Software's Next Step

At the New York Board of Trade, prices of cotton, sugar, and other commodities can rise or fall a hundredth of a cent per pound--not much, until you consider that trades sometimes involve hundreds of thousands of pounds. In the few seconds it takes for a transaction to get executed, the price can change, and traders don't always know whether they made money or lost it. Until recently, it could take as long as two hours to get a preliminary confirmation that a trade was completed at a given price and even longer before the final outcome was verified.

That lag largely disappeared a few weeks ago, when the Board of Trade switched from end-of-day batch processing to a new way of linking the systems involved in processing trades, cutting reporting times to 30 minutes. To do it, the Board of Trade created a services-oriented architecture that facilitates data sharing among the many systems involved in completing a transaction: its four trading systems, back-end accounting servers, clearinghouse system, and the computers of 39 trading partners. "A lot of pieces in each system were tied together," says David Sternberg, director of clearinghouse systems at the New York Board of Trade.

Services-oriented architectures promise IT efficiency and flexibility in the form of reusable software "services." The concept, a few years in making, is hitting the mainstream now that commercial support for Web services is widespread. Yet the approach requires planning and know-how--services-oriented architectures are custom built, not bought. IT departments assemble them using a combination of development tools, XML-messaging middleware, other software standards, and management products. In the process, older applications may need to be reformatted for the services model.

Citigroup Asset Management, the institutional and managed-account investment arm of Citicorp, recently implemented a services-oriented architecture to hasten its handling of repurchase agreements, or "repos." The financial firm processes only 200 repos a day, but they're worth about $5 billion. The trades must be completed by 3 p.m. Eastern or "you miss the market, the customer loses the interest [on the investment], and Citigroup loses face with its client," says Sayee Bapatla, director of technology planning at Citigroup Asset Management.

Until two months ago, Citigroup employees manually entered repurchase-agreement orders into legacy systems with "business logic all over the place," says Bapatla. Completing an order was "a very convoluted process, touching 80 to 90 systems"--IBM mainframes, Unix and Windows servers--using middleware from IBM, SeeBeyond, and Tibco Software. A weakness in the process was the transfer of order files via the File Transfer Protocol, since that lacked the asynchronous nature of Citigroup's new approach. If a file didn't transfer successfully by FTP, Citigroup repo managers had little means of knowing and risked missing a trade. Now, however, an XML-based message is transferred between systems and receipt is automatically confirmed; if not, a request that the message be resent is triggered to the sender."It's completely eradicated the old way of doing things," Bapatla says. In addition, business-process monitoring software from CommerceQuest Inc. audits each business process along the way to spot any disruptions. A real-time message audit eliminates the prospect that a failed trade will lose revenue for a client by missing the deadline. Services-oriented architecture "is so key," Bapatla says.

It's no coincidence that services-oriented architectures are maturing at the same time that businesses are doing other housekeeping. Because they encompass auditable business-process management, services-oriented architectures can help companies achieve compliance with Sarbanes-Oxley, the Health Insurance Portability and Accountability Act, and other regulatory requirements. Analyst Stephen O'Grady with IT research firm RedMonk refers to the idea as a "compliance-oriented architecture." For example, electronic-record retention could be manifest as a software service that's reused whenever saving records is a requirement, O'Grady writes in a recent report.

Despite the fact that they bring a greater degree of order to IT environments, services-oriented architectures have to be managed and maintained (see story, Scalable: Managing Web Services Demands New Approach). They also create new security risks: Since Internet-accessible software components are fundamental to services-oriented architectures, any oversight could expose systems to outside threats. To avoid that, software architects are using the HTTPS protocol, which encrypts messages and documents being sent over HTTP, the new Web Services Security standard, and IP filtering.

To secure a 6-month-old architecture that opens its systems to business partners, Aeroplan is using an appliance from Reactivity Inc. that parses XML messages, making sure they come from known trading partners and contain no hidden instructions. Aeroplan is the frequent-flier program administrator for Air Canada, its parent company, and a loyalty program supplier to American Express and the Canadian Imperial Bank of Commerce, a Visa card issuer. Its rewards programs let credit-card users accumulate miles for purchases made with their cards, then redeem them for freebies such as hotel stays or car rentals.Aeroplan developed a services-oriented architecture because, although it tracked frequent-flier miles and accounted for their redemption in its internal systems, "we needed to externalize those same services to our part- ners," such as hotels offering rewards, says Spyros Kattou, E-business architect. Also, Aeroplan made it easier for consumers to redeem miles on its Web site, skipping the need to apply for a certificate sent in the mail. The change has led to "a very important increase in reward redemption," Kattou says.

There's a compelling business case behind Aeroplan's services-oriented architecture: The company can't recognize the transactions as revenue until the rewards are redeemed. "We earn revenue from the burn rate of those miles," Kattou says.The architectures can give IT planners greater flexibility in choosing products and programming languages. "I don't like it when vendors try to block us in to the point where we can't move and match," says Soren Burkhart, senior VP of business and technology integration at Aloha Airlines Inc., which is pushing vendors to support data in the XML format for easier sharing within its systems. "We're well on our way," Burkhart says.

Burkhart was brought in 12 months ago to revamp Aloha's outmoded mainframes, and a services approach is yielding results. In August, the airline celebrated its 58th birthday by offering dollars-off coupons. In addition to being available by mail for a $3 handling charge, they were available as printouts from its Web site for the first time. Aloha anticipated that only 15% of coupons would be from the Web-site offer, but the percentage was closer to 85%, resulting in "a huge savings for us," Burkhart says.

Vendors urge customers working on services-oriented architectures to think in terms of an "enterprise service bus," loosely defined as an XML messaging software layer that can translate messages being sent between applications. But vendor-specific approaches can be problematic. "No [enterprise service bus] standard has evolved to the point where you're protected against vendor lock-in," Aeroplan's Kattou says.

Among the other things to look out for: Not all applications are perfectly suited to be rewritten as pluggable services. For example, some high-performance systems will continue to work best with point-to-point connections. And in other places, applications that already use WebSphere MQ or Java Messaging Service messages may do just fine without an XML injection.

But the benefits can clearly be worth the sweat. Countrywide Global Markets, a division of Countrywide Financial Corp. that provides mortgage-processing and -underwriting systems, has tied five core applications to Woolwich and Barclays Bank to conduct mortgage processing for the banks. (Barclays acquired Woolwich, and Countrywide provides separate outsourced processing services to each.) A services-oriented architecture means Countrywide Global can extend its mortgage-processing services to additional mortgage originators, integrating their systems into its operations in 60 to 90 days, says chief technology officer Jim Pierce. And, because of the modular nature of its architecture, Countrywide Global has the option of offering one service, such as mortgage quoting or underwriting, rather than insisting on an all-or-nothing deal.That's the dual benefit of services-oriented architectures: In addition to helping companies apply Web services, they support new ways of doing business. At Citigroup and the New York Board of Trade, architectures will help get to straight-through processing, where trades are concluded in one day, while at Countrywide, the architecture opens doors in expanding its mortgage-processing business.

Says Pierce, "We're in a very competitive business. We have to have our developers working on business logic for new products, not the plumbing."

Continue to the sidebar: "Scalable: Managing Web Services Demands New Approach"