Aymen Baouab
email: aymen.baouab@loria.fr

Walid Fdhila
email: walid.fdhila@univie.ac.at

Olivier Perrin
email: olivier.perrin@loria.fr

Claude Godart
email: claude.godart@loria.fr

Towards Decentralized Monitoring of Supply Chains

Keywords: web service, choreography monitoring, crossorganizational business process

niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

I. INTRODUCTION

The ability of linking cross-organizational business processes is receiving increased attention in an ever more networked economy [START_REF] Grefen | Towards dynamic interorganizational business process management[END_REF]. Indeed, collaborative computing grows in importance and processes have to deal with complicated transactions that may take days or weeks to complete across wide ranging geographies, time zones, and enterprise boundaries. Organizations interact with each other forming complex chains including multiple administrative domains in order to drive increased business value.

Building complex distributed processes, without introducing unintended consequences, represents a real challenge. Choreography description languages help to reduce such complexity by providing means of describing complex systems at a higher level. The birth of a service choreography is often determined by putting together external norms, regulations, policies, best practices, and business goals of each participating organization. All these different requirements have the effect of constraining the possible allowed interactions between a list of partners. However, this does not necessarily guarantee that erroneous situations cannot occur due to inappropriately specified interactions. Thus, runtime verification must be taken into consideration, to the aim of checking if the actual behavior of the interacting entities effectively adheres to the modeled business constraints.

Run-time compliance monitoring of services composition have been a subject of interest of several research efforts [START_REF] Ardissono | Monitoring choreographed services[END_REF], [START_REF] Francalanza | Runtime monitoring of distributed systems (extended abstract)[END_REF], [START_REF] Moser | Event driven monitoring for service composition infrastructures[END_REF], [START_REF] Baouab | An event-driven approach for runtime verification of inter-organizational choreographies[END_REF], [START_REF] Chafle | Decentralized orchestration of composite web services[END_REF], [START_REF] Halle | Flexible and reliable messaging using runtime monitoring[END_REF]. Traditional monitoring approaches consist of a central monitor which is notified by each participant whenever an event happens (e.g. sending or receiving a message). Nevertheless, this is mostly limited to inner-organizational roles and may not be adaptive to some situations specially in case of business value chains that span across many circle of trust (i.e. there is no common trusted party among all participants). By removing a central authority responsible for that, it is required to distribute this aspect among the involved participants. Thus, there is a need to find an efficient way to enable an instant propagation of internal exceptions across organizational boundaries. The main purpose behind that is to enable global process tracking, and to guarantee that all involved partners are informed about errors that happen as soon as possible. Indeed, the sooner violations are detected, the better caused failures are properly handled.

In this paper, we present an approach for exchanging monitoring data between collaborating partners. Our approach relies only on state change of choreographies (i.e. occurrence of a message exchange) without providing information about the internal processes. In order to limit data exposure and avoid bandwidth overhead, we define a hierarchical model for selective notification propagation. We design a new component called External Flow Monitor (EFM) to be implemented within each participating organization. According to the pre-defined choreography specification, each EFM supervises all incoming and outgoing calls of its organization and automatically exchanges notifications with a pre-calculated subset of other participants. The collected data can be further used for the evaluation of global process metrics and might help business-level stakeholders gaining insight and understanding into their business operations.

The rest of this paper is structured as follows. Section 2 illustrates our work by a motivating example. Section 3 introduces the formal definitions of choreography and related concepts. Section 4 details our decentralized monitoring approach while Section 5 illustrates it by a case study. Section 6 outlines some implementation guidelines, Section 7 discusses related work and Section 8 summarizes the contribution and outlines future directions.

II. SCENARIO AND MOTIVATION

To illustrate the motivation and concepts of our work, we adopt the scenario of a supply chain choreography. In this type of cross-organizational business value chains, a reseller interacts with multiple suppliers who in turn interact with multiple manufacturers in order to get a quote for some goods or services.

The basic structure of such a network is presented in figure 1. For instance, figure 2 shows a choreography involving seven main parties: the customer (C), the reseller (R), two suppliers (SA and SB), and three manufacturers (A1, A2, and A3). First, the reseller receives a request for a quote from the customer (M 1 ). Then, it selects one of the two suppliers and formulates a new request. In case of selecting SupplierA (M 2 ), manufacturers 1 and 2 are requested in sequence (M 3,...,6 ). In the other case (M 8 ), manufacturers 2 and 3 are requested in parallel (M 9,...,12 ). After getting the final results (M 7 or M 13 ), the reseller replies the customer (M 14 ).

Reseller

Global process tracking : In the inter-organizational setting, each participant has concern only with the partners immediately connected to it and cannot see beyond. Technically, a service (or a subprocess exposed as a service) can see its providers and its consumers with which it is making service level agreements. During runtime, it has no information about the rest of the service choreography. However, a service is dependent on its lower services and might be interested in monitoring the outsourced process fragments. In our example, the customer C only interacts with the reseller R and cannot see beyond. After sending its request to R, C still waits for the response without having any information about the current state of its request. Thus, it would be interesting to keep C notified of what is happening during its request. Such a case shows the need for exchanging notifications in order to enable choreography tracking. Furthermore, exchanging notifications permits to have a wider view on the choreography and to collect additional monitoring data that might be used a posteriori for measuring global process performance and controlling the achievement of business goals.

Exceptions : Exceptions can occur at any time throughout the execution of this choreography. The reason can be an internal problem of one participant or an incorrect message that differs from the one that is specified in the process description. In the latter case, the problem can be managed rapidly especially when using a reliable messaging protocol between the two partners. However, in the case of an internal error which cannot be reported back to the choreography to be treated as a global exception (e.g. using WS-CDL [START_REF] Kavantzas | Web services choreography description language version 1.0. W3C[END_REF] exceptions), the involved participants may not be notified. Traditionally, this kind of situation is handled by adding confirmation calls after the end of each subprocess and/or fixing global timeouts. However, additional calls may complicate the choreography control-flow and global timeouts are still not well adapted to the long-running collaborations. To address this issue, it is preferable to guarantee that all involved partners are informed about errors that happen as soon as an internal subprocess suffer an exception.

Timeouts : Timeout represents the maximum length of time for which a piece of software logic will continue to wait for a certain event to occur. If that event does not happen in the pre-defined amount of time, it will stop the success execution flow and raise this non-occurrence as an exception of some sort [START_REF] Tost | Planning and handling timeouts in service-oriented environments[END_REF]. For instance, when using the BPEL language, a timeout on a receive activity is used when the process is waiting for an external message to arrive. In this case, the timeout value is fixed in accordance with the time in which the service can be expected to complete a request under normal conditions. Typically, this kind of information is prepared for an SLA (service level agreement) which takes into consideration the service levels supported by services it invokes.

In our example, each party may fix a timeout for each invocation to indicate how long an outbound SOAP request will wait for a result message to come back before the participant signals an error.

In case of an internal error within the reseller or a non reception of a response from another participant (e.g. supplier A or B) within the fixed local timeout, the customer remains not informed about that exception and will continue waiting for an answer until its timeout occurs. This may not be adaptive for such a long running collaboration.

III. CHOREOGRAPHY (GLOBAL / LOCAL VIEW)

A choreography defines re-usable common rules that govern the ordering of exchanged messages, and the provisioning patterns of collaborative behavior, as agreed upon between two or more interacting participants [START_REF] Kavantzas | Web services choreography description language version 1.0[END_REF]. In this paper, we perceive a choreography as a description of admissible sequences of send and receive messages between collaborating parties. For the sake of simplicity, we omit assignment of global variables. We use "participant" and "partner" interchangeably. We formalize the semantics of a choreography as follows.

Definition 1 (Choreography global view): Formally, a choreography C is a tuple (P , I, L) where

• P is a finite set of participants (Partners),

• I is a finite set of interactions, • L is the set of constraints on the sequencing of interactions. Every interaction i ∈ I corresponds to a certain type of messages, and is associated with a direction of communication. Let M T be the set of message types. Formally, an interaction is defined as follows.

Definition 2 (Interaction): An interaction I ∈ I is a tuple (s,d,m t ) where s,d ∈ P (the source and the destination of the message), and m t ∈ M T (the type of the message).

In a given choreography, two interactions are either in strict order, in interleaving order, or exclusive to each other. Then, the constraints specified in L are generally of three types :

• The strict order constraint, denoted by the function Seq(M 1 , M 2 ), holds for two messages M 1 and M 2 , if M 2 never occur before M 1 . • The exclusiveness constraint, denoted by the function Ex(M 1 , M 2 ), holds for two messages M 1 and M 2 , if they never occur together with the same instance identifier.

• The co-occurrence constraint, denoted by the function And(M 1 , M 2 ), holds for two messages M 1 and M 2 , if they occur always together in any execution trace. The global view of a choreography specifies a high-level view of the conversation between the participants, and can be considered as being interpreted from an observer point of view. The local view is derived from the global view, and specifies the communication-relevant behavior of each participant. Each local view only include interactions where at least one of the communication actions (e.g. receive, send) is executed by the participant for which the local view is generated. It includes also the set of constraints on the sequencing of those interactions. We define a local view as follows.

Definition 3 (Choreography local view):

A local view C i of a participant P i is a tuple (I i , L i ) where

• I i ⊆ I is a set of interactions involving P i (i.e. having P i as a source or a destination):

i = (s, d, m t ) ∈ I i ⇔ s = P i or d = P i , • L i ⊆ L is the set of constraints on I i .

IV. EXTERNAL FLOW MONITORING

A traditional monitor is supposed to monitor the conformance of incoming and outgoing messages choreography of its own organization referring only to its local view. This kind of monitoring does not allow for choreography tracking because it is not possible to see what is happening beyond the borders (e.g. communications between other collaborating parties). To monitor the whole choreography, proposed solutions [START_REF] Ardissono | Monitoring choreographed services[END_REF], [START_REF] Chafle | Decentralized orchestration of composite web services[END_REF], [START_REF] Wetzstein | Cross-organizational process monitoring based on service choreographies[END_REF] consist of a central monitor which is notified by each participant whenever an event happens (e.g. using a publish/subscribe mechanism [START_REF] Wetzstein | Cross-organizational process monitoring based on service choreographies[END_REF]). Nevertheless, this may present a single point of failure and not be adaptive when there is no common trusted party among all participants. In order to enable cross-organizational business process tracking in a decentralized manner, we propose a new automated mechanism for exchanging monitoring data between selected participants, without inducing significant network overhead.

A. External Flow Monitor

We introduce a new component called External Flow Monitor (EFM) which has to be deployed to each party's infrastructure. Each EFM is configured considering which events it has to provide and to which EFMs. Based on each choreography specification, notifications are automatically exchanged across the formed interconnected network of EFMs. A description of the EFM is shown in Figure 3.

During runtime, the choreography model is used as a basis to transparently observe the behavior of peer-to-peer service interaction. Our approach relies only on choreography state changes (i.e. when a global message is sent or received) monitoring only the interactions between the peers in an unobtrusive way (i.e. the exchanged messages are not altered by the monitors and the peers are not aware of the monitors). We provide an automated mechanism of generating and exchanging notifications. Notifications are defined based on the choreography model by specifying which data it should contain, and to which partner it should be sent.

B. Notifications Exchange

For each exchanged message between two participants, their EFMs generate each a new notification that has to be sent to specified partners. Each notification is correlated to a choreography message and is generated in order to inform other partners about the occurrence of that message. A notification is defined as follows.

Definition 4 (Notification Event): A notification n ∈ N is a tuple (ci,t,s,d,m t ) where ci is an instance identifier (used for correlation), t is the timestamp of generation, s,d ∈ P (the source and the destination of the associated message), and m t ∈ M T (the set of message types).

Exchanging notifications between partners induce additional traffic. In order to enable selective notification exchange and reduce the the additional network overhead (i.e. reduce the number of partners that have to be notified), we introduce a new type of relationship between the participants of the choreography. With such a relationship, we define the direction of each notification.

C. Hierarchical Classification of Participants

Notifications pertaining to different choreography messages of a given participant are meant to be restricted and may be only partially interesting to a subset of business partners. These interested partners are those viewed as consumers of that participant. In a choreography, we can classify participants hierarchically in a producer-consumer manner to form service supply-chains of added value. In other words, the organization of partners is performed in multiple hierarchical layers. Putting the client (i.e. the initiator of the choreography) on the top layer, the lowest layers consist of a set of service providers. Then, each layer is dependent on its lower layers and the propagation of notifications is allowed only upward in the hierarchy. These layers denote the visibility levels of the participants (i.e. service providers and the client). To enable such a classification, we introduce the notion of super/sub-partner as follows.

Definition 5 (Super / Sub Partner): A participant P i ∈ P is called the super -partner of a participant P j if f the first interaction in the local view of P j has P i as a sender. In other words, P i is responsible for the participation of P j in the choreography. Then, P j is called a sub -partner of P i . Formally, we note : Super(P j ) = P i . Then, P i ∈ Sub(P j ).

It should be noticed that we assume all choreographies to be realizable [START_REF] Lohmann | Realizability Is Controllability[END_REF] with only one initiator. In a supply-chain, a service provider may have sub-contractors which may have also further sub-contractors making a hierarchical structure [START_REF] Haq | Aggregating hierarchical service level agreements in business value networks[END_REF]. In this way, each participant has exactly one superpartner (except the one who initiates the choreography) and may have many sub-partners. As such, participants can be classified in a tree : the initiator represents the root (see Each participant notifies its super-partner by generating new notifications (when a message is exchanged) and forwarding those coming from its sub-partners. Using a hierarchical architecture permits to lower the complexity in terms of notifications overhead. Indeed, the complexity depends on the number of choreography messages and the number of participants. Let d be the depth of the generated tree. For each message, there are at most d -1 notifications that have to be transmitted (one generation and d -2 forwards). Then, the number of notifications is upper bounded by O(m) (m is the number of choreography messages).

When considering the number p of participants, the complexity in the best case (when the depth is equal to 1) is obviously linear (figure 4.b). In the average case, our approach requires O(p.log(p)) notifications, but needs O(p 2 ) notifications in the worst case, when the unbalanced tree resembles a linked list (degenerate tree) as shown in figure 4.c.

Proof: Let c be the average number of leaves of each node (i.e. the number of sub-partners of each participant), m be the maximum number of messages sent by each participant, and I i (i ∈ [0..d]) be the level number i of the tree. For each node (participant) in the first level I 1 , there is only m sent notifications, for I 2 , there are 2 * m, and for I d , there are d * m. Then, after multiplying by c i (which is the average number of nodes of the level i), the total number of notifications n is equal to i * c i * m (with 0 < i < d) which is upper bounded by O(d * c d ). We know that depth d of a c-tree is O(log c (p)). We deduce that n is upper bounded by O(log c (p) * c logc(p) ) = O(p * log c (p)) if c > 1. Indeed, c = 1 describes the worst case depicted in figure 4.c.

D. EFM-View

A local view in a choreography represents the visibility of a business partner. Every partner is limited only to its own view. Using such hierarchical setting, each EFM receives notifications on any state change of all its subsequent subpartners. Then the EFM-view allows for a wider visibility than the local view. The EFM-view of a participant P i includes interactions where at least one of the communication actions (e.g. receive, send) is performed by P i or all its subsequent sub-partners. It includes also the set of constraints on the sequencing of those interactions. Formally, we define the EFM-view as follows.

Definition 6 (EFM View): An EFM-view V i of a participant P i is a tuple (IS i , LS i ) where

• IS i = ∪ j∈sub(i) IS j ∪ I i • LS i ⊆ L is the set of constraints on IS i .
Note. If the participant P i do not have sub-partners (sub(P i ) = ∅) then we have IS i = I i , which means that its EFM-view is equal to its local view (V i = C i ).

Considering the lifecycle of our monitoring solution we can distinguish between two phases : the setup phase, and the concrete monitoring.

E. Setup Phase

In the setup phase, we mainly identify the super of each participant as well as the set of notifications it should send or receive. Algorithm 1 presents a pseudocode of the setup procedure. Let's C be a choreography and P the set of participants. For each participant P i , we look for the first partner who initiated a conversation with it. The latter is considered as responsible for initiating P i in the collaboration (super of P i ). Then, we define the set of needed notifications (i.e. that have to be generated during runtime phase).

F. Runtime Phase

An EFM can be seen as a special case of finite state automaton whose transitions are labeled with message events. The automaton is automatically generated from its defined EFM-view. Starting from the initial state when the choreography is locally instantiated, the current state is updated whenever a new exchanged message is detected or an external notification is received. As such, each EFM follows each choreography to which its organization is participating without modifying anything about it (i.e. the structure of the choreography remains the same). In algorithm 2, we explain the runtime monitoring process from a single partner view, and show how notifications and messages are managed by each EFM. We mention that an EFM deals with three types of events: (i) events related to messages exchanged with other partners (i.e. choreography messages), (ii) events related to exchanged notifications (i.e. for monitoring purpose), and (iii) events stating exceptions. According to the event type, the EFM behaves differently.

• If the event is a message exchange, then the EFM checks if it is conform to its view. The conformance test checks if the message is received or sent with respect to the constraints on the sequencing of interactions (i.e. order, exclusiveness and co-occurence constraints). If the message is conform, then the monitor updates its status in the view graph and eventually instantiates a new notification and sends it to its super. Indeed, we don't need to notify the super if he is the source or the destination of the message causing the notification. • If the event is a notification reception, then the EFM checks if it is conform to its view, updates its view status and forwards the notification to its super. • If the event is an exception generated by another partner, then the EFM would simply forward it to its subsequent sub-partners and treat the exception.

In the two first scenarios, if the event is not conform to the EFM view, an exception is raised, the internal monitor is alerted and all its sub-partners are notified. Each sub-partner propagates the exception to its sub-partners according to the Super/Sub-partner tree. It should be noted that the super and its subsequent supers would detect the error automatically and do not need to be notified since they will be blocked in their view graphs.

V. CASE STUDY: SUPPLY CHAIN CHOREOGRAPHY

As an evaluation, we applied our approach on the supply chain choreography introduced in Section II. The local views of the reseller and the two suppliers are shown in figure 5. For the sake of space, we omit the local views of the other participants. After the execution of Algorithm 1, the first interaction of each local view defines the Super of each party. Then we have Super(R) = C, Super(SA) = R, and Super(SB) = R. The customer C, which is the initiator of the choreography, has no Super. Afterwards, the set of needed notifications to be sent to each Super is automatically defined in each party. In this case, we discern twelve definitions of notifications N 2,...,13 associated, respectively, to the defined choreography messages M 2,...,13 . Figure 6 shows the generated EFM-view of the reseller (R). For sake of space, each interaction is labeled with either a send action (prefixed with "!") or a receive action (prefixed with "?"). We remark that the manufacturers A1, A2, and A3 do not have sub-partners (sub(Ai) = ∅) then their EFMviews are equal to their local views (V Ai = C Ai ).

Local constraints on each participant behavior can be re-enforced by its super. For instance, the co-occurrence constraint for the two messages M 9 and M 11 that can be enforced by applying And(M 9 , M 11 ) on the Supplier B (SB) can be further verified by the EFM of R using And(N 9 , N 11 ). Figure 7 sketches an example of execution and the set of sent notifications between the partners. ci1 is the instance identifier. τ i represents a timestamp associated with the occurrence time of the message M i (either its reception or sending time). A timestamp is a mandatory attribute to verify the ordering of the messages.

VI. IMPLEMENTATION GUIDELINES

In order to present the concept in a technologyindependent way, we prefer to outline a general architecture rather than describing technical details related to any service choreography language. We propose to extend any organization architecture with two components : the External Flow Controller and the External Flow Monitor (Figure 8).

The External Flow Controller (EFC): is responsible for the control and the conformance verification of the exchanged choreography messages according to the local view. Two types of control are depicted: (i) incoming message control in order to restrict the access to internal resources taking into account the context of the call and the controlflow of the involved inter-organizational process, and (ii) outgoing message control used to prevent from divulging sensitive information in unexpected ways (i.e. without a consistent inter-organizational process context). This aspect is not covered in this paper. More details can be found in our previous work [START_REF] Baouab | An event-driven approach for runtime verification of inter-organizational choreographies[END_REF]. Furthermore, the EFC generates a notification whenever a received or sent choreography message is validated. The generated notification is then locally sent to the EFM. Event correlation -: During the execution phase, we may have several instances of different defined choreography models. Obviously, we need to correlate notification events belonging to the same instance. The most common solution to deal with this issue is to define two identifiers that have to be contained on each message (e.g. included in the SOAP header): The choreography ID (a unique identifier for each choreography model) and the choreography instance ID (a unique identifier for each choreography instance). Since each choreography message passes through the EFC, this component may be adapted to include and read the identifier whenever a choreography message is exchanged.

Event timestamps -: Time is a critical issue in monitoring cross-organizational processes where a set of monitors communicate through message exchange and do not have access to a global clock. Nonetheless generated notification events have to be timestamped and a common time is required to analyze the acquired monitoring data. To deal with this issue, Clock Synchronization Algorithms [START_REF] Anceaume | A Taxonomy Of Clock Synchronization Algorithms[END_REF] may be adopted. Without setting a global clock, an alternative solution is to send the time separating two consecutive events instead of sending time of occurrence of each event.

VII. RELATED WORK

Run-time monitoring of services composition have been a subject of interest of several research efforts. In this section we want to outline some of the most relevant contributions with the aim to provide a distinction to our work.

Subramanian et al. [START_REF] Subramanian | On the enhancement of bpel engines for self-healing composite web services[END_REF] presented an approach for enhancing BPEL engines by proposing a new dedicated engine called "SelfHealBPEL" that implements additional facilities for runtime detection and handling of failures. This approach may have a negative impact on performance and agility since there is no separation between monitoring logic and the BPEL engine. Barbon et al. [START_REF] Barbon | Runtime monitoring of instances and classes of web service compositions[END_REF] proposed an architecture that separates the business logic of a web service from the monitoring functionality and defined a language that allows for specifying statistic and time-related properties. However, their approach focus on single BPEL orchestrations and do not deal with monitoring of choreographies in a crossorganizational setting. Ardissono et al. [START_REF] Ardissono | Monitoring choreographed services[END_REF] presented a framework for supporting the monitoring of the progress of a choreography in order to ensure the early detection of faults and the notification of the affected participants. The approach consists on a central monitor which is notified by each participant whenever he sends or receives a message. Nevertheless, this approach is centralized and therefore not well adapted to inter-organizational choreographies specially when there is not a common trusted party among all participants.

In case of decentralized processes within the same organization (or within a circle of trust), Chafle et al. [START_REF] Chafle | Decentralized orchestration of composite web services[END_REF] have modeled a central entity as a status monitor which is implemented as a web service. On each partition, a local monitoring agent captures the local state of the composite service partition and periodically updates the centralized status monitor. The status monitor maintains the status of all the activities of the global composite service. However, under high loads, maintenance of global state at one place can become a bottleneck. In [START_REF] Halle | Flexible and reliable messaging using runtime monitoring[END_REF], the authors introduce the concept of monitor-based messenger (MBM), which processes exchanged messages through a runtime monitor. Each local monitor stamps its outgoing messages with the current monitor state to prevent desynchronizations, provide a total ordering of messages, and offer protection against unreliable messaging.

Regarding event-centric perspectives, process monitoring solutions focus on intra-organizational processes and are mostly based on Business Activity Monitoring (BAM) technology [START_REF] Dahanayake | Improving the understanding of bam technology for real-time decision support[END_REF]. To the best of our knowledge, only two eventcentric approaches deal with monitoring cross-organizational choreographies. The first one [START_REF] Kikuchi | Monitoring method of cross-sites' processes executed by multiple ws-bpel processors[END_REF] uses a common audit format which allows processing and correlating events across different BPEL engines. The second approach [START_REF] Wetzstein | Cross-organizational process monitoring based on service choreographies[END_REF] introduces complex event specification and uses a choreography instance identifier (ciid) to deal with event correlation (which is not supported in [START_REF] Kikuchi | Monitoring method of cross-sites' processes executed by multiple ws-bpel processors[END_REF]).

Our introduced event based framework allows for runtime decentralized monitoring of choreographies that are deployed across organizational boundaries. In contrast to the previously mentioned works, we rather focus on providing an automated and decentralized mechanism for exchanging notifications across the involved partners according to specific rules that can be automatically generated from the choreography specification.

VIII. CONCLUSIONS AND FUTURE WORK

In this paper, we proposed an approach for monitoring global state change of cross-organizational choreographies. We introduced the notion of External Flow Monitoring and defined an hierarchical propagation model for exchanging external notifications between the collaborating parties in order to limit data exposure and avoid bandwidth overhead. The generation of notifications relies on state change of choreographies allowing to transparently observe the external behavior of each participant without providing information about the internal processes.

Future work will aim at extending our proposed architecture by a new component to manage the actions to be undertaken if an exception is detected (e.g. constraint violation, message/notification redundancy, deadlock, etc.). We also plan to address privacy issues using role based monitoring to avoid critical information disclosure.

Figure 1 .

 1 Figure 1. Supply chain structure.

Figure 2 .

 2 Figure 2. A Supply Chain Example (BPMN 2.0 Choreography Diagram).

Figure 3 .

 3 Figure 3. External Flow Monitor.

Figure 4 Figure 4 .

 44 Figure 4. Super/Sub-Partner Tree

Algorithm 1 : 4 / 5 Ii0← 6 Superi ← GetSource(Ii0) 7 8 // 9 Vi←

 1456789 Setup Algorithm 1 Require: -C: a choreography (a global view) 2 -P: a set of participants 3 for (each Pi in P) do * Identifying the Super of Pi * / GetF irstInteraction(Pi) SubP artners(Superi) ← SubP artners(Superi) ∪ {Pi} * Define the set of needed notifications * ConstuctN otif icationSet(Pi) 10 end 11 End

Algorithm 2 : 5 U 8 n 11 // 12 F

 2581112 EFM : Runtime monitoring and notification management 1 Require: -S: The super of the current participant 2 -V: The EFM-view 3 for (each event occurrence ei ) do 4 if (ei.type = Exception and CheckConformance(ei)) then pdateM onitorState(ei) 6 if (ei.msrc = Super and ei.mdst = Super) then / * Generate a new notification if ei is not coming from/going to the Super * / 7 if (ei.type = message exchange) then ← GenerateN otif ication(ei) 9 SendN otif ication(n, Super) 10 else * ei.type = notification exchange * orwardN otif ication(ei, Super)

Figure 5 .

 5 Figure 5. Local Views (Reseller, Supplier A and B).

Figure 6 .

 6 Figure 6. Reseller's Monitoring View.

Figure 7 .

 7 Figure 7. Example of a Successful Scenario.

Figure 8 .

 8 Figure 8. Conceptuel Reference Architecture.


Marianna Meo

Student Member, IEEE Vicente Zarzoso

Senior Member, IEEE Olivier Meste

Gabriel Decebal

Nadir Latcu

Saoudi

Member, IEEE Decebal G Latcu

Nadir Saoudi

Multidimensional Characterization of Fibrillatory Wave Amplitude on Surface ECG to Describe Catheter Ablation Impact on Persistent Atrial Fibrillation

published or not. The documents may come   L'archive ouverte pluridisciplinaire

I. INTRODUCTION

Persistent atrial fibrillation (AF) is an arrhythmia characterized by the generation of irregular electrical patterns, inducing an uncoordinated mechanical contraction. Several theories about its electrophysiological mechanisms have been put forward. Early experimental studies state that persistent AF triggering and maintenance can be explained by multiple reentrant wavelets. More recently, reentrant pathways in pulmonary veins (PVs) have been identified as AF drivers [START_REF] Haïssaguerre | Spontaneous initiation of atrial fibrillation by ectopic beats originating in the pulmonary veins[END_REF], whereas fibrillatory conduction passively propagates in other atrial parts. Even if radiofrequency catheter ablation (CA) has become the therapy of choice for the treatment of persistent AF, its effectiveness is still an open issue. Its main goal is to terminate AF either by eliminating the trigger initiating AF or by altering the arrhythmogentic substrate. Since the precise pathophysiology of AF development and progression has not been completely elucidated yet, understanding whether ablation effectively suppresses abnormal rhythm sources and how This work is partly supported by the French National Research Agency under contract ANR-2010-JCJC-0303-01 "PERSIST". Marianna Meo is funded by a doctoral grant from the French Ministry of Higher Education and Research.

* Marianna Meo, Vicente Zarzoso and Olivier Meste are with the Laboratoire d'Informatique, Signaux et Systèmes de Sophia Antipolis (I3S), Université Nice Sophia Antipolis, CNRS, France (e-mail:{meo, zarzoso, meste}@i3s.unice.fr).

Decebal G. Latcu and Nadir Saoudi are with the Service de cardiologie, Centre Hospitalier Princesse Grace, Monaco (e-mail: {dglatcu, nsaoudi}@chpg.mc).

it modifies heart electrical pathways remains a challenging question. Different CA techniques have been developed, yet none of them is widely regarded as effective by the medical community. Their performance is still far from satisfactory, and they are less effective than equivalent procedures for paroxysmal AF. Since this cardiac interventional procedure is profoundly influenced by operator's subjectivity and patient's clinical background, ablation results reported by clinical centers are extremely variable and not easily comparable.

Surface standard ECG is considered a valuable tool for examining AF, whose presence is reflected by the manifestation of irregular fibrillatory waves (f-waves) replacing the physiological P wave. In [START_REF] Haïssaguerre | Catheter ablation of long-lasting persistent atrial fibrillation: critical structures for termination[END_REF], it is shown that prolongation of atrial fibrillation cycle length (AFCL) in the coronary sinus and the atrial appendages predicts AF termination by CA. In [START_REF] Bonizzi | Atrial fibrillation disorganization is reduced by catheter ablation: A standard ECG study[END_REF], reduction in AF spatio-temporal complexity following CA is quantified by variations in the normalized mean square error (NMSE) values between the AA signal and its rank-3 approximations on V 1 . The degree of AF organization is supposed to be directly correlated to the number and interactions of atrial wavefronts through heart substrate. Evidence reported in [START_REF] Nault | Clinical value of fibrillatory wave amplitude on surface ECG in patients with persistent atrial fibrillation[END_REF] establishes the predictive power of f-wave peak-to-peak amplitude: the higher its value, the more likely AF termination by CA. Nevertheless, ECG analysis is not always straightforward, and visual inspection is sometimes not sufficiently effective, as it cannot capture AF features underlying the whole ensemble of leads; hence, the limiting perspective of conventional methods, focusing on single leads separately.

To overcome the limitations of single-lead approaches, in [START_REF] Meo | Noninvasive prediction of catheter ablation outcome in persistent atrial fibrillation by exploiting the spatial diversity of surface ECG[END_REF], a novel predictor of short-term CA outcome has been developed. It describes f-wave spatial distribution and it is able to distinguish between successful and failing procedures before their execution. Such an action has been accomplished by exploiting the spatial variability typical of the standard ECG through the principal component analysis (PCA) of the AA signal. f-wave peak-to-peak amplitude is automatically computed by means of cubic spline interpolation of the AA local extrema, and the same results as those manually obtained in [START_REF] Nault | Clinical value of fibrillatory wave amplitude on surface ECG in patients with persistent atrial fibrillation[END_REF] have been reproduced. It has been demonstrated that taking advantage of the spatial diversity present in the surface ECG does not only improve the robustness to electrode selection, but it also enhances the predictive power of the amplitude parameter.

As opposed to [START_REF] Nault | Clinical value of fibrillatory wave amplitude on surface ECG in patients with persistent atrial fibrillation[END_REF], [START_REF] Meo | Noninvasive prediction of catheter ablation outcome in persistent atrial fibrillation by exploiting the spatial diversity of surface ECG[END_REF], we focus on variations in f-wave amplitude observed between the beginning and the end of the ablation. This paper presents the further ability of this multilead f-wave amplitude index to describe the myocardial electrical remodeling performed by CA and changes in AF pathophysiology during the procedure. This parameter highlights variations in f-wave amplitude for each patients' category, and allows the quantification of the ablation effects at different follow-up lengths. More specifically, we will demonstrate that a decline in f-wave amplitude between the beginning and the end of the procedure can be remarked in patients experiencing AF termination by CA.

II. METHODS A. Experimental Protocol

A group of 31 patients addressed for CA of persistent AF were included in this study. They all gave their informed consent. Three patients underwent a double procedure. Oneminute surface 12-lead ECG signals were acquired at the beginning and at the end of the procedure, through a standard 12-lead system at a 1-kHz sampling rate with the aid of Prucka Cardiolab TM and Biosense CARTO TM electrophysiological measurement systems at the Cardiology Department of Princess Grace Hospital in Monaco. Ablation procedure was performed in a stepwise manner, beginning with LASSO-guided circumferential PV isolation, followed by fragmented potentials, non-PV triggers, roof line and mitral isthmus line right atrial ablation.

According to HRS Expert Consensus Statement guidelines for CA trials [START_REF] Calkins | HRS/EHRA/ECAS expert consensus statement on catheter and surgical ablation of atrial fibrillation: recommendations for personnel, policy, procedures and follow-up[END_REF], immediately after CA performance, there is a three-month "blanking period" during which time AF episodes can occur as part of the body's healing response to the procedure. Any fibrillatory activity during this period is not taken into account. Chosen a certain follow-up time after the blanking period, success can be defined as "freedom from AF, atrial flutter or tachycardia" and discontinuation of antiarrhythmic medication. Patients participating in clinical studies should be followed at least 12 months and, at minimum, should have a 24-hour Holter monitor at three months, six months, one year, and two years.

Following these guidelines, two different criteria of procedural success have been introduced into our study. Due to the risk of recurrence of the persistent form of this disease, we distinguished a short-term success definition from a longterm one. Short-term CA outcome definition provides a preliminary perspective of the immediate effectiveness of the procedure right after a 3-month blanking period. Procedural success is regarded as AF conversion either directly to sinus rhythm or intermediate tachyarrhythmia, exclusively by ablation or by CA shortly followed by electrical cardioversion. According to this short-term criterion, 26 patients out of 31 experienced procedural AF termination. Longterm CA success is defined as freedom from ECG/Holterdocumented sustained AF recurrence (> 30 s) during follow up after at least six months. As far as repeated procedures are concerned, only signals acquired during the first surgical performance are analyzed. Under this hypothesis, definitive sinus rhythm (SR) restoration has been observed in 13 patients out of 20. The smaller size of the second dataset is due to the fact that some ablations have been accomplished very recently, so long-term outcome is still unknown.

Owing to the risk of arrhythmic episodes and the application of complementary therapies after CA over the long-term follow up (namely, chemical or electrical cardioversion), these two criteria can return different results for the same patient.

B. ECG Preprocessing and Atrial Activity Extraction

For every patient, input ECG recordings are first processed by a fourth-order zero-phase Chebyshev bandpass filter with -3 dB attenuation at 0.5 Hz and 30 Hz cut-off frequencies. This action allows the suppression of baseline wander and high frequency noise (e.g., power line interference, myoelectrical artifacts). Furthermore, this frequency interval retains the most significant AF content, whose dominant frequency ranges between 3 and 12 Hz. Then, R-wave time instants are detected on V 1 by Pan-Tompkins' algorithm [START_REF] Pan | A real-time QRS detection algorithm[END_REF]. Q wave onset and T wave offset are subsequently detected with an improved version of Woody's method [START_REF] Cabasson | Time delay estimation: A new insight into the woody's method[END_REF], so as to properly segment the TQ intervals. Their mean-correction and concatenation leads to the definition of the (L × N ) matrix:

Y AA = [y AA (1) • • • y AA (N )] ∈ R L×N (1)
namely, the signal depicting AA content. Vector y AA (t) = [y 1 (t), . . . , y L (t)] T represents the multilead AA signal measured at time sample t, and N the number of samples of the AA signal y (t) for each lead = 1, 2, . . . , L, with L = 12 in the standard ECG.

C. Multilead descriptor of f-wave amplitude

Previous works have established that higher values of fwave peak-to-peak amplitude on the surface ECG predict AF termination by CA [START_REF] Nault | Clinical value of fibrillatory wave amplitude on surface ECG in patients with persistent atrial fibrillation[END_REF]. Nonetheless, conventional approaches are affected by higher error probability, due to the manual computation of this variable. Moreover, they merely deal with a single electrode, so neglecting contributions provided from the whole ensemble of ECG leads.

The ECG-based feature presented in [START_REF] Meo | Noninvasive prediction of catheter ablation outcome in persistent atrial fibrillation by exploiting the spatial diversity of surface ECG[END_REF] is able to condense the information about f-wave spatial distribution over the ECG leads. First, the predictor proposed in [START_REF] Nault | Clinical value of fibrillatory wave amplitude on surface ECG in patients with persistent atrial fibrillation[END_REF] is computed in an automatic manner. An algorithm based on cubic spline interpolation of AA signal local extrema outputs the parameter:

D(y ) = 1 N N t=1 e MAX (t) -e MIN (t) (2)
where e MAX (t) and e MIN (t) represent the upper and the lower envelopes passing through the local maxima and minima, respectively, of y (t). Then, ECG inter-lead variability is accounted for thanks to a rank-1 approximation of the AA matrix Y AA determined by means of PCA. This technique decomposes a multivariate set of observations into a linear combination of maximum-variance sources, or principal components (PCs) x k (t), k = 1, . . . , L:

y AA (t) = Mx(t) = L k=1 m k x k (t). (3)
They are stored in decreasing order of variance, so we expect that the first source can accurately approximate the input signal and characterize f-wave amplitude content over leads. By applying (2) on each row of the term m 1 x 1 and averaging all single-lead f-wave amplitude descriptors, we obtain the parameter D L as the final output:

D L = L =1 d L = L =1 |m 1 |D(x 1 ) L = m 1 1 L D(x 1 ) (4)
where • 1 denotes the L1-norm operator. This index summarizes inter-lead f-wave amplitude distributions.

In [START_REF] Meo | Noninvasive prediction of catheter ablation outcome in persistent atrial fibrillation by exploiting the spatial diversity of surface ECG[END_REF], the role of D L as a CA outcome predictor has been put in evidence: the higher its value, the more likely procedural AF termination. This result can be considered as a multilead extension of [START_REF] Nault | Clinical value of fibrillatory wave amplitude on surface ECG in patients with persistent atrial fibrillation[END_REF]. In the present work, a further role is ascribed to D L as a descriptor of AF evolution during CA, reflected on f-wave amplitude temporal variations which are negative for successful procedures, positive otherwise, regardless of the observation period during follow-up.

III. STATISTICAL ANALYSIS AND RESULTS

Values of all parameters have been expressed as mean ± standard deviation for each category. In Table I, subscripts SUCC and FAIL refer to successful and failing CA procedures, respectively, according to the protocols above presented, whereas subscripts ST and LT are related to the length of the observation blanking period (short-term and long-term period, respectively); headings START and END are associated with the moment of the acquisition of the ECG recordings during the procedure. For each group (SUCC, FAIL) and follow-up window (ST, LT), the relation between D L values computed at the starting of the ablation (independent variable X) and those obtained at its conclusion (dependent variable Y ) is scrutinized, and Pearson's correlation coefficient R is calculated to indicate the degree of linear dependence between variables. The value of the slope S of each regression law Y = SX + I is examined so as to quantify CA effects over patients' heart substrate and their temporal dynamics, knowing that the intercept I has small values. In addition, statistically significant differences between slope values have been assessed through a parallelism test for each couple of regression lines (SUCC, FAIL); p values output by such test are referred to as P S in Table I. The scatter plots in Figure 2 display the distribution of D L values acquired after the completion of the ablation ((D L ) END ) as a function of those describing the beginning of the procedure ((D L ) START ) for each criterion of procedural success (short-term success and long-term success, respectively); the regression laws related to each category. Statistical analysis has been carried out under a confidence level α equal to 0.05.

A comparison with previous works has been drawn as well. f-wave peak-to-peak amplitude D(V 1 ) has been studied on lead V 1 [START_REF] Nault | Clinical value of fibrillatory wave amplitude on surface ECG in patients with persistent atrial fibrillation[END_REF], [START_REF] Meo | Noninvasive prediction of catheter ablation outcome in persistent atrial fibrillation by exploiting the spatial diversity of surface ECG[END_REF]. Furthermore, the NMSE 3 index introduced in [START_REF] Bonizzi | Atrial fibrillation disorganization is reduced by catheter ablation: A standard ECG study[END_REF] has been computed for each CA step on the same electrode and analyzed according to the protocol aforementioned as well.

IV. DISCUSSION

As shown in Tab. I, a highly linear correlation between D L values concerning the beginning of the procedure and those acquired at its completion is exhibited. This result can be generalized for each class of subjects and CA outcome observation time. We assumed that successful CA procedures should result in a progressive decrease of f-wave amplitude values. Indeed, a significant reduction in f-wave amplitude is observed in patients experiencing procedural AF termination, underlined by a value of the slope S less than unity. On the contrary, in the case of failing procedures, there is no effect on f-waves, whose amplitude raises or remains unchanged, as the disease holds up. Moreover, statistically significant differences are obtained for S values related to each category of patients (SUCC, FAIL) at each time of follow-up. This shows the ability of our descriptor to quantify heart substrate changes performed by CA, which are specific for each group of subjects. The index rendering f-wave amplitude on V 1 (D(V 1 )) provides statistically significant inter-class differences, but its short-term value decreases after CA whether the procedure is effective or not. This outcome is not consistent with our initial assumption, as we expect a reduction in f-wave amplitude only in case of procedu-ral AF termination. Moreover, the linearity assumption is not as reliable as for our descriptor. Conversely, singlelead amplitude seems to distinguish between the categories considered (SUCC, FAIL) more accurately in the longterm follow-up than in the short-term one. However, its discrimination ability is clearly outperformed by that of our multilead descriptor, since differences between successful and failing procedures are quantified by lower P S values; linear correlation between the starting and the end of the ablation proves to be weaker for D(V 1 ) as well. Regarding NMSE 3 , even though significant differences are reported for the short-term CA outcome examination, the linearity hypothesis proves to be quite weak, especially when dealing with successful procedures, as low R values are output by regression analysis. Similar conclusions can be drawn by the analysis over longer periods, which reveals no significant differences between regression line slopes as well. Finally, the study is led only in V 1 , the lead classically employed by cardiologists to study AF in surface ECG. Even if it is well known that this lead exhibits the largest ratio of atrial to ventricular signal amplitude [START_REF] Petrutiu | Atrial fibrillation and waveform characterization[END_REF], contributions from other leads are not analyzed at all by this classical approach. Some pertinent information is neglected, thus leading to an incomplete comprehension of the disease.

V. CONCLUSIONS

Our study has corroborated the ability of our parameter to quantitatively evaluate CA impact on AF dynamics during its performance through a multilead characterization of fwave amplitude variations. A linear correlation between the beginning and the end of the procedure has been established. In particular, a reduction in D L values can be associated with successful procedures, thus showing CA efficacy in progressively suppressing f-waves and restore SR, regardless of the length of the postoperative blanking period. Our research is hindered by the lack of comparison with endocardial recordings and the limited size of our long-term database, whose evaluation is also affected by several confusing factors, e.g., effects of cardioversion and/or drugs, which can alter the final procedural outcome. Despite these limitations, we can conclude that AF pathophysiology is deeply influenced by CA performance, and its modifications can be quantitatively evaluated by analyzing f-wave amplitude variations in the surface ECG.

Fig. 1 :

 1 Fig. 1: Example of ECG recording during AF and its characteristic waves on the lead V 1 . Dotted boxes highlight TQ intervals which are concatenated to form the AA signal Y AA in (1).

Fig. 2 :

 2 Fig. 2: Scatter plot of (D L ) as a function of (D L ) START and data regression lines associated with each category (successful CA: O, continuous line; failing CA: ×, dotted line.). (Top) Short-term success; (Bottom) Long-term success.

TABLE I :

 I Statistical analysis and results

		START	END	R	S	P S
	(D L ) SUCC,ST (D L ) FAIL,ST	0.049 ± 0.070 0.022 ± 0.010	0.046 ± 0.060 0.033 ± 0.027	0.982 0.900	0.836 2.422	1.52 • 10 -18
	(D L ) SUCC,LT (D L ) FAIL,LT	0.055 ± 0.100 0.039 ± 0.020	0.051 ± 0.085 0.036 ± 0.023	0.998 0.894	0.849 1.008	8.52 • 10 -5
	D(V1) SUCC,ST D(V1) FAIL,ST	0.068 ± 0.022 0.054 ± 0.018	0.067 ± 0.022 0.048 ± 0.012	0.789 0.665	0.802 0.446	1.68 • 10 -2
	D(V1) SUCC,LT D(V1) FAIL,LT	0.076 ± 0.024 0.054 ± 0.012	0.070 ± 0.023 0.062 ± 0.020	0.883 0.840	0.834 1.392	1.12 • 10 -4
	(NMSE3) SUCC,ST (NMSE3) FAIL,ST	15.4 ± 15.9 18.7 ± 16.9	14.0 ± 14.1 35.5 ± 29.7	0.092 0.813	0.082 1.428	2.40 • 10 -3
	(NMSE3) SUCC,LT (NMSE3) FAIL,LT	9.80 ± 9.65 25.1 ± 24.7	8.50 ± 7.80 26.5 ± 28.9	0.476 0.251	0.384 0.294	8.49 • 10 -1