Deciding Choreography Reliazability

1. Deciding Choreography Reliazability Samik Basu Iowa State University Tevfik Bultan University of California at Santa Barbara Meriem Ouederni University of Malaga

2. Motivation 1: Web Services • Web services support basic client/server style interactions • Example: Amazon E-Commerce Web Service (AWS-ECS) WSDL Request Service Provider Service Requester SOAP Response Server Client

3. Service Composition via Choreography • Can we compose a set of services to construct a new service? • For example: • If we are building a bookstore service, we may want to use both Amazon’s service and Barnes & Noble’s service in order to get better prices Choreography: A specification of how the individual services that participate to a composite service should interact with each other • A choreography is a global specification of interactions among services • Web Services Choreography Description Language (WS-CDL)

4. Motivation 2: Singularity OS • Experimental OS developed by Microsoft Research to explore new ideas for operating system design focusing on dependability • Software Isolated Processes (SIPs) • Closed code space (no dynamic code loading or code generation) • Closed object space (no shared memory) • Inter-process communication occurs via message passing over channels • Singularity channels allow 2-Party asynchronous communication via FIFO message queues • Sends are non blocking • Receives block until a message is at the head of a receive queue

5. Singularity Channel Contracts • Written in Sing # • Contracts specify two things: • The messages that may be sent over a channel • out message are sent from the Server endpoint to the Client endpoint (SC) • in messages are sent from the Client endpoint to the Server endpoint (CS) • The set of allowed message sequences • out message marked with ! • in messages marked with ? publiccontract KeyboardDeviceContract { outmessage AckKey( uint key ); outmessage NakKey(); outmessage Success(); inmessage GetKey(); inmessage PollKey(); state Start { Success! -> Ready; } state Ready { GetKey? -> Waiting; PollKey? -> (AckKey! or NakKey!) -> Ready; } state Waiting { AckKey! -> Ready; NakKey! -> Ready; } }

6. Motivation 3: Erlang • Erlang is a general purpose programming language developed initially at Ericsson for improving dependability of telephony applications • In Erlang distributed processes do not share memory and only interact with each other via exchanging messages asynchronously • UBF(B) is a language for specifying communication contracts in distributed Erlang programs. • UBF(B) specifications list transitions between states where each transition is identified with a request (the message received) and response (the message sent) +NAME(“IRC SERVER”) ... +STATE start logon() => ok() & active | error() & stop +STATE active ls() => files() & active getFile() => fileSent() & active | noFileErr() & stop ...

7. Common: Asynchronous Messaging • Sender does not have to wait for the receiver • Message is inserted to a message queue • Messaging platform guarantees the delivery of the message • Why support asynchronous messaging? • Otherwise the sender has to block and wait for the receiver • Sender may not need any data to be returned • If the sender needs some data to be returned, it should only wait when it needs to use that data • Asynchronous messaging can alleviate the latency of message transmission through the Internet • Asynchronous messaging can prevent sender from blocking if the receiver service is temporarily unavailable • Rather then creating a thread to handle the send, use asynchronous messaging

8. Common: Conversations • Specifications of message-based asynchronous communication • Web Service Choreography Specifications: Global specification of interactions for composition of services • Singularity Channel Contracts: Coordinating inter-process communication in Singularity OS • Erlang Communication Contracts: Coordinating interactions among distributed processes • All these specifications can be modeled as state machines and they all specify sequences of send actions (aka, conversations): Conversation: A sequence of send actions Conversation Protocol (aka Choreography): Specifies a set of conversations

9. Example Singularity Channel Contract • A Singularity channel contract corresponds to a finite state machine • Each message causes a deterministic transition from one state to another state KeyboardDeviceContract publiccontract KeyboardDeviceContract { outmessage AckKey( uint key ); outmessage NakKey(); outmessage Success(); inmessage GetKey(); inmessage PollKey(); state Start { Success! -> Ready; } state Ready { GetKey? -> Waiting; PollKey? -> (AckKey! or NakKey!) -> Ready; } state Waiting { AckKey! -> Ready; NakKey! -> Ready; } } Start SC:AckKey SC:AckKey SC:Success Implicit State CS:PollKey CS:GetKey Waiting Ready Ready$0 SC:NakKey SC:NakKey

10. Example Singularity Channel Contract • Each contract state machine specifies a set of conversations, i.e., it is a conversation protocol: KeyboardDeviceContract Start SC:AckKey SC:AckKey SC:Success CS:PollKey CS:GetKey Waiting Ready Ready$0 SC:NakKey SC:NakKey Conversation set: Success(GetKey(AckKey|NakKey)|PollKey(AckKey|NakKey))*

11. Going to Lunch at UCSB • At UCSB Samik, Meriem and I were using the following protocol for going to lunch: • Sometime around noon one of us would call another one by phone and tell him where and when we would meet for lunch. • The receiver of this first call would call the remaining peer and pass the information. • Let’s call this protocol the First Caller Decides (FCD) protocol. • At the time we did not have answering machines or voicemail due to budget cuts at UC!

12. FCD Protocol Scenarios • Possible scenario • Tevfik calls Samik with the decision of where and when to eat • Samik calls Meriem and passes the information • Another scenario • Samik calls Tevfik with the decision of where and when to eat • Tevfik calls Meriem and passes the information • Yet another scenario • Tevfik calls Meriem with the decision of where and when to eat • Maybe Samik also calls Meriem at the same time with a different decision. But the phone is busy. • Samik keeps calling. But Meriem is not going to answer because according to the protocol the next thing Meriem has to do is to call Samik. • Meriem calls Samik and passes the information

13. FCD Protocol: Tevfik’s Behavior Let’s look at all possible behaviors of Tevfik based on the FCD protocol Tevfik is hungry Tevfik receives a call from Samik passing him the lunch decision Tevfik calls Samik with the lunch decision Tevfik receives a call from Meriem passing him the lunch decision Tevfik calls Meriem with the lunch decision Tevfik receives a call from Meriem telling him the lunch decision that Tevfik has to pass to Samik

14. FCD Protocol: Tevfik’s Behavior T->S:D Message Labels: Tevfik calls Samik with the lunch decision !send ?receive S->M:P Samik calls Meriem to pass the decision !T->S:D ?S->T:P ?M->T:P !T->M:D ?M->T:D ?S->T:D !T->M:P !T->S:P

15. State machines for the FCD Protocol • Three state machines characterizing the behaviors of Tevfik, Meriem and Samik according to the FCD protocol Tevfik Meriem Samik ?T->S:P ?S->T:P !S->T:D ?S->M:P !M->S:D !T->S:D ?T->M:P ?M->T:P !M->T:D !T->M:D ?M->S:P !S->M:D ?M->T:D ?S->M:D ?T->M:D ?S->T:D ?T->S:D ?M->S:D !M->S:P !M->T:P !T->S:P !S->M:P !S->T:P !T->M:P

16. FCD Protocol Has Voicemail Problems • After the economy started to recover, the university installed a voicemail system FCD protocol started causing problems • We were showing up at different restaurants at different times! • Example scenario: • Tevfik calls Meriem with the lunch decision • Samik also calls Meriem with the lunch decision • The phone is busy (Meriem is talking to Tevfik) so Samik leaves a message • Meriem calls Samik passing the lunch decision • Samik does not answer (he already left for lunch) so Meriem leaves a message • Samik shows up at a different restaurant! • Message sequence is: T->M:D S->M:D M->S:P • The messages S->M:D andM->S:P are never consumed • This scenario is not possible without voicemail!

17. A Different Lunch Protocol • To fix this problem, I suggested that we change our lunch protocol as follows: • As the most senior researcher among us I would make the first call to either Meriem or Samik and tell when and where we would meet for lunch. • Then, the receiver of this call would pass the information to the other peer. • Let’s call this protocol the Tevfik Decides (TD) protocol

18. State machines for the TD Protocol • TD protocol works fine with voicemail! Meriem Tevfik Samik ?S->M:P ?M->S:P ?T->M:D ?T->S:D !T->S:D !T->M:D !S->M:P !M->S:P

19. FCD and TD Conversation Protocols TD Protocol FCD Protocol T->M:D S->M:D T->S:D T->M:D M->S:D M->T:D T->S:D S->T:D S->M:P T->S:P T->M:P S->T:P M->S:P S->M:P M->T:P M->S:P Conversation set: { T->M:D M->S:P, T->S:D S->M:P, M->T:D T->S:P, M->S:D S->T:P, S->T:D T->M:P, S->M:D M->T:P } Conversation set: { T->S:D S->M:P, T->M:D M->S:P}

20. Observation & Question • The implementation of the FCD protocol does not obey the FCD protocol if asynchronous communication is used • Implementation of the TD protocol obeys the TD protocol even if asynchronous communication used • Given a conversation protocol can we figure out if there is an implementation which generates the same conversation set?

21. Realizability • Conversation protocols identify the global communication behavior • How do we implement processes that conform to the conversation protocol? • Realizability question: • Given a conversation protocol, are there processes whose communication behavior in terms of conversations (i.e., send sequences) is equal to the set of conversations (i.e., send sequences) specified by the conversation protocol? • The FCD protocol is unrealizable • The TD protocol is realizable ? Conversations specified by the conversation protocol Conversations generated by some processes 

22. Top-Down Verification T->S:D T->M:D Conversation Protocol (Choreography Specification) LTL property ? F(S->M:P  M->S:P) S->M:P M->S:P Peer T Peer X Peer J Input Queue !T->S:D ?M->S:P ?S->M:P ?T->M:D ?T->S:D !T->M:D !S->M:P !M->S:P ... ? Conversation F(S->M:P  M->S:P) LTL property

23. Unrealizable Conversation Protocols • There are unrealizable conversation protocols: BA:m2 AB:m1 AB: m1 AB: m1 BA:m2 AB:m1 CD: m2 CA: m2 AC:m3

24. Unrealizable Examples • Some conversation protocols are unrealizable! AB: m1 !m2 ?m2 ?m1 !m1 CD: m2 Peer A Peer B Peer C Peer D Conversation protocol Projections of the protocol to the processes Conversation “m2 m1” will be generated by all implementations which follow the protocol

25. Unrealizable Examples • Some conversation protocols are unrealizable! AB: m1 !m1 !m2 ?m1 CA: m2 ?m2 Peer B Peer C Conversation protocol Peer A Projections of the protocol to the processes Conversation “m2 m1” will be generated by all implementations which follow the protocol

26. Unrealizable Examples Conversation: A B A, C m2 m2 m1 BA:m2 AB:m1 m3 B m1 BA:m2 C m3 AB:m1 AC:m3 m2 m1 m3 Generated conversation:

27. Challenge & Contribution • Finite state processes that communicate with FIFO message queues can simulate Turing Machines • Checking conformance to a conversation protocol is undecidable • We show that conversation protocol realizability problem is decidable • We implemented the realizability check and applied it to many specifications • Demonstrated that realizability can be checked efficiently in practice

28. Refining Realizability • Just looking at equivalence of the conversation sets is not enough ? Conversations specified by the conversation protocol  Conversations generated by some processes

29. Another Conversation Protocol aP1->P2 aP1->P2 bP2->P1 cP2->P1 bP2->P1 A conversation protocol for 2 processes: P1 and P2

30. Projections on P1 and P2 Process P1 !a !a ?b ?c ?b Process P2 ?a ?a !b !c !b

31. Synchronous Communication Process P1 !a !a aP1->P2 ?b ?c ?b bP2->P1 cP2->P1 Process P2 ?a ?a !b !c !b

32. Synchronous Communication Process P1 !a !a aP1->P2 aP1->P2 ?b ?c ?b bP2->P1 cP2->P1 bP2->P1 Process P2 ?a ?a !b !c !b

33. Synchronous Communication Process P1 !a !a aP1->P2 aP1->P2 ?b ?c ?b bP2->P1 cP2->P1 bP2->P1 Process P2 ?a ?a !b !c !b

34. Synchronous Communication Process P1 !a !a aP1->P2 aP1->P2 ?b ?c ?b bP2->P1 cP2->P1 bP2->P1 Process P2 ?a ?a !b !c !b

35. Synchronous Communication Process P1 !a !a aP1->P2 aP1->P2 ?b ?c ?b bP2->P1 cP2->P1 bP2->P1 Process P2 ?a ?a !b !c !b BLOCKED

36. Synchronous Communication Process P1 !a !a aP1->P2 aP1->P2 ?b ?c ?b bP2->P1 cP2->P1 bP2->P1 Process P2 ?a ?a Conversations sets are equal but processes may get stuck !b !c !b

37. Asynchronous Communication Process P1 Queue: !a !a ?b ?c ?b Queue: Process P2 ?a ?a !b !c !b

38. Asynchronous Communication Process P1 Queue: !a !a aP1->P2 ?b ?c ?b Queue: a Process P2 ?a ?a !b !c !b

39. Asynchronous Communication Process P1 Queue: !a !a aP1->P2 ?b ?c ?b Queue: Process P2 ?a ?a !b !c !b

40. Asynchronous Communication Process P1 Queue: !a !a aP1->P2 ?b ?c ?b bP2->P1 Queue: Process P2 ?a ?a !b !c !b

41. Asynchronous Communication Process P1 Queue: !a !a aP1->P2 aP1->P2 ?b ?c ?b bP2->P1 Queue: a Process P2 ?a ?a !b !c !b

42. Asynchronous Communication Process P1 Queue: !a !a aP1->P2 aP1->P2 ?b ?c ?b bP2->P1 Queue: Process P2 ?a ?a !b !c !b

43. Asynchronous Communication Process P1 Queue: c !a !a aP1->P2 aP1->P2 ?b ?c ?b cP2->P1 bP2->P1 Queue: Process P2 ?a ?a !b !c !b

44. Asynchronous Communication Process P1 Queue: c !a !a aP1->P2 aP1->P2 ?b ?c ?b Cannot consume c cP2->P1 bP2->P1 Queue: Process P2 ?a ?a !b !c !b

45. Asynchronous Communication Process P1 Queue: c !a !a aP1->P2 aP1->P2 ?b ?c ?b Cannot consume c cP2->P1 bP2->P1 Queue: Process P2 ?a ?a !b !c !b

46. Realizability Requirements We refine our realizability condition to eliminate such cases. We have two requirements for realizability: • Conversations specified by the conversation protocol = Conversations generated by the asynchronous system • Asynchronous system is well-formed: All sent messages can be eventually consumed Conversation protocol is realizable if and only if there exists such an asynchronous system

47. Summary of our contribution Conversation protocol: C Asynchronous System • with unbounded buffer:I • with k size communication buffer: Ik Synchronous System: I0 C is realizable if and only Cis equivalent to determinizedI1 obtained from projections of C

48. Determinizing Projections Process P1 !a !a ?b ?c ?b Process P2 ?a ?a !b !c !b

49. Determinizing Projections Peer P1 !a !a !a ?c ?b ?c ?b ?b Peer P2 ?a ?a ?a !c !b !c !b !b

50. Observation 1: Behavioral Order • Behavior exhibited by projections when communicating synchronously is larger than the conversation • Behavior exhibited by projections when communicating asynchronously is larger than that exhibited by projections when communicating synchronously C ≤I0 ≤ I1 ≤ I2 ≤ … ≤ I