. Among those activities, only < invoke > is related to the interaction with external services. < invoke > provides the basic mechanism of remote invocation of external services (specied in the corresponding WSDL documents). A boolean join condition can be associated with this activity to determine whether the invocation is allowed. If the condition evaluates to true, the invoking process sends the SOAP message to the destination service with the request and waits until a reply is received or a timeout has red. After a successful SOAP reply is received before the expiration of the timer, the execution of the < invoke > activity is completed successfully. Since the SOAP connection is subject to message loss and unexpected message delay, < invoke > is considered to be unreliable and a SOAP failure probability is supposed to be associated. According to the discussion above, the < invoke > activity is translated into the GSPN model given in Fig.1. In this gure, the started and completed places indicate the initial and completed states of the process, respectively. The d invokee timed transition denotes the duration needed to

tim e r e x p ir e d a c tiv a te d

s t ar t e d

c o m pl e t e d

tim e o u t d te 1 d te 2 c o m p le te c o m p le te d iv k _ f fa ile d
< w a it> < a s s ig n > , < v a lid a te > , < e m p ty >

s t ar t e d

c o m pl e t e d

e x e c u tio n _ d tim e ly s ta r te d iv k s o a p_ f

fin is h e d

Figure 2. Translation of other basic activities

Figure 1. Translation of the < invoke > activity establish a successful SOAP connection with the operation dened in the WSDL specication. timer denotes the timeout duration. The j f ailure transition captures the failure of the join condition. Because the SOAP connections are prone to failure (caused by message loss, for instance), the soap err transition is used to capture the SOAP failure and it directly marks f ault (in gray) to indicate the unsuccessful invocation. If no SOAP failure occurs and the SOAP delay exceeds the timeout duration, the invocation of the WSDL operations is prevented and the f ault place is marked. Otherwise, the timeout transition is prevented and the invocation of the external operations is permitted and the f inished place is marked. In this case, the operations which implements the atomic process can either be faulty (by ring the ivk f transition and marking the f ault place) or successful (by ring the complete transition and marking the completed place). Note that the dte1 and dte2 (dte stands for dead-token-elimination) transition ensure that no dead token exists when the atomic process normally completes or fails. < assign >, < validate >, < empty > and < wait > activities are used to assign values to variables, to validates the state of variables, to do nothing and to wait for a period of time. Those basic activities are relatively simple and considered to be faultless because they are locally carried out and requires no connection with external services and need no message receipt or sending. Moreover, the execution duration for < assign >, < validate > and < empty > are considered to be negligible. Translation rules for those activities are therefore given in Fig.2. sponding pattern. For simplicity, the sample in the gure is assumed to have only two included inner activities, namely A1 and A2 (can be basic activity or structured activities). The activities inside a < f low > activity are executed concurrently. The translation rule is given in Fig.4. < switch > and < pick > activities both support conditional routing between included activities but they are actually different in the way of branch decision. Each branch of switch is associated with a local condition and branch decision is totally driven by local variables or computation. Conditional selection of branches is modeled in a probabilistic manner through a XOR-SPLIT manner. Each branch is associated with a selection probability for further dependability analysis. On the other hand, each branch of < pick > activity can associate an < onM essage > action to wait for a specic message or an < onAlarm > action to wait for a period of time, before included activity in the branch can really start execution. It waits for exactly one message (through an < onM essage > activity) or alarm event (through an < onAlarm > activity)to occur. For each of the events an activity is associated which is executed if the corresponding event occurs. Based on the difference mentioned above, translation rules of the two activities are given in Fig.5 and Fig.6, respectively. Note that, it is assumed that the < pick > example has an < onM essage > branch (A1 ) and an < onAlarm > branch (A2 ). Similar to Fig.1 timed transition soap ok denotes the duration to successfully receive SOAP message, immediate transition sopa err denotes SOAP error (due to message loss or unexpected message delay). Timed transition wait denotes the waiting duration of < onAlarm > (note that, since onAlarm requires external SOAP messages, it is considered to be without fault). Fig.7 illustrates the translation rule for < if > activity. The < if > activity consists of a list of conditions and

4.2

Translation of structural activities

We start this section by giving the translation rule of < sequence >. Activities embedded in a < sequence > activity are executed sequentially. Figure.3 shows the corre-

195

s t ar t e d 1 s t ar t e d s t ar t e d 2

A1

c o m pl e t e d1 faul t 1 s t ar t e d

s t ar t e d 1

A1

c o m pl e t e d1 faul t 1 c o m pl e t e d faul t

A 2 c o m pl e t e d2
faul t 2 faul t

s t ar t e d 2

A 2 c o m pl e t e d2
faul t 2

Figure 4. Translation of the < f low > activity Figure 3. Translation of the < sequence > activity
s o ap _ o k s t ar t e d 1 o m pl e t e d1 Ac1 faul t 1 c o m pl e t e d2 A2 faul t 2 faul t
faul t 2 faul t

c o m pl e t e d

s t ar t e d 1 s t ar t e d s t ar t e d 2

A1 A2

c o m pl e t e d1 c o m pl e t e d faul t 1

s t ar t e d

s o ap _ e r r s t ar t e d 2

Figure 6. Translation of the < pick > activity the inner activity in < repeatU ntil > is executed at least once. Translation rules for the two activity are illustrated in Fig.8 and Fig.9.

Figure 5. Translation of the < switch > activity

s t ar t e d 1 s t ar t e d if el sei f s t ar t e d 2 el se

A1
faul t 1

c o m pl e t e d

A2
faul t 2 faul t

s t ar t e d 3

A3
faul t 3

Figure 7. Translation of the if activity list of activities. The conditions are checked sequentially. If a condition evaluates to true, the corresponding activity is executed and, after that activity nishes, completes the < if > activity. The if activity encloses at least one activity, an arbitrary number of < elseif > branches, and an optional < else > branch. The conditions of the mandatory activity and those of the < elseif > branches are checked sequentially. < while > and < repeatU ntil > support repeated execution of an embedded activity. Whereas the embedded activity of the while activity is repeatedly executed while a given expression holds, the activity embedded in the < repeatU ntil > activity is executed until an expression holds. Consequently, inner activity in < while > can be skipped (the condition initially evaluates to false) whereas

The < f orEach > activity allows to parallel or sequentially process several instances of an embedded scope activity. An integer counter is dened which is running from a specied start counter value to a specied nal counter value (can be derived using static analysis on XPATH expressions [4]). The enclosed scope activity is then executed according to the range of the counter sequentially or in parallel. Since translation rules for sequential and parallel < f orEach > are very similar to those of < sequence > and < parallel >, they are omitted here.

Translating a WS-BPEL example

Based on the translation rules given above, this section shows how a real-world WS-BPEL sample can be translated into Petri nets. The sample is a purchase management process and its structure is illustrated in Fig.10. The process includes 8 < invoke > activities and is organized through < sequence >, < f low >, < switch > and < while > constructs. Based on the translation rules given in the previous section, the sample can be mapped into the Petri net representation in Fig.11.

196

b ac k s t ar t e d s ki p s t ar t e d 1 c o m pl e t e d1

A1
faul t 1 faul t

s t ar t e d s t ar t e d 1

b ac k c o m pl e t e d1

A1

s ki p faul t 1

c o m pl e t e d faul t

Figure 8. Translation of the < while > activity

Figure 9. Translation of the < repeatuntil > activity

s ta rt C o u n tin g (P 4 ) S h o p s e le c tio n (P 1 )

S hip p ing m a na ge m e nt (P 8)

P ro d u c ts V ie w ing (P 2 )

P ro d u c ts S e le c t io n ( P 3 )

In v e n to ry c h e c k (P 5 )

E le c tr o n ic p aym ent (P 6 )

C as h p aym ent (P 7 )

< seq u en ce> < w h ile> < seq u en ce>

< s w it c h >

< flo w >

en d

Figure 10. The purchase management process

d_invokee
1

ivk_f
1

soap_err 1 j_failure
1

d_invokee d_invokee
2 5

ivk_f
5

ivk_f
2

soap_err 2 j_failure
2

soap_err 5 j_failure
5

d_invokee
6

ivk_f
6

d_invokee
3

ivk_f
3

soap_err 6 j_failure
6

d_invokee
4

ivk_f
4

soap_err 3 j_failure
3

soap_err 4 j_failure
4

d_invokee
7

ivk_f
7

soap_err 7 j_failure d_invokee

8

ivk_f
8

soap_err 8 j_failure
8

Figure 11. The derived GSPN model

197

Predicting the ring rates and ring probabilities of the < invoke > activity

As discussed earlier, the < invoke > activity provides the basic mechanism of service invocation and composition. To predict the dependability of this activity, we rst have to predict the ring delays of its timed transitions and ring probabilities of its immediate transitions. Timed transitions correspond to two kinds of operations in the < invoke > activity, namely the timeout operation and operations of executing invoked services (the d invokee transition). The former always have invariable delays (prescribed by system settings) and the latter usually have nondeterministic delays. Instead of the static evaluation of model inputs, we dynamically t the historical data of these nondeterministic delays into a time-series model and predict the future ring rates using the ARMA method. The prediction is implemented as follows. For any d invokee transition, its empirical ring rate at time t, can be obtained as f r(t) = N 1iN,iN dl(t + (i 1) intv ) (2)

where dl(t) denotes measured execution duration for external service invocation at time t, N denotes the number of test samples with the time window, intv denotes the time interval of samples. This equation suggests that the ring rate can be calculated as the reciprocal of the mean of the N delay samples within the time window of [t, t + (N 1) intv ]. Thus, the ring rates measured at different times can be described as a sequence of data with equal time intervals F Rt = {f r(t (p 1) intv ), f r(t (p 2) intv ), ...., f r(t)} (3)

To study the dependability of ontology-based service compositions, we borrow concepts from the architecturebased-software-reliability theory [11]-[12], where the reliability block diagrams (RBD) are often employed as a representation of system architectures and quantitative model. The elementary congurations of a RBD include the sequential, selective, repetitive and parallel routing patterns. The dependability of the software architecture is therefore decided by both dependabilities of individual activities and the compositional patterns by which activities are organized. As for service compositions, we simply consider the atomic processes in WS-BPEL processes as activities in the RBD block diagrams. That is to say, the dependability of the composite service is decided by both dependabilities of individual atomic processes and their compositional patterns. This allows us to view a composite service as a combination of independent activities, which can be tackled and analyzed in a decomposed manner. We use process-normal-completion-probability (P N CP ) as the metric of dependability. From the GSPN view, P CN P denotes the probability that the completed place of the outer-most process is marked and no f ault place is marked. To calculate P N CP , we rst have to calculate dependability of < invoke > activity. Let P {f ault} denote the probability that place f ault in Fig.1 is marked, the dependability of the atomic process, DAP , can therefore be calculated as DAP = 1 P {f ault} (4) According to earlier discussions, the f ault place in Fig.1 can be marked for four reasons, namely the join failure (by ring immediate transition j f ailure), the SOAP error (by ring immediate transition soap err), the triggering of timeout (by ring timeout), and faults of invoked external services (by ring ivk f ). P {f ault} is therefore calculated as P {f ault} = pe(j f ailure) + (1 pe(j f ailure))pe(soap err) + (1 pe(j f ailure))(1 pe(soap err)) P T E (5) + (1 pe(j f ailure))(1 pe(soap err)) (1 P T E ) pe(ivk f ) where pe(j f ailure), pe(soap err) and pe(ivk f ) denote the predicted probabilities of ring j f ailure, soap err and ivk f , respectively. P T E denotes the probability of triggering timeout. P T E is calculated as rob{to < delayi } ef r(t)to (6)

where p is the volume of the time-series, intv is the interval of the time-series. The prediction of the ring probabilities of the j f ailure, soap err and ivk f immediate transitions are carried out similarly and are therefore omitted for brevity.

Dependability prediction

Dependability is dened by IFIP WG-10.4 as the trustworthiness of a computing system which allows reliance to be justiably placed on the service it deliver. For software systems, there is no dependability denition universally accepted and employed. Dependability is often regarded as a property or possibility for complex software systems to remain functionally normal when running or to successfully accomplish a given task.

where to denotes the timeout threshold and f r(t) denotes the predicted ring rate of the d invokee timed transition at time t.
198

1st <invoke> 2nd <invoke> 3rd <invoke> 4th <invoke>

5.2 5 4.8 4.6 4.4 4.2

4 3.8 3.6 5th <invoke> 6th <invoke> 7th <invoke> 8th <invoke> 0 10 20 30 40 50 60 70 80

3 3.4 2 0 10 20 30 40 50 60 70 80 3.2

Figure 12. d invokee14

Series

of

ring

delays

of

Figure 13. d invokee58

Series

of

ring

delays

of

0.022

0.025

0.02

0.018

0.02

0.016

0.014

1st <invoke> 2nd <invoke> 3rd <invoke> 4th <invoke>

5th <invoke> 6th <invoke> 7th <invoke> 8th <invoke>

0.015

0.012

0.01

10

20

30

40

50

60

70

80

0.01

10

20

30

40

50

60

70

80

Figure 16. Series of failure rates of ivk f14 As mentioned before, < assign >, < wait >, < empty > and < validate > are considered to be faultless. There dependabilities are therefore 1. Dependability calculation of composite processes is easier. For example, the dependability of < sequence > activity in Fig.3, DSE , is DSE = D1 D2 (7)

Figure 17. Series of failure rates of ivk f58 The dependability calculation of < while > activity needs more effort. Their dependabilities are decided by the dependability of the embedded activity and the number of repetitive executions. Let N RE denote the number of repetitive cycles to achieve completion (by marking the completed place in Fig.8), we have that the dependability for < while >, DW , is calculated as the total probability of i DW = D1 P rob{N RE = i} (9)
0i

where D1,2 denote dependability of sub-activities A1,2 . Note that this equation also applies to the < f low > ,< f orEach > activities. The dependability of the < if > activity, DIF , is decided by dependabilities of its two branches and the probability for the associated boolean condition to be true. DIF is therefore calculated as the weighted dependabilities of its branches. Note that this equation also applies to the < switch > and < pick > activities. DIF = pe(branch1 ) D1 + pe(branch2 ) D2 ... + pe(branchn ) Dn (8)

where P rob{N RE = i} denotes the probability that N RE equals i. Since the theoretical distribution of N RE is difcult to evaluate (some studies suggest that the probability of skipping repetition when every iteration ends can be approximately seen stable and the number of repetitive cycles therefore follows the geometrical distribution and employ the expectation of geometrical distribution in evaluating the QoS of repetitive constructs, e.g., [24][25][26][27]), we can approximately calculate P rob{N RE = i} as the occurrence rate of N RE equaling i based on the experimental test or historical runtime logs. That is f rq (N RE equaling i) P rob{N RE = i} (10) NT

199

0.05 0.045 0.04

0.025

0.02 0.035 0.03 0.025 0.02 0.015 0.01 0.01 1st <invoke> 2nd <invoke> 3rd <invoke> 4th <invoke> 5th <invoke> 6th <invoke> 7th <invoke> 8th <invoke> 0.015

10

20

30

40

50

60

70

80

10

20

30

40

50

60

70

80

Figure 14. Series SOAP err14

of

failure

rates

of

Figure 15. Series SOAP err58

of

failure

rates

of

where f rq (N RE equaling i) denote the frequency of the event of N RE equaling i and N T denotes the number of experimental trials. As discussed earlier, the < until > activity also supports the repetitive execution. However, it differs from < while > because it tests the loop condition after the rst round of the execution of A1 nishes. That is to say that the total round of executing A1 is the number of repetitive execution of A1 , N RE , plus the inevitable rst round. RRW =
0i i+1 D1 P rob{N RE = i}

0.85 0.84 0.83 0.82 0.81 0.8 0.79

Real reliabilities ARMAbased Predicted reliabilities Architecturebased predicted reliabilities

(11)

0.78 0.77

Based on analysis above, the dependability of the entire WS-BPEL process, P N CP , can therefore be calculated as the dependability of the outermost activity.

0.76 0.75 0 10 20 30 40 50 60 70 80

8 Experiments and validation

To prove the feasibility and accuracy of our prediction model, we conduct a case study based on the WS-BPEL sample of Fig.10. The sample is executed using the Active BPEL engine and the runtime QoS data are collected through the log les of the engine. The WS-BPEL sample includes eight atomic < invoke > activities, which are responsible for remote invocation of external services. For time-series-based analysis, we obtain the series of SOAP delays for external service invocation of the eight < invoke > activities, which correspond to the ring delay series of the d invokee18 transitions in Fig.11. These series are illustrated in Fig.1213. The intervals for these series is 250ms. The timeout threshold for all invoke activities is 800ms. We also obtain the series of the probabilities of SOAP failures and invocation failures, which correspond to the ring probabilities of the soap err18 and ivk f18 immediate transitions. These series are illustrated in Fig.14-17. Figure 18. The comparison of prediction results

Note that the join conditions for the sample always evaluate to true. pe(j f ailure18 ) are therefore always 0. Using the Petri-net-based prediction model , we can predict the future DW P of the sample process. The predicted DW P results are compared with the actual probabilities of normal completion and the architecture-based prediction results in Fig.18. As can be seen, our approach achieves better curve-tting than the traditional the architecture-based prediction model.

Conclusions

In this manuscript, we present a comprehensive dependability prediction framework for WS-BPEL service compo-

200

sitions. This framework employs the ARMA time series model to capture the qualitative uctuation and predict future QoS of service activities. The predicted future values serve as model inputs into a translation model, which maps WS-BPEL process into general stochastic Petri net. An analytical method based on the derived Petri net is introduced to predict future system dependability. In the case study based on experimental results from a real-world WS-BPEL service process, we conduct a comparative study with traditional QoS prediction models for service compositions and show that our framework achieves better accuracy and characterization of QoS uctuations. Based on the work of this paper, we are also considering further studies given as follows. Developing tools for automatic translation for reliability/dependability computation. It is hoped that a new tool for automatic Petri-net-translation and reliability analysis will be realized. Introducing methods to predict other metrics such as performance, mobility, reputation, maintainability, reusability, etc. Developing selection and scheduling algorithms. Based on our framework, one can easily predict the dependability of a given composite service process. However, sometimes we are more interested to know for a given process denition, how to choose from many functionally identical but qualitatively different services, and schedule those chosen services to achieve the best reliability. We are developing selection and scheduling algorithms based on our current models.

[5] D.G. Malcolm, J.H. Rooseboom, C.E. Clark, W. Fazer Application of a technique for research and development program evaluation, Operations Research, 7 (1959), pp. 646-669 [6] Jorge Cardoso, Amit P. Sheth, John A. Miller, Jonathan Arnold and Krys Kochut: Quality of service for workows and web service processes. J. Web Sem. 1(3): 281-308 (2004) [7] Michael Gillmann, Gerhard Weikum, Wolfgang Wonner: Workow management with service quality guarantees. SIGMOD Conference 2002: 228-239 [8] M.C. Jaeger, G. Rojec-Goldmann, G. Muhl. QoS aggregation for Web service composition using workow patterns, in: Proceedings of IEEE 8th International Conference on Enterprise Distributed Object Computing (EDOC04), 2004, pp. 149-159 [9] H.C. Wang, C.S. Lee, T.H. Ho, Combining subjective and objective QoS factors for personalized Web service selection, Expert Systems with Applications 32 (2) (2007) 571-584. [10] San-Yih Hwang, Haojun Wang, Jian Tang, Jaideep Srivastava: A probabilistic approach to modeling and estimating the QoS of web-services-based workows. Inf. Sci. 177(23): 5484-5503 (2007) [11] Swapna S. Gokhale, W. Eric Wong, Joseph Robert Horgan, Kishor S. Trivedi: An analytical approach to architecture-based software performance and reliability prediction. Perform. Eval. 58(4): 391-412 (2004) [12] Vibhu Saujanya Sharma, Kishor S. Trivedi: Quantifying software performance, reliability and security: An architecture-based approach. Journal of Systems and Software 80(4): 493-509 (2007) [13] Wen-jun Li, Xiao-jun Liang, Hua-mei Song, and Xiao-cong Zhou, QoS-Driven Service Composition Modeling with Extended Hierarchical CPN, Proc. IEEE/IFIP Symposium on Theoretical Aspects of Software Engineering, pp.483-492, June 2007. [14] PengCheng Xiong, Yushun Fan, and MengChu Zhou, QoS-Aware Web Service Conguration, IEEE Transactions on Systems, Man, and Cybernetics, Part A, vol.38, no.4, pp.888-895, July 2008. [15] Paolo Bocciarelli, and Andrea DAmbrogio, ModelDriven Performability Analysis of Composite Web Services, Proc. Performance Evaluation: Metrics, Models and Benchmarks, SPEC International Performance Evaluation Workshop, pp.228-246, June 2008.
201

References
[1] https://www.oasis-open.org/committees/wsbpel/ [2] Gianfranco Balbo, Introduction to Generalized Stochastic Petri Nets, Proc. 7th International School on Formal Methods for the Design of Computer, Communication, and Software Systems, pp. 83-131, May 2007. [3] Makridakis, S., Wheelwrigth, S. C., and Hyndman, R. J. : Forecasting methods and applications, Prentice Hall, 1998, pp. 46-59. [4] Moser S., Martens A., Gorlach K. Amme, and W. Godlinski A., Advanced verication of distributed WS-BPEL business processes incorporating CSSAbased data ow analysis, Proc. IEEE International Conference on Services Computing, pp.9-13, July 2007.

[16] Jiangxia Wu, and Fangchun Yang, A Model-Driven Approach for QoS Prediction of BPEL Processes, Proc. International Conference on Service-Oriented Computing, pp.131-140, Dec. 2006. [17] N. Sato, and Kishor S. Trivedi, Stochastic Modeling of Composite Web Services for Closed-Form Analysis of Their Performance and Reliability Bottlenecks, Proc. International Conference on Service-Oriented Computing, pp.107-118, Sep. 2007. [18] Andrea DAmbrogio, and Paolo Bocciarelli, A model-driven approach to describe and predict the performance of composite services, Proc. Workshop of software performance, pp.78-89, Feb. 2007. [19] Debdoot Mukherjee, Pankaj Jalote, and Mangala Gowri Nanda, Determining QoS of WS-BPEL Compositions. Proc. International Conference on ServiceOriented Computing, pp.378-393, Dec. 2008. [20] Yunni Xia, Yi Liu, Ji Liu, Qingsheng Zhu: Modeling and Performance Evaluation of BPEL Processes: A Stochastic-Petri-Net-Based Approach. IEEE Transactions on Systems, Man, and Cybernetics, Part A 42(2): 503-510 (2012) [21] Yunni Xia, Gang Dai, Jia Li, Tianhao Sun, Qingsheng Zhu: A model-driven approach to predicting dependability of WS-CDL based service composition. Concurrency and Computation: Practice and Experience 23(10): 1127-1145 (2011) [22] Dario Bruneo, Salvatore Distefano, Francesco Longo and Marco Scarpa, QoS Assessment of WS-BPEL Processes through non-Markovian Stochastic Petri Nets, Proc. IEEE International Symposium on Parallel and Distributed Processing, pp.1-12, April 2010. [23] Swapna S. Gokhale, Kishor S. Trivedi. Reliablity prediction and sensitivity analysis based on software architecture. in Proc. 13th IEEE International Symposium on Software Reliability Engineering 2002:64-78 [24] Yajuan Li, Chuang Lin, Quan-Lin Li: A simplied framework for stochastic workow networks. Computers and Mathematics with Applications 56(10): 2700-2715 (2008) [25] Swapna S. Gokhale, Kishor S. Trivedi: Analytical Models for Architecture-Based Software Reliability Prediction: A Unication Framework. IEEE Transactions on Reliability 55(4): 578-590 (2006) [26] Yunni Xia, Hanpin Wang, Wangsen Feng, Yu Huang: QoS modeling and analysis of component-based software systems: a stochastic approach. Concurrency and
202

Computation: Practice and Experience 20(12): 13591385 (2008) [27] Jorge Cardoso, Amit P. Sheth, John A. Miller, Jonathan Arnold, Krys Kochut: Quality of service for workows and web service processes. J. Web Sem. 1(3): 281-308 (2004)