Model checking service compositions under resource constraints

  • Authors:

  • Howard Foster;Wolfgang Emmerich;Jeff Kramer;Jeff Magee;David Rosenblum;Sebastian Uchitel

  • Affiliations:

  • Imperial College London, London, United Kingdom;University College London, London, United Kingdom;Imperial College London, London, United Kingdom;Imperial College London, London, United Kingdom;University College London, London, United Kingdom;Imperial College London, London, United Kingdom

  • Venue:
  • Proceedings of the the 6th joint meeting of the European software engineering conference and the ACM SIGSOFT symposium on The foundations of software engineering
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

When enacting a web service orchestration defined using the Business Process Execution Language (BPEL) we observed various safety property violations. This surprised us considerably as we had previously established that the orchestration was free of such property violations using existing BPEL model checking techniques. In this paper, we describe the origins of these violations. They result from a combination of design and deployment decisions, which include the distribution of services across hosts, the choice of synchronisation primitives in the process and the threading configuration of the servlet container that hosts the orchestrated web services. This leads us to conclude that model checking approaches that ignore resource constraints of the deployment environment are insufficient to establish safety and liveness properties of service orchestrations specifically, and distributed systems more generally. We show how model checking can take execution resource constraints into account. We evaluate the approach by applying it to the above application and are able to demonstrate that a change in allocation of services to hosts is indeed safe, a result that we are able to confirm experimentally in the deployed system. The approach is supported by a tool suite, known as WS-Engineer, providing automated process translation, architecture and model-checking views.