Choreographies and Behavioural Contracts on the Way to Dynamic Updates

Abstract

We survey our work on choreographies and behavioural contracts in multiparty interactions. In particular theories of behavioural contracts are presented which enable reasoning about correct service composition (contract compliance) and service substitutability (contract refinement preorder) under different assumptions concerning service communication: synchronous address or name based communication with patient non-preemptable or impatient invocations, or asynchronous communication. Correspondingly relations between behavioural contracts and choreographic descriptions are considered, where a contract for each communicating party is, e.g., derived by projection. The considered relations are induced as the maximal preoders which preserve contract compliance and global traces: we show maximality to hold (permitting services to be discovered/substituted independently for each party) when contract refinement preorders with all the above asymmetric communication means are considered and, instead, not to hold if the standard symmetric CCS/pi-calculus communication is considered (or when directly relating choreographies to behavioral contracts via a preorder, no matter the communication mean). The obtained maximal preorders are then characterized in terms of a new form of testing, called compliance testing, where not only tests must succeed but also the system under test (thus relating to controllability theory), and compared with classical preorders such as may/must testing, trace inclusion, etc. Finally, recent work about adaptable choreographies and behavioural contracts is presented, where the theory above is extended to update mechanisms allowing choreographies/contracts to be modified at run-time by internal (self-adaptation) or external intervention.

Foundations of Coordination and Contracts and Their Contribution to Session Type Theory

“…On the contrary, if we restrict to output persistent contracts or we consider asynchronous communication, we have that the maximal independent refinement pre-order exists: it can be achieved by considering a coarser form of refinement in which, given any system composed of a set of contracts, refinement is applied to one contract only (thus leaving the others unchanged). This form of refinement, that we call compliance testing [11], is a form of testing where both the test and the system under test must reach success. Given a system P , we use loc(P ) to denote the subset of Loc of the locations of contracts syntactically occurring inside P .…”

Keep me out of the loop: a more flexible choreographic projection

“…Languages for expressing choreographies are used also for the purposes of documenting, specifying, testing, and verifying the communication behaviour of concurrent systems, in textual and visual forms [3,4,6,8,16,17,24,25,31,33,34,41,47,51]. For example, multiparty session types are abstract choreographies that do not specify how message payloads are computed (as in choreographic programming), but only their types [31].…”

“…The design philosophy is: if a process is active in a branch of a conditional, then something interesting happens in that branch, and we need to project it; otherwise we should ignore it. This yields four cases for projecting a conditional for a process p not evaluating the guard: (i) p is active in both branches: then something interesting happens in both branches, and we project both branches and merge them as before; (ii) p is inactive in both branches: then it is not involved in any of the branches, and we project it as bnil; (iii) p is active in the then-branch and inactive 6 and passive in the else-branch: this is the situation illustrated in Examples 1 and 3, and as discussed we should only project the then-branch -see rule pproj_cond_ap below; (iv) the symmetric case where p is active in the else-branch and inactive and passive in the then-branch. Example 4.…”

“…Note that sets are represented as lists in the formalisation 6. Well-formedness prevents a process from being active and passive simultaneously, but the definitions allow for it, and including this hypothesis simplifies a number of proofs 7.…”