Veit Hagenmeyer
email: veit.hagenmeyer@basf.com

Emmanuel Delaleau
email: delaleau@enib.fr.

Robustness Analysis with Respect to Exogenous Perturbations for Flatness-Based Exact Feedforward Linearization

Keywords: Nonlinear systems, tracking control, differential flatness, exact feedforward linearization, stability analysis, exogenous perturbations, robustness. I

A methodology to analyze robustness with respect to exogenous perturbations for exact feedforward linearization based on differential flatness is presented. The analysis takes into consideration the tracking error equation and makes thereafter use of a stability result by Kelemen coupled with results issued from interval analysis. This turns exact feedforward linearization based on differential flatness into a general control methodology for flat systems.

if the initial condition is known. Exact feedforward linearization is recalled in the context of exogenous perturbations and time varying parameters after the following brief representation of differential flatness:

For the sake of simplicity, only SISO flat systems are considered in the sequel without loss of generality (cf. [START_REF] Hagenmeyer | Exact feedforward linearization based on differential flatness[END_REF] for the MIMO case). Given the SISO nonlinear system ẋ(t) = f(̟(t), x(t), u(t)) [START_REF] Sira-Ramírez | Differentially Flat Systems[END_REF] with x(0) = x 0 . Thereby it holds that the time t ∈ R, the state x(t) ∈ R n , and the input u(t) ∈ R. The exogenous perturbations (or time-varying system parameters) t → ̟(t) ∈ R q are supposed to be modeled either by known sufficiently smooth time functions in the time-varying parameter case or close to physical reality by consecutive Heaviside jumps with microstructure in the exogenous perturbation case. Heaviside jumps with microstructure are a so-called class of Heaviside generalized functions [START_REF] Colombeau | Multiplication of Distributions[END_REF]. Roughly speaking, Heaviside jumps with microstructure have an infinitely smooth jump transition at the origin (and in an ǫ-neighborhood around it), therefore ̟ ∈ C ∞ . The exogenous perturbations or time-varying parameters are supposed to be partitionable as:

̟ (j) (t) = ̟ (j) o (t) + ̟(j) (t), ̟(j) i (t) ∈ [̟ (j) i , ̟ (j)
i ], i = 1, . . . , q, j = 0, . . . , n -1

where ̟ o is the nominal value of the exogenous perturbations2 or time-varying parameters and their time derivatives respectively. In (1) the vector field f : R q × R n × R → R n is considered to be smooth. The system (1) is said to be (differentially) flat 3 iff for all ̟(t) satisfying ( 2) there exists a flat output z ∈ R, such that

z = F (x) (3
) x = φ(Π, z, ż, . . . , z (n-1) ) (4) u = ψ(Π, z, ż, . . . , z (n) )

with Π = [Π 1 , Π 2 , . . . , Π q ] T = [̟ 1 , ̟1 , ̟1 , . . . , ̟

(n-1) 1

, ̟ 2 , ̟2 , . . . , ̟ q , . . . , ̟ (n-1) q ] T (Correspondingly, Π o denotes the nominal value of Π.) Thereby F , φ and ψ are smooth functions at least in open subsets 4 of R n , R n(q+1) or R n(q+1)+1 , respectively. For the sake of simplicity, it is furthermore assumed in the sequel that the flat output is independent of Π in two ways: in (3), first the function F is independent of Π, and second F is the same function for all Π defined by (2). 5The equations6 (4) and ( 5) yield -under the assumption of the knowledge of Πthat for every given trajectory of the flat output t → z(t), the evolution of all other variables of the system t → x(t) and t → u(t) are given without integration of any differential equation. Moreover, for a sufficiently smooth desired trajectory of the flat output t → z * (t), eqn. ( 5) can be used to design the corresponding feedforward u * (t) directly for the nominal Π o . The trajectory z * is called the nominal trajectory, while the trajectory u * is called the nominal control. The family of nominal feedforwards is given by

u * (t) = ψ(Π o (t), z * (t), ż * (t), . . . , z * (n) (t)) (6)
that is, for each admissible nominal trajectory z * , there is a nominal feedforward u * . Definition 2.1: The initial condition of the desired trajectory of the flat output t → z * (t) is defined by

z * 0 = [z * (0), ż * (0), . . . , z * (n-1) (0)] T . It is consistent with the initial condition x 0 , if x 0 = φ(Π o (0), z * 0 ) (c.f. eqn. (4)).
Exact feedforward linearization based on differential flatness established in [START_REF] Hagenmeyer | Exact feedforward linearization based on differential flatness[END_REF] can be generalized to the case of exogenous perturbations as follows: to this end, interpret (1) and (3) as a control system with input u, state x and output z.

Theorem 2.1: If the desired trajectory of the flat output is consistent with the initial condition x 0 , and Π = Π o holds for all times, the application of the nominal control (6) to the control system (1) yields an output that satisfies z(t) = z * (t), ∀ t ≥ 0, i.e. the output of the nonlinear system (1)-( 3) corresponds to the output of a Brunovský system driven by z * (n) and initialized at z * 0 . Proof: Considering the results of [START_REF] Jakubczyk | On linearization of control systems[END_REF], [START_REF] Charlet | On dynamic feedback linearization[END_REF], it is easy to show, that every SISO 7 flat system can be represented as follows. Setting

z = [z, ż, . . . , z (n-1) ] T = [z 1 , z 2 , . . . , z n ] T (7)
the system (1) can be transformed via the well defined state transformation

z = F (Π o , x) (8)
(where F is equal to the solution of ( 4)) w.r.t. z, into the control normal form

żi (t) = z i+1 (t), i ∈ {1, . . . , n -1} żn (t) = α(Π o (t), z(t), u(t)) (9)
where α is also smooth with respect to its arguments. (Recall that we assume here that Π = Π o .) The initial condition of ( 9) corresponds to the one of (1) as z 0 = z(0) = F (Π(0), x 0 ) from [START_REF]A Lie-Bäcklund approach to equivalence and flatness of nonlinear systems[END_REF]. Remark, that a sort of matching condition [START_REF] Khalil | Nonlinear systems[END_REF] is always satisfied in the sense, that the input, the perturbation and its derivatives enter the system equation at the same spot. Applying the feedforward (6) to the differentially flat system given by ( 1) is equivalent to the application of u * (t) of ( 6) to [START_REF] Jakubczyk | On linearization of control systems[END_REF], which results in

żi (t) = z i+1 (t), i ∈ {1, . . . , n -1} żn (t) = α Π o (t), z(t), ψ(Π o (t), z * (t), ż * n (t)) (10)
Thus [START_REF] Charlet | On dynamic feedback linearization[END_REF] and ( 1)-( 3)-( 6) have the same solution t → z(t).

The proof proceeds by establishing that (10) admits the same solution as the Brunoský form:

żi (t) = z i+1 (t), i ∈ {1, . . . , n -1} żn (t) = v(t) (11)
when v(t) = z * (n) (t) and z(0) = z * o . By iterative integrations, one sees that the application of v(t) = z * (n) from the initial condition z * 0 to [START_REF] Khalil | Nonlinear systems[END_REF] implies that z(t) = z * (t).

Write now the differential equation satisfied by ǫ = zz * , where z is any solution of (10) and z * is the solution of (11) when z(0) = z * 0 and v(t) = z * (t). We obtain:

ǫi (t) = ǫ i+1 (t), i ∈ {1, . . . , n -1} ǫn (t) = α Π o (t), z * (t) + ǫ(t), ψ(Π o (t), z * (t), ż * n (t)) -ż * n (t) (12)
In view of (9) it is evident, that (5) is the solution for u of

0 = α(Π o , z, u) -żn (13)
with żn = z (n) . Hence one gets

α(Π o , z, ψ(Π, z, żn )) = żn (14)
Consequently, ǫ = 0 is an equilibrium point of [START_REF] Reboulet | A new method for linearizing non-linear systems: the pseudolinearization[END_REF] and thus the solution of (10) initialized at z * o is also z * .

III. EXACT FEEDFORWARD LINEARIZATION AND CONTROL LAW DESIGN

In [START_REF] Hagenmeyer | Exact feedforward linearization based on differential flatness[END_REF], exact feedforward linearization is used to design a specific PID-like stabilization of the desired trajectory. The control law consists of two parts, a feedforward part [START_REF] Colombeau | Multiplication of Distributions[END_REF], and a PID-like feedback part that takes the tracking error into account. Since in [START_REF] Hagenmeyer | Exact feedforward linearization based on differential flatness[END_REF] the control law is implicitly designed for the case of nominal parameters and nominal exogenous perturbations, the assumption throughout this section is that the exogenous perturbations coincide with the nominal ones, that is Π = Π o . The structure of the combination of both parts can then be represented as in [START_REF] Hagenmeyer | Exact feedforward linearization based on differential flatness[END_REF]:

Since v = ż * n is the input of the Brunovský form in Theorem 2.1, the new input v is designed as v = ż * n + Λ(e) (15)
where the tracking error e = [e 1 , e 2 , . . . , e n ] T and the augmented tracking error e = [e 0 , e 1 , e 2 , . . . , e n ] T are defined by (remember z = F (Π o , x) of ( 8))

e i = z i -z * i , i ∈ {1, . . . , n}; e 0 = t 0 e 1 (τ )dτ (16)
The extended PID-like8 feedback part is

Λ(e) = λ 0 t 0 e 1 (τ )dτ + k+1 i=1 λ i e i (t) = k+1 i=0 λ i e i (t) (17)
where k is a fixed integer in {0, . . . , n -1}. Thus, the whole control structure can be denoted by

u = ψ(Π o , z * , v) = ψ Π o , z * , ż * n + k+1 i=0 λ i e i (18)
This structure consists of a specific combination of a nonlinear feedforward part based on differential flatness, and a simple linear feedback part of extended PID type. Remark that this control structure represents a truly nonlinear control. The advantage of the structure [START_REF] Walter | Guaranteed characterization of stability domains via set inversion[END_REF] becomes evident in view of [START_REF] Lawrence | On a stability theorem for nonlinear systems with slowly varying inputs[END_REF]. On the desired trajectory 9 , one gets

α(Π o , z * , ψ(Π o , z * , v)) = v and therefore ∂α(Π o , z * , ψ(Π o , z * , v)) ∂v = 1 (19)
This property shows its effect on the structure of the error equation, which results from the application of the control law [START_REF] Walter | Guaranteed characterization of stability domains via set inversion[END_REF] to [START_REF] Jakubczyk | On linearization of control systems[END_REF]:

żi = z i+1 , i ∈ {1, . . . , n -1} żn = α Π o , z, ψ Π o , z * , ż * n + k+1 i=0 λ i e i (20)
Using ( 20) and ( 16), the corresponding tracking error system can be denoted as

ėi = e i+1 , i ∈ {0, . . . , n -1} ėn = α       Π o , e + z * , ψ(Π o , z * , ż * n + k+1 i=0 λ i e i v )       -ż * n (21)
The linearized system around the desired trajectory (e = 0) is then given by

ėδ =                 0 1 0 • • • 0 0 0 1 • • • 0 . . . . . . . . . 0 0 0 • • • 1 γ 0 γ 1 γ 2 • • • γ n         +         0 0 . . . 0 1         ν 0 ν 1 • • • ν n         e δ (22)
where (remember the arguments of α(Π o , z, u) in ( 9))

γ i = ∂α ∂z i ∂z i ∂e i e=0 = ∂α ∂z i z=z * ( 23
)
since ∂z i ∂e i = 1 in view of ( 16), and furthermore (defining λ i = 0, i ∈ {k + 2, . . . , n} if necessary) 19) and [START_REF] Hagenmeyer | Flatness-based two-degree-of-freedom control of industrial semi-batch reactors using a new observation model for an Extended Kalman Filter approach[END_REF]. When using full state information, that is k = n -1 in [START_REF] Frazer | On the criteria for the stability of small motions[END_REF], the structure of ( 22) shows that all coefficients of the characteristic polynomial of the linearized system around the desired trajectory can be modified, since it can be written as

ν i = ∂α ∂u ∂u ∂v ∂v ∂e i e=0 = ∂v ∂e i e=0 = λ i (24) since ∂α ∂u ∂u ∂v | e=0 = ∂α ∂v | e=0 = 1 in view of (
s n+1 -γ n s n -• • • -γ 0 = s n+1 -( ∂α ∂z n z=z * + λ n )s n -( ∂α ∂z n-1 z=z * + λ n-1 )s n-1 -• • • -λ 0 ( 25
)
Remark 3.1: When considering time-dependent controller coefficients λ i = λ i (z * (t), ż * n (t)), i ∈ {0, . . . , n}, it is evident that the poles of this system can be placed for a given characteristic polynomial. This could be interpreted as a dynamical kind of pseudo-linearization [START_REF] Reboulet | A new method for linearizing non-linear systems: the pseudolinearization[END_REF] around the desired trajectory or a desired flatness based gain scheduling.

In [START_REF] Hagenmeyer | Exact feedforward linearization based on differential flatness[END_REF], several structural properties of the application of ( 18) to (1) are discussed in detail implicitly for nominal constant parameters Π(t) = Π o . In this case, one of the main results of [START_REF] Hagenmeyer | Exact feedforward linearization based on differential flatness[END_REF] consists in a stability proof for (1) under [START_REF] Walter | Guaranteed characterization of stability domains via set inversion[END_REF]. For nominal time-varying parameters Π(t) = Π o (t) the stability proof of [START_REF] Hagenmeyer | Exact feedforward linearization based on differential flatness[END_REF] can easily be extended by including the nominal Π o (t) into the input vector of the error equation. 10Thus in the following, it is assumed, that (18) guarantees stability of (1) for Π(t) = Π o (t).

IV. THE ERROR EQUATION OF EXACT FEEDFORWARD LINEARIZATION UNDER EXOGENOUS PERTURBATIONS In the case Π = Π o as generally defined in (2), it still makes sense to apply the controller of [START_REF] Walter | Guaranteed characterization of stability domains via set inversion[END_REF] if the difference between the nominal exogenous perturbations Π o and the real ones is "not too big". Thereby a difficulty appears for the feedback part of [START_REF] Frazer | On the criteria for the stability of small motions[END_REF], since the exact value of z cannot be reconstructed by the knowledge of x (remember z = F (Π, x) of ( 8)). Therefore, the following approximate state 11 has to be considered

ζ = F (Π o , x) (26)
Thus the tracking error used for the feedback part ( 17) is defined as

ẽi = ζ i -z * i , i ∈ {1, . . . , n}, ẽ0 = t 0 ẽ1 (τ )dτ (27)
Notice that for j = 0, 1, ẽj = e j , since the flat output z is independent of ̟, see [START_REF] Hagenmeyer | Exact feedforward linearization based on differential flatness[END_REF]. Using (27), the nonlinear control law [START_REF] Walter | Guaranteed characterization of stability domains via set inversion[END_REF] has to be rewritten as

u = ψ(Π o , z * , v) = ψ Π o , z * , ż * n + k+1 i=0 λ i ẽi (t) (28)
To study the robustness of the system (1) under the control law (28) in the vicinity of the desired trajectory, the control law ( 28) is substituted into (9), which yields

żi = z i+1 , i ∈ {1, . . . , n -1} żn = α Π, z, ψ(Π o , z * , ż * n + k+1 i=0 λ i ẽi (t)) = α Π, z, ψ(Π o , z * , ż * n + Λ( ẽ)) (29)
where ẽ = [ẽ 0 , ẽ1 , ẽ2 , . . . , ẽn ] T . To find the real tracking error equation in e = z-z * , the following relation between ẽ = [ẽ 1 , ẽ2 , . . . , ẽn ] T and e can be established considering ( 8) and ( 4)

ẽ = F (Π o , x) -z * = F (Π o , φ(Π, z)) -z * = F (Π o , φ(Π, e + z * )) -z * (30)
Since ẽ0 = e 0 , the feedback part Λ( ẽ) can thus be written as Λ(e). Then, using (29) the augmented tracking error system in e can be denoted as

ėi = e i+1 , i ∈ {0, . . . , n -1} (31) ėn = α Π, e + z * , ψ(Π o , z * , ż * n + Λ(e) -ż * n
An analysis of robust stability of (31) will be carried out in the following section.

V. ROBUSTNESS ANALYSIS In this section it is shown, through the study of the error equation (31), how stability of the control strategy (28) applied to the system (1) can be analyzed. For the sake of generality, full state information is used in the PID-part, that is k = n -1 in (28) for the sequel. How this assumption can be relaxed thereafter is described at the end of this section.

The augmented tracking error equation (31) can be written structurally as (defining

z * = [z * 1 , . . . , z * n , ż * n ] T ) ėi = e i+1 , i ∈ {0, . . . , n -1} ėn = β (Π, Π o , e, z * ) (32)
and therefore as (defining

Z = [z * T , ż * n , Π T o , Π T ] T ) ė = Υ(e, Z) (33)
where Z plays the role of an input to the augmented tracking error system in e. Since (33) is of nonlinear nature, known theory of robustness of linear systems can not be applied. However, the robust stability of the presented control law (28) can be analyzed by making use of a result which was primarily introduced by Kelemen [START_REF] Kelemen | A stability property[END_REF], reinterpreted by Khalil and Kokotović [START_REF] Khalil | On stability properties of nonlinear systems with slowly varying inputs[END_REF] and elaborated by Lawrence and Rugh [START_REF] Lawrence | On a stability theorem for nonlinear systems with slowly varying inputs[END_REF]. The version by Lawrence and Rugh [START_REF] Lawrence | On a stability theorem for nonlinear systems with slowly varying inputs[END_REF] (to which the reader is referred for further details) is applied in the sequel. Theorem 5.1: If the initial error e(0), the velocity of the desired trajectory and the velocity of the exogenous parameters Z are not too large, then the augmented tracking error e is uniformly bounded. Moreover, if the desired trajectory of the flat output reaches a given point z * (t) = z * ∞ , ∀t t * > 0 and the exogenous perturbations are constant from this point onwards (̟ o (t) = ̟ o∞ , ̟(t) = ̟ ∞ , ∀t t * > 0, then the tracking error e converges exponentially to zero.

Proof: In order to apply the stability results of [START_REF] Lawrence | On a stability theorem for nonlinear systems with slowly varying inputs[END_REF] based on Lyapunov stability theory, their hypotheses (H1)-(H3) have to be verified: • (H1): In (33), Υ is by construction at least C 2 . • (H2): Define Γ ⊂ R n+1+2qn to be any bounded, open and connected subset of R n+1+2qn such that ∀t ∈ [0, ∞), Z ∈ Γ. Define also the continuously differentiable function ξ : Γ → R n+1 such that Υ(ξ(ζ), ζ) = 0, for all ζ ∈ Γ and Υ as defined in (33). The smoothness of Z ensures the existence of Γ and ξ. The map ξ is nothing but a parametrization of equilibria of (33) corresponding to frozen-time inputs ζ ∈ Γ. In view of the particular structure of (33) displayed in (32) one obviously has

ξ(ζ) = [ξ 0 (ζ), 0, . . . , 0] T , ∀ζ ∈ Γ (34)
where ξ 0 takes values in R. If the interval containing all solutions ξ 0 (ζ) is needed for the calculations presented in (H3), the implicit equation β (Π, Π o , ξ(ζ), ζ) = 0 has to be solved by interval analysis. 12• (H3): To verify the eigenvalues of ∂Υ ∂e around the parametrization of equilibria ξ(ζ) of (34) and thus for all ζ ∈ Γ, consider (31) to get

∂Υ ∂e Γ = ∂Υ ∂e ξ(ζ) =         0 1 0 • • • 0 0 0 1 • • • 0 . . . . . . . . . 0 0 0 • • • 1 µ 0 µ 1 µ 2 • • • µ n         (35)
where :

µ i = µ i (ζ) = ∂α ∂e i Γ , ζ ∈ Γ,
P(Π o , Π) = s n+1 -µ n s n -• • • -µ 0 ( 36
)
To determine whether the polynomial P(̟) of (36) has only zeros with real parts less than -λ, λ > 0 (and thus whether (H3) is satisfied), one of the following methods is applied:

1. If the coefficients of the characteristic polynomial are algebraically independent with respect to the interval parameters, the stability can be deduced analytically in a necessary and sufficient way by the well-known theorem by Kharitonov [START_REF] Kharitonov | Asymptotic stability of an equilibrium position of a family of systems of linear differential equations[END_REF].

2. In the case, in which the coefficients of the characteristic polynomial are algebraically dependent with respect to the interval parameters, the stability can be determined algebraically by the theorem of Frazer and Duncan [START_REF] Frazer | On the criteria for the stability of small motions[END_REF] (it is remarked, that for Π = Π o , there exists by construction at least one stable characteristic polynomial of (36), see Sec. IV).

3. Furthermore a numerical algorithm was developed by Walter and Jaulin [START_REF] Walter | Guaranteed characterization of stability domains via set inversion[END_REF], which is based on interval analysis. It can also be found in [START_REF] Jaulin | Applied Interval Analysis[END_REF], where it is additionally combined with constraint propagation to shorten significantly the calculation time. Moreover, a new value set approach based on the knowledge of at least one stable characteristic polynomial is presented in [START_REF] Jaulin | Applied Interval Analysis[END_REF]. As the hypotheses (H1)-(H3) of [START_REF] Lawrence | On a stability theorem for nonlinear systems with slowly varying inputs[END_REF] are satisfied, there exists a ρ > 0, a T > 0, a δ 1 (ρ) > 0 and a δ 2 (ρ, T ) > 0 such that e(0) < δ 1 (37)

1 T t+T t Ż(τ ) dτ < δ 2 , t ≥ 0 (38)
then the corresponding solution e of (33) satisfies e(t) < ρ, t ≥ 0 (39) that is the system (1) is stable under the tracking control law (28).

Applying the Corollary of [START_REF] Lawrence | On a stability theorem for nonlinear systems with slowly varying inputs[END_REF] in the case Z = Z ∞ , ∀t > t * > 0 implies, in view of the structure of (34), that lim t→∞ e(t) = 0 and e(t * ) lies inside the domain of attraction 13 of the exponentially stable equilibrium given by [ξ 0 (ζ), 0, . . . , 0] T evaluated at ζ = [z * ∞ , 0, . . . , 0] T . Remark 5.1: Note that the condition (38) assures, that robust stability can be proven if the velocity of exogenous perturbation and its derivatives Π (and their respective nominal counterparts) is not too big in an average sense. Since Heaviside jumps with microstructure are considered for the model of the exogenous perturbations, this might lead -depending on the system-to robustness in a lot of cases, even if derivatives of the perturbation Π enter equation [START_REF] Jakubczyk | On linearization of control systems[END_REF].

Remark 5.2: The first component ξ 0 (ζ) of the parametrized manifold in (34) corresponds to the state of the integral of the feedback part of (28). Since ξ i (ζ) = 0, i = 1, . . . , n, ζ ∈ Γ, the other components of the manifold correspond to a zero tracking error e = 0.

Remark 5.3: For the calculations within the mentioned methods, not only Π, Πo and ξ 0 , but also z * can be understood as of interval type. More precisely, since z * is a function of time, for a given time interval 14 t ∈ t = [t 0 , t 1 ], the only interval parameter which has to be added to Π, Πo and ξ 0 for the analysis is therefore t.

Remark 5.4: Partial state feedback is possible with the control strategy (28). Its stability can also be analyzed in the context of Theorem 5.1 by setting the respective control law coefficients λ i = 0, i ∈ {k + 2, . . . , n} (as in [START_REF] Frazer | On the criteria for the stability of small motions[END_REF]). The minimal number of derivative actions k necessary (but not implicitly sufficient) for stability can be determined from ∂Υ ∂e Γ using the necessary condition for negativity of the eigenvalues, that is µ i , i ∈ {0, . . . , n} < 0 (see (36)).

Remark 5.5: In general, the choice of the nominal exogenous perturbation within the given uncertainty interval influences the robustness behavior. It is important to remark, that this choice does not only affect the coefficients of the respective characteristic polynomial, but also the magnitude of the so-called "quasi-exogenous" perturbations, that stem from the desired trajectory injection. The magnitude of these perturbations evidently influences the convergence behavior, therefore the choice of the nominal value within the uncertainty interval has to be undertaken carefully.

VI. ACADEMIC EXAMPLES

In this section, two academic examples are presented in order to highlight the different aspects of how the exogenous perturbation enters the respective equations (for non-academic examples of exact feedfoward application to real systems under exogenous perturbations, cf. the application to the induction machine [START_REF] Hagenmeyer | Flatness-based control of the induction drive minimizing energy dissipation[END_REF], [START_REF] Hagenmeyer | Continuous-time nonlinear flatness-based predictive control: an exact feedforward linearisation setting with an induction drive example[END_REF] and the application to industrial semi-batch reactors [START_REF] Hagenmeyer | Flatness-based two-degree-of-freedom control of industrial semi-batch reactors using a new observation model for an Extended Kalman Filter approach[END_REF]). The first academic example concerns a stable system, whereas the second academic example treats an unstable system.

with the initial condition given by z 0 = [x 10 , x 20 + ̟(0)] T . To find the real tracking error equation in e = zz * , the relation (30) between ẽ and e can be established as

ẽi = e i , i ∈ {0, 1} (51) ẽ2 = e 2 -̟, (52)
Now, the augmented tracking error system in e can be denoted by

ėi = e i+1 , i ∈ {0, 1} (53)
ė2 = -(e 2 + z * 2 -̟) 3 + 1 i=0 λ i ẽi + λ 2 (e 2 -̟) + (z * 2 ) 3 + ̟
Following Section V, the robustness analysis of the augmented tracking error system (53) can be led by applying to it the results of Lawrence and Rugh [START_REF] Lawrence | On a stability theorem for nonlinear systems with slowly varying inputs[END_REF] based on Lyapunov stability theory. Their hypotheses (H1)-(H3) have to be verified: • (H1): The vector field of (53) is at least C 2 .

• (H2): The parametrization of equilibria (34) of (53) corresponding to frozen-time inputs z * 2 , ̟ and

̟ is ξ = [ 1 λ 0 ((z * 2 -̟) 3 + λ 2 ̟ -̟), 0, 0] T (54)
• (H3): To verify the eigenvalues of the linearization of (53) around the parametrization of equilibria (54), this linearization is calculated as

∂Υ ∂e Γ = ∂Υ ∂e ξ(ζ) =    0 1 0 0 0 1 λ 0 λ 1 -3(z * 2 -̟) 2 + λ 2    (55)
Thus the following characteristic polynomial containing the interval parameters z * 2 and ̟ determines the possible root loci of the eigenvalues of ∂Υ ∂e Γ :

P(z * 2 , ̟) = s 3 + (3(z * 2 -̟) 2 -λ 2 )s 2 -λ 1 s 1 -λ 0 (56)
To decide whether this polynomial of (56) has only zeros with real parts less than -λ, λ > 0, it is not necessary to apply interval algebra in this case. Since after a transformation of q = s + λ, the application of a Routh-Hurwitz table yields the following conditions

λ 2 < 3(z * 2 -̟) 2 -3λ (57) λ 1 λ 0 -λ 0 > λ 3 -λ 2 (3(z * 2 -̟) 2 -λ 2 ) (58) (3λ 2 -2λ(z * 2 -̟) 2 -λ 2 ) -λ 1 )(z * 2 -̟) 2 -λ 2 -3λ) > λ 1 λ 0 -λ 0 -λ 3 + λ 2 (3(z * 2 -̟) 2 -λ 2 ) (59)
which can easily be checked for a given situation.

In the following the desired trajectory is chosen as a spline such as

0 t t i , z * (t) = z i t i t t f , z * (t) = 5 k=0 ζ k (t -t i ) k , ζ k ∈ R t f t +∞, z * (t) = z f with t i = 1 s, t f =
0 t t ′ i , ̟(t) = ̟ i t ′ i t t ′ f , ̟(t) = 3 k=0 υ k (t -t i ) k , υ k ∈ R t ′ f t +∞, z * (t) = ̟ f with t ′ i = 2.45 s, t ′ f = 2.
55 s, ̟ i = 0.0 and ̟ f = 1.0. The corresponding trajectories ̟ and ̟ are shown in Fig. 2. The results of the application of the control law (49) to the system (40) are given in Fig. 3 for an initial condition x(0) = (0.35 0.0) T .

The largest real part of eigenvalues of ∂Υ ∂e Γ (55) during the transition are depicted in Fig. 4 and shows the stability margin required in (H3). Thus, a good tracking and robustness of the application of the control law (49) to the system (40) can be concluded.

B. Application to an unstable system

Consider now the unstable system (which is the unstable counterpart of the stable system (40))

ẋ1 = x 2 + ̟ ẋ2 = +x 3 2 + u (60)
with x(0) = [0, 0] T . Following the development in the preceding subsection, in this case the control law can be denoted as

u = z * + 2 i=0 λ i e i -( ż * ) 3 (61)
The results of the application of the control law (61) to the system (60) is reported in Fig. 5, while the maximum real part of the eigenvalues associated with the closed-loop error equation is depicted in Fig. 6. One still remarks a control with good tracking and robustness properties. The article presents a method to analyze robust stability of exact feedforward linearization based on differential flatness with respect to exogenous perturbations and time-varying parameters. It is remarked, that representing the perturbed system in its so-called flat coordinates leads in all cases to the fulfillment of a sort of matching condition, that is the perturbation, its time derivatives and the input entering the system at the same point.

In case of using a PID-like stabilization for the feedback part of the combined control structure, the controller coefficients have to be traded-off with respect to the desired trajectory, its derivatives and generally the size of the uncertainty intervals of the exogenous perturbations or time-varying parameters. Also the choice of the nominal value of these parameters within the given uncertainty intervals is of interest for the performance of the closed loop system.

Modeling the exogenous perturbations by so-called "Heaviside jumps with microstructure" permits to stay close to physical reality. Since in the robustness result the velocity of the exogenous perturbation and its derivatives have to be bounded in an average sense, this might lead, depending on the system, to robustness in a lot of cases.

These results are important for the practicability in real applications of exact feedforward linearization based on differential flatness: 15 in the case of a given flat nonlinear system, for which there already exists a linear PID-like controller stabilizing the system in the vicinity of an operation point, a nonlinear nominal feedforward based on flatness combined with the existing PID-like controller can lead to very good tracking of, for instance, guided set point changes even under exogenous perturbations.

  and α as given in (31). Thus the following characteristic polynomial containing the interval parameters Π and Πo determines the possible root loci of the eigenvalues of ∂Υ ∂e Γ

  4 s, z i = 0.0 and z f = 1. The corresponding trajectories z * , ż * and z * are depicted in Fig 1. The controller gains are furthermore chosen as λ 0 = -343, λ 1 = -147, and λ 2 = -21, the perturbation is chosen as a spline such as

Fig. 1 .

 1 Fig. 1. Flat output predicted trajectory: z * , ż * and z *

Fig. 2 .

 2 Fig. 2. Time trajectory of the perturbation: ̟ and ̟ VII. CONCLUSION

Fig. 3 .

 3 Fig. 3. Simulation result of the application of the control law (49) to the stable system (40): x1 in solid line and z * in dashed line

Fig. 5 .

 5 Fig. 5. Simulation result of the application of the control law (61) to the unstable system (60): x1 in solid line and z * in dashed line

Fig. 6 .

 6 Fig. 6. Largest real part of eigenvalues of ∂Υ ∂e Γ around the respective parametrization of equilibria

If there is no a priori information given about the nominal time profile of the exogenous perturbation, let ̟o i (t) = ̟ * o i , i = 1, . . . , q, where the ̟ * o i are the constant expected mean values of the respective perturbations.

This definition is an adaptation from[START_REF] Fliess | Flatness and defect of non-linear systems: introductory theory and examples[END_REF],[START_REF]A Lie-Bäcklund approach to equivalence and flatness of nonlinear systems[END_REF].

The eventual singularities appearing in F , φ and ψ are outside of this open subsets.

This assumption is not very restrictive in the case of real systems. The flat output can often be chosen to be a physical variable (a position, a current, a voltage, a temperature, etc.), which is independent of any unknown parameter. The range of the uncertainty of the parameter set defined by (2) does not change generically the dynamic structure of the system. Moreover, the whole robustness analysis in the sequel can also be led without this assumption, but then (31) becomes a Liouvillian system and the notationally nice structure of (35) is lost.

The maximal number of derivatives of z in (4) and (5) respectively are due to the results of[START_REF] Jakubczyk | On linearization of control systems[END_REF],[START_REF] Charlet | On dynamic feedback linearization[END_REF] (see more details below in the proof of Theorem 2.1).

The proof is written in the SISO case for notational convenience. A similar proof for the MIMO case can be led considering[START_REF] Hagenmeyer | Exact feedforward linearization based on differential flatness[END_REF].

"Extended" in the sense that multiple derivatives of the error can be used, where the D-parts are in the higher order errors ei, k ≥ 1, cf. (16) and[START_REF] Fliess | Flatness and defect of non-linear systems: introductory theory and examples[END_REF]. Thereby it is important to remark that these derivatives are not obtained by successive derivation of a (possibly) noisy signal, but they are calculated using the measured state (or the necessary part of it), eqn. (8) with Π = Πo, and eqn.[START_REF] Kharitonov | Asymptotic stability of an equilibrium position of a family of systems of linear differential equations[END_REF].

Being on the desired trajectory means z = z * , that is also z = z * and correspondingly x = x * (cf. (4)).

In the same manner as it is also done for the main result of this contribution, see Theorem 5.1 below.

The difference between z and ζ may not affect the whole state depending on F (Π, x).

For a numerical solution, the authors propose to use the algorithm SIVIAX of [15, p. 104].

This result is comparable to linear systems when using an integral part in a PI-controller: for constant perturbations the control law leads to exponential stability, for non-constant perturbations the control law leads to bounded stability.

Consider for example a set point change in [t0, t1] using spline functions.

For successful applications of this method, cf. the application to the induction machine[START_REF] Hagenmeyer | Flatness-based control of the induction drive minimizing energy dissipation[END_REF],[START_REF] Hagenmeyer | Continuous-time nonlinear flatness-based predictive control: an exact feedforward linearisation setting with an induction drive example[END_REF] and the application to industrial semi-batch reactors[START_REF] Hagenmeyer | Flatness-based two-degree-of-freedom control of industrial semi-batch reactors using a new observation model for an Extended Kalman Filter approach[END_REF].

A. Application to a stable system

Given the single-input system ẋ1 = x 2 + ̟ ẋ2 = -x 3 2 + u (40) with x(0) = [0, 0] T . This control system is flat with z = x 1 , and Eqns. ( 4) and ( 5) read as

Thus, for every given admissible nominal trajectory of the flat output t → z * (t), the family of nominal feedforwards is given by

The corresponding state transformation (8)

leads to the control normal form ( 9)

with the initial condition given by z 0 = [x 10 , x 20 + ̟(0)] T . As shown in the proof of Theorem 2.1 of Section II, the nominal input (43) linearizes the system if the nominal perturbation condition ̟ = ̟ o holds, and if the initial condition is consistent following Definition 2.1, i.e. x 0 = z * 0 . This feedforward linearization implies z(t) = z * (t), and thus x(t) = x * (t).

In order to counteract the eventual exogenous perturbations, a control law is designed following Section III, in which first the assumption is made that the exogenous perturbations coincide with the nominal ones in system (40), that is ̟ = ̟ o . In order to simplify notations, it is assumed in the ongoing, that no a priori information is known on the perturbation ̟ ∈ R, thus the nominal values are

Then control law (18) reads as

with the tracking error definitions for e i as in [START_REF] Kharitonov | Asymptotic stability of an equilibrium position of a family of systems of linear differential equations[END_REF].

Considering now Section IV, the assumption ̟ = ̟ o has to be relaxed and ̟ = ̟ o has to be studied. This leads to the approximate state (26)

and the approximate tracking error definition ẽi of (27). The control law (28) reads then as

To study the robustness of the system (40) under the control law (49) in the vicinity of the desired trajectory, the control law (49) is substituted into (45), which yields


Ehtesham Zahoor
email: ehtesham.zahoor@loria.fr

Olivier Perrin
email: olivier.perrin@loria.fr

Claude Godart
email: claude.godart@loria.fr

An Integrated Declarative Approach to Web Services Composition and Monitoring

In this paper we propose a constraint based declarative approach for Web services composition and monitoring problem. Our approach allows user to build the abstract composition by identifying the participating entities and by providing a set of constraints that mark the boundary of the solution. Different types of constraints have been proposed to handle the composition modeling and monitoring. Abstract composition is then used for instantiating the concrete composition, which both finds and executes an instantiation respecting constraints, and also handles the process run-time monitoring. When compared to the traditional approaches, our approach is declarative and allows for the same set of constraints to be used for composition modeling and monitoring and thus allows for refining the abstract composition as a result of run-time violations, such as service failure or response time delays.

Introduction

Traditional Web services composition approaches (such as WS-BPEL and WS-CDL) tackle the composition problem by focusing on the control flow of the composition process. Although control over the composition process is critical, in some cases it must be relaxed to some extent to make the process flexible, but flexibility and control on the composition process are conflicting requirements. We detail in this paper a sample crisis management scenario that highlights the importance of proper balance between control and flexibility of the composition process. A problem of traditional service composition approaches is that they are procedural and as proposed in [START_REF] Van Der Aalst | Decserflow: Towards a truly declarative service flow language[END_REF] they over constrain the composition process making it rigid and not able to handle the dynamically changing situations. Further the focus on data, temporal aspects and other non-functional requirements is not thoroughly investigated. Another important aspect is the run-time monitoring of the composition process and although it is tightly coupled with the composition process, it is not well integrated to the traditional composition approaches. Proposed solutions introduce a new layer for the composition monitoring and thus does not provide the important execution time violations feedback to the composition process. Finally, the scalability of the composition process is an important factor as the number of available services to choose from is increasing rapidly. As a result, exploring all possible solutions to the composition problem may not be a feasible option and some choices should be made at different stages to avoid the solution explosion of the composition process.

In this paper we propose a constraint based declarative approach for Web services composition and monitoring problem. Our approach allows user to build the abstract composition by identifying the participating entities and by providing a set of constraints that mark the boundary of the solution. Different types of constraints have been proposed to handle the composition modeling and monitoring. Abstract composition is then used for instantiating the concrete composition, which both finds and executes an instantiation satisfying constraints, and also handles the process run-time monitoring.

When compared to the traditional approaches, our approach is declarative and allows for the same set of constraints to be used for composition modeling and monitoring and thus allows for refining the composition model as a result of run-time violation. Moreover, our approach models both the data and control flow and the constraints include both the functional and non-functional specifications (such as security and temporal aspects on both control and data). Further, in contrast to the procedural approaches, we propose a declarative approach to model the composition process. Then, our approach aims to target the conflicting requirements of flexibility and control on the composition process. At one hand, user can loosely constrain the composition process to provide the composition engine the flexibility to choose the solution. On other hand user can over constrain the composition process to focus on the control. Further, to handle the scalability requirements our approach allows for one best matched (user chosen) Web service as a result of node instantiation and handles the case when the service selection choice needs to be backtracked based on dependency between services and allows for propagation of newly chosen solution.

Motivation and related work

The motivation for our work stems from the process modeling and monitoring in a crisis situation and we present a crisis management scenario that highlights the benefits of the approach. A crisis situation is, by nature, a dynamic situation especially in its first phases. It also demands for a composition that is characterized by temporal constraints, uncertainty, multiple and changing goals, coordination of multiple services and multiple data sources, and require the composition process to be more flexible to adapt to continuously changing environment. The situations these ad hoc compositions are dealing with are complex, ambiguous, and very dynamic. Information arrives from multiple sources, with varying degrees of reliability and in different formats. Information that was treated at time t may be superseded by new information at time t+1.

The interesting concept with a crisis scenario is that it brings together two related dimensions: organization and situation.Organization encompasses the design time composition modeling which involves identifying activities and control and data flow between them. There have been many approaches to model this dimension. Most of these approaches can be divided into Workflow composition and AI planning based approaches, as discussed in [START_REF] Rao | A survey of automated web service composition methods[END_REF]. The composition result can be regarded as a workflow because it includes the atomic Web services and the control and data flow between these services. Static workflow composition approaches require an abstract composition to be specified and the selection and binding is performed automatically by the Web services composition process, while the dynamic workflow composition approaches require to both build the abstract composition and select atomic service automatically based on user request as proposed in [START_REF] Schuster | Modeling and composing service-based and reference process-based multi-enterprise processes[END_REF]. The composition process can also be regarded as a AI planning problem assuming that each Web service can be specified by its preconditions and effects (using situation calculus [START_REF] Mcilraith | Adapting golog for composition of semantic web services[END_REF][START_REF] Narayanan | Simulation, verification and automated composition of web services[END_REF], rule-based planning [START_REF] Medjahed | Composing web services on the semantic web[END_REF], theorem proving [START_REF] Waldinger | Web agents cooperating deductively[END_REF] or other approaches including [START_REF] Sirin | Semi-automatic composition of web services using semantic descriptions[END_REF]).

The problem of traditional approaches (such as WS-BPEL or WS-CDL) is that all what is not explicitly modeled is forbidden. These approaches have in common that they are highly procedural, i.e., after the execution of a given activity the next activities are scheduled. Seen from the viewpoint of an execution language their procedural nature is not a problem [START_REF] Van Der Aalst | Decserflow: Towards a truly declarative service flow language[END_REF]. However, unlike the modules inside a classical system, Web services tend to be rather autonomous and an important challenge is that all parties involved need to agree on an overall global process. Moreover, this way of modeling renders difficult to model complex orchestrations, i.e. those in which we need to express not only functional but also non-functional requirements such as cardinality constraints (one or more execution), existence constraints, negative relationships between services, temporal constraints on data or security requirements on services (separation of duties for instance). With current approaches, the designer should explicitly enumerate all the possible interactions and in turn over-constrain the orchestration. In case of multiple constraints, the problem becomes even more difficult. Moreover, the flexibility of the obtained model is really low as modifying one aspect (e.g. temporal) has important side effects on other aspects (e.g. control flow or security). A more detailed discussion can be found in [START_REF] Pesic | A declarative approach for flexible business processes management[END_REF]. When compared to other declarative approaches [START_REF] Van Der Aalst | Decserflow: Towards a truly declarative service flow language[END_REF][START_REF] Pesic | A declarative approach for flexible business processes management[END_REF], our approach allows for the same set of constraints to be used for both process modeling and monitoring.

The second dimension a crisis situation focuses on is the situation. The composition process to handle the crisis should be able to measure and to adapt to continuously changing situation. This leads to the problem of Web services monitoring and the approaches for dealing with Web services monitoring include [START_REF] Barbon | Run-time monitoring of instances and classes of web service compositions[END_REF][START_REF] Baresi | An integrated approach for the run-time monitoring of bpel orchestrations[END_REF][START_REF] Mahbub | Run-time monitoring of requirements for systems composed of web-services: Initial implementation and evaluation experience[END_REF]. The problem with current monitoring approaches is that they are mostly proposed as a new layer to the procedural approaches such as WS-BPEL. As a result, they are unable to bridge the gap between organization and situation in a way that it is not possible to learn from run-time violations and to change the process instance (or most importantly process model) at execution time.

The need of observability (the feedback that provides insight of a composition), the support of dynamicity (ability to change resources, services, and ordering as situations change and evolve), the support of focus change (ability to reorient focus in a dynamic environment), and the support of various perspec-tives (ability to consider the organization given different points of view -control, data,...) guide the motivation of our approach. We believe that the declarative approach appears to be well adapted rather than the traditional imperative approach. Using a declarative language allows to concentrate on the "what" rather than the "how" and it is more flexible as you specify only the boundaries of the composition rather than its precise execution (reducing the over-specification associated with the imperative method). Then, the monitoring of the composition is largely facilitated as the same constraints can be used for both the definition, the instantiation, and the execution of the composition.

Motivating example

Let us consider a sample scenario when the emergency landing of the plane carrying important government officials has resulted in serious injuries to the passengers. An emergency center has been set up in the remote region for handling patients. In a typical SOA based setup, the emergency center works by contacting the Web services provided by different systems. Depending on the condition of each patient the emergency center may either opt for nearby initial checkup center or for the detailed checkup center, for providing patient emergency treatment and to examine the nature of injuries to the patient. The emergency center may also decide to transfer the patient to some nearby hospital (not known in advance), this choice will be made using the Web services provided by different hospitals and will also be based on certain constraints such as the hospitalization and surgery facilities availability and some non-functional properties such as reliability, temporal requirements and others. The chosen hospital Web service can then be used to schedule operation theatre, allocate surgery team and to provide critical data to the hospital.

The composition process may also decide to discover and communicate with the ambulance service (or SAMU1 service for serious injuries) to transfer the patient to the selected hospital and again, as the Web service is not known in advance, some constraints may be specified to discover the service.

Due to high-profile passengers, contacting Police department for assistance may be needed. Further the access to the patient information file from the Web service provided by the social security system may also be needed. Finally, the emergency center may also discover and contact some blood bank service to arrange additional blood supply for the patient (if patient blood type is rare).

Proposed framework

Our proposal aims to provide a declarative framework for addressing the Web services composition and monitoring problem, such as the one presented in the motivating example. In this section we will briefly discuss the main concepts related to our approach and will detail them in the sections to follow. Our proposed framework has two main stages, abstract composition and the concrete composition. Each stage has a set of constraints targeted to handle the organization (composition modeling) and the situation measurement dimension (monitoring). This gives our framework the flexibility to use the same set of constraints for bridging the gap between organization and situation measurement (see figure 1). The composition process starts when the user specifies the abstract composition, using a user friendly interface, allowing her/him to drag and drop components and provide constraints. Various related concepts include:

Abstract composition

Concrete composition

Web services Composition

-Web services -The user can specify the concrete Web services instances known in advance, to be used within the composition process. -Nodes -If the Web service instance is not known in advance, the user can specify the Web service node which has a unique type such as Hospital. -Constraints -Constraints specify the boundaries for the solution to the composition process and different type of constraints can be added to the abstract composition process for handling modeling and monitoring dimensions. The constraints related to composition modeling include the local,choreography and non-functional constraints while the constraints for handling composition monitoring include execution constraints (see figure 1).

The abstract composition specified by the user is used to instantiate the concrete composition phase. As similar to the abstract composition, the concrete composition process also has different stages for handling composition modeling and monitoring. Local and choreography constraints are used for nodes instantiation and process execution while the execution constraints are handled at run-time monitoring phase of the concrete composition.

In order to model the abstract composition, our approach relies on the Event Calculus (EC) [START_REF] Kowalski | A logic-based calculus of events[END_REF][START_REF] Montali | Verification of choreographies during execution using the reactive event calculus[END_REF]. The choice of EC is motivated by several reasons. First, EC integrates an explicit time structure (this is not the case in the situation calculus) independent of any sequence of events (possibly concurrent). Then, given the abstract composition specified in the EC, an event calculus reasoner can be used to instantiate the concrete composition. Further, EC is very interesting as the same logical representation can be used for verification at both design time (static analysis) and runtime (dynamic analysis and monitoring).

The EC is a first-order logic that comprised the following elements: A is the set of events (or actions), F is the set of fluents (fluents are reified2 ), T is the set of time points, and X is a set of objects related to the particular context. In EC, events are the core concept that triggers changes to the world. A fluent is anything whose value is subject to change over time. EC uses predicates to specify actions and their effects. Basic event calculus predicates are:

-Initiates(e, f, t) -fluent f holds after timepoint t if event e happens at t. -T erminates(e, f, t) -fluent f does not hold after timepoint t if event e happens at t. -Happens(e, t) is true iff event e happens at timepoint t.

-HoldsAt(f, t) is true iff fluent f holds at timepoint t.

-

Initially(f ) -fluent f holds from time 0. -Clipped(t 1 , f, t 2 ) -fluent f was terminated during time interval [t1, t2]. -Declipped(t1, f, t2) -fluent f was initiated during time interval [t1, t2].
Further, some event calculus axioms are available that relate the various predicates together. Using EC, we are able to represent both the organization, i.e. the abstract composition of services, and the situation, i.e. the verification that everything goes as planned at execution time.

Abstract composition

Constraints

The constraints added to the abstract composition serve as the boundaries for the acceptable solution to the composition problem. These constraints can be divided into following categories:

-Local constraints are the constraints added to the Web service nodes in the composition process. These constraints specify the properties that should be respected while binding the Web service nodes to concrete Web service instances and as our approach aims to choose the best matched solution for the node instantiation, the local constraints specify one specific path (solution) to choose from all available paths (solutions) for the Web services composition process. Local constraints can be in the form of non-functional requirements such as security, reliability, quality requirements. They can also be in the form of some domain specific functional properties (hospitalization, surgery facilities availability for the motivating example). Formally, local constraints are translated as predicates in EC. For instance, service s 1 is reliable would be written with the following formula: reliable(s 1 , value) where value is true. -Choreography constraints specify the constraints regarding the control flow of the composition process and express the order and execution sequence of the participating activities. Some examples of choreography constraints include before, after, if-then-else, choice and others. Choreography constraints are also guided by the dependency between the participating entities, specifying that a service s 1 has a dependency on service s 2 will require s 1 to be executed before the service s 2 . Formally, following EC formula specifies that service s 1 must be executed before service s 2 :

Initially(f orbidden(s 2 , f )) ∧ T erminates(s 1 , f orbidden(s 2 , f ), ).
-Non-functional constraints specify the constraints independent of the functional aspect of the web service composition. It can be for instance security requirements. Formally, if we want to model a specific security rule stating for instance that once a service s 1 has been executed, the service s 2 cannot be executed for the next 20 minutes, we write:

Initiates(s 1 , f orbidden(s 2 , f ), t 1 )∧Declipped(t 1 , f orbidden(s 2 , f ), t 2 )∧(t 1 + 20 ≤ t 2 ).
-Execution constraints specify the constraints to be validated at run-time.

These constraints take the form of monitors, which have a associated monitoring event/condition and actions to perform if the condition to be monitored is encountered. We will take a detailed look on monitors in section-7

Example

Let us now review the motivating example and discuss how the abstract composition can be specified, introducing the associated constraints. The abstract composition is specified using abstract-refine approach, the base abstract composition for the motivating example can be specified as:

initialCheckupWS, detailedCheckupWS, Hospital(?h), Ambulance(?a), SAMU(?s), regionalPo-liceWS, someSocialSecurityWS, BloodBank(?b)

The presentation syntax above is used to describe the participating Web services in the composition process, the question mark (?) operator marks the variables, i.e. the Web service nodes that have not yet instantiated. The syntax also specifies the type of participating nodes.

The base abstract composition has no constraints added to it, i.e. all that is specified is the invocation (or instantiation and invocation for Web service nodes). To mark the boundaries of the abstract composition, we start by adding the different type of constraints to the abstract composition. The initialCheckup is a concrete (already known) web service and thus has no local constraints. For the choreography constraints, we consider the service to be invoked before the hospital and detailedCheckup service and that if the initialCheckup service is executed then the detailedCheckup service is also executed. Further, the service has data dependency on the patient information from the socialSecurity Web service. As part of execution constraints, we consider that the data validity from the service is for 1 hour and the response time of the service should be less that 5 ms. Finally, for the cardinality constraints, which are part of the choreography constraints, we consider that the service can be executed zero or one times during the process execution. This marks the service to be optional and thus can be skipped for some instance (for all other participating services cardinality is exactly one). Below we present the event calculus formalization for the associated constraints to the initialCheckupService (ICS), we will detail the execution constraints later in section-7:

Choreography constraints: before hospital -Initially(f orbidden(Hospital(h), true))∧T erminates(ICSInvoked, f orbidden(Hospital(h), true), ) If ICS then detailedCheckup -Initiates(ICSInvoked, HoldsAt( invoke(detailedChekup, true), t2), t1) ∧ t1 < t2 data dependency on socialSecurityWS -Initially(f orbidden(ICS, true))∧ T erminates(socialSecurityW SInvoked, f orbidden(ICS, true), ) The choreography constraints associated with the initialCheckupWS also guide the partial control structure of the composition process (see figure 2-a), specifying constraints such as before hospital does not mark that the hospital service will immediately follow but specifies that there may be zero or many steps (services) between them. We can then have the similar constraints for the detailedCheckup service, excluding the constraint the if detailedCheckup is executed then the initialCheckup in also executed. This refines the partial control flow induced by the initialCheckup service (see figure 2-b). Next, for the hospital node we have some local constraints such as reliable, secure Web service and that the selected hospital must provide hospitalization and surgery facilities. Further the hospital service has data dependency on initialCheckup and detailedCheckup Web services, below we present constraints modeling using EC, we will leave the discussion of execution constraint (in case of service failure re-instantiate hospital node) until section-7 :

Local constraints: reliable(Hospital(h), true) ∧ providesSurgery(Hospital(h), true) Choreography constraints: Similar to EC model for initialCheckup service For the ambulance and SAMU nodes, we have some local constraints and the choreography constraint that they cannot coexist. Further, they have data dependency constraint on the Hospital node and this refines the partial control flow by stating that in any solution to the composition process either of two services should be chosen after the hospital service invocation (see figure 2-c).

Local constraints: reliable(Ambulance(a), true) ∧ providesAirServices(Ambulance(a), true) Choreography constraints: Initiates(ambulanceServiceInvoked, f orbidden(SAM U Service, true), )∧ Initiates(SAM U ServiceInvoked, f orbidden(ambulanceService, true), )

Then, for the BloodBank node, we can have some local constraints for service discovery and it has data dependency on the socialSecurity service. Finally, regionalPolice service is unconstrained and this gives the flexibility to invoke the service anywhere in the composition process. These constraints mark the boundary of the possible solution to the composition process but intentionally do not over-constraint the composition process providing the flexibility for process execution (see figure 2-d and2-e for possible execution paths).

Concrete composition

The event calculus model for the abstract composition specified by the user can then be used to instantiate the concrete composition using the event calculus reasoner, below we highlight the various related concepts. The concrete composition process is divided into three phases; the instantiation phase handles the instantiation of Web service nodes to concrete Web service instances. The execution phase follows, which executes the instantiated Web services composition process, finally the monitoring phase handles the composition process monitoring during execution. In this section we will detail the instantiation phase and in the next section will discuss the monitoring phase of the composition process.

Instantiation The instantiation process is responsible for binding the Web service nodes to concrete Web service instances. The process starts by using the local constraints added to the abstract composition, that highlight the user preferences for the Web service discovery. These constraints are used to query the Web services repository for identifying the services satisfying these constraints however, in case of a loosely constrained node, the result set can be very large. Our proposal thus aims to choose the best matched Web service either selected manually by the user or based on some user-specified criteria such as the quality rating for the Web service, by assuming that some trusted third-party has quality ratings assigned to services. For the instantiation process, we may also have to consider the choreography constraints associated to a Web service node in order to identify if the service has data dependency on the some already instantiated node. This will further constrain the Web service node to consider only the instantiations that respect the dependency between nodes. For the motivating example, the hospital node has data dependency on the initialCheckup service and thus may require to consider only the hospital Web services which can handle compatible data, this leads to a set of service composability rules which space limitations restrict us to detail.

If the instantiation result set for a node is empty then we have following possibilities. If some constraint is unsatisfied, user can be given option if she/he wants to relax the constraint. For example the user can decide to relax the reliability constraint in an attempt to discover new instances. Further, if the dependency between nodes is unsatisfied, we need to backtrack to the results of previous node to select some other instantiation solution and then proceed to finding solution for the current node. The process continues until all backtrack solutions have been explored. Finally when none of above two situations hold, the composition process fails with notifying the user of the intermediate results.

Then, an important aspect of our proposal concerns the ability for the instantiation to be modified at execution. Let us consider for instance that a node has been statically instantiated. At runtime, if the service fails, the node can be re-instantiated with a new service in order to continue the execution.

Backtracking The backtracking process involves finding an alternative to some previously chosen node instantiation solution. Backtracking is needed when the dependency between nodes is unsatisfied resulting in empty result set.

For the motivating example, the Ambulance node has data dependency on the Hospital node and lets consider the Hospital node has been instantiated to someHospitalService providing data in JSON format, then instantiating the Ambulance node will require us to consider only the Ambulance services requiring data in JSON format. Further, consider that there is no service available for the Ambulance node which can handle JSON data (however all can handle XML), this will require us to backtrack to the Hospital node to choose some other service, say someOtherHospitalService which may be providing XML data.

Propagation Once the backtracking process execution terminates, resulting in a newly chosen solution (instance), the composition solution must be recomputed and may require the propagation of newly chosen solution. This would likely be the case when a (partial) solution to the composition process has already been determined and backtracking to some higher node (in hierarchal order) may result in propagating the new solution. Further, propagation may also be needed when the user fine tunes the solution by manually selecting some other Web service after the instantiation process. In reference to the motivating example scenario discussed for the backtracking process, the reinstantiation result i.e. someOtherHospitalService should be propagated to the Ambulance node.

Composition monitoring

The composition monitoring phase works by using the execution constraints, called monitors, attached to the abstract composition. Below we first briefly discuss the Event Processing Network (EPN) framework on which we will base our proposed monitoring framework.

Event Processing Network

Event processing network [START_REF] Sharon | Event-processing network model and implementation[END_REF] is defined to be a pattern promoting the production, detection, consumption and reaction to events. An EPN model consists of four components, event producers (EP), event processing agents (EPA), consumers (C) and connection channels, called event channels (EC), for communication between other components. The EPA has following three stages, Pattern detection -responsible for selecting events matching a particular pattern, Processing -for applying processing functions to events detected and thus resulting in derived events and Emission -for emission of derived events.

Regarding proposed framework, the events generated by the composition process include the process startup, termination, and messages exchanged between the composition process and the services. Each event has associated header information which indicates the event meta-data including its source, type (such as inputMessage, outputMessage), time stamp and other similar information. In context of our proposed model, the composition process and participating Web services can be termed as the event producers. The produced events will then be processed by the EPA, which in our case is the event listener attached to the composition process.

Monitors

Monitors specify the execution constraints added to the abstract composition and each monitor has a set of activation conditions and associated actions.

Activation condition Each monitor has a set of activation conditions and the associated actions. The monitor activation conditions are based on the pattern detection stage of the EPN, below we discuss different activation stages.

-Context specifies the context of events that will be used for evaluating the event conditions. Temporal context can be specified to handle the conditions where monitoring is based on invocation history, as an example consider that we need to monitor the average response time for a Web service in last 24 hours. Spatial context can be specified, for example to monitor events originating from Web service in certain geographical region. Finally semantic based context can be used to handle cases when generated events have relevance through mutual object or entity, as an example consider the case when we are willing to monitor the response time of all the Web services related to (or have the same type of) a particular Web service. The context can also be specified as of value null, requiring all the events to be processed.

-Policies can include decisions to either use first, last or each of event (within specified context) in stream for pattern detection. They can also apply further constraints to only include the events satisfying a predicate on their attributes or by specifying expiry time for events.

As an example consider that only output messages from some service s, should be used for monitoring; we can thus specify the policy to consider all the events having type as message and source as service s in their meta-data.

-eventConditions as similar to the patterns in an EPN model, the events conditions specify the conditions to be checked for events conforming policies and that are within specified context. Event conditions are specified using event calculus and some common types of event conditions include verifying data values within messages being sent and received by the composition process, overall time taken by the composition process and others.

-Directives specify the directives for reporting monitoring violations to the actions stage. The monitoring process may decide to report the monitoring violations as they are observed by specifying the directive as immediately, this would likely be the case of a service failure. However, the monitoring process can also decide to delay the reporting by specifying directive as delay -timeValue to delay the reporting in an attempt to give the service some time to recover from the violation, this would likely be the case of exceeding response time for the Service.

Actions Once the eventCondition specified for the monitor is satisfied, associated actions specify the actions to be taken. Some common actions include terminate/ignore/reinstantiate and others. The re-instantiation function has an important application to the Web services monitoring process. In case of a service failure or a tardy service having a significant delay in the response time, to a service chosen as the result of the instantiation process, the monitoring process can add directives to re-instantiate the Web service node. The current service is added to the set of already used services for the node and a newly chosen service can then be used. This leads to the run-time composition of the Web services and a detailed discussion is beyond the scope of this paper. The re-instantiation and then propagation to dependent nodes can be expensive, if the services are already in execution but it prevents the complete failure. Another important aspect is the handling of (partial) execution results of the service; if the service hasn't yet been invoked and no data is available, the reinstantiation is safe. If there are some intermediate result, they can either be discarded or passed to the newly instantiated service.

Example

Let us now review the motivating example and see how composition monitoring works using proposed framework. For the initialCheckup service we can specify some execution constraints that the data validity period for the service response is one hour and that the response time for the service should be less than 2 seconds. For the response time, the monitor below can be attached to the composition process as part of execution constraints of the service. The monitor above, added to abstract composition, can then be used by the event listener attached to the composition process for runtime handling. The monitor requires event listener to listen for the messages sent/received by the composition process that are within specified context (specified as none and thus listens for every event) and those conforming policies (last request/response messages from the initialCheckup service). Once the messages within specified context and conforming to policies is detected by the event listener, event conditions are checked (time difference between request/response messages greater than 2 seconds) and in case of conditions become true, directives (immediately) are observed to identify when to report this violation to actions stage. The actions stage can then take the appropriate actions (send notification message). Then for monitoring the data validation, the monitor below can be specified: monitor: initialCheckup_dataValidation type: Message activation:

context: none policies: last response message, service = initialCheckup eventCondition: Declipped(t, available(checkupW SData, true), t ′ ) ∧ (t + 60 > t ′ ) directives: immediate action: send data expiry alert message Every service that is using the data of initialCheckup can then have a monitor to listen for the data expiry message of initialCheckup service and to take the corresponding actions. We can then also have a monitor to handle the Hospital node re-instantiation in case of service failure, omitted due to space limitations.

Conclusion

In this paper, we present a constraint based declarative approach for Web services composition and monitoring problem. Our approach allows user to build the abstract composition by identifying the participating entities and by providing a set of constraints that mark the boundary of the solution. Different types of constraints have been proposed to handle the composition modeling and monitoring; local, choreography and non-functional constraints guide the composition design, while the execution constraints, called monitors and are based on Event Processing Architecture, are used for process monitoring during execution.

The abstract composition can then be used for the concrete composition, which involves instantiating the Web service nodes to the concrete Web service instances respecting local constraints associated with the nodes. The instantiation process then executes the composition and attaches the event listener to the composition process for handling run-time monitoring based on execution constraints. We have also presented a sample Crisis Management scenario, that highlights our approach.

Fig. 1 .

 1 Fig. 1. Proposed framework components

Fig. 2 .

 2 Fig. 2. Abstract composition for the motivating example

  HoldsAt(responseReceived(ICService, true), t ′ ) ∧ t + 2 > t ′ directives: immediate action: send response time alert message

	monitor: initialCheckup_responseTime
	activation:
	context: none -every event should be taken into account
	policies: last request/response message, service = initialCheckup
	eventCondition:
	HoldsAt(requestSent(ICService, true), t) ∧

SAMU (Service d'Aide Médicale d'Urgence) is the French hospital based emergency medical service.

Fluents are first-class objects which can be quantified over and can appear as the arguments to predicates.