Automated Verification of Model Transformations in the Automotive Industry

1. Automated Verification of Model Transformations in the Automotive Industry Gehan M. K. Selim, Fabian Büttner, James R. Cordy, JuergenDingel, Shige Wang

2. Agenda • Motivation • Objective • The Model Transformation Problem • The Verification Methodology • Case Study: Automatically Verifying the GM-2-AUTOSAR Transformation • Results • Verifying the 18 OCL Constraints • Performance of the Verification Approach • Discussion • Strengths of the Verification Approach • Weaknesses of the Verification Approach • Conclusion & Future Work

3. Motivation • MDD • Model Transformations • Verification Are those concepts practical to use in industry ?

4. Motivation • Industrial experiences in adopting MDD… • T. Cottenier, A. Van Den Berg, T. Elrad “The Motorola WEAVR: Model Weaving in a Large Industrial Context” AOSD 2007. • P. Mohagheghi, V. Dehlen “Where is the Proof?-A Review of Experiences from Applying MDE in Industry” ECMDA-FA 2008. • Few studies on industrial model transformations… • A. Daghsen, K. Chaaban, S. Saudrais, P. Leserf “Applying Holistic Distributed Scheduling to AUTOSAR Methodology” ERTSS 2010. • H. Giese, S. Hildebrandt, S. Neumann “Model Synchronization at Work: Keeping SysML and AUTOSAR Models Consistent” Graph Transformations & Model-Driven Engineering 2010. • G.Selim, S. Wang, J. Cordy, J. Dingel“Model Transformations for Migrating Legacy Models: An Industrial Case Study” ECMFA 2012 • Verifying industrial model transformations ??

5. Objective [1] G. Selim, S. Wang, J. Cordy, J. Dingel "Model Transformations for Migrating Legacy Models: An Industrial Case Study", ECMFA 2012 [2] F. Büttner, M. Egea, J. Cabot, M. Gogolla “Verication of ATL Transformations Using Transformation Models and Model Finders”, ICFEM 2012

6. The Model Transformation Problem GM Metamodel AUTOSAR Metamodel [1] G. Selim, S. Wang, J. Cordy, J. Dingel "Model Transformations for Migrating Legacy Models: An Industrial Case Study", ECMFA 2012

7. The Verification Methodology • Transformation Model: • Elements representing : T, • OCL Constraint sets: SEM, PRE, POST ATL Transformation T transform Source Metamodel Transformation Model (OCL) Target Metamodel [1] F. Büttner, M. Egea, J. Cabot, M. Gogolla “Verication of ATL Transformations Using Transformation Models and Model Finders”, ICFEM 2012

8. The Verification Methodology • For each property , the following must be unsatisfiable: [1] M. Kuhlmann, L. Hamann, M. Gogolla “Extensive Validation of OCL Models by Integrating SAT Solving into USE” TOOLS 2011 [2] The USE Validator. available online, http://sourceforge.net/projects/useocl/les/Plugins/ModelValidator/

9. The Verification Methodology Ecore + OCL Relational Logic Propositional Logic ATL + Ecore + OCL

10. Case Study: Automatically Verifying the GM-2-AUTOSAR Transformation

11. Case Study: Automatically Verifying the GM-2-AUTOSAR Transformation Automatically Generated by the Prototype Manually Formulated OCL Preconditions … ?

12. Case Study: Automatically Verifying the GM-2-AUTOSAR Transformation • Multiplicity Invariants (6):M’ conforms to MM’ Uniqueness Contracts (9): If ‘name’ unique for Module, then ‘shortName’ unique for ComponentPrototype Security Invariant (1): Every ComponentPrototypeassigned to an EcuInstance by a mapping of a System is also contained in the System Pattern Contracts (2):Ifa PhysicalNodeprovidessome Service, then the corresponding System will be connected to a PPortPrototype GM Metamodel MM AUTOSAR Metamodel MM’ <<conforms to>> <<conforms to>> <<transforms>> Model M Model M’ T

13. Results: Verifying the 18 OCL Constraints • 2 Multiplicity Invariants of the 18 constraints are violated, i.e., got 2 counter-examples • CompositionType_component • SwcToEcuMapping_component • 2 bugs fixed and 18 constraints rechecked

14. Results: Performance of the Verification Approach • Standard laptop (2.50 GHz, 16GB of memory) • Ran the verification prototype: • once for each constraint • for scopes up to 12 • For each scope& constraint, 2 numbers were generated: • Translation Time: Time taken to translate the relational logic representation of the transformation into propositional logic. • Constraint Solving Time: Time taken by SAT solver to solve the propositional representation of the transformation.

15. Results: Performance of the Verification Approach Translation time (sec) \ constraint solving time (sec)

16. Discussion: Strengths of the Verification Approach

17. Discussion: Weaknesses of the Verification Approach

18. Conclusion & Future Work • Demonstrated using an automated verification prototype [1] to verify industrial transformation [2] • Result: The used prototype uncovered 2 bugs ! • Performance: Verifying the transformation up to a scope of 12 was possible ! Application of automated verification to a case study was successful & practical to use in an industrial context [1] F. Büttner, M. Egea, J. Cabot, M. Gogolla “Verication of ATL Transformations Using Transformation Models and Model Finders”, ICFEM2012 [2] G. Selim, S. Wang, J. Cordy, J. Dingel "Model Transformations for Migrating Legacy Models: An Industrial Case Study", ECMFA 2012

19. Conclusion & Future Work

20. Thank You  • Questions ?