automated verification of model transformations in the automotive industry

AUTOMATED VERIFICATION OF MODEL TRANSFORMATIONS IN THE AUTOMOTIVE INDUSTRY

GEHAN M. K. SELIM, FABIAN BÜTTNER, JAMES R. CORDY, JUERGEN DINGEL, SHIGE WANG

2

AGENDA- Motivation

- Objective

- The Model Transformation Problem

- The Verification Methodology

- Case Study: Automatically Verifying the GM-2-AUTOSAR Transformation

- Results

- Verifying the 18 OCL Constraints- Performance of the Verification Approach

- Discussion

- Strengths of the Verification Approach- Weaknesses of the Verification Approach

- Conclusion & Future Work

3

MOTIVATION

- MDD

- Model Transformations

- Verification

Are those concepts practical to use in

industry ?

4

MOTIVATION- Industrial experiences in adopting MDD…

- T. Cottenier, A. Van Den Berg, T. Elrad “The Motorola WEAVR: Model Weaving in a Large Industrial Context” AOSD 2007.

- P. Mohagheghi, V. Dehlen “Where is the Proof?-A Review of Experiences from Applying MDE in Industry” ECMDA-FA 2008.

- Few studies on industrial model transformations…- A. Daghsen, K. Chaaban, S. Saudrais, P. Leserf “Applying Holistic

Distributed Scheduling to AUTOSAR Methodology” ERTSS 2010.- H. Giese, S. Hildebrandt, S. Neumann “Model Synchronization at Work:

Keeping SysML and AUTOSAR Models Consistent” Graph Transformations & Model-Driven Engineering 2010.

- G.Selim, S. Wang, J. Cordy, J. Dingel “Model Transformations for Migrating Legacy Models: An Industrial Case Study” ECMFA 2012

- Verifying industrial model transformations ??

5

OBJECTIVE

What?• Validate an industrial model

transformation [1]

How?• Using an automated verification

prototype [2]

Why?

• Report on the practicality of using automated verification in industry

• Discuss any issues that need to be addressed for the industry to readily adopt such prototypes

[1] G. Selim, S. Wang, J. Cordy, J. Dingel "Model Transformations for Migrating Legacy Models: An Industrial Case Study", ECMFA 2012[2] F. Büttner, M. Egea, J. Cabot, M. Gogolla “Verication of ATL Transformations Using Transformation Models and Model Finders”, ICFEM 2012

6

THE MODEL TRANSFORMATION PROBLEM

GM Models GM-2-AUTOSAR Transformation AUTOSAR models

[1] G. Selim, S. Wang, J. Cordy, J. Dingel "Model Transformations for Migrating Legacy Models: An Industrial Case Study", ECMFA 2012

GM

M

etamodel

AU

TO

SA

RM

etamodel

7

THE VERIFICATION METHODOLOGY

Transformation Model:

- Elements representing : T,

- OCL Constraint sets: SEM, PRE, POST

tarsrc MMMM ,

transform

ATL Transformation T

Source Metamodel

Target Metamodel

Transformation Model (OCL)

srcMM

tarMM

[1] F. Büttner, M. Egea, J. Cabot, M. Gogolla “Verication of ATL Transformations Using Transformation Models and Model Finders”, ICFEM 2012

8

THE VERIFICATION METHODOLOGY

Transformation Model:

- Elements representing : T,

- OCL Constraint sets: SEM, PRE, POST

tarsrc MMMM ,

Transformation Model (OCL)

[1] F. Büttner, M. Egea, J. Cabot, M. Gogolla “Verication of ATL Transformations Using Transformation Models and Model Finders”, ICFEM 2012

transform

ATL Transformation T

Source Metamodel

Target Metamodel

srcMM

tarMM

9

THE VERIFICATION METHODOLOGY

For each property , the following must be unsatisfiable:iPost

What• Check partial correctness of transformation

model w.r.t. properties (OCL Constraints)

How

• Check if there is a counter example in a specific scope (i.e. maximum number of objects per class)

• Use satisfiability checkers or Model finders, e.g., USE Validator [1][2]

[1] M. Kuhlmann, L. Hamann, M. Gogolla “Extensive Validation of OCL Models by Integrating SAT Solving into USE” TOOLS 2011[2] The USE Validator. available online, http://sourceforge.net/projects/useocl/les/Plugins/ModelValidator/

10

THE VERIFICATION METHODOLOGY

Run the prototype to generate the USE specification & the search configuration

Added the constraints to the USE specification & negate constraint in search configuration

Ran the tool once for each of the postconditions

Relational Logic

Propositional Logic

Ecore + OCLATL + Ecore

+ OCL

11

CASE STUDY: AUTOMATICALLY VERIFYING THE GM-2-AUTOSAR TRANSFORMATION

Old Implementation

• 2 ATL Matched Rules• 9 Functional Helpers• 6 Attribute Helpers

New Implementation

• 3 Matched Rules• 2 Lazy Rules

12

CASE STUDY: AUTOMATICALLY VERIFYING THE GM-2-AUTOSAR TRANSFORMATION

18 OCL PostconditionsTarget Invariants

6 Multiplicity Invariants

1 Security Invariants

Transformation Contracts9 Uniqueness Contracts

2 Pattern Contracts

Autom

atically G

enerated by the P

rototype

Manually

Form

ulated

OCL Preconditions … ?

13

CASE STUDY: AUTOMATICALLY VERIFYING THE GM-2-AUTOSAR TRANSFORMATION

Context CompositionType inv CompositionType_co:self.componentsize>=1

14

RESULTS: VERIFYING THE 18 OCL CONSTRAINTS- 2 Multiplicity Invariants of the 18 constraints are violated

- CompositionType_component- SwcToEcuMapping_component

15

RESULTS: VERIFYING THE 18 OCL CONSTRAINTS

CompositionType_component

16

RESULTS: PERFORMANCE OF THE VERIFICATION APPROACH- Standard laptop (2.50 GHz, 16GB of memory)

- Ran the verification prototype:

- once for each constraint - for scopes up to 12

- For each scope & constraint, 2 numbers were generated:

- Translation Time: Time taken to translate the relational logic representation of the transformation into propositional logic.

- Constraint Solving Time: Time taken by SAT solver to solve the propositional representation of the transformation.

17

RESULTS: PERFORMANCE OF THE VERIFICATION APPROACH

18

DISCUSSION: STRENGTHS OF THE VERIFICATION APPROACH

Full Automation

• Translation from ATL & constrained metamodels to constrained Ecore model & then to relational logic

• Verification of industrial transformation models up to a scope of 12 !

Verifying a Substantial Subset of ATL

• Except for Imperative blocks, recursive lazy rules, & recursive queries

• 83/131 transformations in ATL Zoo are in this fragment…24 of the remaining 48 transformations can be expressed declaratively…too!

19

DISCUSSION: WEAKNESSES OF THE VERIFICATION APPROACH

Correctness of

ATL-2-Relational-Logic Translation

• Testing & Inspection• BUT cannot formally

prove correctness No formal semantics for ATL & OCL

Bound Search Approach

• Scope too small to verify the transformation ?

• Maximum scope to use is transformation-dependent

20

CONCLUSION & FUTURE WORK- Demonstrated using an automated verification prototype

[1] to verify industrial transformation [2]

- Result: The used prototype uncovered 2 bugs !

- Performance: Verifying the transformation up to a scope of 12 was possible !

Application of automated verification to a case study was successful & practical to

use in an industrial context

[1] F. Büttner, M. Egea, J. Cabot, M. Gogolla “Verication of ATL Transformations Using Transformation Models and Model Finders”, ICFEM 2012[2] G. Selim, S. Wang, J. Cordy, J. Dingel "Model Transformations for Migrating Legacy Models: An Industrial Case Study", ECMFA 2012

21

CONCLUSION & FUTURE WORK

More In

dustrial

transfo

rmatio

ns

in case

study

Use Incremental SAT Solvers

Pruning of the

transformation

model