Transformation Models Fabian B uttner AtlanMod Team INRIA / - PowerPoint PPT Presentation

Transformation Models Fabian B¨ uttner AtlanMod Team INRIA / ´ Ecole des Mines de Nantes fabian.buettner@inria.fr 15. Sep. 2012

Transformation Models Next: A methodology for the verification of model transformations [MODELS’12, ICFEM’12, JSS’10] � AtlanMod – atlanmod-contact@mines-nantes.fr c 2/11

Transformation Models Next: A methodology for the verification of model transformations [MODELS’12, ICFEM’12, JSS’10] ◮ applicable to declarative ATL (and QVT-R) ◮ suited for automatic checking by off-the-shelf solvers ◮ “side-effect”: allows reverse execution (in the small) � AtlanMod – atlanmod-contact@mines-nantes.fr c 2/11

Transformation Models Next: A methodology for the verification of model transformations [MODELS’12, ICFEM’12, JSS’10] ◮ applicable to declarative ATL (and QVT-R) ◮ suited for automatic checking by off-the-shelf solvers ◮ “side-effect”: allows reverse execution (in the small) Core idea: Translate the transformation into an equivalent logical satisfiability problem � AtlanMod – atlanmod-contact@mines-nantes.fr c 2/11

Transformation Models Next: A methodology for the verification of model transformations [MODELS’12, ICFEM’12, JSS’10] ◮ applicable to declarative ATL (and QVT-R) ◮ suited for automatic checking by off-the-shelf solvers ◮ “side-effect”: allows reverse execution (in the small) Core idea: Translate the transformation into an equivalent logical satisfiability problem My hopes for a collaboration: 1. Use our results for reverse execution in the large 2. Identify (bigger) decidable fragments of metamodels and transformations for ATL and UnCAL 3. A formal semantics for ATL? � AtlanMod – atlanmod-contact@mines-nantes.fr c 2/11

Motivation: Type-correctness Several interesting correctness properties: termination, confluence, type-correctness, semantics preservation, . . . . � AtlanMod – atlanmod-contact@mines-nantes.fr c 3/11

Motivation: Type-correctness Several interesting correctness properties: termination, confluence, type-correctness, semantics preservation, . . . . � AtlanMod – atlanmod-contact@mines-nantes.fr c 3/11

Motivation: Type-correctness Several interesting correctness properties: termination, confluence, type-correctness, semantics preservation, . . . . We want to verify for T : M I → M F : Partial type-correctness of T For each model M I of M I on which T terminates, M F = T ( M I ) is a model of M F . � AtlanMod – atlanmod-contact@mines-nantes.fr c 3/11

Motivation: Type-correctness Several interesting correctness properties: termination, confluence, type-correctness, semantics preservation, . . . . We want to verify for T : M I → M F : Partial type-correctness of T For each model M I of M I on which T terminates, M F = T ( M I ) is a model of M F . M I , M F are metamodels consisting of classes, attributes, associations, and constraints (OCL / FOL). � AtlanMod – atlanmod-contact@mines-nantes.fr c 3/11

Motivation: Type-correctness Several interesting correctness properties: termination, confluence, type-correctness, semantics preservation, . . . . We want to verify for T : M I → M F : Partial type-correctness of T For each model M I of M I on which T terminates, M F = T ( M I ) is a model of M F . M I , M F are metamodels consisting of classes, attributes, associations, and constraints (OCL / FOL). ⇒ Hence, satisfiability is undecidable in general. � AtlanMod – atlanmod-contact@mines-nantes.fr c 3/11

Transformation Models Given a terminating transformation T : M I → M F A transformation model for T is an extension M T = M I ∪ M F ∪ R � AtlanMod – atlanmod-contact@mines-nantes.fr c 4/11

Transformation Models Given a terminating transformation T : M I → M F A transformation model for T is an extension M T = M I ∪ M F ∪ R such that, for each models M I , M F of M I , M F , the following holds: Equivalence Property M F = T ( M I ) iff there exists a model M T of M T whose M I -part is M I and whose M F -part is M F . � AtlanMod – atlanmod-contact@mines-nantes.fr c 4/11

Example ER2REL: Metamodels INPUT MM OUTPUT MM 0..1 1 1..* SchemaElement RELSchema ERSchema elements name : String 1..* Relation 0..1 relations name : String RelshipEnd type ends Entity Relship name : String 1 2..* 1 RELAttribute {xor} 1..* name : String ERAttribute isKey : Boolean attrs name : String attrs attrs isKey : Boolean context ERSchema inv ER_EN: context RELSchema inv REL_RN: elements−>forAll(e1,e2| relations−>forAll(r1,r2| e1.name = e2.name implies e1 = e2) r1.name = r2.name implies r1 = r2) context Entity inv ER_EK: context RELSchema inv REL_AN: attrs−>exists(a | a.isKey) attrs−>forAll(a1,a2| a1.name = a2.name implies a1 = a2) context Relship inv ER_ER: context Relation inv REL_RK: not attrs−>exists(a | a.isKey) attrs−>exists(a | a.isKey) −− and further constraints � AtlanMod – atlanmod-contact@mines-nantes.fr c 5/11

Example ER2REL: Transformation 0..1 1 1..* SchemaElement RELSchema ERSchema elements name : String 1..* Relation 0..1 relations name : String RelshipEnd type ends Entity Relship name : String 1 2..* 1 RELAttribute {xor} 1..* name : String ERAttribute isKey : Boolean rule S2S { from s : ER!ERSchema attrs name : String to t : REL!RELSchema ( relations <- s.entities->union(s.relships) )} attrs attrs isKey : Boolean rule E2R { from s : ER!Entity to t : REL!Relation (name<-s.name, schema<-s.schema) } rule R2R { from s : ER!Relship to t : REL!Relation (name <-s.name, schema<-s.schema) } rule EA2A { from att : ER!ERAttribute, ent : ER!Entity (att.entity=ent) to t : REL!RELAttribute (name<-att.name, isKey<-att.isKey, relation<-ent)} rule RA2A { from att : ER!ERAttribute, rs : ER!Relship (att.relship=rs) to t : REL!RELAttribute (name<-att.name, isKey<-att.isKey, relation<-rs)} rule RA2AK { from att : ER!ERAttribute, rse : ER!RelshipEnd (att.entity=rse.entity and att.isKey=true) to t : REL!RELAttribute (name<-att.name, isKey<-att.isKey, relation<-rse.relship)} � AtlanMod – atlanmod-contact@mines-nantes.fr c 6/11

Example ER2REL: Transf.Model S2S 0..1 1 1..* SchemaElement 0..1 0..1 RELSchema ERSchema elements name : String E2R 0..1 0..1 1..* Relation 0..1 relations R2R 0..1 name : String RelshipEnd 0..1 type ends Entity Relship name : String EA2A 1 2..* 1 0..1 RELAttribute {xor} RA2A 1..* name : String 0..1 ERAttribute isKey : Boolean attrs name : String RA2AK attrs attrs 0..1 isKey : Boolean context x1 : ERAttribute inv match_EA2A: Entity.allInstances()−>forAll(x2 | x1.ent = x2 implies Matching constraints EA2A.allInstances()−>one(z | z.att = x1 and z.ent = x2) context EA2A inv match_EA2A_cond: self.att.entity = self.ent −− ... context EA2A inv bind_EA2A_t_name: self.t.name = self.att.name Binding constraints context EA2A inv bind_EA2A_t_relation: self.t.relation = self.ent.e2r.t context S2S inv bind_S2S_t_relations: Set{self.s.elements−>collect(z|z.oclAsType(Entity).e2r.t), self.s.elements−>collect(z|z.oclAsType(Relship).r2r.t)}−>flatten()−>select(z|z <> null) −− ... Creation constraints context Relation inv create_Relation: self.e2r−>size() + self.r2r−>size() = 1 −− ... � AtlanMod – atlanmod-contact@mines-nantes.fr c 7/11

Deriving Transformation Models Encode the model finding as a satisfiability problem in a logic: Find ⌈ M T ⌉ such that ⌈M T ⌉ | = ⌈ M T ⌉ Two different approaches. 1. Generate metamodel extensions (classes, OCL constraints) and then use existing logic translations � � ⌈M T ⌉ = MM2L M I ∪ M F ∪ T2MM [ T ] ⇒ Orthogonal, tool-agnostic approach 2. Directly generate a (first-order) logic formula ⌈M T ⌉ = MM2L [ M I ] ∪ MM2L [ M F ] ∪ T2L [ T ] ⇒ Better suited for automated theorem proving � AtlanMod – atlanmod-contact@mines-nantes.fr c 8/11

Verifying type correctness Type correctness revisited The transformation T : M I → M F is type-correct iff the transformation model for T : M I → M F c is unsatisfiable for each type constraint c of M F . ( M F c is constrained only by the negation of c ) � AtlanMod – atlanmod-contact@mines-nantes.fr c 9/11

Verifying type correctness Type correctness revisited The transformation T : M I → M F is type-correct iff the transformation model for T : M I → M F c is unsatisfiable for each type constraint c of M F . ( M F c is constrained only by the negation of c ) Checking ...REL RN � AtlanMod – atlanmod-contact@mines-nantes.fr c 9/11

Verifying type correctness Type correctness revisited The transformation T : M I → M F is type-correct iff the transformation model for T : M I → M F c is unsatisfiable for each type constraint c of M F . ( M F c is constrained only by the negation of c ) Checking ...REL RN, REL K � AtlanMod – atlanmod-contact@mines-nantes.fr c 9/11