SLIDE 1
Modular transformation from AF3 to nuXmv
Sudeep Kanav, Vincent Aravantinos fortiss GmbH
SLIDE 2 Abstract
- A transformation between a high-level and a low-level model
- Two way
- Modular
- Employs reusability
- Implemented in Java
SLIDE 3
Motivation
Support formal verification in our MDE tool AutoFOCUS3
SLIDE 4
Preliminary: AutoFOCUS3 “AF3” (1/2)
Behavior modelling Structure modelling Deployment modelling Hardware modelling …
SLIDE 5 Preliminary: AutoFOCUS3 “AF3” (2/2)
- Model-based development tool for embedded systems
- Execution semantics
à code generation, simulation, formal verification
- Integrates most development phases in one tool and connects them
à models for: requirements, architecture, behavior, hardware and for connections between those: traces, deployment https://af3.fortiss.org/
SLIDE 6 nuXmv1
- Classical symbolic model checker
- Systems are modeled as finite state machines
- Supports LTL2 and CTL3 specifications
1 https://nuxmv.fbk.eu 2 Linear temporal logic 3 Computational tree logic
SLIDE 7
SLIDE 8
What is so special?
SLIDE 9 What is so special?
- Metamodel is not a toy metamodel
- Reuse: reusing parts of the forward transformation
in reverse transformation.
SLIDE 10 Real world metamodel
- Metamodel not designed for demonstrating model
transformations
- Legacy metamodel: it has been evolving for 8 years
- Elements implement various interfaces related to other
features of the tool (e.g., UI)
SLIDE 11
Real world metamodel
SLIDE 12 Reuse
- Modular design makes reuse easier
- Parts of the AF3 to nuXmv transformation used for the
trace interpretation
SLIDE 13
Transformation Description
SLIDE 14
Chain of transformations
SLIDE 15
Running example
SLIDE 16
Running Example t = 1 t = 2
SLIDE 17
Transformation on the running example
SLIDE 18 Transformation on the running example
ToStateAutomaton
SLIDE 20 ArrayToStructure
SLIDE 21 FlattenStructures
SLIDE 22 StronglyToWeaklyCausal
SLIDE 23 Counterexample Transformation
- The user needs to observe the trace
- Lifting the result to the user level
- Instead of performing a reverse transformation, we reuse some parts
- f the above transformation to achieve this
SLIDE 24
Counterexample Transformation [ip] – Value of “ip” in the trace
SLIDE 25
Counterexample Transformation [ip] ⟹ [ip_PRESENT] ? [ip] : NoVal
(applying NoValResolution transformation)
SLIDE 26
Counterexample Transformation [ip] ⟹ [ip_PRESENT] ? [ip] : NoVal ⟹ [ip_PRESENT] ? [[ip_elem0], [ip_elem1]] : NoVal
(applying ProductToSimpleTypes transformation)