Model Driven Engineering Languages and Systems

The paper presents several algebraic models for semantics of bidirectional model synchronization and transformation. Different patterns of model synchronization are analyzed (including view updates and incremental synchronization), and this analysis motivates the formal definitions. Relationships between the formal models are precisely specified and discussed. A new formal model of updates is proposed.

In this paper we propose a method to derive OCL invariants from declarative specifications of model-to-model transformations. In particular we consider two of the most prominent approaches for specifying such transformations: Triple Graph Grammars and QVT. Once the specification is expressed in the form of invariants, the transformation developer can use such description to verify properties of the original transformation (e.g. whether it defines a total, surjective or injective function), and to validate the transformation by the automatic generation of valid pairs of source and target models.

Model transformation is one of the key activities in model-driven software development. An increasingly popular technology to define modeling languages is provided by the Eclipse Modeling Framework (EMF). Several EMF model transformation approaches have been developed, focusing on different transformation aspects. To validate model transformations wrt. functional behavior and correctness, a formal foundation is needed. In this paper, we define EMF model transformations as a special kind of typed graph transformations using node type inheritance. Containment constraints of EMF model transformations are translated to a special kind of EMF model transformation rules such that their application leads to consistent transformation results only. Thus, we identify a kind of EMF model transformations which behave like algebraic graph transformations. As a consequence, the rich theory of algebraic graph transformation can be applied to these EMF model transformations to show functional behavior and correctness. We illustrate our approach by selected refactorings of simplified statechart models.

Problem frames are patterns for analyzing, structuring, and characterizing software development problems. This paper presents a formal metamodel for problem frames expressed in UML class diagrams and using the formal specification notation OCL. That metamodel clarifies the nature of the different syntactical elements of problem frames, as well as the relations between them. It provides a framework for syntactical analysis and semantic validation of newly defined problem frames, and it prepares the ground for tool support for the problem frame approach.

Functional requirements are often written using use cases formatted by textual templates. This textual approach has the advantage to be easy to adopt, but the requirements can then hardly be processed for further purposes like test generation. In this paper, we propose to generate automatically through a model transformation an activity diagram modeling the use case scenario. Such an activity diagram allows us to guess in a glimpse the global behavior of a use case, and can easily be processed. The transformation is defined using the QVT-Relational language, and is illustrated on a case study using a supporting tool.

Extension of the modeling notations and formal languages for use case description are the commonly suggested solutions for adding precision to use case models. Practitioners have often argued against adoption of such techniques citing reasons like the steep learning curve for formal languages; and the quickness in using imprecise use case descriptions for communicating to different stake-holders of the system. In this paper we introduce the Archetest modeling environment, which through a unique bi-layer approach accepts use case descriptions in their imprecise form and then assists in adding precision through a wizard driven process. Thereby, it lends itself to both quick and precise modeling. Also the two forms of the use case models are self contained and cross-linked. This allows different modelers, the precise and the imprecise, to collaborate and also supports stake-holder specific feedbacks of the automated analysis. We describe the structure of Archetest’s use case models, and show how these models are amenable to automated processing. We present a case study which reports on typical modeling times using Archetest and demonstrates its scalability.

Workflow languages are designed for the high-level description of processes and are typically not suitable for the generation of complete applications. In this paper, we present WebWorkFlow, an object-oriented workflow modeling language for the high-level description of workflows in web applications. Workflow descriptions define procedures operating on domain objects. Procedures are composed using sequential and concurrent process combinators. WebWorkFlow is an embedded language, extending WebDSL, a domain-specific language for web application development, with workflow abstractions. The extension is implemented by means of model-to-model transformations. Rather than providing an exclusive workflow language, WebWorkFlow supports interaction with the underlying WebDSL language. WebWorkFlow supports most of the basic workflow control patterns.

Producing the source code for a railway interlocking system based on the description of a station has traditionally been a multistage manual process. We show how this process can be automated and made less error-prone by introducing model-driven development (MDD). This paper addresses the experience of developing a Domain Specific Language (DSL) to describe railway stations, Train Control Language (TCL), and tools to support this language. In the railroad domain where there are extreme safety requirements, it is essential to show that consistency and completeness can be assured. We address how the model is used to generate several different representations for different purposes. We look at advantages and challenges with our approach, and we discuss improvements to existing technologies to support our case better.

Domain-specific modeling languages (DSMLs) are designed to provide precise abstractions of domain-specific constructs. However, models for complex systems typically do not fit neatly within a single domain and capturing all important aspects of such a system requires developing multiple models using different DSMLs. Combining these models into multi-models presents difficult challenges, most importantly those of integrating the various models and keeping both the models and their associated data synchronized. To this end, we present NAOMI, an experimental platform for enabling multiple models, developed in different DSMLs, to work together. NAOMI analyzes model dependencies to determine the impact of changes to one model on other dependent models and coordinates the propagation of necessary model changes. NAOMI also serves as a useful testbed for exploring how diverse modeling paradigms can be combined.

Most of the available work on model transformation is based on the hypothesis that transformation rules exist and that the important issue is how to express them. But in real life, the rules may be difficult to define; this is often the case when the source and/or target formalisms are not widely used or proprietary. In this paper, we consider the transformation mechanism as a combinatorial optimization problem where the goal is to find a good transformation starting from a small set of available examples. Our approach, named model transformation as optimization by examples (MOTOE), combines transformation blocks extracted from examples to generate a target model. To that end, we use an adapted version of particle swarm optimization (PSO) where transformation solutions are modeled as particles that exchange transformation blocks to converge towards an optimal transformation solution. MOTOE has two main advantages: It proposes a transformation without the need to derive transformation rules first, and it can operate independently from the source and target metamodels.

Software changes. During their life cycle, software systems experience a wide spectrum of changes, from minor modifications to major architectural shifts. Small-scale changes are usually performed with text editing and refactorings, while large-scale transformations require dedicated program transformation languages. For medium-scale transformations, both approaches have disadvantages. Manual modifications may require a myriad of similar yet not identical edits, leading to errors and omissions, while program transformation languages have a steep learning curve, and thus only pay off for large-scale transformations.

We present a system supporting example-based program transformation. To define a transformation, a programmer performs an example change manually, feeds it into our system, and generalizes it to other application contexts. With time, a developer can build a palette of reusable medium-sized code transformations. We provide a detailed description of our approach and illustrate it with examples.

We are proposing an approach for applying design patterns that consists of recognizing occurrences of the modeling problem solved by the design pattern (problem pattern) in input models, which are then transformed according to the solution proposed by the design pattern (solution pattern). In this paper, we look at the issue of identifying instances of problem patterns in input models, and marking the appropriate entities so that the appropriate transformations can be applied. Model marking within the context of MDA is a notoriously difficult problem, in part because of the structural complexity of the patterns that we look for, and in part because of the required design knowledge– and expertise. Our representation of design problem patterns makes it relatively easy to express the pattern matching problem as a constraint satisfaction problem. In this paper, we present our representation of design problem patterns, show how matching such patterns can be expressed as a constraint satisfaction problem, and present an implementation using ILOG JSolver, a commercial CSP solver.

An approach to integrating UML Sequence Diagrams is presented. It rests on a well-established theory, is generalizable to a large class of requirements engineering models, and supports many different kinds of scenario integration operations. An implementation of the approach as an Eclipse extension is described. Lessons learned from the implementation and during first, preliminary experiments to study the practical aspects of the approach, are discussed.

Some analysis and design methods for complex software systems lead to the specification of components (classes) by

slices

. It is the case of the use-case slicing technique proposed by Jacobson and Ng, and of view-based modelling proposed by Nassar et al. The composition of class slices is known from the literature to be closer to aspect composition than to traditional interface-based composition, but remains largely an open problem.

In this paper we propose a set of constructs to support the behavioral specification and composition of class slices, based on the idea of non-intrusive

event observation

. This allows slices to be specified separately – for example by different design teams – and to be integrated later without changes. The proposal is made in the context of VxUML, a language which supports view-based and use-case-driven separation of concerns.

Static analysis tools, such as OCLE and USE, can be used to analyze structural properties of class models. The USE tool also provides support for analyzing specified operations through interactive simulations in which users provide operation parameters, and manually assign values to state elements to reflect the effect of an operation. In this paper we describe an approach to statically analyzing behavior that does not require a user to manually simulate behavior. The approach involves transforming a class model into a static model of behavior, called a Snapshot Model. A Snapshot Model characterizes sequences of snapshots, where a snapshot describes an application state. A scenario describing a sequence of operation invocations can be verified against a Snapshot Model using tools such as USE and OCLE. We illustrate our approach by verifying a scenario against a Snapshot Model that describes the behavior of some operations in a role-based access control (RBAC) application.

We present an implementation of the OMG’s Human-Usable Textual Notation (HUTN) [6] that provides a generic concrete syntax for MOF-based metamodels. The notation is summarised. Ways in which HUTN can be applied in order to improve the productivity of Model-Driven Engineering are identified. The use of HUTN to improve the quality of test suites for verifying model management operations (such as model-to-model transformation) is described. We also present a comparison of generic and domain-specific concrete syntax with HUTN.

X3D-UML utilises X3D (eXtensible 3D) to enable standards-based advanced 3D UML visualisations. Using X3D-UML, 3D UML State Machine Diagrams have been evaluated against actual user tasks and data, using the Sequential Evaluation methodology. The results of User Task Analysis, Heuristic Evaluation and Formative Evaluation phases provide clear evidence that the use of UML extended with 3D is a practical solution for visualising complex system behaviour. RoseRT model metrics show between 56%-90% of state machine diagram work would benefit from such 3D UML extensions; hence the 3D improvement can deliver considerable benefit to organisations.

The main goal of this paper is to provide empirical evidence, through a controlled experiment, of the influence of stereotypes when modelers, developers, and maintainers have to comprehend UML sequence diagrams. The comprehension of UML sequence diagrams with and without stereotypes was analyzed from three different perspectives: semantic comprehension, retention and transfer. The experiment was carried out with 77 fourth year undergraduate students of Computer Science from the University of Bari in Italy. The results obtained show a slight tendency in favor of the use of stereotypes in facilitating the comprehension of UML sequence diagrams, although it is not statistically significant. Further replications are needed to obtain more conclusive results.

Models are becoming increasingly important in the software process. As a consequence, the number of models being used is increasing, and so is the need for efficient mechanisms to search them. Various existing search engines could be used for this purpose, but they lack features to properly search models, mainly because they are strongly focused on text-based search. This paper presents Moogle, a model search engine that uses metamodeling information to create richer search indexes and to allow more complex queries to be performed. The paper also presents the results of an evaluation of Moogle, which showed that the metamodel information improves the accuracy of the search.

The growing complexity of current software systems naturally conveyed their development toward incremental and distributed approaches to speed up the process. Several developers update the same artefact operating concurrent manipulations which need to be coherently combined. The interaction among those changes inevitably involves conflicts which must be detected and reconciled.

This paper proposes a domain specific language able to define and manage conflicts caused by cooperative updates over the same model elements. The approach relies on a model-based representation of model differences and enables the specification and the detection of both syntactical and semantic conflicts.

Applying Model-Driven Engineering (MDE) leads to the creation of a large number of metamodels, since MDE recommends an intensive use of models defined by metamodels. Metamodels with similar objectives are then inescapably created. A recurrent issue is thus to turn compatible models conforming to similar metamodels, for example to use them in the same tool. The issue is classically solved developing ad hoc model transformations. In this paper, we propose an approach that automatically detects mappings between two metamodels and uses them to generate an alignment between those metamodels. This alignment needs to be manually checked and can then be used to generate a model transformation. Our approach is built on the Similarity Flooding algorithm used in the fields of schema matching and ontology alignment. Experimental results comparing the effectiveness of the application of various implementations of this approach on real-world metamodels are given.

In use case-driven approaches to requirements modeling, UML activity diagrams are a wide-spread means for refining the functional view of use cases. Early consistency validation of activity diagrams is therefore desirable but difficult due to the semi-formal nature of activity diagrams. In this paper, we specify well-structured activity diagrams and define activities more precisely by pre- and post- conditions. They can be modeled by interrelated pairs of object diagrams based on a domain class diagram. This activity refinement is based on the theory of graph transformation and paves the ground for a consistency analysis of the required system behavior. A formal semantics for activity diagrams refined by pre- and post-conditions allows us to establish sufficient criteria for consistency. The semi-automatic checking of these criteria is supported by a tool for graph transformation.

In this paper, we show how to implement the conformance relation on transition systems. The computability of this relation relies on the composition of two operators: the reduction relation whose computability has been proven in our previous work, and the merge function of acceptance graphs associated with transition systems under comparison. It is formally demonstrated, and illustrated through a case study whose analysis is performed by a

Java

prototype we have developed. This research work is developed in order to be applied in a larger context: our goal is to support modelers to develop UML state machines through an incremental modelling method which is able to guarantee that model upgrading does not introduce inconsistencies. Hence, these works lead to a semantics for the specialisation relation between UML State Machines.

Building applications by assembling software components requires analyses of Architecture Description (AD) models for checking that component interactions respect the application and runtime context requirements. Most existing interaction model analyses are static: they do not take into account runtime information, e.g., parameter values.

This paper presents a model-based framework that enables architects to both specify component interaction and perform dynamic validation. Our framework analyses AD models to identify partially compatible interactions, which require runtime checking. Then, it instruments the application to reify runtime information for error detection. By using this framework in iterative software design processes, architects can get design feedback,

i.e.

, detected errors, and update the AD models accordingly. Moreover, our solution is generic regarding underlying platforms. This genericity is achieved through the mappings from the generic AD models to platform-specific API calls for constructing the running system.

The Meta Object Facility (MOF) is one of the most frequently used languages for the definition of a DSL’s abstract syntax. However, its lack of sophisticated modularization concepts in comparison to GPLs such as Ada or component-oriented ADLs makes it hard to maintain a large number of complex metamodels. MOF 2.0 packages can be used to a certain extent to define, refine, and compose language descriptions, but do not offer appropriate support for information hiding as well as for the specification of parametrizable metamodeling components. Motivated by a running example we, therefore, extend MOF 2.0 with concepts for the specification of proper metamodel components with provided export and required import interfaces. Furthermore, we present a formalization of a metamodel component composition operator based on graph morphisms. The resulting component-oriented version of MOF allows language developers to describe reoccurring, parametrizable sublanguages once and instantiate them differently in several metamodels.

Evolution and customization of component-based systems require an explicit understanding of component inter-dependencies. Implicit assumptions, poor documentation and hidden dependencies turn even simple changes into challenges. The problem is exacerbated in XML-intensive projects due to the use of soft references and the lack of information hiding. We address this with dependency tracking interface types for models and metamodels. We provide automatic compatibility checks and a heuristic inference procedure for our interfaces, which allows easy and incremental adoption of our technique even in mature projects. We have implemented a prototype and applied it to two large cases: an enterprise resource planning system and a healthcare information system.

Model-based software engineering (MBSE) projects require and generate numerous artifacts. While MBSE methodology and design tools have reached certain maturity level, the issue of artifact persistence and management has been somewhat left in the background. We present design and implementation of the repository that supports storing and managing of artifacts such as metamodels, models, constraints, metadata, specifications, transformation rules, code, templates, configuration or documentation, and their metadata.

Mainstream development environments have recently assimilated guidance technologies based on constraint satisfaction. We investigate one class of such technologies, namely, interactive guided derivation of models, where the editing system assists a designer by providing hints about valid editing operations that maintain global correctness. We provide a semantics-based classification of such guidance systems and investigate concrete guidance algorithms for two kinds of modeling languages: a simple subset of class-diagram-like language and for feature models. Both algorithms are efficient and provide exhaustive guidance.

The Object Constraint Language (OCL) is a central element in modeling and transformation languages like UML, MOF, and QVT. Consequently approaches for MDE (Model-Driven Engineering) depend on OCL. However, OCL is present not only in these areas influenced by the OMG but also in the Eclipse Modeling Framework (EMF). Thus the quality of OCL and its realization in tools seems to be crucial for the success of model-driven development. Surprisingly, up to now a benchmark for OCL to measure quality properties has not been proposed. This paper puts forward in the first part the concepts of a comprehensive OCL benchmark. Our benchmark covers (A) OCL engine accuracy (e.g., for the undefined value and the use of variables), (B) OCL engine determinateness properties (e.g., for the collection operations any and flatten), and (C) OCL engine efficiency (for data type and user-defined operations). In the second part, this paper empirically evaluates the proposed benchmark concepts by examining a number of OCL tools. The paper discusses several differences in handling particular OCL language features and underspecifications in the OCL standard.

Sometimes, because of an atypical situation, an important mandatory association between classes in a UML Class Diagram must be replaced by an optional one. That semantic and functional impoverishment happens because the mandatory constraint must have a boolean value. In this paper we analyze the use of soft constraints in the UML Class Diagram, and their automatic repercussion in the corresponding Relational Model. The soft (deontic) constraints allow the formal representation of requirements, which ideally should always be fulfilled, but can be violated in atypical situations. In this paper we enrich a previous deontic approach, by introducing the ability to explicitly represent the so called Contrary-To-Duties requirements, i.e., domain integrity requirements that emerge as a consequence of an unfulfilled mandatory constraint. We support our approach with the UML/OCL language.

Concurrency problems, such as deadlocks, should be identified early in the design process. This is made increasingly difficult as larger and more complex concurrent systems are being developed. We propose here an approach, based on the analysis of specific models expressed in the Unified Modeling Language (UML) that uses a specifically designed genetic algorithm to detect deadlocks. Our main motivations are (1) to devise practical solutions that are applicable in the context of UML design without requiring additional modeling and (2) to achieve scalable automation. All relevant concurrency information is extracted from systems’ UML models that comply with the UML Schedulability, Performance and Time profile, a standardized specialization of UML for real-time, concurrent systems. Our genetic algorithm is then used to search for execution sequences exhibiting deadlocks. Results on three case studies show that our approach can achieve efficient results.

The paper proposes to integrate performance analysis in the early phases of the model-driven development process for Software Product Lines (SPL). We start by adding generic performance annotations to the UML model representing the set of core reusable SPL assets. The annotations are generic and use the MARTE Profile recently adopted by OMG. A first model transformation realized in the Atlas Transformation Language (ATL), which is the focus of this paper, derives the UML model of a specific product with concrete MARTE performance annotations from the SPL model. A second transformation generates a Layered Queueing Network performance model for the given product by applying an existing transformation approach named PUMA, developed in previous work. The proposed technique is illustrated with an e-commerce case study that models the commonality and variability in both structural and behavioural SPL views. A product is derived and the performance of two design alternatives is compared.

Companies using domain specific languages in a model-driven development process need to measure their models. However, developing and maintaining a measurement software for each domain specific modeling language is costly. Our contribution is a model-driven measurement approach. This measurement approach is model-driven from two viewpoints: 1) it measures models of a model-driven development process; 2) it uses models as unique and consistent metric specifications, w.r.t a metric specification metamodel. This declarative specification of metrics is then used to generate a fully fledged implementation. The benefit from applying the approach is evaluated by two applications. They indicate that this approach reduces the domain-specific measurement software development cost.

In the current and future service environment, service parts are being developed separately while being dynamically combined at runtime. In this paper we address the problem of defining a model-driven process for enabling dynamic composition of services. Composition policies are used to define choices in behaviour under which service roles involved in a composite service can be dynamically combined at runtime. We model policy-ruled choreography of collaboration components using a policy enforcement state machine (PESM). We also define transformation rules for translating a global PESM diagram into a set of local PESM diagrams, one for each role. As an example, we consider the case of dynamically composing an existing service with a set of authentication and authorization collaborations. The approach is supported by a formal syntax and semantics.

In this paper, we propose a model-driven approach for specifying, deploying and testing security policies in Java applications. First, a security policy is specified independently of the underlying access control language (OrBAC, RBAC). It is based on a generic security meta-model which can be used for early consistency checks in the security policy. This model is then automatically transformed into security policy for the XACML platform and integrated in the application using aspect-oriented programming. To qualify test cases that validate the security policy in the application, we inject faults into the policy. The fault model and the fault injection process are defined at the meta-model level, making the qualification process language-independent. Empirical results on 3 case studies explore both the feasibility of the approach and the efficiency of a full design & test MDE process.

The Pattern Language Verifier (PLV) is a process for verifying the application of a pattern language in a design. The PLV process focuses on a pattern language for the design of web-based enterprise applications. We show how PLV exploits the ideas of programming language compilers to detect the structural, syntactic, and semantic errors in a design model and then guides the designer in fixing the problems. To provide tool support, we integrate PLV into the ArgoUML modeling tool. We use the tool to design a simple student registration system as a case study, and show how the process finds the mistakes in the model and helps the designer in repairing the detected problems.

Increasingly, high-assurance applications rely on dynamically adaptive systems (DASs) to respond to environmental changes, while satisfying functional requirements and non-functional preferences. Examples include critical infrastructure protection and transportation systems. A DAS comprises a collection of (non-adaptive) target systems (represented as UML models) and a set of adaptations that realize transitions among target systems. Two sources of uncertainty inherent to DASs are: (1) predicting the future execution environment, and (2) using functional and non-functional trade-offs to respond to the changing environment. To address this uncertainty, we are inspired by living organisms that are astonishingly adept at adapting to changing environmental conditions using evolution. In this paper, we describe a digital evolution-based approach to generating models that represent possible target systems suitable for different environmental conditions, enabling the developer to identify the functional and non-functional trade-offs between the models, and then assisting the developer in selecting target systems for the DAS.

Autonomic computing is recognized as one of the most promizing solutions to address the increasingly complex task of distributed environments’ administration. In this context, many projects relied on software components and architectures to provide autonomic management frameworks. We designed such a component-based autonomic management framework, but observed that the interfaces of a component model are too low-level and difficult to use. Therefore, we introduced UML diagrams for the modeling of deployment and management policies. However, we had to adapt/twist the UML semantics in order to meet our requirements, which led us to define DSMLs. In this paper, we present our experience in designing the Tune system and its support for management policy specification, relying on UML diagrams and on DSMLs. We analyse these two approaches, pinpointing the benefits of DSMLs over UML.

This paper investigates the relation between the level of detail (LoD) in UML models and defect density of the associated implementation. We propose LoD measures that are applicable to both class- and sequence diagrams. Based on empirical data from an industrial software project we have found that classes with higher LoD, calculated using sequence diagram LoD metrics, correlates with lower defect density. Overall, this paper discusses a novel and practical approach to measure LoD in UML models and describes its application to a significant industrial case study.

Modeling is a fundamental activity within the requirements engineering process concerning the construction of abstract descriptions of system requirements that are amenable to interpretation and validation. In this paper we report on a controlled experiment aimed at assessing whether dynamic modeling of system requirements provides an accurate account of stakeholders’ requirements. The context is constituted of second year Bachelor students in Computer Science at the University of Basilicata. The data analysis reveals that there is not significant difference in the comprehension of system requirements achieved by using or not dynamic modeling.

As most software artifacts, meta-models can evolve. Their evolution requires conforming models to co-evolve along with them. Coupled evolution supports this. Its applicability is not limited to the modeling domain. Other domains are for example evolving grammars or database schemas. Existing approaches to coupled evolution focus on a single, homogeneous domain. They solve the co-evolution problems locally and repeatedly. In this paper we present a systematic, heterogeneous approach to coupled evolution. It provides an automatically derived domain specific transformation language; a means of executing transformations at the top level; a derivation of the coupled bottom level transformation; and it allows for generic abstractions from elementary transformations. The feasibility of the architecture is evaluated by applying it to data model evolution.

Model-based software development promises to increase productivity by offering modeling languages tailored to a problem domain. Such modeling languages are often defined by a metamodel. In consequence of changing requirements and technological progress, these modeling languages and thus their metamodels are subject to change. Manually migrating models to a new version of their metamodel is tedious, error-prone and heavily hampers cost-efficient model-based development practice. Automating model migration in response to metamodel adaptation promises to substantially reduce effort. Unfortunately, little is known about the types of changes occurring during metamodel adaptation in practice and, consequently, to which degree reconciling model migration can be automated. We analyzed the changes that occurred during the evolution history of two industrial metamodels and classified them according to their level of potential automation. Based on the results, we present a list of requirements for effective tool support for coupled evolution of metamodels and models in practice.

Much of the knowledge about software systems is implicit, and therefore difficult to recover by purely automated techniques. Architectural layers and the externally visible features of software systems are two examples of information that can be difficult to detect from source code alone, and that would benefit from additional human knowledge. Typical approaches to reasoning about data involve encoding an explicit meta-model and expressing analyses at that level. Due to its informal nature, however, human knowledge can be difficult to characterize up-front and integrate into such a meta-model. We propose a generic, annotation-based approach to capture such knowledge during the reverse engineering process. Annotation types can be iteratively defined, refined and transformed, without requiring a fixed meta-model to be defined in advance. We show how our approach supports reverse engineering by implementing it in a tool called

Metanool

and by applying it to (i) analyzing architectural layering, (ii) tracking reengineering tasks, (iii) detecting design flaws, and (iv) analyzing features.

A current Request for Proposal [1] from the OMG describes the requirements for an “Executable UML Foundation”. This subset of UML 2 would serve as a shared foundation for higher-level modeling concepts, such as activities, state machines, and interactions. In a sense, this subset would define a basic virtual machine for UML, allowing the execution and analysis of runtime behavior of models. Regardless of the executable subset chosen, a precise definition of execution semantics of UML actions is required. To the best of our knowledge, no formal semantics of such a subset yet exists. We present our work on clarifying the semantics and pragmatics of UML actions. In particular, we sketch a formalization of a subset of UML actions and discuss common usage scenarios for the most complex actions, identifying usage assumptions that are not explicit in the UML 2 specification.

To define the formal semantics of a modeling language, one normally starts from the abstract syntax and then defines the static semantics and dynamic semantics. Having a formal semantics is important for reasoning about the language but also for building tools for the language. In this paper we propose a novel approach for this task based on the Alloy language. With the help of a concrete example language, we contrast this approach with traditional methods based on formal languages, type checking, meta-modeling and operational semantics. Although both Alloy and traditional techniques yield a formal semantics of the language, the Alloy-based approach has two key advantages: a uniform notation, and immediate automatic analyzability using the Alloy analyzer. Together with the simplicity of Alloy, our approach offers the prospect of making formal definitions easier, hopefully paving the way for a wider adoption of formal techniques in the definition of modeling languages.

In model-driven engineering (MDE), software development is centred around a formal description (model) of the proposed software system, and other software artifacts are derived directly from the model. We are investigating

semantically configurable

MDE, in which specifiers are able to configure the semantics of their models. The goal of this work is to provide a modelling environment that offers flexible, configurable modelling notations, so that specifiers are better able to represent their ideas, and yet still provides the types of analysis tools and code generators normally associated with model-driven engineering. In this paper, we present a semantically configurable code-generator generator, which creates a Java-code generator for a modelling notation given the notation’s semantics expressed as a set of parameter values. We are able to simulate multiple different model-based code generators, though at present the performance of our generated code is about an order of magnitude slower than that produced by commercial-grade generators.

In general, diagrams and text are both considered to have their advantages and disadvantages for the representation of use case models, but this is rarely investigated experimentally. This paper describes a controlled experiment where we compare safety hazard identification by means of misuse cases based on use case diagrams and textual use cases. The experiment participants found use case diagrams and textual use cases equally easy to use. In most cases those who used textual use cases were able to identify more failure modes or threats. The main reason for this seems to be that use cases encourage analysts to specifically focus on threats related to the functions mentioned in the use case, and textual use cases include more functional details than diagrams. The focus is decided by information in each use case which will thus decide the number of threats identified.

Dependability is a non-functional property that should be assessed early in the software lifecycle. Although several UML profiles exist for quantitative annotations of non-functional properties, none of them provides concrete capabilities for dependability analysis of UML system models. In this paper, we propose a dependability analysis and modeling profile. The objective is twofold: to reuse proposals from the literature on deriving dependability models from UML annotated specifications and to be compliant with the recently adopted MARTE profile, which provides a framework for general quantitative analysis concepts that can be specialized to a particular analysis domain. The profile definition process was done in several steps. Firstly, an in depth analysis of the literature has been carried out to collect the information requirements for the profile. Secondly, a domain model for dependability analysis was defined independently of UML. Thirdly, the domain model was mapped to UML extensions by specializing MARTE.

We present a model-driven test environment called Visual ScatterUnit, which optimizes the application testing process of wireless sensor networks. Instead of having to implement the test case completely manually, the model-driven test environment allows the abstract modeling of the test process. At the same time the test case’s technical implementation requirements are kept hidden from the user.

In the following a code generator is able to create the necessary test case code, which complies with technical requirements from the test case model. The test case is executed with the help of Visual ScatterUnit and the test results are subsequently visualized in the test case model’s diagrams. In this way the user can easily comprehend the test run and consequently understand the cause of failure. Furthermore the test case’s abstract modeling allows it to be validated, which brings with it a quality assurance for the executable test case.

Research in Aspect-Oriented Software Development (AOSD) has brought up powerful abstractions in order to specify under which conditions an aspect affects the base software. So far, Model-Driven Development (MDD) approaches to AOSD have mostly concentrated on the weaving process and, as a result, they have come up with manifold ways to compose aspect models and base models. All too often, however, the approaches disregard the benefits that the aspect-oriented abstractions can bring to software development, though. This paper discusses the implications that such negligence has on the specification of aspect-oriented models in MDD. Furthermore, it presents a weaver that is able to cope with sophisticated join point selection abstractions, as they are known from many aspect-oriented programming languages, and which go far beyond the selection capabilities provided by current model weavers. By means of this weaver, models can realize both a higher separation of concerns as well as a higher level of abstraction.

Constructing and executing distributed systems that can adapt to their operating context in order to sustain provided services and the service qualities are complex tasks. Managing adaptation of multiple, interacting services is particularly difficult since these services tend to be distributed across the system, interdependent and sometimes tangled with other services. Furthermore, the exponential growth of the number of potential system configurations derived from the variabilities of each service need to be handled. Current practices of writing low-level reconfiguration scripts as part of the system code to handle run time adaptation are both error prone and time consuming and make adaptive systems difficult to validate and evolve. In this paper, we propose to combine model driven and aspect oriented techniques to better cope with the complexities of adaptive systems construction and execution, and to handle the problem of exponential growth of the number of possible configurations. Combining these techniques allows us to use high level domain abstractions, simplify the representation of variants and limit the problem pertaining to the combinatorial explosion of possible configurations. In our approach we also use models at runtime to generate the adaptation logic by comparing the current configuration of the system to a composed model representing the configuration we want to reach.

Aspect-Oriented Modeling (AOM) approaches propose to model reusable aspects that can be applied to different systems at the model level. To improve reusability, several contributions have pointed out the needs of variability in the AOM approaches. Nevertheless, the support of variability makes the aspect design more complex and the introduction of several dimensions of variability (advice, pointcut and weaving) creates a combinatorial explosion of variants and a risk of inconsistency in the aspect model. As the integration of an aspect model may be a complex task, the AOM framework has to be a support for the designer to ensure the consistency of the resulting model. This paper presents an approach describing how to ensure that an aspect model with variability can be safely integrated into an existing model. Verification includes static checking of aspect model consistency and dynamic checking through testing with a focus on the parts of the model that are impacted by the aspect.

It is state of the art to provide UML modeling by means of class diagrams and code generation from there. But whereas drawing diagrams is most often well supported, code generation is limited in scope. Association classes, multiplicities, aggregation and composition are not correctly or not at all processed by most code generators. One reason may be that the UML semantics is not formally defined in the UML specification. As a result of that, associations are usually transformed into code by using properties of the same type as the associated classes or corresponding typed sets. This approach must fail although the UML2 Superstructure Specification considers association ends owned by a class to be equal to a property of the owning class. In this paper, we describe why associations should be implemented as classes when generating code from class diagrams.

UML2 composite structures are a natural solution for the basic modeling issues associated with component-oriented approaches. They provide mechanisms for defining reusable ”pieces” of design, which are well-encapsulated through explicit interaction ports. While intuitive in principle, the semantics of request propagation across ports may cause semantic ambiguities if the composition mechanisms are not used consistently, thus leading to meaningless composite structures (that cannot be safely reused within the context of a particular environment). To ensure consistent usage, this article proposes an empirical study that provides an intuitive description of composite structure semantics focusing on request propagations across ports. It supplements this description by highlighting cases conducive to semantic ambiguities and offers practical solutions and a rationale for building composite structures that avoid them. Among possible solutions, the opportuneness of encapsulating explicit behaviors in ports is discussed.

The advantage of supporting a uniform modeling approach across multiple, logical (or ontological) instantiation levels has been well documented in the literature. However, the published approaches for achieving this have focused on making it possible for classes and objects to be treated uniformly across multiple instantiation levels, but have neglected the problems involved in doing the same thing for “connectors” (i.e. concepts rendered as edges in graph based depiction of models rather than nodes). On closer examination, this turns out to be a significant problem, because without an effective strategy for modeling connectors in a uniform way, multi-level modeling as a whole is not possible. In this paper we describe the problems arising from the way in which connectors (e.g. associations, links, generalizations etc.) are currently supported in mainstream modeling languages such as the UML and why they are incompatible with multi-level modeling. We then define three fundamental connector rendering and representation principles that rectify the identified problems.

Software in embedded (e.g. automotive) systems requires a high level of reliability. Model-based development techniques are increasingly used to reach this goal, but so far there is relatively little published knowledge on the comparative benefits in using different assurance techniques. We investigate different and potentially complementary model-based software quality assurance methods (namely simulation and white-box testing vs. model-checking) at the hand of an application to the software component of a door control unit. We draw conclusions with regards to suitable application use cases.

Implementation of MDA in large, product developing organizations involves changing processes, practices, tools, and communication infrastructures. The paper presents a case study, in which modeling related needs of a unit within Ericsson were compared to features of current and envisioned MDA tools, using qualitative methods. The paper’s main contribution is an ontology defining areas and sub-areas of improvement associated with the introduction of MDA in complex embedded systems projects. The ontology is grounded in interviews with senior modellers at Ericsson and in survey publications from within the field of MDA. It identifies 26 improvement areas concerned with model content, modeling activities, and the management of modeling projects. The ontology has been presented to stakeholders within the unit studied, with positive feedback: appreciated were its groundedness, traceability, holistic scope, and potential as platform and checklist for several recurrent analysis and communication tasks related to software process improvement within Ericsson.

High quality and flexibility are strongly required for embedded software on artificial satellites. High quality is very important because any single halt is not allowed over 15 years operation period without any significant maintenance. Flexibility is also important to adapt customer requirements which may vary after operation experiences. A quick and reliable way to modify the software functions is required. The model-based approach will contribute to solve this problem. Mitsubishi Electric Corporation, one of the representing artificial satellite suppliers in Japan, is now implementing a General Mode Controller on on-board software of satellites. We noticed functions related to modes and sequences are often required to modify from previous projects. The General Mode Controller can modify them in a reliable way by changing control parameters without modifying source code. The control parameters are verified by using a model-based tool, Matlab Simulink and Stateflow, to enable quick and low risk modifications.

The MODELS conference organizes a number of workshops as co-located events. Workshops provide the opportunity for a small group of people to exchange recent or preliminary results and to conductintensive discussions on a particular topic. They complement the main conference and are generally very well appreciated by attendees.

Model-driven engineering is becoming increasingly popular in software development projects as it raises level of abstraction, thus improving our ability to handle complex systems. In many academic and industrial centers, software modeling has already been introduced into their curricula. Despite this, it seems that education does not yet support the modeling paradigm well enough thus limiting its acceptance as a mature method of developing software systems. The goal of this symposium was to find ways to change this situation. Specifically, the symposium sought ways of showing benefits of modeling in a way that is pedagogically effective and attractive to the students. It also tried to make recommendations for placing the modeling courses in the overall software development educational path, which should include not only UML fundamentals but also a demonstration of the importance and place of modeling in the overall path from business (environment) to software products.

The doctoral symposium solicited submissions on research-in-progress that is meant to lead to a PhD dissertation. The goal of the symposium is to provide doctoral students with independent constructive criticism

by written reviews of three members of the program committee; and

by discussing their work with senior scientists and other doctoral students

Regardless of whether or not the submission is accepted for presentation, students would hence benefit from submitting to the symposium.

Model-driven engineering (MDE) is used frequently for complex systems development in various domains. Although the UML has played a large role in software modeling in both academia and industry, other languages and systems are also used. The 2008 edition of MODELS tutorials covered a wide range of domains in which MDE is applied, including semantic web, real-time distributed and embedded systems, web services, and security.

The selection committee reviewing the proposals was formed by the following researchers:

Colin Atkinson, University of Mannheim, Germany;

Xavier Blanc, University Pierre et Marie Curie, France (chair);

Jeff Gray, University of Alabama at Birmingham, USA;

Tom Mens, University of Mons-Hainaut, Belgium; and

Jacques Robin, Universidade Federal de Pernambuco, Brazil.

The committee selected nine tutorials which are detailed in the following section.

Domain-specific modeling languages (DSMLs) are designed to provide precise abstractions of domain-specific constructs. Models for complex systems typically do not fit neatly within a single domain, however. Moreover, capturing all important aspects of such a system requires developing multiple models using different DSMLs. This panel will explore key challenges and promising solutions associated with combining DSML models into multi-models.